I was recently asked for advice by someone who is concerned about the unintentional leakage — or very intentional discovery — of her personal information online; specifically, she was wondering if she should use VPN. Her intended use of the Internet is using social media sites, such as Twitter and Facebook. I am no expert in this area, but below is what I am going to tell her. If you are an expert and have any corrections of, or additions to, the content of this article, please do let me know.
The Short Answer
The shower answer is use the following:
… and make sure you access whatever sites you want to visit via HTTPS (formerly known as “HTTP over SSL,” now “HTTP over TLS”), not HTTP.
Tor was designed for anonymous communication. It implements it by directing Internet traffic through a free, worldwide, volunteer overlay network consisting of more than seven thousand relays.
You have to anticipate some slowdown of your Internet connection speed when you use Tor. This is unavoidable given how Tor works.
Many potential weaknesses have been identified about Tor. One of them is that (with Tor alone) the “exit node” (the last node from which your data leaves the Tor network) sees your data in the clear, i.e., decrypted. So if that node is compromised, your data is up for grabs. Also, the communication between the exit node and the target site is not encrypted. This is why you’d want to use HTTPS in conjunction, because it provides end-to-end encryption and thus also covers the last leg of the trip of your data.
Later in this article I will discusses whether you want to use VPN instead of Tor and/or in tandem with Tor.
Use A Dedicated Computer
If anonymity is very important to you, I strongly recommend using a dedicated computer just for it. You could potentially use your PC or Android device for your usual use and use Tor on it only when you want added anonymity, but this is prone to human errors. It would be best to completely separate the two worlds. If you do not have a spare computer lying around, then you’d have to make do with whatever you have got.
There exist a group of operating systems called “Security-focused operating systems.” Some can boot from a USB memory stick, so this might ultimately be a better option if you have a PC than trying to be anonymous on your regular OS. See, for example, “Linux distributions built for security and anonymity – BestVPN.com.”
I would avoid using a smart phone for this purpose altogether. Smart phones collect way too much personal information, and that data is often constantly sent to various servers.
Depending on how serious you are about anonymity, I would also recommend you have your computer connect to the Internet using a public Wifi service, for example, at a coffee shop or a library, not through your ISP. But then you will want to make sure that the facility will not give hints as to where you are. Yes, the road to anonymity is not an easy one.
Which is better, Tor or VPN?
If you were to choose just either one of Tor or VPN, which would be better? It seems that, generally speaking, Tor is better. The Wikipedia entry for Tor states, citing a study in 2009, that Tor and the like are “considered more resilient to website fingerprinting techniques than other tunneling protocols.” It adds:
The reason for this is that conventional single-hop VPN protocols do not need to reconstruct packet data nearly as much as a multi-hop service like Tor or JonDonym. Website fingerprinting yielded greater than 90% accuracy for identifying HTTP packets on conventional VPN protocols versus Tor which yielded only 2.96% accuracy.
Will Combining Tor with VPN Help?
Okay, so Tor is better than VPN, but is there any added benefit to combining the two? This seems to be a debatable issue.
Before we delve into this complicated issue, it is worth noting that some argue against the use of commercial VPN services in general. The author of “Don’t use VPN services” contends you shouldn’t use commercial VPN services in the first place (with Tor or otherwise). His reasoning behind this argument is more political than technological. VPN service providers can log your activities (depending on their jurisdictions, they are legally bound to) and they can submit that data to the authorities. His argument appears compelling in the light of such a case of a well-known VPN service provider which led to an arrest of one of its users. The author’s advice is to set up a VPN server yourself if you really need one.
There can be two ways to combine Tor and VPN: i) Tor through VPN, and ii) VPN through Tor. This is where I have to admit it gets beyond my comprehension. I understand how the former works, but I cannot say the same about the latter. So the rest of this section is therefore mostly based on “hearsay” — I cannot personally judge if it is true or not.
An article by a VPN provider, “TOR Over VPN & VPN Over TOR: Which is Better? | BolehVPN Blog,” compares the two as follows:
connecting to TOR through a VPN generally offers higher security, while connecting to a VPN through TOR generally provides better anonymity.
The former, Tor through VPN, seems a no go given the fact that the VPN service provider knows your real IP address.
Now as to the latter, VPN through Tor, I do not understand how it works as I said earlier. It appears tricky to set up, and AirVPN is the only commercial VPN service provider that allows this kind of setup.
ExpressVPN, a VPN service provider that does not support Tor through VPN, maintains that they do not because it does not offer any added anonymity. However, it appears that there is indeed added level of anonymity, judging from such articles as “Tor and VPN: how well do they mix? | TechRadar” and “5 Best VPNs for Tor 2018 | Guide to Using Tor With a VPN.” To me, the VPN service provider not being able to know your real IP address and being exempt from malicious Tor exit nodes sound like logical reasons to choose this setup.
This article is meant for the “light-weight,” i.e., those ordinary law-abiding citizens who just want to be a little more careful about their privacy than average people. When you take a look at the series of articles available at “Jolly Roger’s Security Guide for Beginners – Deep Dot Web,” then you will see the great lengths you’d have to go to cover your tracks if you really want to be discreet.
For example, even if you decide to use a commercial VPN service, you cannot just sign up using your credit card, because it could eventually be a downright giveaway. It would be wise to use one of those cryptocurrencies such as Bitcoin, but how would you get your hands on a cryptocurrency in the first place? Unless you know exactly what you’re doing, you’ll easily find yourself stuck in a chicken-and-egg problem.