4 ms·

So encrypting content as it travels through Tor is generally considered best practice, but how does one get/manage/pay for a VPN such that the VPN itself doesn'

So encrypting content as it travels through Tor is generally considered best practice, but how does one get/manage/pay for a VPN such that the VPN itself doesn't lead directly back to you?

hawkice 12y ago
So, to clarify something: you connect to the VPN, and the VPN connects to TOR. If you do it the other way around (as you point out) it's pretty worthless. If you connect to TOR from the VPN then the most de-anonymized you are going to get is "customer of this VPN provider". As for paying for services such that "customer of this VPN provider" can't be linked to you, I'd look at places that specifically accept bitcoin (I'm not a fan in general, but in this case, it signals their willingness to avoid collecting normal billing data like name, address, cc#, etc.). https://proxy.sh/ https://proxy.sh/ I have no affiliation but they popped up in the googlings. Seems to be simple enough to get their service without giving away anything personally identifiable. EDIT: the reason I tease out those two parts is because I'm concerned people will think TOR can protect against entities that can do a global customer-of-VPN dereference. TOR doesn't protect against global super-adversaries, consult your local security practitioner before feeling safe, etc. etc.
- onewaystreet 12y ago
  VPN -> TOR is wrong. Think about what happens if the VPN gets owned or seized. The bottom line is if your need for anonymity isn't just fantasy (i.e. you are actually a target of law enforcement) then no layer of your protection should be an IP that is connected to your real identity or location.
  - escapologybb 12y ago
    I am unsure at this VPN -> TOR notification, would you mind clarifying it for me please? At the moment if I start up my VPN client and wait for the connection to my very trustworthy VPN provider, and only then open to Tor Browser Bundle, is that the right way round? Thanks for the clarification.
  - bluedino 12y ago
    That's at least another layer for the people trying to find you to go through.
- chatmasta 12y ago
  Anonymous VPN is pretty easy. Bitcoin, or if not, VCC is all you need.
mcintyre1994 12y ago
My immediate thought is cryotocurrency. You could probably lose direct links quite easily by using some sort of tumbler process - that should stop the trivial tracing back route. Bitcoin is not strictly designed to be anonymous but I do wonder whether something built on bitcoin or another crypto will achieve that in the near future.
elif 12y ago
There are dozens of vpn providers that are not based in the US, who accept bitcoin and don't even require an email address for an account. Many of them proudly do not record logs, let alone retain them. TorrentFreak did a really good comparison of them recently: http://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ http://torrentfreak.com/which-vpn-services-take-your-anonymi...
- e12e 12y ago
  Bitcoin isn't anonymous (it's not a design goal, either). It might be pseudonymous, but that depends entirely of how you acquire bitcoins in the first place. Second, "no logs"... well: https://www.bestvpn.com/blog/8383/earthvpn-user-arrested-cops-find-logs/ https://www.bestvpn.com/blog/8383/earthvpn-user-arrested-cop... Good luck with your "no logs" operation in any NATO member/friendly country. Not sure about Russia and its allies, but I expect you'd be hard pressed to achieve "no logs" in China as well. South-Africa and Israel is probably out too. Not sure what that leaves you.
  - leshow 12y ago
    bolehvpn is based in malaysia
newaccountfool 12y ago
Use bitcoin, pay for the bitcoins with cash. Or buy a VPN and use a giftcard to pay for it. When connecting to the VPN, use a public WiFi or a WiFi without a password, use a long range antenna so your very far away.

So encrypting content as it travels through Tor is generally considered best practice, but how does one get/manage/pay for a VPN such that the VPN itself doesn't lead directly back to you?

hawkice 12y ago

So, to clarify something: you connect to the VPN, and the VPN connects to TOR. If you do it the other way around (as you point out) it's pretty worthless. If you connect to TOR from the VPN then the most de-anonymized you are going to get is "customer of this VPN provider". As for paying for services such that "customer of this VPN provider" can't be linked to you, I'd look at places that specifically accept bitcoin (I'm not a fan in general, but in this case, it signals their willingness to avoid collecting normal billing data like name, address, cc#, etc.). https://proxy.sh/ https://proxy.sh/ I have no affiliation but they popped up in the googlings. Seems to be simple enough to get their service without giving away anything personally identifiable. EDIT: the reason I tease out those two parts is because I'm concerned people will think TOR can protect against entities that can do a global customer-of-VPN dereference. TOR doesn't protect against global super-adversaries, consult your local security practitioner before feeling safe, etc. etc.

onewaystreet 12y ago
VPN -> TOR is wrong. Think about what happens if the VPN gets owned or seized. The bottom line is if your need for anonymity isn't just fantasy (i.e. you are actually a target of law enforcement) then no layer of your protection should be an IP that is connected to your real identity or location.
- escapologybb 12y ago
  I am unsure at this VPN -> TOR notification, would you mind clarifying it for me please? At the moment if I start up my VPN client and wait for the connection to my very trustworthy VPN provider, and only then open to Tor Browser Bundle, is that the right way round? Thanks for the clarification.
- bluedino 12y ago
  That's at least another layer for the people trying to find you to go through.
chatmasta 12y ago
Anonymous VPN is pretty easy. Bitcoin, or if not, VCC is all you need.

mcintyre1994 12y ago

My immediate thought is cryotocurrency. You could probably lose direct links quite easily by using some sort of tumbler process - that should stop the trivial tracing back route. Bitcoin is not strictly designed to be anonymous but I do wonder whether something built on bitcoin or another crypto will achieve that in the near future.

elif 12y ago

There are dozens of vpn providers that are not based in the US, who accept bitcoin and don't even require an email address for an account. Many of them proudly do not record logs, let alone retain them. TorrentFreak did a really good comparison of them recently: http://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ http://torrentfreak.com/which-vpn-services-take-your-anonymi...

e12e 12y ago
Bitcoin isn't anonymous (it's not a design goal, either). It might be pseudonymous, but that depends entirely of how you acquire bitcoins in the first place. Second, "no logs"... well: https://www.bestvpn.com/blog/8383/earthvpn-user-arrested-cops-find-logs/ https://www.bestvpn.com/blog/8383/earthvpn-user-arrested-cop... Good luck with your "no logs" operation in any NATO member/friendly country. Not sure about Russia and its allies, but I expect you'd be hard pressed to achieve "no logs" in China as well. South-Africa and Israel is probably out too. Not sure what that leaves you.
- leshow 12y ago
  bolehvpn is based in malaysia

newaccountfool 12y ago

Use bitcoin, pay for the bitcoins with cash. Or buy a VPN and use a giftcard to pay for it. When connecting to the VPN, use a public WiFi or a WiFi without a password, use a long range antenna so your very far away.