Cloudflare ReCAPTCHA De-Anonymizes Tor Users

That's because this is a speculation; e.g. "this obvious opportunity is not the proof" is admitted in the text itself. As mentioned, the requirement is the ability to correlate two different traffic signals: from your computer to Tor, and from Tor to the exit. So, the agency trying to trace you needs to be listening at both of those points. Their approach is simply to have one of those be the ISPs (presumably this ranges into the hundreds of thousands if not millions of computers) of US citizens (foreign ISPs would seem much harder to monitor), and the other being the CloudFlare servers (only maybe hundreds or thousands of machines needed to log this?).

Actually, watching the entrance and exit nodes in this fashion is probably more expensive than simply hosting your own entrance and exit nodes. It would be within the NSA's power to, say, host or monitor 500 of the 1000ish exit nodes by now, collecting 50% of the exit traffic at almost no real cost. Entrance traffic is harder as the network is larger, but if you hosted (or, again, captured the traffic to) another 2k non-exit relays you might be able to capture 10-20% of the entrance traffic. The basic points I'm making here are: (1) that there are way fewer relay nodes to monitor than there are ISPs, if you would prefer surveillance; and (2) you are not restricted to surveillance or even to your own nation--there's literally nothing stopping the NSA from purchasing VPSes in the Netherlands and Germany and Sweden and running Tor on them, and it'll seem like a very geographically diverse set when you're looking at it with Vidalia.

Combined together the NSA can maybe deanonymize about 5-10% of the Tor traffic to the Internet right now with a much cheaper method, and this is where it gets interesting: the Tor default is to have 3 hops, which means that in addition to correlating traffic patterns you get to correlate on the IP address of the hop in the middle, even if that hop is not colluding with you. So even in the face of network jitter you have a 32-bit identifier which links together packets above and beyond simple network traffic into or out of Tor. And you only need to operate a few thousand computers to do it -- far fewer than you'd need to monitor the US ISPs in general.

You can also try to watch specific popular exits like Cloudflare, but doing this removes this awesome IP address that you get for the middle hop, and you still need either a relay node or else to be tapping a given user's IP, to try to deanonymize them.

I don't see anything that makes this unique to CloudFlare, either.

(You imply this in your point, but given the specificity of the accusation, I think it's worth clearly pointing out.)

Isn't this explicitly outside Tor's threat model? https://svn.torproject.org/svn/projects/design-paper/tor-des... See section 3.1

>No one is that incompetent.

Well, I'm not sure I'd go that far.

I believe the "unique to CloudFlare" element is that CloudFlare effectively sees traffic for significant portions of the web...but is one entity. So, a powerful enough hostile actor (say, a state) would only need to compromise one entity (CloudFlare) to exploit users of thousands of websites, including many major ones. Er, well, two entities, because they also need entrance data. So, if a state were to compromise an ISP and CloudFlare it would give that state a lot of Tor users identities.

Very few small-ish entities have such a large reach and can interject themselves into so many connections on the web.