Nothing new, and I'm pretty sure these sorts of attacks have been possible and used ever since it's founding.

TOR ultimately works like any old relay system; if you control enough nodes, you can effectively decloak people if they happen to connect to only your nodes. Nodes are assigned for connection based on a trust value so all a Nation state would have to do is host enough nodes (relay+exit) and they'd be able to decloak a connection. This kinda inherently gives TOR decloaking abilities to entities with the most infrastructure, which at that scale basically will only be nation states.

TOR works well enough for privacy when your adversaries aren't well-funded state actors. (ie. It's probably enough to mask your traffic if you use TOR to access resources to get out of an abusive relationship or need to circumvent cult-level inspection of your personal interests by religious schools. Most dictatorships also don't really have the resources to mount this sort of attack - it's probably just the US and some European countries.) That rule kinda also goes for VPNs in general however.

There are thousands of relays run by altruistic volunteers. Unless your opsec sucks (i.e. you configure Tor to favor performance and not swap circuits every ten minutes) the opportunity to correlate by malicious nodes is small.

Also, these nodes operated by bad actors are constantly identified and excluded.

The articled confirms that the authorities are conducting a dragnet operation. Everyone who connected to a certain entry relay was tracked and reported.

Does the tor daemon connect automatically? If so, even people who installed tor for fun and forget about may be on the list.

Did the lucky ones have the "Bundestrojaner" (gov surveillance app) installed on their machines?

>If so, even people who installed tor for fun and forget about may be on the list.

Good. That reduces the quality of the list.

They selected that relay after they determined it was the one used by the person they were trying to go after. That isn't a dragnet.

There probably is a dragnet too.

Plenty of people still believe that using a VPN + Tor means they are “private”. What we need to teach others is that this is no longer the case - privacy is not a one size fits all solution. You may be private from other users on your network, but not nation state actors.

VPN/Tor provide something else anyway: anonymity. Privacy is a different thing. You can lead an entirely private life in an environment where everyone knows who you are and who you interact with. They just don't know how you are interacting with those people.

Most people don't need anonymity most of the time...

Really curious on your definition of private here because I have a buttload of evidence that says that is entirely untrue and you can as a private citizen buy detailed demographic and location data at an easily identifiable level for people without even needing to talk to another person.

I think the surprising element is that the German government actually deployed enough resources.

They knew that the target had nearly half a million [child ab]users.

That's sufficient motivation right there.

The problem is that once you have the infrastructure you can go after, well, any other random Tor onion service you damn well please, all with a minimum of judical oversight (if any).