Replying to Avatar boston wine

My understanding is that Tor can leak IP addresses, so a VPN will mask it. That way, you’re effectively “decentralizing” your privacy - IP masked by (but visible to) VPN provider, and web traffic masked by (but visible to) Tor nodes.

I’m still fairly new to this so I could be mistaken, but that’s the consensus/guidance I’ve gotten so far.

Simple enough: enable a VPN before you open Tor browser. Then your ISP also doesn’t know you’re even using Tor (which is a problem in and of itself in some countries).
11
f9OfwT 2y ago

Tor provides a secure connection by routing your internet traffic through 3 nodes, ensuring your IP remains anonymous. The first node knows your IP but not the content or destination of your data. Tor nodes are run by volunteers, similar to Bitcoin.

Many VPNs are considered honeypots, as exposed by Edward Snowden, with real-world examples to support this.

It seems there's a misunderstanding about the Tor network.

Tor does not leak IP addresses, and even if it did, no data would be associated with those addresses.

Tor nodes cannot see web traffic. If you wish to avoid your ISP detecting Tor usage, consider using Snowflake (https://snowflake.torproject.org/). Snowflake conceals Tor usage, while a VPN (honeypot) might reveal it.

Using a VPN with Tor generally offers no benefits, and for multiple reasons, I would advise against using a VPN even for regular internet usage. However, with Tor, a VPN does not make any sense.

Reply to this note

Please Login to reply.

Discussion

Avatar
boston wine 2y ago

I’d trust a regularly audited VPN more than Verizon or Spectrum, lol

Thanks for the additional points regarding Tor. Do you work on or for the project?

My understanding is that it’s not quite so black and white, and that there are still privacy risks with Tor as well…

This article links to a bunch of examples, studies, other articles. Curious to hear your take on it — as I said, I’m still learning.

https://restoreprivacy.com/tor/

Obv if one is doing something illegal then the internet is dumb, period. I’m more curious about how freedom activists in adversarial jurisdictions can protect themselves…

11
f9OfwT 2y ago

I do not have any affiliation with the Tor Project. Im just also exploring options for better privacy.

Lot's of the points in that atricle are fair, but probebly exaggerated. Tor as a protocol is not perfect, but VPN's are not a alternative and using them in combination does make even less sense.

When talking about using a VPN without Tor. The question is who to trust, your ISP or a VPN company. But when using Tor with a VPN it does not provide any direct benifit.

Another alternative to look at is the Invisible Internet Project or i2p. It's very different than both Tor and a VPN. But probebly even more private, because it does not use the existing ip address system. You can't access the rest of the internet while connecting to i2p.

Avatar
boston wine 2y ago

I also got the feeling that the article may be trying to sell VPN subscriptions via referral links, lol. But it did seem like they had decent sources to back up the risks mentioned.

Def agree about VPN > ISP.

Do you think that running Tor through a VPN is problematic? Or just a waste of time? How come, if so? Seems like an extra (if minimal) layer of security to me.

I don’t know much about i2p but I’ve heard it mentioned a fair bit. Always curious to learn more!

11
f9OfwT 2y ago

Yea there are lots of articles and blog posts trying to sell VPN subscriptions with referral links. It's also wierd to see VPN companys sponsor random youtube video's.

About using Tor through a VPN, it is not problematic, but it's a possible waste of time/speed/money.

And about using a standalone VPN, even then, in many cases, i whould argue against using a VPN. Because it's just shifting trust from your isp to a vpn. And when using a vpn, you stand out, to the vpns (honeypots) and to your ISP. And the VPN can collect data, like DNS data.

Avatar
boston wine 2y ago

You make good points about VPN alone.

My primary goal with using one for browsing etc is less about security than simple user privacy enhancement - reducing how much targeting data gets explicitly and blatantly collected by innumerable third parties to be shared and sold.

That along with a browser like duck duck go. Just a few improvements.

If I’m putting Bitcoin in cold storage, then a Tor connection to protect a “family savings account” is warranted 🤙

11
f9OfwT 2y ago

Yes those are good things. If you just want to protect against third parties it can be a option. But better whould be for regular browsing, using encrypted DNS, private browsing mode or clearing cookies/localStorage regularly ect. And for more sensitive browsing, using Tor.

Avatar
boston wine 2y ago

Great, thanks - I appreciate the discussion 🤝