1

The VPN won't see anymore than your ISP already is. So even if the VPN was logging everything you did, shouldn't it just leave you in status quo? How can it ever compromise your identity, that you move your "entry-point" from your ISP to a VPN?

Improve this question

1 Answer 1

Reset to default
4

Where did you get the concept that using VPN to connect you to tor will send you to jail?

First of all, you shouldn't be sent to jail (in a decent country) if you don't do anything illegal. I'll take that as a metaphor for someone is able to identify you but you should be precise.

You can connect through a VPN and TOR in two ways:

Connect to Tor, then to VPN

In this way third parties will see the connection as coming from the VPN. This has the downside that your ip will consistently come from the VPN, while tor frequently changes the ips you are exiting from.

The VPN operator will be able to log everything (unencrypted) you did.

I see two reasons for wanting this:

  • You want to hide your real location to the VPN service. However, the VPN is probably a paid service, and they probably have your name and credit card data already. So it's unlikely to be much useful.

  • You want to hide from your ISP that you are connecting to the VPN (eg. it's blacklisted). It's not clear that they would be much happier when they find you are connecting to tor (you could use a hidden bridge instead of a public entrypoint, but still it's probably risky).

Finally, you'll need to use TCP mode for the VPNs (as Tor only routes TCP) and the tor project reports that In our experience, establishing VPN connections through Tor is chancy, and requires much tweaking.

Connect to a VPN, then to Tor

In this way the VPN will only see that you are connecting to Tor. While the Tor exit node you get at each time can log everything (unencrypted) you do.

If someone broke the Tor path they would only discover you are using that VPN (for which they may be able to warrant or not, depending on power/jurisdiction), which probably already has your payment details.

On the other hand, it's more likely that they could discover who you are because of something you leaked (eg. a http:// url to something leading to you).

Also take a look at https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN describing the different options and some of the drawbacks.

Improve this answer
1
  • I imagine he got the concept from something The Grugq said. His threat model is completely different from most people's.
    – forest
    Apr 18, 2018 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .