The title pretty much says it all. I'm using Tor with PIA VPN also running. Is this a good extra level of security, or just a waste of time. Thanks all.
-
useful information about Tor & VPN from the tor project itself: torproject.org/docs/faq#IsTorLikeAVPN– DJCrashdummyFeb 24, 2019 at 15:04
Add a comment
|
4 Answers
It can be more dangerous. It can be a useful dodge. It depends on the threats facing you in particular.
If you connect to a VPN provider through Tor, your VPN provider typically knows who you are (or at least has a path back to near you) via your payment arrangements. They can also know you use Tor to reach them. The VPN provider will provide this information to authorities upon request or coercion. This can destroy your anonymity.
If you connect to Tor after going through a VPN provider, the VPN provider can know you are using Tor, just as any provider of connectivity (ISP, etc.) can know you are using Tor. The VPN provider can also know what else you're doing, including seeing what leaks when you use non-Torified applications. If you are in the rare circumstance of having a local ISP which is Tor-hostile, but which doesn't mind VPNs, then using Tor across a VPN can be a useful work-around.
-
1To be at all useful, any VPN used through Tor must be set up entirely through Tor. Unless it's a free VPN, such as SecurityKISS, any money trail limits anonymity. Cash by mail is one option. Another is using multiply mixed Bitcoins, using Bitcoin Fog with a few Multibit clients in Whonix.– mirimirApr 23, 2014 at 19:31
-
@mirimir SecurityKISS is crap. They keep logs and do some other sneaky things that you wouldn't like from a VPN provider. Check out this page and their very own TOS for more info on it.– GDP2Aug 16, 2017 at 22:47
-
[...] having a local ISP which is Tor-hostile, [...] then using Tor across a VPN can be a useful work-around. -- in this case the Tor project suggests to use a bridge and not a VPN. Feb 28, 2019 at 5:20
This is a matter of who are you trusting more? Your ISP or your VPN provider? Since you have a lot more choices with VPN providers than ISPs, it is logical to prefer the VPN provider over ISP. This is in a case where the schematic of your network looks something like the following:
User---VPN---Node 1 (Guard)--- Node 2 (middle node)--- Node 3 (exit node)--- destination site
There is one addtional outcome to this setup. Tor will not be able to determine where you are connecting from, even for reserch purposes. This may or may not give you some additional piece of mind that your data can not be used even in an anonymous way for reserch purpose.
The second option is to use the following topology:
User---Node 1 (Guard)---Node 2 (middle node)---Node 3 (exit node)---VPN---destination site
In this case The exit node can not snoop on you, but instead VPN can snoop on you. Now the question is who do you trust more? The VPN or exit node. You need to make a judgement here for yourself. There is one additional advantage to this setup: You may access the web sites that block Tor exit node. There is also one downside to this setup: The VPN IP address is not changing every 10 minutes or so.
The third option is to use the following topology:
User---VPN---Node 1 (Guard)--- Node 2 (middle node)---Node 3 (exit Node)---VPN---destination site
This look like a best of both worlds.
First, you have replaced the ISP with the VPN provider of your choice.
Second, you prevented Tor to figure out where you are connecting from.
Third, The destination Web sites that block Tor exit node do not block you.
Forth, Your data is completely encrypted all the way to the destination site and from destination site to you.
Fifth, You have increased the the number of nodes from 3 to 5 node and eliminated any possible exit node snooping.
Now there are some precautions you should take for this topology to work as intended.
Both your VPNs should be free of charge so that there is no money trail.
Your VPNs should be located outside your jurisdiction, advesaries jurisdiction and outside the adversaries jurisdiction of influence.
Tails with this setup will provide the best result because it is an amnesic system.
Do change the VPNs from time to time. for example every month or quarter.
If you find VPN provides with Multi-hop routing, that much the better.
There is still one downside to this setup. The destination sites will see a constant IP address (VPN IP address) until you change the VPN provider or if you are using multi-hop routing VPN provider.
-
What sort of performance impact will you see with the third option? Would there be significant lag in loading largish web pages?– AdrianSep 30, 2016 at 2:09
-
It can surely be a great way to increase your anonymity, especially if you trust your VPN provider more than your ISP. Actually it's like replacing your ISP with somebody else. And considering common data retention laws that apply to most of ISPs but not to VPN providers (for example, some of them operate offshore), the winner is obvious. You have also generally much more choices when it comes to VPN providers compared to ISPs. For maximum anonymity, you should buy your VPN service with mixed Bitcoins or via pre-paid/gift cards etc, or get a free one (e.g. securityKISS or riseup.net).
I suggest you read this article explaining it in more detail.
When choosing a VPN, one nice feature to look for is Multihop routing. It means that the public IP you get is different than the IP of gateway you're connecting to. This makes traffic analysis attacks somewhat difficult even if we assume that the attacker is monitoring every single Internet tube.
Of course, this all stands only if you trust the VPN provider that he does not store any logs about your usage. While it can be hard for you to trust some unknown for-profit company to keep their word, you can for sure trust your ISP that he is keeping the logs :-) Finally, business is business and if some VPN provider gives out some customers' data that he was not even supposed to have in the first place, he'll probably loose the business ending up like HideMyAss.
-
1What's also relevant is whether you trust your government less than your VPN provider and its government. Although multi-hop VPNs are good, as you say, better is using nested chains of VPNs. There's very little performance hit vs Tor alone. That further complicates traffic analysis, especially if one of the VPN servers is not readily accessible.– mirimirMay 21, 2014 at 23:42
-
-
@user812 What ("all this") are you saying that ones ISP can already do? Once you use one VPN, the ISP can only see traffic to/from that VPN.– mirimirMay 23, 2014 at 0:28
-
1
-
Don't know where you're going with this. Have you actually read my answer? I'm clarifying this in the first two sentences.– knaperekMay 24, 2014 at 7:26
Does this mean that your VPN client uses Tor to connect to the VPN server, or that your Tor client uses your VPN tunnel to connect to its entry guard node?
The former will give you no benefit over using only VPN, but it will be slower. You hide your IP from your VPN provider.
The latter might make it somewhat harder to trace back, but probably not much, also depending on what logs your VPN provider keeps.
-
Your first example gives you the benefit that no tor servers can see your data, not even the tor exit node. Which means that you only have to trust your VPN with your data that's not sent over https, not tor. I am much more willing to trust my VPN whose business depends on providing good/private/secure service over some random tor exit node that any teenager can set up in his basement. And then additionally, if you paid for your VPN servus anonymously, if you connect through tor they don't know where you're coming from or who you are.– srchuloAug 16, 2016 at 19:40