I know that HTTPS is end-to-end encrypted, so no one except Twitter can know what data is sent, not even the VPN provider.
Yes, if everything with SSL operates correctly, but by very definition the VPN is a man-in-the-middle.
I would rather use my ISP than use a VPN provider from China, India or Russia. The middle letter P stands for private and that's very subjective.
Second, I know that when I am using a VPN no one can know who is the user, except the VPN provider.
They will know the VPN, and the IP address is shared with other users. So you're not anonymous. They've likely seen that IP address many times before.
What I mean to say, is they might allocate more server CPU time in the monitoring of VPN IP addresses compared against other IPs. It's called being guilty by association. You've put a flag on your connection to their servers.
VPNs make you look like the woman in the red dress from the Matrix movies. You stand out in a crowd of busy users.
So, Twitter doesn't know the user, and the VPN provider doesn't know the data. Is this true? Am I 100% anonymous?
Why should Twitter depend upon network traffic to identify a user?
Your behavior alone can be enough for them to identify you, if you do one of the following:
- Use a VPN to like your own tweets.
- Use a VPN to post links to your own websites.
- Use a VPN to follow your own account.
- Use a VPN to view accounts for people you know in real-life.
- Use a VPN to attack people you know in real-life.
- Someone is able to identify you base upon your activity.
If Twitter wanted to track a user back to the real-world, they could do one of the following:
- Twitter can fake a network error on unique URLs to see if you come back without the VPN.
- Twitter can profile you by baiting you with fake tweets.
- Twitter can position you by tracking location of tweets you interact with.
- Twitter asks other users to help identify you.
- Twitter asks the VPN to identify you.
- Twitter asks Facebook or Google to help identify you.
- Twitter can redirect all VPN traffic to dedicated servers that have extra resources for tracking high-risk users.
I have no proof they do any of the above, but I also think it's perfectly reasonable to think they would. Given the history of idiots who use Twitter to do stupid things or even worse things.