I approach privacy issues on the Internet from two ends. On the one hand, I design and evaluate defensive measures, so-called privacy enhancing technologies (PETs), which can be used by individuals to protect themselves against surveillance on the Internet. On the other hand, I study the efficacy of offensive techniques. I am especially interested in passive surveillance techniques that cannot be detected. For instance, I have shown how machine learning techniques can be used to infer the contents of encrypted traffic and how to track users solely based on characteristic behavioral patterns.