The title pretty much says it all. I'm using Tor with PIA VPN also running. Is this a good extra level of security, or just a waste of time. Thanks all.
It can be more dangerous. It can be a useful dodge. It depends on the threats facing you in particular.
If you connect to a VPN provider through Tor, your VPN provider typically knows who you are (or at least has a path back to near you) via your payment arrangements. They can also know you use Tor to reach them. The VPN provider will provide this information to authorities upon request or coercion. This can destroy your anonymity.
If you connect to Tor after going through a VPN provider, the VPN provider can know you are using Tor, just as any provider of connectivity (ISP, etc.) can know you are using Tor. The VPN provider can also know what else you're doing, including seeing what leaks when you use non-Torified applications. If you are in the rare circumstance of having a local ISP which is Tor-hostile, but which doesn't mind VPNs, then using Tor across a VPN can be a useful work-around.
This is a matter of who are you trusting more? Your ISP or your VPN provider? Since you have a lot more choices with VPN providers than ISPs, it is logical to prefer the VPN provider over ISP. This is in a case where the schematic of your network looks something like the following:
User---VPN---Node 1 (Guard)--- Node 2 (middle node)--- Node 3 (exit node)--- destination site
There is one addtional outcome to this setup. Tor will not be able to determine where you are connecting from, even for reserch purposes. This may or may not give you some additional piece of mind that your data can not be used even in an anonymous way for reserch purpose.
The second option is to use the following topology:
User---Node 1 (Guard)---Node 2 (middle node)---Node 3 (exit node)---VPN---destination site
In this case The exit node can not snoop on you, but instead VPN can snoop on you. Now the question is who do you trust more? The VPN or exit node. You need to make a judgement here for yourself. There is one additional advantage to this setup: You may access the web sites that block Tor exit node. There is also one downside to this setup: The VPN IP address is not changing every 10 minutes or so.
The third option is to use the following topology:
User---VPN---Node 1 (Guard)--- Node 2 (middle node)---Node 3 (exit Node)---VPN---destination site
This look like a best of both worlds.
First, you have replaced the ISP with the VPN provider of your choice.
Second, you prevented Tor to figure out where you are connecting from.
Third, The destination Web sites that block Tor exit node do not block you.
Forth, Your data is completely encrypted all the way to the destination site and from destination site to you.
Fifth, You have increased the the number of nodes from 3 to 5 node and eliminated any possible exit node snooping.
Now there are some precautions you should take for this topology to work as intended.
Both your VPNs should be free of charge so that there is no money trail.
Your VPNs should be located outside your jurisdiction, advesaries jurisdiction and outside the adversaries jurisdiction of influence.
Tails with this setup will provide the best result because it is an amnesic system.
Do change the VPNs from time to time. for example every month or quarter.
If you find VPN provides with Multi-hop routing, that much the better.
There is still one downside to this setup. The destination sites will see a constant IP address (VPN IP address) until you change the VPN provider or if you are using multi-hop routing VPN provider.
It can surely be a great way to increase your anonymity, especially if you trust your VPN provider more than your ISP. Actually it's like replacing your ISP with somebody else. And considering common data retention laws that apply to most of ISPs but not to VPN providers (for example, some of them operate offshore), the winner is obvious. You have also generally much more choices when it comes to VPN providers compared to ISPs. For maximum anonymity, you should buy your VPN service with mixed Bitcoins or via pre-paid/gift cards etc, or get a free one (e.g. securityKISS or riseup.net).
I suggest you read this article explaining it in more detail.
When choosing a VPN, one nice feature to look for is Multihop routing. It means that the public IP you get is different than the IP of gateway you're connecting to. This makes traffic analysis attacks somewhat difficult even if we assume that the attacker is monitoring every single Internet tube.
Of course, this all stands only if you trust the VPN provider that he does not store any logs about your usage. While it can be hard for you to trust some unknown for-profit company to keep their word, you can for sure trust your ISP that he is keeping the logs :-) Finally, business is business and if some VPN provider gives out some customers' data that he was not even supposed to have in the first place, he'll probably loose the business ending up like HideMyAss.
Does this mean that your VPN client uses Tor to connect to the VPN server, or that your Tor client uses your VPN tunnel to connect to its entry guard node?
The former will give you no benefit over using only VPN, but it will be slower. You hide your IP from your VPN provider.
The latter might make it somewhat harder to trace back, but probably not much, also depending on what logs your VPN provider keeps.