6

I'm trying to decide which method is safer, Tor -> VPN or VPN -> Tor. Lets suppose both exit nodes are compromised(Tor and VPN). They were set up by the government and it's goal is to spy on users.

enter image description here

The first example of this image (Tor -> VPN), the Tor exit node would only see the previous node, and the Entry one(me) would be safe. Right? The VPN would never find out about me.

In the second example, the VPN knows who I really am and that I'm connected to a Tor network. Could they in anyway trace a profile of me and know everything I do?

I'm not so worried about reports coming from internet since I will browse "safe websites"(I hope) and either way, my identity is secure.

Improve this question

3 Answers 3

Reset to default
3

VPN -> Tor -> VPN

Any paranoid tell you "the more, the merrier"

  • 1) VPN -> Tor. ( VPN inside Tor )

If you have enough skill, you know VPN protocol, you see that it is raw, aggressive protocol, it talks everytime about everything.

Timing attack.

Provider see your Tor session, crop your connection to uncontrollable nodes, you are going through nodes under control of your provider, your session looks like torrent traffic, raw UDP ( lesser often TCP ).

  • 2) Tor -> VPN ( Tor inside VPN )

Your session could look like raw Tor session, nothing changes. Provider will see only encrypted VPN traffic. Beware, there is whisper that ALL VPN protocols are compromised by NSA.

In this case, provider will read your VPN traffic plainly. He will see that you use Tor, only.

MITM-attack.

Thereafter, provider collaborate with NSA and sell you. You are marked like a Tor user.

Imagine such abstract picture:

You --> VPN Provider ( Probably listening by NSA) --> Tor --> Proxy ( Any free proxy ) --> VPN Provider( Another one listening by NSA ) --> Tor --> Proxy ( Any free proxy ) --> Target

NSA read that you get session with Tor.

Thereafter, NSA read that someone from Free Proxy got session with Tor.

Target will see only the Last Proxy as a client.

Nowadays, you can get 10/100 mb/s for cents. It is paradize for cryptopunks. You can wrap 10-100 middle nodes, your bandwidth will be the same 14,400 like it was 10 years ago.

Partially, the question of "What should be wrapped into what ?" - is a question of gourmet. My answer here: "As you wish."

Improve this answer
2

I think is best is to not include any non-legitimated part in the chain.

Untill there is not a part that could be considered like NSA-safe 'apart' of TOR, if a minor safe part like VPN is include, the strength of the whole chain is equal to the wickest part.

In my opinion Tor should be used Alone and as much isolated as possible, (like with live Tails), Until you find a trusted net/system/protocol to connect trough and could be combined with Tor.

Then, in this case, if Tor and the new found system to safely connect are combined, under anonymity perspective, it doesn't matter which go first.

Actually I think that connect with TOR and after go to some trusted (or Russian at least) free-web-proxy could add an extra layer. (not translate.google) but I didn't try it yet.

To end, In the second example: me>>VPN(NSA)>>Tor>>target is equal to

me>>NSA>>Tor>>Target. NSA guys could be happy with that.

Improve this answer
0

Unless you use encrypted links to the final destination, like https, both the exit node and the VPN host have your plaintext traffic in both scenarios.

In the first scenario, neither of them has your IP. In the second, the VPN host has it.

Edit: So yes, if you use unencrypted links, they can see everything you do.

Improve this answer
1
  • Right, that's why I didn't want to use VPN as my first pass. They can trace a profile of me and use that information. In this case I think Tor doesn't have much utility, other than hide itself from my ISP. Using Tor-VPN instead seems more secure as the end node can't find me(or can it?)
    – user2789749
    Commented Dec 21, 2013 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .