0

Are there any plans to provide integrated (and free) VPN support from within the Tor Browser? I am interested to see if something similar to this functionality provided by the Opera browser (DEV 39) is in work...

Correct me if I'm wrong, but I believe the following statements are true WRT VPNs and Tor:

Trusted VPNs provide encryption/authentication functionality to protect packet payload content for a given session connection but do nothing to 'anonymize' traffic routing information. VPNs are data-centric from a security/privacy standpoint and cannot 'help once the active connection goes 'outside' the current VPN tunnel session.

Tor provides functionality to 'anonymize' packet header information (traffic routing information) within the Tor relay network but does not address packet payload encryption/authentication. Tor is routing-centric from a security/privacy standpoint but cannot 'help' once the active connection goes 'outside' the current exit node.

I need to spend some additional time putting together a meaningful use case as per the comment below - please bear with me...

Improve this question
17
  • 2
    Um... Why? For all intents and purposes, Tor acts as a VPN inside the browser. Sending traffic through Tor from any other applications would be unique (possibly traceable). What use case are you suggesting here?
    – SuperSluether
    Jun 11, 2016 at 5:07
  • 1
    Actually, Tor does provide encryption. That's how it works. In my opinion, I don't think Tor should operate as a VPN because that is not its purpose. Right tool for the right job.
    – SuperSluether
    Jul 1, 2016 at 2:52
  • 1
    Connections in the Tor Network are encrypted. See here: torproject.org/about/overview and here: eff.org/pages/tor-and-https
    – SuperSluether
    Jul 1, 2016 at 23:47
  • 1
    A VPN doesn't encrypt data either. Once data exits the VPN server, it's left in its original unencrypted form.
    – SuperSluether
    Jul 2, 2016 at 14:06
  • 1
    @TL7 The "even if you encrypt" suggests you not only need to encrypt, but you also need to use a system such as TOR, to defeat traffic analysis attacks on your internet usage. If TOR didn't encrypt then the system wouldn't work at all; an attacker could just follow the packets and observe each relay that was involved in a journey from user to exit node and pretty soon they'd find the exit node. Ie a regular vpn won't protect you in china if chinese authorities detect you connecting to a server which has an ip address allocated to tibet, for example, even if they don't know what you're sending
    – bye
    Jul 2, 2016 at 18:58

2 Answers 2

Reset to default
1

Actually, it's technically impossible to keep browser a privacy-oriented and having a VPN support from within it. The VPN itself, however, can be elaborated in other network layers - but defenately not in browser itself: in a browser you will have an add-on for VPN or something with add-on inside. The add-ons list, however, can be enumerated and used as a fingerprinting solutions. Also please keep in mind that using even the most trustworthy VPN can result in a very few "exit points" to the Tor network and can be traced. However, using a VPN as an additional way to reach the Tor network is a very good idea

Improve this answer
1

VPNs are terrible from an anonymity perspective.

This is my own write-up on the issue, I'm going to address a few specific points of your question too since they are badthink that needs to be purged with fire^Wfacts.

"Trusted VPNs".

In information security "Trusted" is bad. Trusted means that you have to trust it, it doesn't mean that it is trustyworthy. It means that it acts a point of failure, a gamble, since you've no good reason to trust it and it is turns out you were wrong, you lose.

"Tor provides functionality to 'anonymize' packet header information"

This is technically incorrect, Tor does not "anonymize" packet header information, it is simply never transmitted, only the datastream is transmitted.

"the Tor [...] network [...] does not address packet payload encryption/authentication"

False. The Tor network uses encrypted, authenticated cells, which may have multiple layers of authenticated encryption applied depending on which part of a circuit they are being sent to, they are also transmitted inside encrypted, authenticated TLS connections between relays inside the network. This claim is entirely bizarre and suggests that your "deep digging" didn't go much beyond the overview page. The data that reaches the exit node cannot be tampered with while within the network, after it leaves the network it can be tampered with, but as you yourself point out this is exactly the same with a VPN.

"[... Spurious bullshit about crypto-magic that you don't understand ...]"

No network (VPN, Tor, whatever else) can make claims for data once it has left that network. It must be the responsibility of the application which is sending and receiving the data that will leave the network to ensure that it is receives appropriate levels of encryption to ensure confidentiality, integrity and authenticity. There is no alternative.

"My client requires me to get their prior approval before 'publishing' such ideas"

If you really do have clients, you should consider providing them a refund and an apology. You really have no idea what you're talking about and, to be frank, you're harming the integrity of the information security industry.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .