Question regarding chaining two VPNs

Question

Perhaps I am just too stupid to understand it on my own, but I cannot find reliable answers trough Google. Anyway, let me explain what I have on my mind. Please correct me if I am wrong, I am relatively new to security-related stuff.

I consider picking one of three setups:

a) no use of VPN at all - so assuming malicious ISP, he can see and log all the traffic

b) one VPN - protects from ISP spying except metada, but VPN provider can see and log everything he wants to

c) chain of two VPNs - ISP can see only metadata of first provider I connect, both VPNs see each other's IP, but is endpoint (last provider I connect to) able to decrypt all trafic?

What kind of data can both VPNs see in scenario c) ?

(Note that I am not either hacker or someone important, I just can't withstand feeling that all my data is in hands of either ISP or VPN provider. Everyone can set up VPN server and sell it under no-logs policy - you can't check whether he's actually logging or not.)

Answer 1

You can imagine a VPN as an encrypted tunnel to some endpoint:

 you -- encrypted(secret1) --> VPN-endpoint --- not encrypted -> target

This means the VPN endpoint can see the unencrypted traffic and even modify it.

If you add another VPN to the mix and tunnel through the first VPN to the second VPN you get this:

 you -- encrypted(secret1,encrypted(secret2)) --> VPN1 
     -- encrypted(secret2)                    --> VPN2
     -- not encrypted                         --> target

This is, the final VPN endpoint (VPN2) can again see and modify the traffic, but not the first VPN endpoint (VPN1). This one can only see that you have some connection to VPN2. And VPN2 can only see that you connect from VPN1 although depending on the VPN protocol it might identify you based on your authentication credentials. A typical example of such "onion network" is the TOR network: the nodes in the middle cannot see the unencrypted traffic but the exit node can.