@threat @Terry @0 @syzygy @Hoss @Nudhul @sapphire traffic correlation works if they (eventually) own the destination point, like when they take over a website and have their logs, and they can get your connection time from your isp or vpn provider. or, if they can really tightly correlate the traffic to you, this is how bomb threats at universities have been caught, they get federal funding so the feds coerce them to track Tor connections on campus. They see who made a Tor connection the exact second they got a bomb threat email. a lot harder when talking about hidden services. I am not saying they don't have a trick to track connections to hidden services, but so far every case I've seen indicates to me that people made elementary mistakes that got them caught.