I read an article titled the network is hostile, in which the following is stated:
Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected browser connection can leak a vast amount of information [pdf] about the user's browsing habits.
In the linked article, a the website visited may be identified due to the subsequent
GET requests after visiting an encrypted website. The adversary only sees the traffic and is in possession of a database of websites and their subsequent requests (amount and sizes).
Is this attack applicable to HTTP traffic flowing through ssh-socks5 connections (with DNS request through the tunnel)? I'm not sure if such a channel is included in the SSL or TLS type encryptions mentioned in the paper.