2

There is tremendous misinformation about Tor in my country's mainstream media so, even though i use Tor for everyday surfing, I'd like to hide it from my ISP.

Currently, I use a VPN whenever I am online, tunneling also other traffic such as torrents.

I am in a 14-eyes country, but my VPN server is not.

I know that using a VPN I should be covered, but I fear that this could not be enough.

Here is my question: If I generate heavy loads of traffic with p2p protocols (e.g. torrent) while I am surfing with Tor-browser, everything over the same VPN, can it gives me privacy benefits?

In other words, will my ISP have to try harder in order to discover that I am using Tor?

Improve this question
6
  • Hi Esa, when i say Tor, i mean the latest Tor browser.
    – Gigiisbae
    Feb 19, 2019 at 13:24
  • Could you clarify this a bit, so that it doesn't look like you are using Tor and torrent interchangeably. It seems you are trying to generate traffic to the VPN tunnel using torrent, and your goal is to hide that there's Tor traffic, too. But it's unclear whether the problem is having laws against Tor or torrent. This question could be more briefly and clearly expressed.
    – Esa Jokinen
    Feb 19, 2019 at 13:30
  • yes, sorry if i was being unclear. I want to absolutely hide Tor browser usage from my ISP. And since whenever my machine boots up, it starts seeding torrents continuously over my VPN connection, whenever it is that i run Tor, its over an already established VPN connection, which, according to what i have read, does prevent the ISP from knowing that i am using Tor. But i want to create as much obfuscation as possible, even though i know Tor over VPN is a good start. My question is, will my utorrent downloading and seeding keep me more or less identifiable that there is Tor traffic mixed in?
    – Gigiisbae
    Feb 19, 2019 at 13:35
  • 1
    Ideally the VPN is entirely opaque to the ISP. They have no real way of determining what traffic you are sending. But be aware that there are insecure VPNs, such as PPTP, which can be easily broken by nothing more powerful than your watch.
    – Michael Hampton
    Feb 19, 2019 at 15:33
  • 1
    @Gigiisbae Your ISP can see that you are running the Bittorrent protocol even through a VPN by analyzing packet timings. They can also tell basic information like what kinds of webpages you visit (dynamic vs static, full of ads, lots of AJAX, etc), but not usually the exact webpages themselves.
    – forest
    Feb 20, 2019 at 4:11

3 Answers 3

Reset to default
3

If you want to hide the fact that you are using Tor, you should use pluggable transports with a bridge. These are a variety of protocols that obfuscate the traffic between you and a supported bridge relay. It functions to hide the protocol and thus the existence of the Tor connection in order to evade ISP-level censorship. The current best obfuscation protocol to use is obfs4. Many bridges support this protocol.

You can visit the Tor's BridgeDB to obtain bridges using pluggable transports for obfuscation.

will my ISP have to try harder in order to discover that I am using Tor?

No, it is easy for an ISP to know that you are using Tor through a VPN. Tor sends traffic in "bursts" of 514 bytes (previously 512), called cells. If the data being sent does not divide evenly by 514, then it will be padded. A VPN, on the other hand, sends data encrypted but without any padding. This makes the usage of Tor through a VPN apparent to anyone who is monitoring packet sizes and can detect those cells. Anyone who sees a VPN send traffic in bursts of 514 knows that Tor is running underneath.

I am in a 14-eyes country, but my VPN is not.

That's not necessarily a good thing. If your connection to your VPN passes the border of an SSEUR country, then traffic will almost certainly be logged. If your VPN is within your country, then the chances that high-resolution logs will be kept is significantly lower, since the small ISPs between you and a local VPN are less likely to have the resources to wiretap. Using an offshore VPN is especially problematic, since your connection to it will be going over an undersea fiber optic cable which is trivial to tap.

Improve this answer
7
  • i will be right with you @forest, excuse me. {commence rant: oh ffs forest, why u do dis to me, whyyy?? i just want my get my doujinshi updates in peace & non-judgement. -end rant.} ok then, on a rational note. So, Tor over VPN is a encrypted tunnel within a tunnel, so the 514 bytes will have to subtracted somehow from the MTU of 1380 from my OpenVPN tunnel's max ethernet frame size according to whoer.net. (If what i just typed makes little sense, you arent alone dear reader.) I see this thread: tor.stackexchange.com/questions/9127/… so a bridge will help?
    – Gigiisbae
    Feb 20, 2019 at 12:01
  • 1
    @Gigiisbae The MTU won't help you. If you want to hide the Tor usage so you can read your doujinshi in peace, you'll want to use an obfuscated bridge. However, the mere knowledge that you are using Tor is not usually an issue unless your government makes Tor illegal or your ISP tries to block it.
    – forest
    Feb 20, 2019 at 12:04
  • Sorry reached limit. So if i use a obfs4 bridge in Tor over VPN, will it help from the ISP's DPI to find out Tor usage? Interestingly you mention, that there needs to be a gap (few milliseconds or more) where no other traffic is passing over the OpenVPN tunnel to see the burst of 514 cell bytes of Tor, but since i am seeding and downloading torrents the second i come online, and since i have a killswitch enabled, i realistically dont think there is a going to be a gap where my p2p client is going to be completely silent. So then, its still padded with more bytes than 514 bytes as a result...
    – Gigiisbae
    Feb 20, 2019 at 12:05
  • 1
    There will absolutely be a gap. All it takes is the busiest peer choking up for a split second. Also I'm sure there are ways QoS scheduling would interfere... Sending lots of traffic is not a guarantee unless you have some way to ensure a constant bitrate, which is complex and highly inefficient. Using a bridge completely hides the 514 byte cell size with variable padding and timing delays, along with protocol obfuscation.
    – forest
    Feb 20, 2019 at 12:07
  • 1
    @Gigiisbae Changing to TCP would not help since the padding in TCP is only for the headers and is predictable. As for whether or not it would help to do uploading/downloading, it might, but it might also do the opposite and cause harm. Seeding a torrent helps the swarm and the BitTorrent community so you should feel free to do that (over your VPN, not over Tor!) if you would like, but don't rely on it as a security measure.
    – forest
    Feb 23, 2019 at 4:09
1

Your VPN exit point is outside of your country and your ISP eyes, so anything being transfered inside the VPN will be protected. Adding torrenting to the same tunnel will increase the data volume and make it more difficult to analyze.

In the end, using torrent or not will not add much, and will not hurt your privacy. A properly configured VPN is enough.

Improve this answer
1
  • Thank you, yes by default i will be doing multiple things like seeding and downloading Linux Distros in Utorrent, and streaming videos from sites (where i dont sign in) and regular surfing and Tor. So Tor will be a part of this entire range of traffic coming inside the established secure OpenVPN tunnel established from me to the overseas VPN server. I want to make my traffic more difficult for dragnet surveillance to easily analyze, so can you confirm that, provided good online infosec is followed by me, whats inside the encrypted VPN tunnel cant be deciphered and isolated by application?
    – Gigiisbae
    Feb 20, 2019 at 3:04
0

What you want to achieve is not possible, is well know the list of IP address of the Tor nodes as well as the generated SSL random certificate that they generate. So is possible for your ISP to know if you are using the Tor on your home with a high detection rate.

Here is a site with the IPS https://torstatus.blutmagie.de/

So your only option is to use a VPN and also that can be detected by the ISP

Improve this answer
4
  • 1
    If OP have a VPN in place, and the Tor traffic goes thru it, ISP cannot tell he is connecting to Tor.
    – ThoriumBR
    Feb 19, 2019 at 21:13
  • 1
    @ThoriumBR It could still be detectable due to packet size and other issues.
    – AndrolGenhald
    Feb 19, 2019 at 22:45
  • @AndrolGenhald So my thinking is, and correct me if i am wrong, that you are talking about the "fixed Tor cells 512 byte size, but once that comes through the OpenVPN tunnel using UDP, along with simultaneous p2p and web streaming and surfing traffic, inside the OpenVPN tunnel itself, its going to be relatively hard for an ISP or malicious state actors to determine "Aha! there is Tor traffic inside this OpenVPN tunnel." Am i wrong?
    – Gigiisbae
    Feb 20, 2019 at 3:10
  • 1
    @Gigiisbae The bursts of 514 (it's no longer 512) bytes is visible even if you have heavy competing traffic. All it takes is a few milliseconds of a non-saturated link to detect the use of Tor.
    – forest
    Feb 20, 2019 at 4:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .