5

As some of you may be aware the UK government has pretty much passed a new surveillance bill. For those that wish to read in more detail can do so here http://www.computerworlduk.com/security/draft-investigatory-powers-bill-what-you-need-know-3629116/

The main aspect of the bill is to require ISPs and mobile network providers to log your browsing history to allow various government departments and the odd private company access to it.

Now I can somewhat understand the need by a country to observe its people with a lot of what we do now carried out online it is one tool in the toolbox to combat serious criminals and terrorists however the Governemnt can get carried away giving its self too much power and the fact that departments that don't really need my history such as Gambling Commission, Food Standards Agency, Competition and Markets Authority and NHS Foundation Trusts will be given access is where I decide enough is enough.

I'm here because I'm considering using either a VPN or joining TOR. But have some questions.

  • Would both VPNs and the TOR network put a stop to this surveillance?
  • Which is the better option for every day use (least speed reduction)?
  • If VPN is the best option what are favourites to use (again, with focus on privacy and speed)?

Thanks

closed as off-topic by Stephane, grochmal, kasperd, Matthew, Steve Nov 28 '16 at 15:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Currently it's all a bit unclear, so this may well get closed as opinion based (the government doesn't really seem to have worked out the technical difficulties), but a paid-for VPN will be faster than TOR, and assuming a VPN provider based outside the UK, should mean that the only traffic visible directly to a given IP address should be encrypted VPN data. Product and service recommendations are off topic here though. – Matthew Nov 25 '16 at 13:20
  • Well I even have my doubts over a US based VPN considering we are very close allies and previous history of NSA and GCHQ. Would there be any countries that aren't as co-operative? Do we know if the bill will be back dated for keeping records? – Smush Nov 25 '16 at 13:34
  • 1
    It's a bit difficult to back date record keeping - either you're doing it, or you're not. If you're not, you can't just generate a bunch of older data! In terms of countries for VPN providers, Fiveeyes members are probably poor choices, but EU countries might be ok - they're not really feeling co-operative with the UK at the moment... Look for countries with no log retention requirements. – Matthew Nov 25 '16 at 13:42
  • How do you know the tor exit node you will be using isn't owned by the UK government? – defalt Nov 25 '16 at 15:49
  • It's irrelevant whether the government controls the exit node, as they don't know who made the request they're proxying. – Xiong Chiamiov Nov 25 '16 at 16:32
2

There are realy long and detailed articles out there, which are nice to read if you got time.

This is a short overview:

  • TOR is "more secure", but VPN is most of the time faster
  • It is "easier" to track you back when using VPN (depends on the provider)
  • TOR can only be used for browsing the internet (yes i know, its possible... but we are talking about every day use and not some special builds)

-> I would recommend using VPN primarily. If you have some shady stuff to do, feel free to use TOR. But remember not using both at the same time.

  • Can the ISP not log your history before traffic gets to the TOR or VPN? I'm not completely confident in TOR for a few reasons for one exit nodes can be government/criminally controlled and another reason let's not forget onion routing was first used for protecting US intelligence what's not to say they cracked it or put back doors in before making it publicly available? – Smush Nov 25 '16 at 13:41
  • 1
    No, they can't. The Data gets encrypted on your Client, that means before it even leaves your local network at home. The only thing they can see are metadata, like the time when a packet leaves your house, your ip and (maybe) the destination ip of the first node / your vpn provider. And the backdoors: It is possible, though very very unlikely. There have been so many crimes happening over tor allready and most of the criminals have'nt been caught yet. – licklake Nov 25 '16 at 13:47
  • TOR can only be used for browsing the internet TBB is a special build, Tor is not a special build. But remember not using both at the same time. what?! it's so much more secure than Tor itself. Also, it's Tor, not TOR. – Samuel Shifterovich Nov 26 '16 at 11:05
  • Well, its not. But that's an endless discussion which other people have done often enough. I know that Tor isn't a special build, that's not what i said. And i wrote Tor only TOR to highlight it... – licklake Nov 26 '16 at 11:15
  • Using a VPN with Tor at the same time can be bad if you do Tor->VPN, but VPN->Tor can be useful in certain cases (for example, to evade censorship that pluggable transports are not helping with). – forest Dec 9 '17 at 9:59
0

Would both VPNs and the TOR network put a stop to this surveillance?

Which is the better option for every day use (least speed reduction)?

If VPN is the best option what are favourites to use (again, with focus on privacy and speed)?

Recommendations for a specific product are considered off-topic here, and the trouble with VPNs anyways is that we can't verify that any are good - we can only tell you which ones are known to be bad.

At a high level, VPNs and tor are very similar: rather than your internet traffic leaving your house with a destination address of the server you want to contact, you send it instead to another server, which proxies the request to the real destination. In both cases the connection between you and the proxy server is encrypted, which means the most likely place the government would be able to observe your traffic is now cut off for them. Do note, though, that they will be able to know that you're using a method to avoid them. (That's one of the arguments for pushing encrypted traffic by default and getting as many people as possible using tor, so that this no longer becomes an interesting signal to eavesdroppers).

However, there is a really important difference between VPNs and tor, and that has to do with trust. The VPN knows everything that you do, and you have to trust them to keep that a secret. Cheap VPNs are known to sell browsing history for advertising purposes. If the VPN provider is located in the UK, they almost certainly will provide customer logs on government request; even if they aren't, they might, as long as they don't think it will get out that they did so (since that would be bad for business). And even a well-intentioned VPN is a great target for an intelligence agency to hack into.

The Tor protocol, on the other hand, is specifically designed to retain privacy when used with untrustworthy nodes.* The exit node knows the same information as the VPN provider about the request (who it's going to, what its contents are, what the response is), but has no idea who is making that request. The entry node knows that you're making a request, but has no idea what it is. And the middle node knows essentially nothing.

Although this isn't directly related to your stated privacy goals, tor also rotates through exit nodes every five minutes, which helps prevent a website operator (or advertising network) from building a profile on you by IP.

You should always use https connections with tor when possible. There are privacy reasons to do so that are best explained with this diagram from the EFF (this applies to VPNs, too), and also security reasons, given that you're essentially introducing a man-in-the-middle into your requests.

In short, tor provides distinctly better privacy than VPNs, both in general and for the specific things you're worried about.


* There are some correlation attacks when an attacker controls both the entry and exit nodes in a circuit, so go run your own node to add diversity!

  • It'll be a lot slower than a VPN though - there is a trade off between hops (reducing the amount of data that any given node knows) and speed. Agreed that TOR will generally provide an increased level of privacy though. – Matthew Nov 25 '16 at 17:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.