# Clarify Tor's weaknesses with respect to observability **URL:** https://discuss.privacyguides.net/t/clarify-tors-weaknesses-with-respect-to-observability/3676 **Category:** Guide Suggestions **Tags:** completed **Created:** 2022-10-21T02:45:19Z **Posts:** 22 **Showing post:** 14 of 22 ## Post 14 by @jonah — 2023-11-08T18:44:58Z **Edit 11/29:** I ended up publishing a video response to Mental Outlaw basically covering the stuff in this post. > **[Don't Stop Using Tor with VPNs](https://www.youtube.com/watch?v=vo22D-dUeCA)** > > In which I respond to Mental Outlaw's "Stop Using Tor With VPNs" video that somebody shared with me, and also talk more about Tor security...❤️ Support the w... * * * Thanks for sharing! It’s very close to being a good video :slight_smile: I’ll respond to every point he makes here for future reference, ~~I might make a response video to him since I’m already writing on the subject anyways.~~ **1:08** - He says that Tor doesn’t recommend the use of Tor with a VPN. - In reality (and as his screenshot shows), Tor _does_ acknowledge that a VPN _can_ be used with Tor without compromising privacy. As stated [earlier](https://discuss.privacyguides.net/t/clarify-tors-weaknesses-with-respect-to-observability/3676/5) in this thread, Tor also acknowledges the benefits of using a VPN to stand out _less_ on your network. - Tor makes the suggestion to only use Tor because it simplifies their advice and makes the network easy to use. This still doesn’t change the fact that using a VPN with Tor provides additional protections which Tor inherently can not, so it doesn’t stop us from covering the real benefits of VPN+Tor. **2:42** - Minor nitpick but he claims Tor changes your whole relay every 10 minutes which isn’t true now that [entry guards](https://support.torproject.org/about/entry-guards/) exist to protect against the very threat he’s describing here. **3:11** - He brings up threat modeling :smile: and then he immediately tells people that there are only two valid threat models :sob: - He says that the only people who need to hide Tor usage from their ISP are: - I believe that it’s fair to say there are plenty of other, real-world situations where you would want to hide your Tor activity from your ISP or network administrator which are not government-related at all. ## People in countries which block Tor **3:44** - Here he covers folks in countries like Iran/China which block network connections. - :white_check_mark: This is true, and is the reason I state in my draft that… **4:08** - He conflates the idea of _blocking_ bridges and _identifying_ bridges here. - Bridges **are** fairly decent at circumventing censorship, because they are unpublished and make efforts to obfuscate the fact that they are indeed Tor bridges. However, these are only transient protections because Tor bridges are virtually always **eventually** identified and blocked. For the next minute he goes further into why a VPN won’t bypass censorship in the same way bridges can, and we agree on those facts. However, I will point out that at the same time there are also plenty of real-world network censors who _do_ block Tor and _don’t_ block VPNs, so it’s not like a circumstance where a VPN is a valid censorship circumvention technique is inconceivable. I would still suggest that people _try_ to use a VPN to bypass censorship, and explore other options if that isn’t feasible on your specific network. ## People doing crime **5:25** - Here he covers folks who are likely to be targeted by law enforcement. We can agree that opsec failures are much more likely to be the reason criminals get caught rather than network analysis. Not much to say here… **6:57** - Then he says that using a VPN to connect to Tor will make you stand out **more** , and this is where the argument falls apart a bit: **7:08** - He claims that entities like Interpol are _Global Passive Adversaries_, not using that term but he describes them as if they are. This is maybe a common misconception but is very untrue and borders on conspiratorial thinking: - A “Global Passive Adversary” (GPA) is an entity which can monitor the network traffic of every Tor node, every VPN, and every ISP. **7:18** - …so given all of that he makes the point that if a GPA sees traffic between a VPN and Tor, that traffic will be extra suspicious. - In a situation where a GPA exists, Tor does not protect you, Tor+VPN does not protect you, you are not protected and we state as such in the guide: - Let’s assume a GPA doesn’t exist though, and they’re doing this investigation after the fact. The ability for a law enforcement agent to determine that a VPN user connected to Tor hinges on either your VPN collecting logs, or the law enforcement agency to already be monitoring traffic from that VPN. **9:36** - He claims you will stick out like a sore thumb because you’re connecting to Tor via a VPN, and most Tor users connect directly to Tor. - Again however, this hinges on a—frankly absurd—idea that they can tell that you’re connecting to Tor via that VPN because they’ve broken the encrypted tunnel and can read your traffic. This is an unrealistic scenario he’s posed, but there are a few semi-realistic (not really) scenarios where an observer on your ISP could tell that you’re connecting to Tor via a VPN: - Secondly, you know what else makes you stick out like a glow stick? **Connecting to Tor!** **10:27** - Anyways, his overall recommendation is to use Tor to blend in with other Tor users on your ISP, which is certainly a nice thought. - As I said before, if we all lived in a perfect ideal world this could be good advice, but this suggestion ignores the reality that Tor use simply is not common or non-suspicious in the first place, and Tor traffic is flagged by nearly every firewall or logging device that your ISP might use. - It’s a shame that he brought up threat modeling once in the video and then ended the whole thing with a black and white “don’t do this” recommendation. * * * ## Response to YouTube comments I’ll also respond to some of his confused commenters: I see some YouTube commenters claim that using a VPN with Tor makes you stand out more because you’re sending your network traffic through 4 hops. - This doesn’t make sense because of how Tor is designed, and you can figure this out with 5 seconds of thinking about it. If you could stand out on the Tor network based on what your network looks like **before** the entry node, that would obviously defeat the point of Tor in the first place, because you could be fingerprintable based on ISP configuration. Using a VPN before Tor should not increase your fingerprintability to either the destination or to Tor relays. I also see people make claims along the lines of “your VPN acts like a permanent guard node.” This doesn’t make sense, because you still have an actual guard node protecting your ingress into the Tor network. - By this logic, your ISP would be acting as a “permanent guard node” too, which obviously is not a real issue. Your VPN replaces your ISP, not any Tor nodes. - The reality is that whatever happens **before** your Tor entry node cannot be detected and fingerprinted by observers on the Tor network or at your destination. I addressed this earlier too, but I just want to reiterate that as long as your last three connections are through the Tor network, you’re not _losing_ any benefits of the Tor network. Luckily I also saw a decent amount of comments explaining why his video is not the greatest advice too. * * * ## Regarding protestors & criminals I was disappointed he didn’t go into protestors and other dissidents much, I think it is probably the most obvious example of when using a VPN with Tor **does** make sense. In situations like that you’re likely dealing with surveillance states who don’t _censor_ traffic. This is also the situation where VPN usage among the general population will likely be very high for a variety of reasons, and will arouse much less suspicion from network monitors. Again, in other situations with actual _censorship_ of VPNs and Tor, that isn’t what this recommendation is geared towards anyways. The other thing I want to add is that the reason it may appear that I/we are defending criminals with this advice is twofold: 1. It’s newsworthy when criminals fail at privacy, and court cases are well-documented, so there are simply more real-world examples to point to when explaining privacy failures. This does not mean that criminals are the only people who need stronger privacy protections, it’s just that when the average person’s privacy protections are broken the impact isn’t necessarily shared with the rest of the world. It does not mean that the impact in non-criminal real-world situations doesn’t exist. 2. What’s lawful in one country is criminal in another, and there are a lot of gray areas where it is almost certainly morally acceptable and even encouraged to break some laws in especially repressive countries, so the knowledge on how to do so is still fairly important. So basically despite all this theoretical talk about “evading law enforcement,” this advice isn’t intended for _actual_ criminals to evade law enforcement. The reader is intended to take these examples and find out ways they might also apply to their regular, every-day life :slight_smile: --- _[View the full topic](https://discuss.privacyguides.net/t/clarify-tors-weaknesses-with-respect-to-observability/3676)._