The adversary may want to correlate user identities or sessions across multiple remote services.
The adversary may want to correlate user identities or sessions across multiple remote services.
For instance, advertising networks may wish to know that a user who visited `site-x.com` is the same user that visited `site-y.com` to serve them targeted ads while law-enforcement may wish to associate anonymous activity on `site-b.com` with a known identity on `size-a.com` to build a criminal case.
For instance, advertising networks may wish to know that a user who visited `site-x.com` is the same user that visited `site-y.com` to serve them targeted ads while law-enforcement may wish to associate anonymous activity on `site-b.com` with a known identity on `size-a.com` to build a criminal case.
5.**Fingerprinting/anonymity set reduction**
Fingerprinting (more generally: "anonymity set reduction") is used to attempt to gather identifying information on a particular individual without the use of tracking identifiers.
If the dissident's or whistleblower's timezone is available, and they are using a rare build of Firefox for an obscure operating system, and they have a specific display resolution only used on one type of laptop, this can be very useful information for tracking them down, or at least tracking their activities .
6.**History records and other on-disk information**
6.**History records and other on-disk information**
In some cases, the adversary may opt for a heavy-handed approach, such as seizing the computers of all Tor users in an area (especially after narrowing the field by the above two pieces of information).
In some cases, the adversary may opt for a heavy-handed approach, such as seizing the computers of all Tor users in an area (especially after narrowing the field by the above two pieces of information).
