[nightpool]

What's the next step to protect against traffic analysis? Are there any VPN providers that provide stochastic masking to defeat traffic analysis? Is TOR working on mitigations? A quick search turns up https://blog.torproject.org/new-low-cost-traffic-analysis-at..., which discusses the use of fixed-size padding in TOR protocol headers, but it's mostly focused on traffic analysis using then-commercially available data sources (for example, Real Time Bidding logs & DNS queries), and considers full netflow data a "high-effort" attack available only to "intelligence agencies". It seems like this may need to be reassessed.

EDIT: looks like this is addressed to some extent in the FAQ for Tor https://2019.www.torproject.org/docs/faq.html.en#SendPadding.