3

I want to be as anonymous as possible online without anyone being able to connect me to my online activity. Assume that the people trying to track me have lots of resources and can even use the legal system against me. In essence, assume the United States Government is trying to track me.

I know Tor and VPNs provide anonyminity. Will the combination of these protect me? Would someone be able to find my VPN from Tor, and then from the VPN find me? Or am I actually secure? Can I remain anonymous from the government of the United States of America?

  • 2
    When you use a VPN your VPN provider knows your 'real' IP address. Apart from that the anonymity depends largely on your actions. E.g. if you go to google.com and log in with your google account during your 'anonymous' session, then at least Google will know who you are and can track some of your actions. Also if you use a browser that can be fingerprinted then it will be possible to profile you in some way. If you are unlucky enough to use a compromised Tor exit node, then the additional VPN will give you some extra protection (e.g. noone can see your IP address). – Martin Fürholz Jun 20 at 1:32
  • 1
    The short answer is going to be that there's no such thing as 100% security. There's always going to be a chink in your armor. Even if this layer is secure, you always leave traces of your activity that can potentially tied back to you. – Steve Sether Jun 20 at 15:08
  • 1
    There's no such thing as total security. – Tobi Nary Jun 27 at 7:06
  • 1
    Snake, I've edited your question fairly heavily. As you may have gathered from comments there is no such thing as 100% security. My goal with my edit is to still get your question answered, while avoiding the kind of assumptions that will make it hard to get food answers. If you don't like my edit you can revert it. – Conor Mancone Aug 25 at 22:21
  • 1
    The way that you combine Tor and a VPN heavily impact how likely it is for a nation state attacker to be able to identify you. Also, the particulars of the VPn, and your online browsing habits too. – YetAnotherRandomUser Aug 27 at 19:23
4
+150

This is a long explanation, for a TL:DR, read my first answer here.

What a VPN does is create an encrypted tunnel between you and a VPN server. When you want to send data to a server on the internet (let's call it website for simplicity but it can be anything and everything on the internet), you first send it to the VPN server through the encrypted tunnel and the VPN sends it on your behalf. For the website, it seems as if the VPN server sent the data. It then sends it response to the VPN server, which then forwards it to you using the encrypted tunnel again.

Now this helps makeing you anonymous in several ways. It prevents the website from seeing your IP address from the connection, because the data is sent to it by the VPN server. You could also try spoofing your IP address but then, the response would be sent to the spoofed IP and never get to you. That is why you need a VPN. Your ISP still can see you are sending data, but it can only see when you send it, how much you send and that it is sent to the VPN server. Because the data is encrypted in the tunnel, the ISP does not know what you are sending or whom to.

Now notice that the ISP knows you are sending data to the VPN server and the website knows it is receiving data from the VPN server. Therefore if they cooperate, they can immediately narrow down the number of "suspects" to the users of the VPN you are using. Further, they can see when exactly you were sending data and how large the packets were and narrow it down further, possibly to you exactly. This is called a correlation attack.

Furthermore, the VPN obviously knows everything. It knows your IP, because you are sending data to it and it needs to send you the responses. It knows who you are sending data to, because it has to deliver it. It also knows what you are sending, as the encrypted VPN tunnel ends at the VPN server. Now if there is another layer of encryption, such as HTTPS, then the VPN server still just sees the encrypted traffic, but it still knows a lot and the website knows the rest. If you don't use HTTPS or other encryption, than the VPN knows everything on its own. The FBI has successfully compromised a VPN in the past.

As you can see, VPN are only secure if you trust the VPN provider and even then, correlation attacks can be dangerous. While VPN can be effective against less powerful attackers, that can't force ISPs, websites and VPN providers to cooperate, they are not as effective against nation state actors, especially the USA, who can usually just force them to reveal the information they seek.

Tor works similarly to a VPN, except there are three computers between you and the website. These servers are called nodes. When you send data through Tor, they are sent to the first (entry) node, which forwards them to a second node, and that one forwards them to a third (exit) one. The exit node then forwards them to the website. Responses take the same route in the opposite direction. Now there are encrypted tunnels from YOU to each of the nodes, sort if tunnels within tunnels. This prevents anyone but the exit node to see, what and to whom you are sending. And of course, the exit node is furthest away from you, so it has the least chance of figuring out, what IP address is yours.

Now nodes in Tor are volunteers. Anyone can add a Node to the Tor network. This includes malicious attackers. It is theorized that many such attackers try to control exit nodes, so they can see the un-encrypted traffic and then try to figure out who it belongs to based on the content. Also if you are unlucky, you may end up connecting to three malicious nodes and then, these know everything just like a VPN server. Some believe an attack on Tor by flooding the network with malicious nodes was already pulled off by the FBI in collaboration with a university to take down the Silk Road 2.0.

Now as I said, compromising all three Tor nodes you use is more difficult than compromising a single VPN server, but not necessarily impossible for someone like the US government. Keep in mind that these nodes (or VPN server) do not need to cooperate voluntarily with the US government. A US agency, such as the NSA may simply hack the nodes/servers to gain access or send a team to break in and access the server physically.

Furthermore, while Tor makes correlation attacks harder, because there are many more users of the whole Tor network than a single VPN server, they are far from impossible. Especially if they can find clues elsewhere. A student once used Tor to report a bomb threat before an exam. He was caught, because he was the only student using Tor at that school at the time. While they did not break Tor per-se, he was an obvious suspect and eventually admitted to it.

Neither a VPN, nor Tor can protect you from revealing your identity accidentally. Internet browsers send large amounts of data to websites, that you may not even know about. Javascript and Flash may send your real IP or even physical location, browsers automatically send the size of your screen so that the website can adjust, they send cookies, information about the browser, about the operating system you use and many more. Your content may also provide clues. Your vocabulary, style of writing, language, references, etc. can all be used to narrow down the "suspects" and trace back to you. A certain well known hacker whose name I forgot got caught, because he shared too many broad personal details on IRC. While the FBI was never able to trace him through Tor, he over the years revealed bits of seemingly generic information that slowly narrowed down the possibilities until he was found.

In addition, this all presumes that the encrypted tunnels are secure. But with no-one knowing, what capabilities the NSA has, when it comes to breaking encryption, it is entirely possible they can just decrypt the tunnels and see everything without any of this hassle.

Using VPN and Tor together is a mixed bag. On one hand, it can sort of "extend" Tor to four nodes and decrease the chance of you being traced that way, but it can pose some other dangers.

And finally, neither a VPN nor Tor prevents a website from sending you malware and hacking your computer, then using it to find your real identity and/or location. The FBI has been known to use malware in its investigations and have successfully used it to unmask someone using Tor.

In the end, you can try your best to stay anonymous, but a single mistake, that may not even be made by you can reveal you, irreversibly. It may be an oversight by a developer of Tor, or the browser you use. There is no sure way to stay secure at all, only decreasing the risk. And against someone like the US government, who won't let a mistake go unpunished, the risks will always be high, no matter what you do.

The US government complicates things even further by keeping their successes secret. For example, they were known not to use advanced malware against hackers, because there was increased chance it would be discovered. Preventing us from knowing about it prevented us from defending against it. They will only use their most advanced techniques when they need to, keeping us from learning about them and defending ourselves from them.

If you are interested in doing your best, I would recommend taking a look at Tails. Tails is an operating system, whose whole idea is, that it does not allow to store any information. It does not allow writing anything to the disk, meaning you can't be distinguished from others using anything on your computer. It also routes all traffic through Tor, preventing you accidentally connecting somewhere directly. Because it is so minimalist, it is harder to hack. In addition, I would recommend not using the same identity for longer periods of time, such as nicknames. If they can't connect your activities online, they can't combine information they gain to narrow down the options.

Thanks to ConorMancone for the links to the real life examples.

  • 1
    This is a great answer! It explains all the things I would have if I had more time. There are some good real-life examples of the US government using techniques like these to track down people using Tor and/or VPNs. If I have a chance I may mention add them here for completeness. – Conor Mancone Aug 31 at 11:18
  • Good answer, even tho I think Qubes is better than tails, either way this whole trying to remain secure seems meh, you're a string doesn't matter how complicated you tie it or how long, you can still be tracked, I have a theory, if you were several strings then directed to several cores that had everyone else's strings combined you'd be much more secure, then redirected from there, but it's hard to explain in text and would not work properly with current technology and structure of the internet itself. – Thesnake123 Sep 1 at 7:55
  • @Thesnake123 I think Qubes is better at what it was designed for, which is isolation and malware resistance. But Tails was designed for anonymity from the ground up and that is why I recommend it over Qubes in these scenarios. While Qubes can probably do Everything Tails can, Tails comes set-up properly from the box, which eliminates opportunities for the user to forget or mess up something. Of course, you are free to recommend something different than I do. – Peter Harmann Sep 1 at 8:01
  • Yeh, if you want to use Qubes, run Tails or Whonix inside Qubes for all of the jolly good reasons explained. – Ian Sep 6 at 19:16
8

No. Just installing Tor and a VPN does not make you safe. Even if Tor was resilient against attack and VPN was secure and trustworthy, they would only mask your IP. Many people using Tor were caught, not because Tor was defeated, but because they made a mistake. They logged in to a social network or used it on a school computer or had cookies in their browsers or allowed javascript/adobe flash player to reveal their IP and many more. Being completely anonymous against the government of the United States is an open problem. Even if there was a way, there would be no way to show, if it really works or not.

  • 1
    Also the window should be locked and the size should be set to a random size at the time of startup (not max). – tungsten Aug 25 at 20:47
  • 4
    @tungsten random window size? I feel like that makes you more trackable, not less. The goal is to look like everyone else, not to stick out – Conor Mancone Aug 25 at 22:24
  • 1
    It should not be random, it should be the size Tor browser is set to default. Having it full screen reveals your screen size. Having it on randoum could allow correlation attacks. Leaving it default makes you look like other tor users. – Peter Harmann Aug 28 at 5:04
  • Tor Browser does not include Flash, and JavaScript does not allow for deanonymization without exploiting a 0day. And I'm not sure why cookies would be an issue. But you're right that people have been caught for mistakes... – forest Sep 2 at 8:38
  • @forest Well, the Onion (Tor) network can be used with a different browser or someone may install it (I think it is possible). Tracking cookies can be a problem or may not be depending on what you use the browser for. As for JavaScript, I am not sure but would be somewhat surprised if it could not at least reveal clues. – Peter Harmann Sep 2 at 9:54
4

If you're serious about it, you could look into installing Qubes as your main OS, and running Whonix in one of the Qubes.

Qubes was a project started by Joanna Rutkowska (who developed the idea of the Blue Pill virtualisation rootkit).

Qubes takes an approach called security by compartmentalization, which allows you to compartmentalize the various parts of your digital life into securely isolated compartments called qubes.

...and...

Whonix is based on Debian and Tor and utilizes two VMs, a “gateway” and a “workstation”. Qubes security architecture makes use of Whonix’s isolation by using the gateway as a ProxyVM to route all network traffic through Tor, while the workstation is used for making AppVMs.

Between the two of those (and some reading around common mistakes as mentioned by @Peter Harmann) might see you as best protected as possible.

[Edit] To further the answer, to potentially address issues raised in the comments regarding advice, there are some discussions raised over on tor.stackexchange which might add some clarity:

Comparison of Whonix and Tails Threat model that Qubes is most appropriate for (including an answer from a whonix maintainer)

'Can I remain anonymous from the US government?'

I don't believe so.

  • 1
    Any reason why qubes instead of Tails? For most purposes, Tails should be a better choice for anonymity IMO. I did not give a recommendation on purpose, as I am not able to list all the caveats and partial advice here could be worse then no advice. – Peter Harmann Jun 20 at 15:04
  • 1
    Could run Tails on top of Qubes. I accept your point of recommendations being potentially fraught. – Ian Jun 20 at 15:13
  • 1
    So you have a suggestion for anonyminity, and say that it is probably your best bet. However, I feel that it still leaves the main question unanswered: will this secure a user from tracking by an adversary as well-resourced as the US government? After all, if this still gets you de-anonymized after just a week, then it really doesn't help. – Conor Mancone Aug 25 at 22:32
  • 2
    This is one of those threat model responses. Is it possible to avoid nation level interest? I'm not so sure it is, as the powers that exist can compel organisations to give nation level attacker information that will de-anonymise the user. If not that, then the resources available to them will swamp any walls a single user stands up. It would irresponsible to state, 'this is the solution' without knowing more about nation state capability (assume it's very high indeed). – Ian Aug 27 at 11:36
1

"assume the United States Government is trying to track me" - it depends on the value that tracking you will give the government. If you have no big value, nobody will spend much resources to track you and even Tor might be sufficient.

If you have a big value for the government, then expect that proper resources will be used. For instance, special hardware can be installed on your devices, in your house, in your car etc. No need to decrypt you traffic if one sees your display and reads your keyboard. Another resource: People around you. Information about you from one of them can be much more valuable than analysis of your emails and chats, and it can be much cheaper than other approaches. And so on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.