"Cover traffic is only there if the tor instance(s) also run as relay." I was talking about clients, not servers just to clarify. If multiple Tor instances are running in client mode (or even in one instance, if there's a lot of traffic), it becomes harder to do traffic analysis and pin one circuit to one user. Am I mistaken in that conclusion? Ringo