Is it recommended to use a VPN, DNScrypt, I2P Protocol, orbot and private DNS simultaneously for acessing the Tor Browser? Or are there any potential risks? Fyi, I don’t care about speed degradation at all.
PS:
I use invizible pro app which has options like:
For VPN, I use IPVanish, Proton or Windscribe
And Nextdns as Private Dns
From the details given, I have the impression that you are kind of just throwing all of the possible IP obscuring tools and DNS privacy tools at an undefined problem.
I don’t personally know what the potential risks and downsides of trying to use all of these things at the same time would be, but unless you’ve really thought through the potential risks and unintended consequences, and unless you’ve thought about all the potential ‘unknown-unknowns’ introduced by the added complexity, it seems to me that the costs (potential footguns and added points of failure from added complexity) would outweigh the benefits (unless possibly you have a clear and specific unstated goal in mind).
Could you reframe your question in terms of your goal/objective, and how your proposed combination of tools helps achieve that objective (better than Tor Browser on its own, or VPN → Tor Browser)?
I have seen that people say, “Even you use vpn over tor, its not very secure”, “use this, use that” kinda stuff. So, I would like to use Tor browser at the highest level of anonimity and security along with privacy. It’s my objective and speed degradation or complexity are not at all problem.
I think this community may not the best place for advice on that if that is truly your objective and part of your threat model. Not saying its wrong to ask here, and I actually enjoy discussions focused on higher threat models, but I think you are much more likely to get good specific advice from the Tor Project, Tails, and Whonix communities (and more importantly reading the documentation these projects provide), there are a couple other places that are more focused on anonymity and opsec for extreme threat models that can be found.
Personally, as a non-expert–I think that throwing a bunch of tools towards the task is unlikely to meaningfully improve your privacy (and could unintentionally degrade it) compared to an on-the-beaten-track solution that has been thought through by experts in that field, and used in the wild (e.g. (1) Tor Browser < (2) Tails or (3) Whonix, with or without a VPN).
I also think (possibly wrongly) that if you truly are looking for *“the highest level of anonymity and security along with privacy” you shouldn’t be considering a phone for that at all. A stripped down desktop/laptop with Whonix or Tails seems like a much better starting point, and only diverge from the recommended configurations if absolutely necessary and to solve specific problems.
In my very limited experience, it seems that for those whose lives or freedom truly depends on higher levels of anonymity than Tor can provide typically rely more on a combination of physical/real-world, and opsec strategies to do so and bespoke approaches to obscuring their physical and virtual location (most of which are tedious, a few of which are illegal and/or unethical).
Examples would include:
Most of the popular apps that provide DNSCrypt support, such as RethinkDNS and invinzible pro, harm you.
You’re adding another trusted party that can view what sites you visit through tor, since the exit node can always correlate the IP address with the DNS record with reverse DNS lookup. On top of that, it ruins your anonymity by fingerprinting your sessions. With DNSCrypt, not only the exit node and the DNSCrypt server owner can cross-link your Tor sessions, but the websites you visit because of the DNS fingerprinting. TL;DR the websites you visit can determine the DNS Server you’re using. DNS leak test
With VPN, you’re simply shifting the informed party from your ISP to the VPN provider and the T1 ISP it operates under, which is a good thing if you ask me.
Same applies for VPN. You should always use the included DNS server of your VPN service, given that it has no dns leaks. If you want to filter connections - filter them locally via RethinkDNS in Simple mode.
How does the owner of the DNSCrypt server know that you are using Tor? You are just another regular user. You can also hide your IP from the DNSCrypt server by using anonymised DNSCrypt relays, ODoH, or DNSCrypt over Tor.
On the other hand, if you use Tor DNS, you are actually using the DNS of the Tor exit node. So the exit node will see your encrypted traffic if you’re using https, which it can’t modify. And unencrypted DNS, which can be spoofed. All your data is in one place. So using that data, a malicious exit node could potentially perform a MITM SSL Strip attack. Whereas DNSCrypt prevents this from happening. You may have heard the old story of cryptocurrency being stolen by malicious Tor nodes a few years ago.
Because Invinzible Pro routes the DNSCrypt traffic through Tor lol.
You can, but this stupid thing doesn’t protect you from being tracked, and you’re adding yet another informed party. It’s funny to see you ignore the most crucial parts of my message. Once again, the exit node knows what websites you visit, regardless of the DNS requests.
Tor Browsers, modern browsers & applications in general enforce https. SSL Strip is a meme long gone.
We have CA for that reason.
All your DNS requests are in one place. You’re simply shifting trust.
The DNSCrypt server can spoof the DNS responses, which is apparently bad in your world.
Modern MiTM attacks are very complicated, rely on CA flaws and are done on other end. Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service —
Security experts themselves recommend using Tor if you fear MiTM. Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
No unless you configure it to do so.
Certainly. But it cannot alter your unencrypted DNS if you are using any DNS encryption method.
SSL strip attack can be used not only to downgrade your https connection, which may be difficult in modern browsers, but also to redirect you to a phishing site. Do you really check every time you browse privacyguides.net or privacyguide.net? Take a look at this fun tool Intercepter-NG, for example.
I don’t trust anyone, neither VPNs that promise they don’t keep logs, nor a Tor node with an unknown owner. I only trust technology that can protect me.
It can, but it doesn’t make much sense if you’re only intercepting DNS traffic.
Even worse. If the DNSCrypt owner cooperates with the site owner/exit node/it’s ISP, they will know your IP address.
You lack technical knowledge. Once again. SSL Strip MiTM attacks without user explicitly agreeing to them are impossible nowadays. I’m honestly tired of rehearsing the same stuff. If an exit node tries to MiTM you, you’ll get notified by your browser multiple times. If the exit node drops connections, forcing you to switch to http, it’ll do so regardless of whether you use DNSCrypt or not. You can prevent MiTM from happening by simply not downgrading the connection when the browser pop-up appears. There’s no justification for busting Tor’s anonymity model by letting the websites you visit fingerprint you with DNS resolv. Should i remind you that the websites you query can determine the DNS server you’re using, and that you’re 100% unique and cross-session traceable because of it? You have no idea what you’re doing, just admit it 
I already showed you a way to hide your IP. But you just don’t like anything. This is ridiculous.
Unless you are using the Tor browser with all default settings, you already have a different fingerprint. So it doesn’t matter if you use the same DNS or a different one, as long as you use Tor for the whole device, as in the case of Orbot or InviZible Pro. On the other hand, fingerprinting is not as dangerous as someone wants to present it as long as you follow the simple rules.
There are advanced techniques. I pointed you to Intercepter-NG which can use some of them. A few years ago when I tested it, it worked pretty well for a regular browser. Also keep in mind that the users will just accept the downgrade of https if they are not tech savvy. Do you think Tor is only used by advanced users?
So maybe you can provide solid evidence that SSL Strip attack in any form is no longer possible, instead of insulting your opponent. The more technical details and practical experiments, the better. Or maybe you’re already running DNSCrypt and feel safe from potential MITM attacks, but you’re just afraid to admit it?