7

I've been reading how VPN service and Tor network works, and I can't understand the difference between the VPN server and Tor node.

I know that in the Tor network there are several nodes, but what would be the difference between the Tor network and network made from several VPN servers if they communicate (the first node encrypts/hides request user identity and last node decrypts traffic) same as in Tor network?

3

In a way you are comparing apples with trees. VPN is not a specific technology but a general concept with multiple often significantly different implementations. Tor instead is a concrete protocol.

But VPN is essentially an encrypted tunnel between two communication peers. If the clients is putting multiple encrypted tunnels inside each other (not after each other but inside) you essentially get something like Tor: you have multiple layers of encryption done by the client, the client defines which path through the VPN the data take and only the final exit node of the VPNs can see the original traffic - all others see only traffic encrypted from another VPN.

There are some significant differences though: when manually putting multiple layers of VPN inside each other one defines usually only a single path through the network. Tor instead will take care that different connections take different routes involving different exit nodes and also different intermediate nodes. This increases the level anonymity since creating an association between different flows is way harder even for an advanced attacker if all flows go a different way than if they would use all the same way through some multi-layered VPN setup. Additionally the protocol used by Tor is specifically designed to bypass deep inspection, i.e. it can mimic other protocols so it does not get blocked and it also has some protections against analysis of traffic patterns. These are all things one does not find typically in common VPN implementations.

Apart from that VPN usually work at the network layer and thus covers any IP traffic while Tor only covers TCP traffic and only for applications which are specifically designed to send the TCP traffic through something like Tor (for example by using Tor as a SOCKS proxy). Insofar Tor is from the configuration more comparable to a proxy instead of a real VPN. This kind of setup has the additional advantage that OS fingerprinting at the IP or TCP level is not possible, i.e. all what gets fingerprinted this way is the OS of the exit node.

  • 2
    An additional thing that you might want to mention is the fact that a VPN is a tunnel for your entire networking stack, meaning it supports any protocol your kernel does, whereas Tor is more like a proxy in that it only supports TCP, and it does not expose your network stack to fingerprinting. Another important fact is that Tor has an intelligent path selection algorithm which goes to lengths to pick the right relays, whereas shoving three VPNs together will not give the same anonymity advantages (no cell padding or netflow padding, etc). – forest Dec 20 '18 at 7:26
  • @forest: good points. I've added these to the answer. – Steffen Ullrich Dec 20 '18 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.