3

Lets assume the following set-up:

  • VPN A in e.g. Russia
  • VPN B in e.g. Israel
  • Both registered through a one-time email and payed via Bitcoin
  • A brand-new notebook with a virtual machine
  • VPN A is connected on the host
  • VPN B is connected on the virtual machine

Given this set-up, has VPN B any chance to identify an user? To my understanding, traffic from VPN A looks the same for all users who are using their service, so how could VPN B identify a single user?

  • so you onion route traffic first through VPN A and then through VPN B? Why not simply use TOR? (uses 3 hops by default) – SEJPM Apr 14 '15 at 21:11
  • 2
    Because I have control over the entry and exit node with a VPN as opposed to TOR. If the entry and exit node in TOR is controlled by the same person I can flush my privacy down the toilet. – Gregor Apr 14 '15 at 21:16
6

To quote The Grugq on this:

"VPNs provide privacy - Tor provides anonymity. Confuse the two at your peril."

So, don't use VPN for anonymity but use it to protect your privacy instead.

Update: to answer your questions in a more direct manner:

Given this set-up, has VPN B any chance to identify an user? so how could VPN B identify a single user?

VPN B only knows that traffic is coming from an endpoint of VPN A. Depending of the abilities of your adversary, the mere fact that both VPNs are located in different countries may or may not help "them" to e.g. get connection logs from each of these VPN providers. For example, an intelligence service could sneak into each of these VPN providers, no matter where they are located.

If your only adversaries are the VPN providers itself, then you'd have to trust them that they don't work together and VPN A doesn't tell VPN B about its users.

So, it all depends on your level of security and/or paranoia trust towards the involved parties. However, the quote from above still stands and I'd recommend NOT to rely on VPNs for anonymity but use e.g. Tor for that purpose.

  • Thanks for the quote, but I don't see how it answers the questions. It mainly is a definition. – Gregor Apr 15 '15 at 20:32
  • I thought the quote had the answer implied. Apparently not, so I updated the answer. – ckujau Apr 18 '15 at 1:10
4

If you route your traffic throught two VPNs you'll gain a lot of anonymity.

However you're not anonymous to every possible attacker, as an attacker could break both VPNs (NSA broke quite a lot VPNs), so an attacker could backtrace your connection from your target, break B, break A and get your IP - and this is what you wanted to avoid.

So at most an attacker can gain your IP, but this attacker has to be really good, if your only concern are criminals and small-to-medium-funded companies, you're safe. Against national-states and well-funded companies, who really want to attack you, using Tor would be a better alternative.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.