The request is going over tor-- do timing attacks work with that? When I browse with tor my connection is so slow that I don't think I could get good data for timing attacks.
It doesn't matter if your connection is slow, all that matters is that latency is fairly consistent during the attack. You can use statistics to extract high-confidence data even from noisy signals, if you run the attack long enough to get lots of timing data.
They are not talking about the same kind of timing attacks. Deanonymization attacks require vastly less latency consistency.