Why is putting a VPN between the destination and an exit node unsafe?

Question

In a recent Tor blog post the following was mentioned:

The help desk has been asked how to configure a VPN to prevent a website from learning that a user is using Tor. We consider positioning a VPN between one’s exit node and the destination site to be totally unsafe, and not much more anonymous than using a VPN without Tor.

Now, having read the FAQ, I understand the reasons why it is preferred to not hide the Exit nodes, but none of those reasons seem to have anything to do with privacy or anonymity. How does adding a VPN after an exit node break Tor's model so badly that it becomes not much more anonymous than using a VPN without Tor?

Answer 1

If an exit operator routed all traffic through a private VPN, and the exit relay and VPN server were hosted by comparably trustworthy providers, I don't see any issues about anonymity. With no VPN, the provider hosting the Tor exit could sniff all traffic. With the VPN, the provider hosting the VPN exit could sniff all traffic, but the host of the Tor exit would see only encrypted VPN traffic. The Tor network would see the exit relay at the VPN exit IP address. That IP address could be changed, but so can any IP address. If there were too much bandwidth reduction and increased latency, however, the exit would be bad for the network.

I suspect that the help desk was considering a third-party VPN service, rather than a private VPN managed by the exit operator. In that case, the VPN provider could sniff exit traffic. That would introduce an additional unknown.

But even in that case, I think that it's overreaching to claim that it's "not much more anonymous than using a VPN without Tor". Every Tor exit is uniquely identifiable by its IP address. I don't see how another IP address, not listed by the Tor Project, would break anonymity.

Answer 2

It's not unsafe at all. Without VPN you are effectively as an exit node doing clearly the traffic of the remote Tor users.

It just adds some more lag.

Answer 3

Short answer: Because a VPN account degrades your anonymity to pseudonymity.

Long answer:

All your VPN traffic is tied to a single VPN account. If one "anonymous" post (or page view) can be linked to another "anonymous" post (or page view) as coming from the same user... the anonymity is no more, even if your IP is still unknown. Instead of telling the VPN operator your IP, you tell them about yourself simply by revealing what you do on the Internet.

Meanwhile bare Tor exit traffic is shared by all Tor users, so no two posts (or page views) can be confidently attributed to the same user.

P.S.

1. This could be avoided in theory by using some kind of VPN that's not account-based (similarly to Tor). But even then it would have to have a massive number of users who share the traffic in order to deliver practical anonymity.

2. Another possible (although probably not permitted) countermeasure would be to somehow share your VPN account between hundreds of users unbeknownst to your VPN operator.

3. Third countermeasure: redirect random traffic from some source (maybe your own Tor exit node) in order to obscure your VPN identity. But even "hiding in the crowd" tactic is not entirely anonymous because a malicious VPN operator still knows where to look for for all your traffic, and that's a single VPN account.