Visit duration tracking possible in TorBrowser using a favicon which downloads from a server using a connection that's never closed
The attack scenario is described here https://twitter.com/davywtf/status/951203191944773632.
The code sample can be found at https://github.com/wybiral/tracker.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information