What is the best way for high-level anonymity and privacy via Tor?

Question

I am newish to security but I have looked a lot for the perfect way to stay fully anonymous while all data is encrypted. Let's say someones a whistleblower or trading government secrets, how could he wander of freely around the Tor network without being spotted (it's just an example), or anyone else who wishes to. My thoughts...

Tor over VPN

Gives me a great advantage to hide data and the fact that I'm using Tor but if I would hit a bad exit node, he could find sniff my metadata and see all content of the data because VPN has already decrypted the message. No Good!

VPN over Tor

Gives me a great advantage to hide data from exit note and impossible to see metadata. But the disadvantage that my ISP can see everything, and no protection from any spying TOR exit nodes. No Good!

VPN over Tor over VPN?

Possible to then hide my metadata and encrypted data from both exit note and ISP? Not sure and didn't find anything about it.

How about using a VPN to work over Tor on Tails? Would I need to create my own VPN servers around the world?

Let's say I would anonymously pay via digital currencies for the VPN server. Maybe shared IP address?

I feel like I'm on the right track to find full anonymity and privacy solution via Tor, but I'm not sure. I hope some of you can help an average Joe to understand how most experienced hackers would hide themselves.

Answer 1

Mixing Tor and VPN is potentially very risky!

If you establish a VPN connection, then a Tor circuit, the Tor entry node sees the VPN exit IP, and your ISP sees only the VPN activity and this potentially works fine if everything is correct. Unfortunately it’s not uncommon for VPNs to leak information (such as DNS), in which case a VPN flaw potentially negates the anonymity of Tor before it even gets used. Ask yourself what advantage you are deriving here? Hiding the fact you’re using Tor from your ISP may be worth it in some instances or countries.

If you do the reverse and establish a Tor circuit, then a VPN connection, you’ve completely defeated the anonymity of Tor as you are logging into the VPN with a registered and paid identification. If you paid for the VPN using some form of anonymous payment and gotten your account information via some other form of anonymous communication, and you never make the mistake of directly connecting to the VPN, this approach can work. Except for rather unusual circumstances, this is a whole lot of risky moving parts that are more likely to harm than help.

Multiple security measures do not necessarily increase security, quite the opposite sometimes. Ask yourself what you’re trying to accomplish before throwing tools at the problem.