Tor can anonymize traffic but only against passive attackers who cannot perform traffic flow confirmation on a global scale.<p>&gt; A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical  low-latency  systems,  Tor  does  not  protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers.<p>(<a href="https:&#x2F;&#x2F;svn.torproject.org&#x2F;svn&#x2F;projects&#x2F;design-paper&#x2F;tor-design.pdf" rel="nofollow">https:&#x2F;&#x2F;svn.torproject.org&#x2F;svn&#x2F;projects&#x2F;design-paper&#x2F;tor-des...</a>, Page 4)<p>I read an interesting article in the ACM last month, titled &quot;Seeking Anonymity in an Internet Panopticon&quot; (<a href="http:&#x2F;&#x2F;cacm.acm.org&#x2F;magazines&#x2F;2015&#x2F;10&#x2F;192387-seeking-anonymity-in-an-internet-panopticon&#x2F;fulltext" rel="nofollow">http:&#x2F;&#x2F;cacm.acm.org&#x2F;magazines&#x2F;2015&#x2F;10&#x2F;192387-seeking-anonymi...</a>).<p>&gt; The most well known global-traffic-analysis attack—&quot;traffic confirmation&quot;—was understood by Tor&#x27;s designers but considered an unrealistically strong attack model and too costly to defend against.<p>They explain a number of attacks against Tor (both active and passive) and introduce Dissent, &quot;a project at Yale University that expands the design space and explores starkly contrasting foundations for anonymous communication&quot;.