printAn improved clock-skew measurement technique for revealing hidden services (2008)
by delroth
A side-channel "attack" to discover encrypted traffic type (in this paper, using Tor). Only proven to work on a reduced version of the onion network in this paper, but maybe one day it will be usable in the wild :)