  The Tor anonymity network is difficult to measure because, if not done
carefully, measurements could risk the privacy (and potentially the safety) of
the network's users. Recent work has proposed the use of differential privacy
and secure aggregation techniques to safely measure Tor, and preliminary
proof-of-concept prototype tools have been developed in order to demonstrate
the utility of these techniques. In this work, we significantly enhance two
such tools--PrivCount and Private Set-Union Cardinality--in order to support
the safe exploration of new types of Tor usage behavior that have never before
been measured. Using the enhanced tools, we conduct a detailed measurement
study of Tor covering three major aspects of Tor usage: how many users connect
to Tor and from where do they connect, with which destinations do users most
frequently communicate, and how many onion services exist and how are they
used. Our findings include that Tor has ~8 million daily users (a factor of
four more than previously believed) while Tor user IPs turn over almost twice
in a 4 day period. We also find that ~40% of the sites accessed over Tor have a
torproject.org domain name, ~10% of the sites have an amazon.com domain name,
and ~80% of the sites have a domain name that is included in the Alexa top 1
million sites list. Finally, we find that ~90% of lookups for onion addresses
are invalid, and more than 90% of attempted connections to onion services fail.
