Looking to maximize anonymity. What will go wrong with this configuration (other than it can be slow)?

Laptop with factory NIC removed and replaced (USB NIC or other). Running Linux as main (host) OS Running Express VPN in host Running VMWare Workstation VM with second Linux install (Kali) VM with Kali running Nord VPN Browse with TOR using VM only, otherwise everything is out via the double VPN set-up.

If I don’t need extra anonymity (and I need speed) I can kill a VPN.

Both VPNs are purchased with tumbled bitcoins on no-ID internet in Vietnam. Any email used is similarly anonymous.

Running with DNS encryption behind the VPNs just because.

What am I missing with that and where is the weakness (beyond the usual user weakness of not having good discipline)? Can VMWare broadcast any identifying info that can tie back to that purchase?

I assume non-paid proxies generally are not secure. I assume individually any VPN can be compromised and TOR is compromised as a rule, but taken as a group, it is too difficult to tackle unless the motivation is extremely high.

closed as too broad by David, Xiong Chiamiov, Polynomial, CaffeineAddiction, Anders Jan 28 '18 at 12:17

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Ensure the bios does not support any of the Laptop Lojack type software which gets embedded in the laptop's bios at the factory. Look at companies like absolute.com After that you really need to do things to avoid User Behavior Analytics which could identify you. If possible never associate to the same wireless network twice and never associate it to your home network. Might want to buy the laptop with cash too. Ensure IPv6 is completely disabled. – Trey Blalock Mar 27 '17 at 5:54
  • A licensed VMware Workstation? Really? – techraf Mar 27 '17 at 5:56
  • How do you get it on to the internet? Do you steal internet cafe space or use a stolen data SIM card? – daniel Mar 27 '17 at 6:28
  • 2
    Whenever designing a security architecture, you need to define what the threats are - who do you want to be anonymous to? Who are you ok with being identified by? There are a lot of people who know how you are in your setup. – schroeder Mar 27 '17 at 6:37
  • 1
    Kali is not designed for security. It runs everything as root by default, and does not get quick security fixes. It has many highly vulnerable programs. It is designed only for pentesting. Do not use it as your main system if you care at all about your security. – forest Dec 1 '17 at 4:57

My opinion is that you are trying to use quite a full set of security/anonymy tools. Still my opinion is that few flaws if any could allow to identify you from a remote host. Now if the question is is it enough to guarantee my anonymity my opinion will be no.

Fingerprinting methods could allow to identify your connection practices. No way to identify who and where you are till now. But if other evidences could make a legal inquiry suspect you, the knowledge of both how your computer is configured and what were the connection pratices could add evidences that your machine was used. And as you speak of China, my advice is to never underestimate rubber hose attack.

Of course if all what your need is that little cousin cannot guess that you hacked if facebook page, that is probably too much.

TL/DR: as said by Shroeder in its comment, you must first define what are the threats you want to address and only them setup a security system relevant for them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.