2

What are the advantages of running Tor after a VPN as compared to using an Obfsproxy bridge? For example, assuming the goal is to prevent an eavesdropper on the local end from noticing Tor usage, it would stand to reason that VPN addresses would be more readily recognized than those of Tor bridges; it would also stand that Tor bridges typically exist over a broader number of countries and are harder to monitor, particularly Obfsproxy, due to camouflage. In addition, VPNs can almost always be forced into revealing user information on government request.

  1. Are there any real benefits to using a VPN before Tor that cannot be achieved by bridges?

  2. Is there a benefit to stringing together multiple VPNs that cannot be achieved by increasing the number of relays per circuit? Does it suffer the same drawbacks?

1
  • Nobody mentioned anything about "private obfsproxy bridges" Commented Aug 14, 2019 at 0:52

1 Answer 1

5

First, let's consider that "the goal is to prevent an eavesdropper on the local end from noticing Tor usage". For argument's sake, let's say that it's easier, at any particular time, to identify all VPN service entry servers than it is to identify all Tor bridges. And let's say that all Internet traffic is logged, and at least metadata (such as IP addresses, times and so on) is retained indefinitely.

Although Tor bridges may well be "harder to monitor", it's arguable that this is so only transiently. That is, sooner or later, virtually all Tor bridges are identified, and replaced with new bridges.

If that assessment is accurate, consider the implications for observers of my ISP-assigned IP address. If I were using Tor bridges, all of my prior traffic to a particular Tor bridge would be readily found once that bridge had been identified. And my Tor use would be apparent, given that all Tor bridges (I assume) lead to Tor.

If I were instead accessing Tor through a VPN service, identifying my Tor use would require either traffic analysis based on intercepts, or access to VPN connection logs. In contrast to the Tor-bridge scenario, identification of past Tor use would arguably become harder over time.

But of course, if I were truly concerned about hiding my Tor use, I would use both VPN services (in nested chains) and Tor bridges with Obfsproxy.

Second, regarding the "benefit to stringing together multiple VPNs that cannot be achieved by increasing the number of relays per circuit", the most obvious one is usability. On a good day, I can get at least 5 Mbps each way with a nested chain of three VPN services, with latency under 400 msec. With the standard Tor configuration, I'm lucky to get 2-3 Mbps each way, and latency is typically 1000-2000 msec.

Another benefit of using multiple VPNs instead of Tor bridges is that Tor traffic is further disassociated from users. Even if one could chain multiple Tor bridges, all prior Tor use would be revealed as soon as the initial bridge had been identified.

Identifying Tor users in VPN traffic, especially retrospectively, is arguably harder than searching based on known Tor bridges. Many people use VPN services, far more than use Tor. BitTorrent use and HD video streaming account for a substantial and increasing share of Internet throughput overall. And, in response to efforts to block "piracy", that traffic is increasingly migrating to VPN services.

1
  • To: mirimir You wrote:"On a good day, I can get at least 5 Mbps each way with a nested chain of three VPN services, with latency under 400 msec." Could you show us the steps to chain three VPN services?
    – user281403
    Commented Dec 21, 2014 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .