Hacker News Reader

No, it sounds like they knew new nodes joined the network.

Not that they knew what they were doing - they seemed to have suspected something, but made the decision that it was a small enough fraction of the network to not worry about, but obviously in hindsight they were wrong about that.

View on HN

Yes, they saw a bunch of new relays, starting in February 2014. And they weren't doing anything obviously alarming. But once Tor devs had seen the Black Hat abstract, they figured out what to look for. Once they were monitoring relevant parameters, the attack was obvious.

In retrospect, more monitoring seems an obvious approach. But that would probably hurt performance. And threaten security and anonymity. Maybe there's a middle ground.

Reply on news.ycombinator.com