A more recent and thorough real world analysis of the traffic correlation problem is https://www.freehaven.net/anonbib/#ccs2013-usersrouted . In general, that site has a lot of great papers on these topics.
Why not? I'm talking about shuffling queues such that it cannot be determined that a given node is relaying traffic in the order that it receives it. This is how most packet shaping works, no?
At a minimum, I would expect Tor to be more secure by having nodes:
* Not process traffic in the order in which its received, obfuscating the cause-and-effect of a packet being received and a packet going out
* Pad traffic substantially with garbage such that the outgoing size cannot be associated with whatever came in, potentially splitting packets in half so that they can appear smaller than they actually are, forking around many different nodes.
* Sending lots of random garbage traffic between relays such that input and output is meaningless overall, perhaps relaying packets to several nodes needlessly, when only a single node is instructed to actually do something with it.
To my knowledge, Tor doesn't do any of this and has explicitly ruled out the possibility because they're more concerned with usability than security. And maybe that's the right call to make in the end, I don't know enough to say. I'm just saying that it's possible to imagine a system like Tor that is more secure than Tor, and that's something worth talking about.
I'll check that link out, thanks for posting it.
Already lots of people pick less safe options because "Tor is too slow". If you make it slower, you lose users, and everyone loses anonymity. That's only part of the answer and not the only argument against some of the changes proposed.
I highly recommend the original design paper. [1] It touches on the very valid suggestions you make, and the tradeoffs. Sadly, not much has changed since. If you have a valid proposal, and you double-checked briefly what is covered on Anonbib as previous considerations, post to the tor-dev list and it will be looked at by Tor developers. At least that is my experience from following that list.
https://svn.torproject.org/svn/projects/design-paper/tor-des...
https://security.stackexchange.com/questions/147402/how-do-t...
The referenced Tor Project blog post, "One cell is enough to break Tor's anonymity", was written in 2009, prior to any Snowden revelations about the scale and scope of state-level actors to see the entirety of the global networks.
AFAIK, Tor still refuses to have nodes add random delays and random padding, etc. to make this style of analysis more difficult, but I am just going off what I researched a few years ago, so I could be wrong.