17

In his talk about OPSEC, The Grugq stresses that you first have to go through TOR before connecting to a VPN. Otherwise, the VPN would be a direct link from the endpoint to you. He summarizes:

TOR connection to a VPN OK, VPN connection to TOR go to jail.

How so? The end node connecting you with the target site is a TOR server. After leaving the VPN, the traffic is routed through the TOR network. How can your VPN be a direct link to you?

I get the discussions about not using a VPN because any added point of failure, any link added to the chain is a potential threat and attack surface for an adversary.

But I don't understand what he is on about here. I thought both scenarios (VPN -> TOR, TOR -> VPN) had advantages and disadvantages, depending on your needs and potential adversaries, basically boiling down to whether you can live better with your VPN being your last link or TOR. But as he described it, VPN -> TOR equals suicide.

I would be very much obliged if someone could explain in detail what is meant by that.

6
  • 1
    Related but probably does not fully address the question: Difference between Tor over VPN and VPN over Tor. Also see Tor -> VPN or VPN -> Tor at Tor Aug 20, 2023 at 8:06
  • 1
    I suspect this is because Tor attempts to choose a path such that timing and correlation attacks are difficult for any single entity. A VPN takes no such measures. This could backfire, if for instance, your exit node and your VPN server both happen to be in the same ISP's network. This places that ISP in a position where they can monitor both and correlate the traffic, thereby de-anonymizing you.
    – nobody
    Aug 20, 2023 at 8:07
  • 1
    "I thought both scenarious (VPN -> TOR, TOR -> VPN) had advantages and disadvantages, depending on your needs and potential adversaries, basically boiling down to whether you can live better with your VPN being your last link or TOR." This is in principle the correct answer. It depends on lots of variables if one of the scenarios is better for you (or the adversary).
    – secfren
    Aug 20, 2023 at 10:16
  • @nobody But in a real world scenario, that would never be the case, right? Nobody would connect to a VPN server that close to himself.
    – Arbuiwer
    Aug 20, 2023 at 12:50
  • Well, the exit node won't necessarily be close to you either, so it definitely could happen but would likely have a low probability. Either ways, I'm just speculating, I don't know exactly what issue/attack with Tor over VPN the grugq had in mind.
    – nobody
    Aug 20, 2023 at 15:04

2 Answers 2

19

TOR connection to a VPN OK, VPN connection to TOR go to jail.

This assessment, in general, is not accurate. Though it's true that there's always something that can go wrong with any security system. Let's consider some user who uses one of these setups.


The Invisible Wanderer

The case where the speaker's assessment is most true, is when the user is physically traveling around to locations which are not tied to them.

In this case, the user is hoping they're physically indistinguishable by local surveillance systems, and to achieve k-anonymity among all of the other people who could have passed through those locations to access those network entry-points.

Connecting to a VPN with user log-in credentials now is clearly a problem. This is because, the user just went through all the trouble to be indistinguishable in that location, to then connect themselves, and their VPN account, to that location. This isn't so much a problem if the VPN provider also cannot identify the user. Which may be the case when the VPN account payments are not tied to the user and that account is only used once, for instance.

Although, how the user connects to the network is also important. Because, a user that vanishes to some unlinkable location, which then utilizes their phone, or personal hotspot, to access the network, also just identified themselves at that location.

But in general, the situation isn't made better by connecting to a VPN after Tor. If the user's VPN account points to their personal identity, it usually doesn't matter much if their physical location in some narrow time-window is unknown. Most users can be found physically once their personal identity is uncovered.

There isn't much essential difference between an ISP and VPN provider. They both sit between the user and the web, proxying everything (Imagine this illustration, but with a VPN provider added). The main difference is that the ISP's business model is selling internet access and selling or sharing user data; while the VPN business model is building user trust of their effectiveness in hiding user internet activity and location data (though it's not clear whether a VPN can be trusted)(0).

Most users will not have access to the kinds of resources necessary to do this well. The Invisible Wanderer may consider not using a VPN at all, or paying anonymously for throwaway accounts.


The Visible Wanderer

This user only uses public internet access-points. So, they're likely identifiable, on camera sitting at a café or library somewhere.

In this case, it doesn't hurt if the VPN account is accessed before touching the Tor relays, because the user's identity is already traveling to these locations. It's a safer bet to trust a VPN with knowledge of the Entry Guard than to trust an ISP with the same.

On the other hand, it does hurt if their VPN account is accessed after the Tor relays. Because again, a direct connection can be made going backwards from the thing the user is touching on the web, to their VPN account.

Many users can act as a Visible Wanderer. Here, it's better to connect to a VPN before the Tor relays.


The Stationary

This user is sitting in some private location that is linkable to their personal identity. This scenario is almost exactly like the Visible Wanderer case, except that the user is probably not on camera connecting every one of their keystrokes to some activity on the web.

In this case as well, for mostly the same reasons, it's a safer bet to connect to the VPN prior to connecting to Tor.


TL;DR

In all cases, the user has to limit activity fingerprinting, and increase the ephemerality and personal unlinkability to their accounts and devices. That'll help protect their anonymity.

While, in general, connecting to a VPN after Tor does not improve their anonymity. It's usually safer to do VPN-then-Tor, even though in some cases, using a VPN at all (as with any linkable account) may harm their anonymity.

11
  • 2
    Thank you very much. The more I look into the topic of achieving maximum anonymity on the internet, the clearer it becomes that it's virtually impossible. All scenarios you described are ultimately not safe from a skilled adversary. Which begs the question of how skilled cybercriminals manage to sometimes evade authorities for years. No set of security measures and safety habits I ever read about guarantee that one can't be tracked down. So how can one come as close as possible to complete anonymity? You mentioned limiting fingerprintable behaviour and ephemerality. Could you elaborate a bit?
    – Arbuiwer
    Aug 20, 2023 at 15:40
  • 2
    You have many new questions, perhaps avenues of research to explore. In regards to the long run, Helen Keller once said: (goodreads.com/quotes/…). Whereas, fingerprinting is explained here: (privacysavvy.com/security/safe-browsing/web-tracking). While ephemerality is a central goal in this project: (tails.net/about/index.en.html).
    – aiootp
    Aug 20, 2023 at 15:52
  • 1
    If you do not trust the VPN provider but have an anonymous (e.g. free) VPN, connecting to VPN then TOR gives the VPN provider and, as you're not trusting the VPN provider, anyone, your location. TOR then VPN on the other hand does not give the VPN provider your location. Or am I missing something?
    – DonQuiKong
    Aug 20, 2023 at 16:59
  • 2
    I guess you could do TOR → VPN → TOR? Aug 20, 2023 at 19:56
  • 5
    @PaŭloEbermann That's also not a good idea.
    – wizzwizz4
    Aug 21, 2023 at 14:08
1

Depends on what you want to hide from whom.

Using a VPN before TOR hides where you are towards the TOR entry node. And opens up to the VPN who you are, where you are and what you do. So if you do anything illegal (which you shouldn't): you're bust if the VPN receives a search warrant and you're not already on the run.

While using a VPN after TOR hides the accessed target from TOR and the TOR usage from the target, exposing to the VPN the target and the TOR usage, allowing for the VPN to fingerprint you by your usage, but not directly linking identity, behavior and location.

So as this seems to be a rule of thumb rather than a 100% fail safe guide to perfect anonymity for the career criminal, he's probably right arguing that TOR -> VPN is safer than VPN -> TOR as VPN and TOR are essentially serving the same purpose just that TOR has at least 3 nodes hiding information from each other which need to be compromized, while the VPN has all that info available in one location and is an official company that can be prompted for that data by officials. So VPNs are generally LESS safe than TOR and really mostly serve to hide the location for legal activities that are geoblocked.

3
  • This answer led me to realize the answer is probably "For most people, their real identity and their internet identity are connected". If you're attempting to separate them (via TOR), then VPN->TOR is better when the VPN knows your "real" identity, and TOR->VPN is better when the VPN knows your "internet" identity. aiootp's answer assumes the VPN knows the "real" identity, because you need to pay them money, which presumably came from your real identity. It's tricky to get money to a separate "internet" identity which which to pay a VPN. Aug 21, 2023 at 15:48
  • @MooingDuck 1/ If the VPN knows you're real identity you've already failed. Suppose you're doing something illegal, like journalism in a dictatorship and your VPN knows who you are (name, credit information, etc...), where you are (IP, cookies, where the packages are routed to) and what you do (sees what you request and receive) and towards the authorities is visible as the culprit of your actions, it's basically only a matter of time before the service is discontinued and and/or they'll turn around and say "it's not us, it's that guy (name,address, log of deeds etc...)".
    – haxor789
    Aug 22, 2023 at 9:23
  • @MooingDuck 2/ Even if the VPN knows a fake persona rather than your real identity there's always a point of entry where you and your device are in the same room at the same time linking your internet persona to your real life persona and if you make the VPN that point of entry you're placing a lot of trust in an institution that is most likely going to tell on you and if so has a lot to say about you.
    – haxor789
    Aug 22, 2023 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .