What order is best for nesting VPNs?

Question

if anyone is available to give me advice on a VPN situation I'd appreciate it.

So the story is, I have one Swedish VPN which I trust not to log, and which I've connected to with my real IP, and I've connected to things like Facebook with the VPN. The problem is that this VPN uses a fairly weak symmetric cipher and no PFS. This VPN service is run by one person in Sweden, although it is medium sized. I trust this VPN pretty well, it seems very honest and not out only to make money, and the TOS is extremely tiny and lenient.

There is another VPN which I plan on buying so I can nest the two. The new VPN is a larger company, and the exit nodes are not in as friendly a country as the first. However this VPN takes pride in being very technologically knowledgeable in how to secure their servers, and they a strong cipher and kex, and implement PFS (which is a huge plus side). A problem is that they say that their small staff will do anything they can to prevent child porn from going through their network. While I am not going to send that through, I don't know if by "stop" they mean simply block access to those sites, or to temporarily enable logging (which is not good), or what. And I don't want my anonymity to be damaged if I accidentally come across jailbait.

So here's my dilemma... Should I do "me -> old VPN -> new VPN -> www" or "me -> new vpn -> old vpn -> www"? The most important things for me is having PFS so if my ISP logs, they will not get anything out of it if the private keys are compromised, and that the exit nodes do not log. My adversary is primarily government, so that if any one of the two VPN's private keys are compromised, or if any one of the two VPNs turn on logging for LEA, it will not automatically destroy my anonymity.

My thought is that it should be "me -> new VPN -> old VPN -> www" because I trust the old VPN's intentions more (so I want it to handle my plaintext exit traffic) and the exit nodes are in good countries, but I trust the new VPN's technical skills more (so I'd like for the connection going through my ISP is encrypted with it). I'm hoping that if I do it this way, I'll get the best of both worlds.

tl;dr I have VPN A, and am about to buy VPN B. I trust VPN A's intentions more, but I trust VPN B's skills and encryption more. In what order should I nest them?

What should I do? Is there anything else I haven't taken into account?

Answer 1

If you want to connect to the old VPN through the new VPN, it's best to start by canceling your account with the old VPN. Get an account with the new VPN, and use it for a month or two.

Then get a new account with the old VPN, without revealing any connection to your old account. Never connect to their website or VPN servers except through the new VPN. Use a new email address that's not linked in any way to your old VPN account. Pay for the new account with your old VPN provider using cash through the mail, or with thoroughly anonymized Bitcoins.

It's very easy to anonymize Bitcoins by using mixing services (such as the Blockchain wallet, BitLaundry and Bitcoin Fog) via Tor among multiple Multibit clients in Whonix instances.

It's easy to nest VPNs, as Pseudo Reality noted, by using one in a VM host machine, and another in a VM. For more complex configurations, one can use pfSense VMs as VPN clients, and combine them with Whonix and other Tor gateway VMs.

Answer 2

I would connect to the new VPN from the base machine then use a virtual machine to connect to the old VPN. This way you have the more secure tunnel with the new VPN and you have another secure encrypted tunnel inside you initial tunnel.