A recent report from Tagesschau has revealed a significant breach in Tor's anonymity. German authorities have successfully deanonymized Tor users through a large-scale timing attack.
What Happened: Law enforcement agencies coerced major ISPs to monitor connections to specific Tor relays. By analyzing the precise timing of data packets, they were able to link anonymous users to their real-world identities. While such Traffic Analyses have been theoretically known to pose a threat to Tor, this is afaik the first confirmed usage of them being used successfully on a larger scale to deanonyise tor users.
Implications: While it's undoubtedly positive that this pigs will be brought to justice, the implications for the Tor network as a whole are concerning. The involvement of a major German ISP raises serious questions about the future of online anonymity and the tools we rely on to protect our privacy.
I haven't found a English news source or a independent confirmation for this news yet. But the German Tagesschau is highly reliable, although not that strong in technical matters.
Update: There's a statement from the Tor project that's worth reading, and it reads very differently. In a nutshell: Yes, users were deanonymized through “timing” analysis, but a number of problems had to come together to make this possible, most notably that the (criminal) Tor users were using an old version of the long-discontinued Ricochet application.
