The Tor network promises online privacy by routing users' internet traffic through a number of servers – or layers – while encrypting data.
The surveillance whistleblower Edward Snowden is known to have used Tor to maintain his privacy, while the documents he leaked showed that the US National Security Agency (NSA) struggled to uncover identities of those on the network.
However, a presentation promising to detail flaws in the anonymising network has been cancelled, organisers of a major hacker conference have confirmed.
The talk, called "You don't have to be the NSA to break Tor: de-anonymising users on a budget", was due to be delivered by the Carnegie Mellon researchers Alexander Volynkin and Michael McCord, but a notice on the Black Hat conference website said lawyers from the university had stepped in.
The counsel for Carnegie Mellon said that neither the university nor its Software Engineering Institute (SEI), had given approval for public disclosure of the material set to be detailed by Volynkin and McCord, according to the Black Hat organisers.
Their talk was one of the most anticipated sessions at this year’s conference, which starts on 2 August in Las Vegas. They promised to explain how anyone with $3,000 could de-anonymise users of Tor.
Details on the presentation, which have now been removed from the Black Hat site, suggested that a determined hacker could “de-anonymise hundreds of thousands Tor clients and thousands of hidden services within a couple of months”.
Besides individual users, there are numerous criminal websites making use of Tor, including sites offering hitman services and illegal drugs, even though the most prominent example, Silk Road, was shut down in 2013.
Organisers from the Tor Project said they were working with the Computer Emergency Response Team (CERT) at Carnegie Mellon, which is sponsored by the US Department of Homeland Security, to release information on the problems identified by the researchers.
“We did not ask Black Hat or CERT to cancel the talk. We did (and still do) have questions for the presenter and for CERT about some aspects of the research, but we had no idea the talk would be pulled before the announcement was made,” said Tor Project president Roger Dingledine.
“We never received slides or any description of what would be presented in the talk itself beyond what was available on the Black Hat webpage. Researchers who have told us about bugs in the past have found us pretty helpful in fixing issues, and generally positive to work with.”
Carnegie Mellon had not responded to a request for comment by the Guardian at the time of publication.
• What is Tor? A beginner's guide to the privacy tool
