Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
Let's assume that the VPNs in the nested chains have been anonymously purchased through bitcoin, maybe using Anonabox. Let's also assume I have good OPSEC.
Now isn't this the ultimate setup guaranteeing 100% anonymity and untraceability, even against global adversaries?
Few holes.
Anon purchased VPNs help prevent your identity from being exposed when the VPN is raided. It doesn't shield the first VPN from knowing your IP address. So assuming you piss off the NSA, and they raid your VPN while your connected to the VPN, and the sysadmin doesn't hit the kill switch when they kick in the door, the NSA would be able to correlate your real IP address with your VPN account name of your first VPN. From there they could raid your ISP which are less privacy conscience than bitcoin VPNs. If your ISP keeps NSA logs, then the NSA would have a pretty good idea of when you were connected to your first VPN.
Now if your global Mr Robot NASDAQ hack started 5 minutes after you connected to your first VPN in the chain, and stopped 5 minutes before you disconnected from your first VPN, there would be pretty good circumstantial evidence for the FISA judge to go medieval on you.
To mitigate you should randomize which VPN is first in your VPN chain (you didn't mention if you did that or not). If you randomize which is first, you reduce the NSA agent and FISA judge from catching your global conspiracy by a factor of the number of VPNs in your chain. So if you have 10 VPNs in your chain or pool, then there is only a 10% chance that the agents raid the VPN your connected to when you do your Mr Robot work.
Your biggest vunerability will be on your laptop itself. Even with Whonix VMs you are exposed to hardware implant hacks, acoustic cryptanalysis, and other side-band attacks like Meltdown and Spectre. These are all theoretical and there is no proof that the NSA or GCHQ have deployed AC, Spectre, or Meltdown to deanonomize a Whonix instance or RSA keys from a host OS. In theory its possible giving an infinitely intelligent advisory with limitless funds and sole focus on taking down Mr. Piece0fshite@stackexchange.
Point is there is no 100% anonymous if your dealing with omnipotent opponents. But unless your planning to hack NASDAQ or something, Comcast + TOR + HTTPS will likely be all you will ever need.
As you've described it - your particular setup is secure, but using it carelessly will compromise you if you will make mistakes like phone number verification and personal data sharing e.t.c...
You won't know when the surveillance is initiated unless they let you know for legal reasons in some juristictions. Cryptocurrency VPN's was mentioned , so was hardware hacks.
Those combined points make life very difficult for amateur/professional security experts with hypothetical (hopefully) plots/behaviour and although critical, the planning phase is ideally thorough, comprehensive, covert, and take a minimal amount of time to mitigate surveillance initation before your final, best draft is put in to action.
