first off I apologies for asking a question very similar to other threads that have been posted before, but I did not find the exact answer to my doubts.
What I wonder is the following, in an era with increasingly feasible worldwide communication monitoring and analysis thanks to AI, in a scenario where the adversary is a powerful government or similar, what would be the disadvantage of using a VPN before Tor, given that the VPN is bought with Monero or similar privacy focused methods?
I often see this setup regarded as ‘possible’, but never openly recommended in any official guide. Why is that?
I do understand that if the VPN provider is pressured by a government, it could release the original ISP IP and entry Tor IP, but in what scenario would that not add another layer of protection? In the absence of the VPN an adversary would either start from the ISP IP, and easily get the Tor IP too, or get to the ISP directly if Tor is somehow breached. On the other hand a VPN bought responsibly could add plausible deniability or maybe not even collaborate at all with hostile dictatorships.
Is there any traffic correlation or similar concern that widens the attack surface that I am missing?
Very interesting read, and apologies for my ignorance, but isn’t that just an extra step to identify this setup? Even then I don’t think that the VPN is having any downsides, or am I mistaken?
Hi, maybe someone will respond with more insight, but the query might be better targeted to the Whonix forum:
You can search through with the keyword “vpn” and see what comes up, as this is an area of recurring questions. If you ask a new question, you are likely to be directed to the wiki, which has relevant topics like these:
Maybe take a look and see if you can find your answers there. And if so, do come back here and summarize your findings.
Thanks! You are right I definitely did not chose the optimal forum.
Also yes I read all of that, and yet I did not find ANY credible downside of using an ‘anonymous’ VPN, just vague suggestions. But I will try to get an answer there if I don’t here
Edit: the only thing I found is:
‘On the other hand, in some circumstances this may result in making you, more unique, easier to track because the IP address is known to belong to a VPN provider but only few users are using it.’
But even then, how would it be worse then just using the real ISP IP. I guess only if the adversary starts the research from a VPN log breach or similar.
You want to lower the probability that an adversary can read the traffic between you and your guard node, because packets still contain your real IP address at that point. If you use a VPN before Tor, chances are that you increase that probability and make an attack more likely. Ideally, you trust the guard node, the guard node is close to you network-wise, so that the adversary cannot see your real IP address.
But, if the adversary wants to intercept those package, they either suspect you and have X amount of real IPs to monitor, and in that case they would see real IP > Guard when the right one is picked,
or alternatively they would start from the exit node IP, hypothetically break Tor, and get to the real IP directly.
Isn’t the scenario where the adversary knows to monitor X VPN server and intercept packages, decrypts them, and from that decides to break Tor, near impossible to happen? I guess that would only happen with a honeypot VPN server, or am I missing something?
I do get that this way packets containing the real IP do ‘travel’ more, and increase the chances that they are randomly intercepted, but I guess that de-anonimization attacks on Tor are not random right?
I mean, without a VPN a powerful adversary can always intercept it if they know either the real IP or Guard IP, since they pass trough ISPs no?
Ok I think I understand, it can be an issue depending on network topology, in some cases it could make it easier.
Let’s take:
User > Tor > Goal
and
User > Vpn > Tor > Goal
If the Goal can be monitored, and the adversary can monitor the Vpn location, but not the User ISP for some reason, for example jurisdiction, then it would be worse, as correlation attacks could then happen. But this seems like a very unlikely scenario to me, and given that the adversary is a global observer, this would never be the case, as a VPN is always better then a collaborative or state-owned ISP.
Also an user that often changes real IP networks, but re uses the same VPN profile, would also increase the attack surface.
So this is not my field of expertise and I might be missing something very obvious, but given the threat model of an adversarial global observer, and a securely acquired VPN, I do not see the possibility of worsening security, if anything internet speed would be reduced for questionable benefits, right?
interception points are commonly considered to be relatively static. Think about interception points as Internet exchanges, ISPs, or nation states that collaborate with (or represent) the adversary.
If the adversary knows your IP and they have means to observe your traffic, you’re out of luck. Same if the adversary knows your guard’s IP and they have means to observe the guard’s traffic.
If you ISP is adversarial, I’m afraid you’re out of luck, no matter how many VPNs or Tor you put there - no low latency anonymization tool will provide reasonable protection.
If your adversary truly observes all traffic globally, you’re already out of luck, no matter what you do. Adversaries are commonly modeled to have at most partial views of the Internet. Now if you use a VPN, it is very likely not in the same network as you are. They might even be in another country. So packets travel through multiple ISPs, Internet exchanges, and countries - plenty of chances to pass an observation point of your adversary.
Maybe you can think about guard nodes and VPN (before Tor) in a similar way. Against network adversaries, both need to be trustworthy and as close as possible to you network-wise. If they are, they provide the same protection, and you’re good. So, a (trustworthy) VPN in the same network as you are, will provide better protection against a network adversary compared to a guard node at the opposite end of the world. Similarly, guard node in the same network will provide better protection against a VPN endpoint that’s far away. The choice of your first hop is crucial, not whether it is a VPN or a guard node.
So, a (trustworthy) VPN in the same network as you are, will provide better protection against a network adversary compared to a guard node at the opposite end of the world. Similarly, guard node in the same network will provide better protection against a VPN endpoint that’s far away. The choice of your first hop is crucial, not whether it is a VPN or a guard node.
I found this interesting, thanks. So did I understand you, do you specify somewhere in torrc or somewhere to make your first hop in your country (or closest) or a known, trusted guard? Or try to get a VPN server as physically close to you as possible? I always assumed to choose one in a privacy respecting country where VPN providers or ISPs would have better data protection laws. I see your logic but then there is the fact that many people use a vpn to escape the 1st hop being in their draconian oppressive country.
yes, you can use the EntryNodes directive for that.
yep, and that’s fine in such a scenario. You just need to be certain that your adversary is not capable of observing the traffic between the VPN and the destination too; otherwise correlation would be trivial for the adversary and the VPN won’t protect you.
