Just as a note, Steven’s attack targets the “hidden services” facility in Tor. This is the method by which people hide a server (web server, chat server) behind the Tor network. This represents probably considerably less than 1% of the Tor network traffic, and has never been a focus of development — we know it has a number of vulnerabilities.

This facility would be used, for example, by the military to conceal the location of command and control facilities on the open Internet (perhaps one of the initial uses planned for onion routing by the US Naval Research Lab, who created the *original* onion routing spec).

As people assess their risks in using the Tor client, they should be aware that this attack is not a threat to them. They might want to make sure they are not using plug-ins that run code on their computer (Flash, ActiveX,…) which are far more likely to casually betray your anonymity.

Thanks!
Shava Nerad
Executive Director
The Tor Project
http://tor.eff.org/