This question already has an answer here:

MyPC > RDP > Windows VPS > Tor > Socks5 > Internet


MyPC with Tor sandboxed > socks5 > Internet.

Which is better? Any better idea that doesn’t compromise on network speed?

marked as duplicate by forest, iainpb, Steffen Ullrich, Xiong Chiamiov, David Mar 5 '18 at 7:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


The answer is, as usual, depending on your threat model. What does "anonymous" means to you?

  • Hiding traffic from family members, coworkers, people who share your exit gateway: a simple VPN will do the trick.
  • Hiding traffic from your ISP: again, a VPN is sufficient -- the ISP (probably) doesn't have the reach to compromise the VPN server.
  • Hiding traffic from people with jurisdictional powers: ouch. A VPN has proved insufficient in multiple high-profile cases (1) (2) (although I certainly don't condone the actions of the people caught, it shows how commercial VPNs don't offer enough protection wrt anonymisation).

Your proposed options are problematic in that they pile up indirections without much coherence, and may allow more attack vectors than they close.

First option

My PC > ISP > VPS (RDP) > Tor > SOCKS5 > Destination

  • Your ISP sees encrypted traffic (RDP) to the VPS (probably won't raise any flags).
  • Your VPS (and the VPS provider) sees encrypted outbound traffic to a Tor node.
  • Destination sees incoming traffic from a SOCKS5 proxy.

Now what if the VPS provider is spooked that their server may have been compromised with malware or been enrolled in a botnet, they might be tempted to start monitoring the activity. They might also become an outright adversary (remember they know it's you who control the server, and they have physical access to the machine) and compromise the machine without your knowledge. Your traffic becomes visible to them and whoever is being given access to the machine or it's monitoring.

Similarly, jurisdictional powers with interest in your activities will see consistent traffic to the VPS, and will become interested in it.

Interfacing an additional SOCKS5 proxy between the Tor exit node and the destination seems superfluous. Are you concerned with the annoying captchas many websites put up for incoming Tor traffic?

Second option

MyPC with Tor sandboxed > ISP > Tor > socks5 > Internet

  • Your ISP sees encrypted outbound traffic to a Tor node.
  • Destination sees incoming traffic from a SOCKS5 proxy.

In some countries, ISP don't get too concerned with subscribers using Tor. In some others, it's grounds for being reported. Again it depends on your situation. Sandboxed or not, there is visible traffic to the Tor node.

Like option 1, jurisdictional powers may also become interested in your use of Tor and target you in a deanonymisation attack. It's more difficult than just compromising your VPS in option 1, but can still be done (e.g. browser fingerprinting or traffic correlation).

Your SOCKS5 proxy doesn't help, apart from the captchas maybe...

Further thoughts

Note that any anonymisation setup will only work if you consistently use it. The more complex it is, the harder it is to use, and the more likely you will slip up one day, like it happened to Lulzsec's Sabu when he forgot to turn on Tor just once.

Incidentally, the more complex your setup, the more failure points there will be, and as such the less reliable and the more attackable it will be.

In short, privacy advocates often boil down recommendation to the following:

  • Strict and watertight separation of sensitive (anonymous) activity from other mundane activity
  • Consistent and exclusive use of the anonymisation setup for any sensitive activity
  • Consistent and exclusive use of air-gapped hardware for sensitive activity
  • An association of software similar to TailsOS or Qubes OS, along with Tor Browser

And even with this you are not immune.

You should not take any of this as a prescription for becoming anonymous. Please consider, instead, the interactions, good and bad, between differents solutions that you may put in place in order to achieve your goal in more details.

Until you decide, you can start by just using the Tor browser (and keeping up to date). It's a good start.

  • 1
    Note that having a proxy after Tor is a bad, bad idea. It defeats the purpose of having a rotating exit relay and increases the risk of traffic analysis attacks. – forest Feb 23 '18 at 4:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.