I recently came across this answer here https://security.stackexchange.com/a/17860 and was surprised that VPN traffic could apparently be monitored.
I am new to this subject and am trying to better understand how it all works. I have zero interest in doing anything illegal, but I am highly paranoid and don't like the idea of being monitored (I grew up with enough of that already).
So I became interested in security, but I don't understand it very well. Conventional wisdom suggests a VPN is the answer, but then answers like the one above confuse me. It seems like traffic coming from you is encrypted, but not the traffic coming back?
Is a VPN really enough? If I log into Gmail from my normal IP address, but then log into that same account with a VPN, is this considered a security hazard? Is the only way to use a VPN safely is to basically be a completely different person from your non-VPN self? Different accounts, different mannerisms, different everything? What information is accessible by someone monitoring my traffic (either a malicious person or the building that owns the routers / local network or the ISP, etc)? Is it wise to use a VPN and then activate a Tor browser? Can we really assume the VPN is not logging you? Does it matter if you use PayPal? Does it matter what email address you use to sign up? Does it matter if you use a credit card associated with your real name?
I am operating on the fundamental assumption here that it is never fully possible to achieve 100% security, anonymity, and privacy, because at some point security through obscurity is part of the equation, and at some point we have no choice but to trust something or assume we're being logged and monitored, and so on. But I'd still like to do all that I can.
When is a VPN not safe? What are the best practices for using one?