The thing about anonymity that a lot of people don’t get is that there is no such thing as 100% anonymous. Vpn makes it more expensive to track you. Tor makes it more expensive to track you. Good opsec makes it more expensive to track you but ultimately, if you’ve got a target on your back, there is no way to be 100% anonymous.

The thing you gotta ask yourself is, what is your threat model ? Are you hiding from LEO on account of torrents or just want some privacy from corporations? VPN is fine. Are you buying drugs on the darkweb ? TOR is fine. Are you selling drugs on the darkweb ? You probably need a more sophisticated masking network mesh. Are you involved in CSAM or run a darkweb market ? Nothing you do will help you, you are going to get caught, that is a certainty.

Don’t go wasting your precious brain matter on developing a leak free network. There is no such thing. If someone wants badly to track you down, with enough money, they will. Best you can do is be a little bit more trouble than it’s worth to spend on you. For some things, like i mentioned before, there is a cutoff point where you’re as anonymous as you’ll ever be. For others, there is basically unlimited resources to track you. Even using TOR, they can get you at your entry node, like it has happened before, if no one else in your neighborhood is connected to TOR.

you can use bridges even with as simple vpns as calyx or riseup

What about the fact that many large VPNs are owned by (the same) ad companies / data mining companies? Despite the technical discussion, aren’t we ultimately placing our trust in the hands of the untrustworthy?

Maybe if you can to through 2 VPN servers?

Like ProtonVPN and their “Secure Core” feature where it goes to first a VPN server in a country with higher privacy protections (like Switzerland, Iceland, etc.), then it goes to any location of your choice, I like to pick US, Canada, or UK, so websites always appear in English.

Its much harder to unmask a Secure Core connections with Switzerland --> United States, for example.

(Not sponsored, and other providers may also have such a feature)

It makes a lot to coordinate a timing demask. Those VPN nodes are busy. You also need to be monitoring very close to the in/e-gress which means you’re going to need ISP or data center cooperation.

Doing this to tor is a little more approachable, because you can run tons of exit nodes* in your own data center. If you throw enough money at the problem it’s possible to greatly raise chances to keep the entire conversation in your own data center.

The thing is none of this is trivial. And it’s *probably not a good candidate for automatic. So you’re really going to have to have pissed in somebody’s wheaties sufficiently to become a target.

If you’re doing anything that’s prison term illegal, All bets are off that a VPN will sufficiently protect you by itself.

deleted by creator

Some VPNs allow multi-hopping, similar to Tor. I couldn’t give you an exhaustive list but most popular ones support this. Mullvad and Proton do, for example. There are also strategies to add noise into VPN traffic.

This is not a silver bullet, of course. Tor has similar problems as you describe if an adversary has visibility into enough nodes. As always, this comes down to your threat model.

On the one hand, I find the advertising of VPNs outright dishonest. On the other hand, I would trust any reputable VPN provider much more than I trust my ISP or cell carrier.

The main defense against VPN timing attacks is to ensure your VPN exit node isn’t somewhere that the same person would have access to as your connecting IP.

That said, if someone runs a website or service where you have a unique login or custom token and they have access to your ISP’s connection logs… a standard VPN will once again give you away. This is why TOR exists.

I generally argue that an exit VPN doesn’t really provide much privacy; the only real services it provides are georelocation and protection against low effort bulk filtering (eg, identifying torrenters or bulk metadata collection).

For everything else, either encryption and third party DNS is enough, or the exit VPN isn’t enough to stop targeted surveillance.

Also, if you have a limited RAM smartphone and your VPN is operating in userspace, then all it takes is for one really large image to grace your smartphone screen for your OS to go into out-of-memory kill mode. What’s it going to kill? The foreground app you’re trying to use, or the background VPN app.

In my experience, the VPN goes down before the browser does. Mounting a swap on your phone is not the worse solution against this, but the UI starts to get really unresponsive.

https://mullvad.net/en/blog/introducing-defense-against-ai-guided-traffic-analysis-daita