I've been fiddling around lately about my security as I'd like to stay completely anonymous on the Internet because we all deserve privacy, and I hope this setup will at least make it hard to find out who I am. Please tell me what I can improve on and change in this setup. All feedback and criticism is appreciated.

Encrypted USB → Debian 8 → VPN →
VM w/ Windows 7 → VPN →
RDP w/ Windows 7 → VPN →
TOR with obfuscated bridges or Firefox.

I plan on adding Socks 5 Proxies when I browse with Firefox. Bridges for TOR are changed on a weekly basis. Both the RDP and the VM running Windows are cleaned daily with CCleaner and logs are deleted. I have three VPN connections running, all with different locations, no logs are kept on their part. However, at times I do not have a VPN running on the RDP because it already has a different IP and I only use VPN when I need to access blocked websites from it.

I've been considering changing my VM's OS to something else as we all know Windows 7 isn't the most anonymous OS out there. I've been thinking about Tails or Qubes but I'm not sure it's possible to connect to RDP from those.

I've also been reading that using a VPN before TOR can be dangerous but I've also read that it can be beneficial. If someone can clarify this please do.

Lastly, how safe would this be to run on home wifi vs public wifi? I'm guessing it would be almost impossible on public wifi but home wifi?

My laptop is decent enough to run all this with no lag or problems, as well as my internet speed. I'm currently accessing from my home wifi and it runs well.

  • 5
    I don't understand. Why do you think that adding more software in the mix would help anonymity? That's more chances of leaking something that could identify you. Commented Mar 7, 2016 at 22:47
  • 1
    Tor is not 100% safe. If someone is hosting a relay node he can see all the traffic
    – user102753
    Commented Mar 7, 2016 at 22:49
  • If something gets compromised, it can never get to my host os, so adding more layers is Deffo a go. About leaking, I'm not gonna store ANY information about me or something that links to me at all, it's only gonna be for browsing using an unknown identity that won't have any links to me, I have a MacBook that I use for other things.
    – Shr3d
    Commented Mar 7, 2016 at 22:55
  • Sounds like you are trying to hide something, but that's not interest. But you said that your VPN's doesnt keep logs, but how sure are you? If the vpn is located in the USA there's a big chance they are logging everything. Its sounds like you are reinventing the wheel, because there is an OS called Tails (which is focused on anonymity). Commented Mar 8, 2016 at 8:16

1 Answer 1


That's actually a pretty bad setup. You are making it over complicated to the point where what you view as defense in depth is actually extra attack surface. For example using a VPN defeats Tor's guard rotation algorithms, which are fine-tuned to reduce the chance that you hit both a malicious guard and exit at the same time.

Using bridges when you are not being blocked by censorship is also a very bad idea It reduces the amount of possible entry points you can blend in with. Bridges are so ubiquitous that chances are, you would be one of the only if not the only person to use that bridge at any given time. That makes traffic correlation attacks much eaiser when an adversary does not have to demultiplex communications from the guard (or bridge) to the middle node. Think about it this way: if you are the only one using the bridge, then is there any doubt that the traffic going from the bridge to the middle node is not yours? Now, if you are using a popular guard, much more work would have to be done to correlation which stream of traffic is yours and which is just noise from other users.

Additionally, you say you change bridges frequently. Just as with changing guards, that is a VERY BAD idea. The first node in the Tor circuit should be long lived. In fact, Tor Project rather recently changed guard parameters to make it even more long lived, because even changing every few months was too quick, and made deanonymizing sybil attacks significantly easier. Their modification of the parameters to keep a single guard for a year or more has made sybil attacks, and other types of traffic correlation attacks much harder. Search the Tor Project blog for "tor guard parameters" for more information on the mathematics behind that.

Logs are kept on your VPN. Just because the VPN service claims not to log does not mean their upstream ISP (which is in all likelyhood something like OVH) does not either. If the upstream ISP logs, which it certainly does, then the claim that your VPN does not log becomes moot.

Using CCleaner is often quite useless. Modern filesystems which are either journaling filesystems (like ext4, jfs, etc) or copy-on-write filesystems (like NTFS, which is partial CoW, btrfs, or zfs) cannot have files or even free space reliably erased. Furthermore, many VM virtual hard disk formats are CoW anyway, so even if you switched to FAT32 or something, it would still not end up being quite useless.

The unnecessary use of VMs and RDP also add to attack surface area. Furthermore, on all x86 and most ARM hardware, it is quite trivial to mount side-channel attacks from within a virtual machine. These attacks are capable of reliably detecting what phrases are being typed on the host, and can even steal keys from the memory of certain insecure cryptographic applications. The attacks that can do this reliably are named prime+probe, flush+reload, and flush+flush, named in order of stealth and efficiency. Furthermore, virtual machines still expose low level hardware to the guest, and trivial escapes are not uncommon at all.

All in all, your setup makes it easier both to deanonymize you from the outside, but also from the inside, by exposing the huge attack surface area of RDP and VMs. I would very, very strongly urge you stop this setup and instead use Tails, or even just Tor Browser on Debian.

Before you try to do anything like this again (creating your own complex setup), first formalize your threat model. Information on threat modeling online is ubiquitous. Until you do that, using Tails is almost always a safe bet for anonymity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .