asking for the kind that vpn hides tor and not the other way
i have a framework with whonix in qubes using tor browser (real one i think not brave) and idk if im safe.
i want to use wifi in public (food places and schools) and be hard to spy on and not have anything blocked (videos are blocked). my home network is also phoning home because my family is using a google wireless access point (cant change this (
would vpn and tor fix this? should i pick just one? or is there a better way? (all things have to be on device since you cant change someone elses network) (this includes vlans)
Videos (assuming you mean YouTube) will get blocked using Tor. So just use a VPN. Sounds fine for your threat model. If you want Tor in there too for some reason, and is doesn’t sound necessary, you’d want Tor > VPN, that way your exit node isn’t a Tor one.
Just point your clearnet browser Qubes to route through a sys vpn Qube and you’ll be right.
Therefore, you should make an effort to hide your IP address before connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing Tor as normal (e.g., through Tor Browser). This creates a connection chain like so:
You → VPN → Tor → Internet
From your ISP’s perspective, it looks like you’re accessing a VPN normally (with the associated cover that provides you). From your VPN’s perspective, they can see that you are connecting to the Tor network, but nothing about what websites you’re accessing. From Tor’s perspective, you’re connecting normally, but in the unlikely event of some sort of Tor network compromise, only your VPN’s IP would be exposed, and your VPN would additionally have to be compromised to deanonymize you.
This is not censorship circumvention advice because if Tor is blocked entirely by your ISP, your VPN likely is as well. Rather, this recommendation aims to make your traffic blend in better with commonplace VPN user traffic, and provide you with some level of plausible deniability by obscuring the fact that you’re connecting to Tor from your ISP.
We very strongly discourage combining Tor with a VPN in any other manner. Do not configure your connection in a way which resembles any of the following:
But what if you want to access a clearnet site that blocks all Tor connections and at the same time, want to have a technical guarantee that a company can’t hand any information over? You could live in a Western country where accessing Tor is not an issue at all, but if the service you are trying to access blocks Tor traffic, you have to use a different exit IP.
I’d take a step back from tutoring others for now. You’re proposing something something dangerous.
Routing clearnet browser through VPN qube is just forced VPN. Tor isn’t being used here at all.
You the only situation where you’d want VPN behind exit node is if you have access to anonymous free VPN that accepts connections from exit node. But those are practically always data mining operations. No free lunches. Even if you bought mullvad with cash, the wireguard VPN’s private key ties sessions together. So your actions online can eventually deanonymize you.
E.g. the largest set of sites you visit periodically can very probably be unique to you. It doesn’t matter if you buy your VPN with Monero, the VPN works the same way: They have a unique account number for you, and a set of wireguard keys associated with that account. They see the IPs you connect to, TLS’ SNI is an unencrypted header (that’s finally changing with encrypted clientHello this year), and they very much want to protect your DNS queries, by doing those for you, meaning they’ll get the data instead.
Is there any particular reason to hide this from your school and people on public wifi you need Tor in the mix? I’m not saying necessarily don’t do it but just curious why.
VPN. But under the threat model of VPNs, i.e., don’t assume it’s as private as using some site would be under Tor. If your threat model does not allow this, use another site or try to solve the problem another way.
Alternatively if the site blocks VPN and you need stronger assurance than VPN, there’s still the option for wardriving for unprotected wireless access points, or poorly protected ones. Maybe some relatively distant cafe doesn’t update wifi password every day. Maybe it’s reachable with cantenna in your backpack. Don’t forget to adjust your MAC address beforehand with macchanger and leave your phone home.
Also, whatever you do, do NOT set your WiFi location region to something like Bolivia to have maximum power and range and thus best anonymity. That’s illegal unless you live in e.g. Bolivia. The wifi tx-power police might arrest you on the spot. You have been warned.
Yeah so this guy is just trying to watch some videos on the clearnet that are blocked, maybe because of Tor exit nodes, or maybe because of the country he’s in. In any case it doesn’t sound like he wants to use Tor for the purposes of absolute anonymity, just to be able to access the content and possibly hide some data about what he’s watching from the network. So to me anyway, a VPN does sound like an appropriate option, if not the most appropriate one. I could be wrong maybe he does need more certainty.
Those other methods are of course possible, but I highly doubt this dude is gonna wardrive around, leaving his phone at home, with a cantenna to capture and brute-force WPA-2 handshakes.
Yeah cantennas aren’t that relevant to most people. VPN sounds like an option but YT tends to block VPN unless you sign in. So it may boil down to annoying quasi-spycraft to at least get a relatively anonymous Gmail account first.
The nasty part is Google might be running its own program to try to get a good confidence score for who is behind the account and below some threshold, it might just require strong identification, or email for another service who knows who you are, or who has more data points.
Also note that brute forcing WPA2 keys is rarely an option these days nor would I recommend that. It’s probably a felony.
Yeah they can be aggressive. I watch YouTube every day using Mullvad VPN though (not signed in). Once you find which servers work you can bookmark them and it becomes easy. You can watch it through Mullvad browser too.
Mullvad VPN plus browser plus randomized per domain proxy is probably the best way to go about it, outside of some crazy Tor to VPN chaining. There’s always Newpipe too.
It depends on the VPN. If YT is blocked, just switch servers.
Other alternatives would be a public Invidious front end, or even just searching with DDG as the proxy and playing the video from there. That being said, it’s also likely that OP doesn’t want to watch content on YT specifically, and it’s more about if the site is blocking Tor connections or not.