To set up a Hidden service in a private mode, only accessible by just you or additionally your trusted associates…
When activated, no one (not even the Hidden Service Directories) can derive your .onion address from the descriptors nor can they know the introduction points to your server and consequently will not be able to connect to you.
If one of your associates is compromised, and the attacker gains access to their auth-cookie, is there any additional mitigation provided by using Hidden Service Authentication? Or does the adversary now have all knowledge about introduction points and gain ability to conduct traffic analysis attacks as if HSA was never implemented? How “trusted” is “trusted”?
Yes. This feature allows the HS operator to generate multiple shared secrets - giving access to different parties which is revocable. Configurable with the “stealth” auth type used with HiddenServiceAuthorizeClient. Meaning that clients who are banned no longer know about the HS’ introduction points anymore.
Or does the adversary now have all knowledge about introduction points and gain ability to conduct traffic analysis attacks as if HSA was never implemented?
Until access is revoked the HS is exposed. I would worry about exploiting the software stack running on the server than a hypothetical weakness in Tor - though both are bad.
How “trusted” is “trusted”?
Trusted means the authorized clients are not malicious parties nor are they compromised by them.