A VPN encrypts your traffic and relies on a single server.
A Tor Socks proxy goes through multiple nodes with each node providing a new layer of encryption, offers higher anonymity while accessing a website, with the disadvantage of being slower.
I am interested in what an attacker could do if they have access to the public wifi access point.
Assuming someone can read all traffic between you and the router, a variety of things can be seen:
- Without VPN or Tor
Your mac address, if not spoofed.
What Website you are accessing (and what exact data you are submitting (username, passwords etc.) when the Website doesnt use any encryption like HTTPS (very unlikely nowadays)).
- With VPN
Your mac address, if not spoofed. Except that, it can only be seen that you are accessing the VPN. All communication between you and the VPN is encrypted. The encryption is practically Impossible to crack, assuming it's configured properly.
- With Tor
Same as with VPN, only with the difference that all data is encrypted multiple times, 1 more time by each node it goes through.
Please keep in mind that both the Tor exit node and VPN can see the same data a mitm attacker would be able to see when not using a VPN or Tor (What website you are accessing etc., see 1)).
Blocking VPN and Tor
As a counter measure, the attacker could try blocking your VPN or Tor by dropping all connections to it and so forcing you to access the website without extra protection.