  The use of anonymity-based infrastructures and anonymisers is a plausible
solution to mitigate privacy problems on the Internet. Tor (short for The onion
router) is a popular low-latency anonymity system that can be installed as an
end-user application on a wide range of operating systems to redirect the
traffic through a series of anonymising proxy circuits. The construction of
these circuits determines both the latency and the anonymity degree of the Tor
anonymity system. While some circuit construction strategies lead to delays
which are tolerated for activities like Web browsing, they can make the system
vulnerable to linking attacks. We evaluate in this paper three classical
strategies for the construction of Tor circuits, with respect to their
de-anonymisation risk and latency performance. We then develop a new circuit
selection algorithm that considerably reduces the success probability of
linking attacks while keeping a good degree of performance. We finally conduct
experiments on a real-world Tor deployment over PlanetLab. Our experimental
results confirm the validity of our strategy and its performance increase for
Web browsing.
