Governments outlaw activities which are perfectly moral. Law is always claimed to be based on morality, however inaccurately. Laws can be immoral laws, even when they pretend to encode morality.
I don't think laws are based on morals, they are based on order. It's just morals is something that often times people can agree on to follow and thus result in order. There's plenty of immoral things that are legal because they are unenforceable and plenty of moral things that are illegal because it's right next to something that would disturb public order, even though following that law to the letter wouldn't cause a problem. Like having a lot of controlled substances that can be used to make meth isn't immoral or harmful as long as you don't make meth, but it makes it a lot easier for people to make meth so it's illegal despite being directly harmless.
@@AWanderingSwordsman laws still exist because of morals. Even though things that are prohibited by law aren't necessarily directly immoral and vice versa, in the end it's still morals that are the reason for these laws to exist. Therefore they are still based on morals
I agree completely. When Mental Outlaw said that connecting to tor looks less suspicious than connecting to a VPN I already knew the argument was ridiculous. It’s just the fact of the matter that connecting to Tor looks WAY more suspicious than connecting to a VPN Even my mom who knows nothing about technology uses a VPN for work, and I guarantee there are thousands of people who DO use a VPN + Tor and not “so small you could count them on two hands” like M.O. also says and I highly doubt law enforcement are using “quantum computers” to crack every single one of them on the belief everyone who does this is a super criminal I do not believe booting up a VPN and then connecting to Tor makes you any more suspicious than straight up connecting to TOR in the first place. Also, without a VPN your ISP now knows *YOU* connect to TOR on a regular basis
@@Bottleopnrthat's what I was thinking, isn't a TOR bridge literally designed to do the exact same thing? Without getting some fedcucked company involved in your traffic.
@@thelaundryman9287 yep. When you log onto tor over a bridge, it shows the ISP as a different url link such as Bestbuy, vacations, animal stores…. Etc. without having to jump through extra hoops
@@thelaundryman9287The thing is: everyone who uses Tor bridge uses Tor, but few who use VPN use Tor, so you blend in more. It's not certain that you use Tor because you used VPN sometime, but it is certain that you use Tor if you used Tor bridge sometime. Using Tor Bridge inside a VPN is the right choice, as neither the provider nor the VPN knows that you use Tor.
Great video. If you add torrent traffic and put a website in the background streaming video, wouldnt that help in obfuscation because the encrypted tunnel blends/multiplexes multiple data streams and sends it to you, which means that the fixed tor packet can be added to another streaming packet thereby obfuscation. Your thoughts?
That should certainly make the traffic more difficult to distinguish 👍 I would still prefer using a bridge which obfuscates the Tor traffic itself via obfs4 inside the VPN tunnel if this is of great concern to you though. You can always make use of all these techniques :)
@@jonaharagon thanks again. There is so much misinformation on reddit forums about this that it's reached cult status. Unnecessary alarm bells about using tor over vpn. Somehow people are forgetting logic and reasonable arguments and instead getting behind the "Thou shall not use a vpn+tor" decree from other coneheads.
There's a point I wish you had covered. What are the implication of using Tor with a VPN when that VPN is paid with a credit card? That's undeniable identifiable information that can be linked to that traffic. Whereas, not using a VPN, it's only known to the ISP that Tor traffic comes from a given network but not exactly from whom on that network (unless I'm misunderstanding something in how it works). There would seem to be more plausible deniability when not using a VPN in that case.
You probably already pay for your internet with an identifiable transaction (CC, bank transfer) or provide personal information while getting a connection installed. If you pay for a VPN with a CC you're no worse off than using a direct connection.
@@wi0lono There's typically more users sharing a local network than there are on a single VPN account which gives more plausible deniability in that case. It's true that, in a worst case scenario, when you're alone on your own network using Tor, possibly in a country that bans it, then a VPN is an obvious choice. In other cases, where you're sharing a network, maybe not even your own, it seems to me that not using a VPN could be better. Although I'm not sure if that's the case which is the reason of my comment. Both options, using or not a VPN, seem to have their pros and cons: trying to hide the traffic itself vs. trying to hide the origin of that traffic, each option compromising on the other.
@@Zatmos I mean in the case of 95% of the networks you're connected to you're either the only person connecting to the network or there will be someone who'll be aware of who _you_ are in that network (friend, network admin). You could try your luck with a public WiFi with little to no monitoring (Starbucks, etc.) but then you need to be in range, which brings with it a bunch of physical opsec issues. Unless I've misunderstood your question, my point is that your origin isn't very likely to be hidden better without a VPN. A VPN at worst can leave you at the same level of exposure (if you use CC) or a bit better (if you don't). That being said, noone can see your traffic on TOR anyway, so you'll have enough plausible deniability unless you live in a country where TOR is illegal as a whole.
@@wi0lono That makes sense. It either doesn't matter when it's legal or it's just too dangerous in most cases not to use a VPN even bought with a CC when it's not. I think you're right. The type of optimal scenarios where you can successfully hide among users in a big network are going to be rare and that strategy doesn't work well on smaller networks. That's not as big a point as I thought it was.
I am very grateful for Tor and people like you that care about integritet and privacy. Without you and guys like you we would not have any thing like Tor, Onion and duckduckgo and much more. Hat is coming off for you.
What is moral can be criminal, or in America, enforced as if it was criminal, like asserting your Constitutional rights in places actively quash these rights, you need all the protection you can get.
A VPN is just the same as your ISP. You're just creating logs at another location. It's like electric cars or solar panels. You're just creating pollution at another location.
@@darrylbaker7162 actually that's a great idea if the cloud provider let you access it with tor and pay with monero, cash, gift card or some private alternative.
VPN differs from an ISP; some don't even keep logs. Even for the ones that do, do your research on which VPN you use; it still makes it harder to track the steps. There is no perfect way, but adding one more possible protection is still worth it. A lot of people use a VPN all the time and have for years.
@@darrylbaker7162 Do you knows any cloud service providers that don't block traffic coming from tor and has anonymous forms of payments like monero, cash, gift card, etc? If there is such a thing like that than it would be a really great idea
Another point is that if enough users start using tor over a particular vpn then even if Tor somehow gets broken, the ip they will see is the vpn. And if the VPN wasn't laying about their logs policy then youre still fine. Worst case scenario it doesnt make it worse either.
I appreciate this, as it confirms a lot of the doubts I had about many of MO's arguments. He seemed to assume that one would only be using the VPN when they were connecting to TOR, rather than always. Perhaps you stick out for always using a VPN, but no packet of yours will ever stick out amongst your other packets. The value in that is limited but still seems obvious. And his "criminals" line was just baffling, as it's basically "good people have nothing to hide", which is an argument against privacy _in general._ If you're concerned with who "should" have access to privacy, you've already endorsed the adversary. He has an odd moralism that undercuts his dedication to privacy and security. It's a bummer that this video has such a small fraction of the views that that one does. I feel like someone somewhere is going to get screwed over by the bad advice.
I have always used a VPN and connected to Tor over it. It makes it more difficult to try and find people, but you also need to only use downloaded files on a sandbox machine. Work networks block Tor, but not all VPNs.
The problem is, that today it seems any citizen is per se a criminal online unless proven otherwise. So the argument number 2 of mentaloutlaw is for us all. Thank you for the video!
Which bridge is the one I should use? Pretty insecure to do any shift from the already installed from installation. Only if there's any help recommended that fits my use of Tor. Also Orbot have installed stuff that I don't touch. Of course I try to read what the most that is for me and my use.
Watching your video just after Mental Outlaw's was a good recommendation by CZcams I would say. I was not comfortable at all after MO gave advice on a different VPN himself after critisizing Network Chuck on this :) I just want to point out my idea on a part of your video. I am not really sure if an ISP would keep a log record of the IP traffic for a long period of time. By long, I mean at least for the time for the discovery of a bridge. If the ISP is not fast enough your data will be erased eventually, so you are safe. It becomes a matter of how much that specific ISP actively blocks Tor and how much they are willing to pay for it. Also, VPN operators are never trustful enough for me as they would happly sell my data for a government claiming my data as illegal in their eyes as all VPNs are already blocked. Adding them might cause a connection to slow down more which is already very slow, making it unusable.
Might have to agree to disagree, but my argument would be that keeping basic logs like IP & timestamp costs them virtually $0 (plain text storage is both very small and extremely compressible), and in my experience it’s very common for *local network administrators* (at workplaces etc.) to keep firewall logs for 1+ years. I don’t have much experience with the inner workings of *ISPs*, but I find it hard to imagine they’d take a very different approach. Looking at the ToS of my own ISP and my mobile carrier, both say they keep network logs for a year. Could be worth checking on your end! :)
also appreciated this as counterpoint/context to the MO video as i've always thought he downplays the fact that there are use cases where vpn+tor is beneficial. as far as recommending mullvad over nord vpn - mullvad is a different breed than most other commercial vpn's as they structure their services to require the minimum amount of trust from the user, i.e. by allowing multiple methods of anonymous payment and not requiring any personal information to activate an account. mullvad is the only vpn i'd personally recommend. even if their no-logs/data-deletion policies turned out to be a sham, you can engage with their service in a way that prevents them from having any meaningful p.i.i. to associate with your traffic. nord is arguably the most corporate vpn provider, which in itself doesn't bode well for their ability to resist court orders, etc (also a complaint i have about proton), but beyond that nord is documented to have given personal information to authorities (come to think of it, same with proton) as well as the fact that nord's "no-logs" policy is a misnomer/half-truth at best. proton is documented to have gotten activist(s?) arrested by turning in information to authorities, and nord is perfectly capable of doing this as well in the unlikely event that it hasn't happened already also just would point out network chuck is sponsored by nord whereas MO doesn't seem to have any affiliation with mullvad beyond recommending them as a legitimate privacy tool
Mental Outlaw only recommended another VPN service for those that absolutely needed it, in the end he still did not recommend using a VPN if you could avoid it
Does anyone know if you can use tor over VPN from a android mobile? As I use the orbot app or invisible pro app and that connects as VPN Orbot has a option to connect via proxy not as VPN so would this let me use VPN also?
I share ISP with 75 other apartments in my building (internet is included in the monthly fee) so the ISP don’t know me. Do you still suggest me to use VPN? Country is Sweden.
Given that there are malicious TOR exit nodes and that you cannot control if your traffic is using one, wouldn't it be better to use a VPN while inside TOR as opposed to TOR inside a VPN?
This way you completely negate the point of using TOR which is anonymization via randomly generated fungible circuits and blending in with the crowd, since you're routing all your traffic through one choke point after all. The ONLY case when this makes sense is if you want to reliably hide your identity from the VPN provider of your exit point, given that you've bought it with anonymized crypto. But why bother with that if you can just use TOR?
Jonah, amazing video! Not only are you very detailed in what you're saying, but it's also in a way where it keeps me interested and engaged. You just earned yourself a sub!
i'm fairly ignorant on this topic but just thinking about it logically... traffic analysis and fingerprinting don't seem like the biggest worry in a real world scenario for the average user. i imagine that amount of effort is reserved for pretty serious criminals like kingpin/major distribution level drug trade, production level you-know-what, trafficking, terrorism? reduce these breakpoints too much and you're talking about tens or hundreds of thousands of people, and the resources simply aren't there. but they've cast a wide net before, and it wasn't traffic analysis or isp/vpn takeovers or kax17's shitload of nodes. it was javascript exploits, forum takeovers/social engineering, media player exploits phoning home. what role does a vpn play in these situations? basically without the assumption of: "they broke tor, so they can break your vpn", which is practically never the actual scenario
i think mo has a point in terms of suspicion levels / pre-filtering *potential* suspects. law enforcement can't track anybody down who is using tor. because there is no single point of contact that allows them to lawfully (court order etc.) obtain your ip / info. in contrast to using a vpn which obviously is a legal entity in form of a company and is a single weak point introduced into the whole equation. it would simply NOT be advisably at all to use either tor or vpn if you know the government controls all isps and traffic and will generally put every single citizen under suspicion for using a vpn let alone tor.. so in non-authoritarian countries ... do NOT use vpn to connect to tor nodes. in authoritarian countries... do not use tor or non-sanctioned vpn services at all! i.e. do NOT try to forcefully circumvent the "official vpns" if you do not want to be visited by evil men in black suits.
This assumes everyone uses the same VPN. In reality there is no single point of contact when you’re using a VPN either, because they would have to obtain data from every VPN provider.
One argument that I have not seen either you or Outlaw address is the fact that ALL ISPs and VPNs (in most countries) have a certain level of logs they must keep by law. Even if those logs are not published or open they can be subpoenaed. Have these laws changed? Are there countries that do not have these laws now offering VPN services? There are documented cases were VPN records have lead investigators to the people they were pursuing. Do you feel this is not the case anymore? Why? Personally it does not matter to me because nothing I do on the internet is illegal were I live. I do not have to worry about my countries LEA busting down my doors because of my political activism. I mostly use tor to avoid being constantly profiled. It does not really matter to me who finds out I use tor. Though I have never trusted VPNs and have read articles about them turning over logs to the authorities. No big deal in my case though I sure to some that would be a concern. Is this no longer a concern? Has something changed that I have not heard about?
I thought you might find it humorous that when I watch your videos youtube autoplay dives right into a Network Chuck video at extreme speed when your video ends. Or maybe it's not humorous; I find it interesting though. I appreciate your channel please keep it up. I'll run all your videos in full on CZcams and let all the ads play through. With all of my identities. This is my actual identity. I have a bunch of really generic "I'm a dumb stereotypical" hackerish pseudonyms. It's possible that I'll try to pick your brain with one of them; I think you'll recall this comment when I do. Feel free to tell me you're not interested. Given your videos I don't think you need to be told to feel free to tell me anything.
This video was so awesome! does anyone have any good tutorials for how to set up a vpn on tails? as a novice it's really frustrating and i'd rather not go on tor for the first time without a vpn after everything i've read and watched.
Do not do any tampering on tails whatsoever. Don't install new software, don't get browser extensions, don't change system settings if you can help it. Tails is made to be as secure as can be without anything else. Any changes will increase your fingerprint and ruin the point of tails.
That really depends on your usage. The biggest thing that Tails gives you is that with the default configuration (and this part is not easy to undo and should not be) every connection to the internet has to go through tor. The reason this can be a benefit is that when you browse to a site, even a onion site, you could download something (a script if you have it enabled) that will make a clear net connection that could compromise you. Tails also operates entirely from memory leaving no information behind (accept what you may have setup in persistent data) so if you are concerned about what might get stored on your computer then this is a use. If you have no concern about information that might be in caches on your computer or whether or not your real IP is disclosed by other connections being made while on tor then you do not need Tails. If you have a reason then Tails would be advised. Keep in mind that just like Tor Tails has its limitations and how you use it could effect your privacy. You could highly customize Tails to do away with most of what makes it useful. Read the documentation from Tails and Tor to see their limitations and what you may or may not need.
Great video Jonah! But get ready, people in the space are really sensitive and are just going to cherry pick segments of your video. Need more long form content like this!
Most criminals get caught because they made other mistakes and were identified. Criminals are generally stupid or get too confident and start making mistakes. Just because you use your VPN doesn't make you any more of a suspect. In general, it is better to use a VPN with TOR.
I can see arguments from a cost perspective. Tor is nice in that it grants people access to the internet indiscriminately, and locking that freedom behind a paywall is unfortunate. It’s certainly better than *neither* Tor nor a VPN. But yes, the reality of the situation is that you are generally better off with a VPN than without, and wishful thinking alone won’t change that.
If cost was the reason someone recommends against using a VPN then I'd expect them to say so, but really no one cares about my expenses if they're not the recipient of my spending. BTW, I really enjoyed this video and never knew that TOR usage could be traced back after the fact using old exit node data. I ignorantly _assumed_ these volunteers kept no data and had no notion that they'd be inspected by TLAs. And I also never expected malicious actors (facepalm). No advertising ever convinced me to use a VPN, although I've been often tempted so I can watch CZcams as it is meant to be, but this particular video convinced me.
I haven't trusted it since 2013 when the team altered settings, then pushed an update to facilitate Operation Onymous. All your scripts were ON even if the switch said they were off, this was to allow Tor sites to execute code on behalf of police on compromised sites. So I would not trust it one bit.
It all depends on the VPN provider if u use one in a spy state like germany (Nord vpn) or USA .. then u should not use it look for legal providers outside of spy states (bulgaria for example) where No Log is ok with the Laws
thanks for this video, love to see a well thought out explanation that isn't basically just regurgitating outdated docs based on faulty rationales floating away into space on their galaxy brains
Both yours and his videos gave good reasoning. I think that normal commercial vpn should not be used but a vpn in general should be used but only one which does not take ur information
Thanks for the video. Maybe it's better to use three chained VPNs instead of Tor: one on a travel router (such as one of the GL-iNet models), one on a Linux host operating system, and one on a Linux guest virtual machine (sitting in Virtualbox). The Linux host and guest and Virtualbox can be run from a USB drive. What do you think?
@@rootcanal7188 no need to worry, they are. they still need to control both entry and exit nodes that you used to de-anonymize you, or break tor encryption. the likelier is the former, but still low probability
Great take, I never understood the people who said that VPN --> tor is worse than only tor. In a worst case scenario, it's as safe. In a better scenario, your vpn provider doesn't keep logs and you're safer than only tor.
Good video but setting up tor to stop using your vpn before exiting is not the easiest thing to do. I am glad you said that is the only safe way to use tor/vpn. Secondly even if you live in a free country using tor will get you on a list or maybe a visit from the local police. In the USA snowden revealed that the NSA keeps a record of all usa citizens and in germany using tor may get you an unexpected guest. This happened to my friend and can be confirmed easily online as germany does not hide this fact. I think this video puts and end to the discussion tor/vpn
@@scharlyeonce you enter tor what you do becomes anonymous so there is no way for them to know. btw all he was doing was using a tor email account i set up for him so we could communicate in private. Also I never said tor was forbidden, i only said the police can visit your house if you do use it. that is a german law. i lived there for 7 years.
@@mikemaldanado6015 they can't just visit your house simply because of someone using tor. I am German and it requires some reasoning and evidence for a house visit and tor isn't a reason good enough for that. If they did enter your house without proper reason then it was most likely not legal.
Ah! I was trying to figure out what you meant by this, and then I looked and it's literally blank. Not sure how that happened 😅 I think I used CZcams's trim tool correctly, let's see if it fixes itself...
Do you think it would be possible to make your own search engine, so that you could be 100% sure the search engine wasn't spying on you? You still have to trust that the google alternatives haven't been compromised.
Most likely no. While its possible to host your own seach engine with tools like SearX or Whoogle, if you are the only one who use them to browse internet it defeats the purpose of scrambling your identity.Perhaps if you made it public and archieve to gain some popularity among others yes, though if I was stumble upon public instance of searX that was hosted by an unknown person I would likely to pass up in favor of things like statepages as I find it difficult to have a trust on anon online individual over a relatively reputable company. A better solution is to use Tor for all the shady stuff IMHO, it obviously is leave a trace on the engine per se but make it practically impossible to connect it with your real identity.
You have no clue what your talking about. Yes, using a vpn is good for privacy. People using Tor want anonymity. Privacy and anonymity are VERY different beasts. Worried about 'suspicion' or your "isp knowing"? Use a bridge.... that's what they are for. Dude you cited as 'deanonymized' confessed, right away.... this video is full of holes and gaps in logic or just plain old WRONG info.
How is using a VPN with Tor a bad thing? What's your reasoning? A VPN DOES provide anonymity. Tor is not bulletproof. There have been plenty of cases of users being deanonymized, whether through malicious nodes, zero-day exploits (both in the Tor browser and operating systems such as Tails), traffic correlation attacks with cooperation from ISPs, etc. Using a VPN helps prevent against these and gives an additional layer of protection. I would argue that even if it's a VPN that keeps logs, it's still better than no VPN. If the attacker that deanonymizes your Tor session has no authority, then they'll only get your VPN IP, and that's where the attack ends lol. If the attacker does have authority (e.g. feds), then it's still an extra step of having to request the logs in order to identify you. Obviously, ideally you would want to use a privacy respecting VPN that doesn't keep logs and can be paid for anonymously.
You denied nothing though - 1. For ISP - you both said that using a VPN could elevate the chance of you being detected by you ISP! But what he talked more abt had govt at principle unlike you who had ISP - 2. For govt - you both said that in the case of logging data it will be all for nothing - so why would i use VPN now?? If i know that these will be ground 0 again!! So what did you said, I think nothing!
Use a VPN that doesn't log. It's your ISP you need to worry about, more than your VPN (assuming you use a good one). There's a small chance your VPN might log you, but your ISP is definitely logging you. They are the ones who are going to be actively compiling a list of TOR users for your local government. It's your VPN that stops your ISP from recognizing that you are connecting to TOR. All they know is you were connected to a VPN at certain times and the volume of traffic you had during those times. That should be less suspicious, as using VPNs is mainstream in most places. If you live in a country where VPN use is rare, then you should look at other options.
You know, you fellow geeks of the internet need to stop this back and forth. Someone will now make a counter video to yours, and then someone to theirs, and it will go on and on until ∞ This is what happened to Biggie and Pac. Ya'll should just talk and be friends.
Governments outlaw activities which are perfectly moral. Law is always claimed to be based on morality, however inaccurately. Laws can be immoral laws, even when they pretend to encode morality.
...yeah, that's pretty much common knowledge.
@@cubedude8690 not common enough.
I don't think laws are based on morals, they are based on order. It's just morals is something that often times people can agree on to follow and thus result in order. There's plenty of immoral things that are legal because they are unenforceable and plenty of moral things that are illegal because it's right next to something that would disturb public order, even though following that law to the letter wouldn't cause a problem. Like having a lot of controlled substances that can be used to make meth isn't immoral or harmful as long as you don't make meth, but it makes it a lot easier for people to make meth so it's illegal despite being directly harmless.
@@AWanderingSwordsman laws still exist because of morals. Even though things that are prohibited by law aren't necessarily directly immoral and vice versa, in the end it's still morals that are the reason for these laws to exist. Therefore they are still based on morals
@@AWanderingSwordsman is order good or bad? If you say it's good, how is that not a moral judgement?
TOR does in fact work as intended in the presence of global passive adversaries if there’s sufficient traffic through TOR relays.
It does exactly nothing if the entrance and exit nodes are controlled by an adversary
@@LennyMiller739 if ISP and Exit node too
I agree completely. When Mental Outlaw said that connecting to tor looks less suspicious than connecting to a VPN I already knew the argument was ridiculous.
It’s just the fact of the matter that connecting to Tor looks WAY more suspicious than connecting to a VPN
Even my mom who knows nothing about technology uses a VPN for work, and I guarantee there are thousands of people who DO use a VPN + Tor and not “so small you could count them on two hands” like M.O. also says and I highly doubt law enforcement are using “quantum computers” to crack every single one of them on the belief everyone who does this is a super criminal
I do not believe booting up a VPN and then connecting to Tor makes you any more suspicious than straight up connecting to TOR in the first place. Also, without a VPN your ISP now knows *YOU* connect to TOR on a regular basis
Boom! Exactly
Use a bridge and stop having to rely on a vpn to not give in to feds when they will every-time, depending on the company
@@Bottleopnrthat's what I was thinking, isn't a TOR bridge literally designed to do the exact same thing? Without getting some fedcucked company involved in your traffic.
@@thelaundryman9287 yep. When you log onto tor over a bridge, it shows the ISP as a different url link such as Bestbuy, vacations, animal stores…. Etc. without having to jump through extra hoops
@@thelaundryman9287The thing is: everyone who uses Tor bridge uses Tor, but few who use VPN use Tor, so you blend in more. It's not certain that you use Tor because you used VPN sometime, but it is certain that you use Tor if you used Tor bridge sometime.
Using Tor Bridge inside a VPN is the right choice, as neither the provider nor the VPN knows that you use Tor.
Thanks friend! I downloaded Tor and was able to acess X (just got banned in Brazil)
goverments really think they can bann things but they can't nice job!
Great video. If you add torrent traffic and put a website in the background streaming video, wouldnt that help in obfuscation because the encrypted tunnel blends/multiplexes multiple data streams and sends it to you, which means that the fixed tor packet can be added to another streaming packet thereby obfuscation.
Your thoughts?
That should certainly make the traffic more difficult to distinguish 👍
I would still prefer using a bridge which obfuscates the Tor traffic itself via obfs4 inside the VPN tunnel if this is of great concern to you though. You can always make use of all these techniques :)
@@jonaharagon thanks again. There is so much misinformation on reddit forums about this that it's reached cult status. Unnecessary alarm bells about using tor over vpn. Somehow people are forgetting logic and reasonable arguments and instead getting behind the "Thou shall not use a vpn+tor" decree from other coneheads.
There's a point I wish you had covered. What are the implication of using Tor with a VPN when that VPN is paid with a credit card? That's undeniable identifiable information that can be linked to that traffic. Whereas, not using a VPN, it's only known to the ISP that Tor traffic comes from a given network but not exactly from whom on that network (unless I'm misunderstanding something in how it works). There would seem to be more plausible deniability when not using a VPN in that case.
You probably already pay for your internet with an identifiable transaction (CC, bank transfer) or provide personal information while getting a connection installed. If you pay for a VPN with a CC you're no worse off than using a direct connection.
@@wi0lono There's typically more users sharing a local network than there are on a single VPN account which gives more plausible deniability in that case. It's true that, in a worst case scenario, when you're alone on your own network using Tor, possibly in a country that bans it, then a VPN is an obvious choice. In other cases, where you're sharing a network, maybe not even your own, it seems to me that not using a VPN could be better. Although I'm not sure if that's the case which is the reason of my comment. Both options, using or not a VPN, seem to have their pros and cons: trying to hide the traffic itself vs. trying to hide the origin of that traffic, each option compromising on the other.
@@Zatmos I mean in the case of 95% of the networks you're connected to you're either the only person connecting to the network or there will be someone who'll be aware of who _you_ are in that network (friend, network admin).
You could try your luck with a public WiFi with little to no monitoring (Starbucks, etc.) but then you need to be in range, which brings with it a bunch of physical opsec issues.
Unless I've misunderstood your question, my point is that your origin isn't very likely to be hidden better without a VPN. A VPN at worst can leave you at the same level of exposure (if you use CC) or a bit better (if you don't).
That being said, noone can see your traffic on TOR anyway, so you'll have enough plausible deniability unless you live in a country where TOR is illegal as a whole.
@@wi0lono That makes sense. It either doesn't matter when it's legal or it's just too dangerous in most cases not to use a VPN even bought with a CC when it's not. I think you're right. The type of optimal scenarios where you can successfully hide among users in a big network are going to be rare and that strategy doesn't work well on smaller networks. That's not as big a point as I thought it was.
Mullavad doesn’t use emails and you can pay with monero a privacy conscious coin
I am very grateful for Tor and people like you that care about integritet and privacy. Without you and guys like you we would not have any thing like Tor, Onion and duckduckgo and much more. Hat is coming off for you.
What is moral can be criminal, or in America, enforced as if it was criminal, like asserting your Constitutional rights in places actively quash these rights, you need all the protection you can get.
A VPN is just the same as your ISP. You're just creating logs at another location.
It's like electric cars or solar panels. You're just creating pollution at another location.
YES, but vpn logs is only: Using Tor, dont show what you are using in Tor.
host your own vpn server in the cloud
@@darrylbaker7162 actually that's a great idea if the cloud provider let you access it with tor and pay with monero, cash, gift card or some private alternative.
VPN differs from an ISP; some don't even keep logs. Even for the ones that do, do your research on which VPN you use; it still makes it harder to track the steps. There is no perfect way, but adding one more possible protection is still worth it. A lot of people use a VPN all the time and have for years.
@@darrylbaker7162 Do you knows any cloud service providers that don't block traffic coming from tor and has anonymous forms of payments like monero, cash, gift card, etc? If there is such a thing like that than it would be a really great idea
Solid video. Awesome delivery and breakdown of info. no stupid click-bait either.
Tor Docs said we do not recommend
Another point is that if enough users start using tor over a particular vpn then even if Tor somehow gets broken, the ip they will see is the vpn. And if the VPN wasn't laying about their logs policy then youre still fine. Worst case scenario it doesnt make it worse either.
I appreciate this, as it confirms a lot of the doubts I had about many of MO's arguments. He seemed to assume that one would only be using the VPN when they were connecting to TOR, rather than always. Perhaps you stick out for always using a VPN, but no packet of yours will ever stick out amongst your other packets. The value in that is limited but still seems obvious.
And his "criminals" line was just baffling, as it's basically "good people have nothing to hide", which is an argument against privacy _in general._ If you're concerned with who "should" have access to privacy, you've already endorsed the adversary. He has an odd moralism that undercuts his dedication to privacy and security.
It's a bummer that this video has such a small fraction of the views that that one does. I feel like someone somewhere is going to get screwed over by the bad advice.
I have always used a VPN and connected to Tor over it. It makes it more difficult to try and find people, but you also need to only use downloaded files on a sandbox machine. Work networks block Tor, but not all VPNs.
The problem is, that today it seems any citizen is per se a criminal online unless proven otherwise. So the argument number 2 of mentaloutlaw is for us all.
Thank you for the video!
Which bridge is the one I should use? Pretty insecure to do any shift from the already installed from installation. Only if there's any help recommended that fits my use of Tor. Also Orbot have installed stuff that I don't touch. Of course I try to read what the most that is for me and my use.
Watching your video just after Mental Outlaw's was a good recommendation by CZcams I would say. I was not comfortable at all after MO gave advice on a different VPN himself after critisizing Network Chuck on this :)
I just want to point out my idea on a part of your video. I am not really sure if an ISP would keep a log record of the IP traffic for a long period of time. By long, I mean at least for the time for the discovery of a bridge. If the ISP is not fast enough your data will be erased eventually, so you are safe. It becomes a matter of how much that specific ISP actively blocks Tor and how much they are willing to pay for it. Also, VPN operators are never trustful enough for me as they would happly sell my data for a government claiming my data as illegal in their eyes as all VPNs are already blocked. Adding them might cause a connection to slow down more which is already very slow, making it unusable.
Might have to agree to disagree, but my argument would be that keeping basic logs like IP & timestamp costs them virtually $0 (plain text storage is both very small and extremely compressible), and in my experience it’s very common for *local network administrators* (at workplaces etc.) to keep firewall logs for 1+ years. I don’t have much experience with the inner workings of *ISPs*, but I find it hard to imagine they’d take a very different approach.
Looking at the ToS of my own ISP and my mobile carrier, both say they keep network logs for a year. Could be worth checking on your end! :)
I also have no idea how ISPs work on logging. Your argument seems valid. Thanks for the answer. That would be a good point to search further.
also appreciated this as counterpoint/context to the MO video as i've always thought he downplays the fact that there are use cases where vpn+tor is beneficial. as far as recommending mullvad over nord vpn - mullvad is a different breed than most other commercial vpn's as they structure their services to require the minimum amount of trust from the user, i.e. by allowing multiple methods of anonymous payment and not requiring any personal information to activate an account. mullvad is the only vpn i'd personally recommend. even if their no-logs/data-deletion policies turned out to be a sham, you can engage with their service in a way that prevents them from having any meaningful p.i.i. to associate with your traffic. nord is arguably the most corporate vpn provider, which in itself doesn't bode well for their ability to resist court orders, etc (also a complaint i have about proton), but beyond that nord is documented to have given personal information to authorities (come to think of it, same with proton) as well as the fact that nord's "no-logs" policy is a misnomer/half-truth at best. proton is documented to have gotten activist(s?) arrested by turning in information to authorities, and nord is perfectly capable of doing this as well in the unlikely event that it hasn't happened already
also just would point out network chuck is sponsored by nord whereas MO doesn't seem to have any affiliation with mullvad beyond recommending them as a legitimate privacy tool
@@yakuzamert it is common practice to keep these logs for around 4 years.
Mental Outlaw only recommended another VPN service for those that absolutely needed it, in the end he still did not recommend using a VPN if you could avoid it
Does anyone know if you can use tor over VPN from a android mobile? As I use the orbot app or invisible pro app and that connects as VPN
Orbot has a option to connect via proxy not as VPN so would this let me use VPN also?
not sure about using tor for your whole device, but you can use the android tor browser app whilst using a vpn
Beautiful. Not only informative, but also aligns with broader values that I would like to see on people's web. Thank you!
I share ISP with 75 other apartments in my building (internet is included in the monthly fee) so the ISP don’t know me. Do you still suggest me to use VPN? Country is Sweden.
Your network is divided into a subnet where each device has its own local ip and mac address. Your isp knows who you are.
Tor is slow anyway, but with a VPN its really slow
Incroyable.
Given that there are malicious TOR exit nodes and that you cannot control if your traffic is using one, wouldn't it be better to use a VPN while inside TOR as opposed to TOR inside a VPN?
This way you completely negate the point of using TOR which is anonymization via randomly generated fungible circuits and blending in with the crowd, since you're routing all your traffic through one choke point after all. The ONLY case when this makes sense is if you want to reliably hide your identity from the VPN provider of your exit point, given that you've bought it with anonymized crypto. But why bother with that if you can just use TOR?
Wouldn't this be worse? Because the malicious exit nodes connect to your vpn, that's linked to your account.
@@kurbisfurst5194 Your VPN connection is (or should be) end-to-end encrypted.
Jonah, amazing video! Not only are you very detailed in what you're saying, but it's also in a way where it keeps me interested and engaged. You just earned yourself a sub!
i'm fairly ignorant on this topic but just thinking about it logically... traffic analysis and fingerprinting don't seem like the biggest worry in a real world scenario for the average user. i imagine that amount of effort is reserved for pretty serious criminals like kingpin/major distribution level drug trade, production level you-know-what, trafficking, terrorism? reduce these breakpoints too much and you're talking about tens or hundreds of thousands of people, and the resources simply aren't there. but they've cast a wide net before, and it wasn't traffic analysis or isp/vpn takeovers or kax17's shitload of nodes. it was javascript exploits, forum takeovers/social engineering, media player exploits phoning home. what role does a vpn play in these situations? basically without the assumption of: "they broke tor, so they can break your vpn", which is practically never the actual scenario
Fuck it, i'll just have to learn chemistry and make my own drugs then. At least chemistry makes sense.
🤣🤣🤣🤣🤣😂😂😂
Weird that this video is in my feed. I don't even know what Tor actually is beyond being a browser.
Haha yeah bullshit
how about using two distinct VPNs and then connecting to tor
I believe that would result in a extremely slow connection
I use VPN 24/7... so I just log on to tor usually on whonix when I need.
Is it true that if you use the tor browser, others cannot see the router history?
No.
They will know that you were on tor, but not what you were doing in there
Mental Outlaw's video seemed out of character for him.
i think mo has a point in terms of suspicion levels / pre-filtering *potential* suspects.
law enforcement can't track anybody down who is using tor. because there is no single point of contact that allows them to lawfully (court order etc.) obtain your ip / info.
in contrast to using a vpn which obviously is a legal entity in form of a company and is a single weak point introduced into the whole equation.
it would simply NOT be advisably at all to use either tor or vpn if you know the government controls all isps and traffic and will generally put every single citizen under suspicion for using a vpn let alone tor..
so in non-authoritarian countries ... do NOT use vpn to connect to tor nodes.
in authoritarian countries... do not use tor or non-sanctioned vpn services at all! i.e. do NOT try to forcefully circumvent the "official vpns" if you do not want to be visited by evil men in black suits.
This assumes everyone uses the same VPN. In reality there is no single point of contact when you’re using a VPN either, because they would have to obtain data from every VPN provider.
One argument that I have not seen either you or Outlaw address is the fact that ALL ISPs and VPNs (in most countries) have a certain level of logs they must keep by law. Even if those logs are not published or open they can be subpoenaed. Have these laws changed? Are there countries that do not have these laws now offering VPN services? There are documented cases were VPN records have lead investigators to the people they were pursuing. Do you feel this is not the case anymore? Why? Personally it does not matter to me because nothing I do on the internet is illegal were I live. I do not have to worry about my countries LEA busting down my doors because of my political activism. I mostly use tor to avoid being constantly profiled. It does not really matter to me who finds out I use tor. Though I have never trusted VPNs and have read articles about them turning over logs to the authorities. No big deal in my case though I sure to some that would be a concern. Is this no longer a concern? Has something changed that I have not heard about?
I thought you might find it humorous that when I watch your videos youtube autoplay dives right into a Network Chuck video at extreme speed when your video ends. Or maybe it's not humorous; I find it interesting though. I appreciate your channel please keep it up. I'll run all your videos in full on CZcams and let all the ads play through. With all of my identities. This is my actual identity. I have a bunch of really generic "I'm a dumb stereotypical" hackerish pseudonyms. It's possible that I'll try to pick your brain with one of them; I think you'll recall this comment when I do. Feel free to tell me you're not interested. Given your videos I don't think you need to be told to feel free to tell me anything.
I really liked your detailed and unemotional discussion of this topic, and find the related website very informative as well.
Ive used computers for a good bit, but really only know the surface level for this kind of stuff. Really interesting video, hope to see more from you
This video was so awesome! does anyone have any good tutorials for how to set up a vpn on tails? as a novice it's really frustrating and i'd rather not go on tor for the first time without a vpn after everything i've read and watched.
Do not do any tampering on tails whatsoever. Don't install new software, don't get browser extensions, don't change system settings if you can help it. Tails is made to be as secure as can be without anything else. Any changes will increase your fingerprint and ruin the point of tails.
Thanks for the video. How can we avoid buffering of videos when using TOR?
is an option like LinuxTails a helpful thing or not??
That really depends on your usage. The biggest thing that Tails gives you is that with the default configuration (and this part is not easy to undo and should not be) every connection to the internet has to go through tor. The reason this can be a benefit is that when you browse to a site, even a onion site, you could download something (a script if you have it enabled) that will make a clear net connection that could compromise you. Tails also operates entirely from memory leaving no information behind (accept what you may have setup in persistent data) so if you are concerned about what might get stored on your computer then this is a use. If you have no concern about information that might be in caches on your computer or whether or not your real IP is disclosed by other connections being made while on tor then you do not need Tails. If you have a reason then Tails would be advised. Keep in mind that just like Tor Tails has its limitations and how you use it could effect your privacy. You could highly customize Tails to do away with most of what makes it useful. Read the documentation from Tails and Tor to see their limitations and what you may or may not need.
Great video Jonah! But get ready, people in the space are really sensitive and are just going to cherry pick segments of your video. Need more long form content like this!
stopped watching at 7:00
Most criminals get caught because they made other mistakes and were identified. Criminals are generally stupid or get too confident and start making mistakes. Just because you use your VPN doesn't make you any more of a suspect. In general, it is better to use a VPN with TOR.
I can't see how anyone would recommend against using a VPN before TOR unless they have a motive in doing so.
I can see arguments from a cost perspective. Tor is nice in that it grants people access to the internet indiscriminately, and locking that freedom behind a paywall is unfortunate. It’s certainly better than *neither* Tor nor a VPN. But yes, the reality of the situation is that you are generally better off with a VPN than without, and wishful thinking alone won’t change that.
If cost was the reason someone recommends against using a VPN then I'd expect them to say so, but really no one cares about my expenses if they're not the recipient of my spending.
BTW, I really enjoyed this video and never knew that TOR usage could be traced back after the fact using old exit node data. I ignorantly _assumed_ these volunteers kept no data and had no notion that they'd be inspected by TLAs. And I also never expected malicious actors (facepalm). No advertising ever convinced me to use a VPN, although I've been often tempted so I can watch CZcams as it is meant to be, but this particular video convinced me.
@@jonaharagon Correct. You want a fallback in case Tor has been cracked. Some say that Tor has already been cracked.
Vpn certainly have economic interests in making you believe you need a vpn.
I haven't trusted it since 2013 when the team altered settings, then pushed an update to facilitate Operation Onymous. All your scripts were ON even if the switch said they were off, this was to allow Tor sites to execute code on behalf of police on compromised sites. So I would not trust it one bit.
can you talk about Orbot with Tor please
Run your own VPN server on a VPS and disable all logging.
Any VPS with Monero?
Hey Jonah, thank you so much for the information in your video. Much appreciated. I'm subscribing to learn more from you.
It all depends on the VPN provider
if u use one in a spy state like germany (Nord vpn) or USA .. then u should not use it
look for legal providers outside of spy states (bulgaria for example) where No Log is ok with the Laws
Proton is based in Switzerland
thanks for this video, love to see a well thought out explanation that isn't basically just regurgitating outdated docs based on faulty rationales floating away into space on their galaxy brains
it could be worse to use a vpn because it gives police more places to look for traffic
traffic they still cannot use
Both yours and his videos gave good reasoning. I think that normal commercial vpn should not be used but a vpn in general should be used but only one which does not take ur information
Thanks for the video. Maybe it's better to use three chained VPNs instead of Tor: one on a travel router (such as one of the GL-iNet models), one on a Linux host operating system, and one on a Linux guest virtual machine (sitting in Virtualbox). The Linux host and guest and Virtualbox can be run from a USB drive. What do you think?
not the same
@@myname-mz3lo I worry that the feds are monitoring Tor.
@@rootcanal7188 no need to worry, they are. they still need to control both entry and exit nodes that you used to de-anonymize you, or break tor encryption. the likelier is the former, but still low probability
Great take, I never understood the people who said that VPN --> tor is worse than only tor.
In a worst case scenario, it's as safe. In a better scenario, your vpn provider doesn't keep logs and you're safer than only tor.
You are becoming one of the best in this space in CZcams man
Good video but setting up tor to stop using your vpn before exiting is not the easiest thing to do. I am glad you said that is the only safe way to use tor/vpn. Secondly even if you live in a free country using tor will get you on a list or maybe a visit from the local police. In the USA snowden revealed that the NSA keeps a record of all usa citizens and in germany using tor may get you an unexpected guest. This happened to my friend and can be confirmed easily online as germany does not hide this fact. I think this video puts and end to the discussion tor/vpn
Since it happened to me too it probably wasn't because of Tor but because of what your friend was doing on tor. Using tor is per se not forbidden.
@@scharlyeonce you enter tor what you do becomes anonymous so there is no way for them to know. btw all he was doing was using a tor email account i set up for him so we could communicate in private. Also I never said tor was forbidden, i only said the police can visit your house if you do use it. that is a german law. i lived there for 7 years.
@@mikemaldanado6015 they can't just visit your house simply because of someone using tor. I am German and it requires some reasoning and evidence for a house visit and tor isn't a reason good enough for that. If they did enter your house without proper reason then it was most likely not legal.
@@scharlye I REPLIED TO YOUR POST WITH AN ARTICLE ABOUT HOW IT HAPPENED TO A GROUP OF GERMANS BUT GOOGLE KEEPS SHADOW BANNING MY POSTS.
Last third is blank, but the first two... Dense!
Ah! I was trying to figure out what you meant by this, and then I looked and it's literally blank. Not sure how that happened 😅
I think I used CZcams's trim tool correctly, let's see if it fixes itself...
@@jonaharagon Sorry for being mysterious, i just did not wanted to be rude :) Fixed by now!
Do you think it would be possible to make your own search engine, so that you could be 100% sure the search engine wasn't spying on you? You still have to trust that the google alternatives haven't been compromised.
mozilla is open source ...
Most likely no. While its possible to host your own seach engine with tools like SearX or Whoogle, if you are the only one who use them to browse internet it defeats the purpose of scrambling your identity.Perhaps if you made it public and archieve to gain some popularity among others yes, though if I was stumble upon public instance of searX that was hosted by an unknown person I would likely to pass up in favor of things like statepages as I find it difficult to have a trust on anon online individual over a relatively reputable company.
A better solution is to use Tor for all the shady stuff IMHO, it obviously is leave a trace on the engine per se but make it practically impossible to connect it with your real identity.
You have no clue what your talking about.
Yes, using a vpn is good for privacy.
People using Tor want anonymity.
Privacy and anonymity are VERY different beasts. Worried about 'suspicion' or your "isp knowing"?
Use a bridge.... that's what they are for.
Dude you cited as 'deanonymized' confessed, right away.... this video is full of holes and gaps in logic or just plain old WRONG info.
You should watch the video lol
How is using a VPN with Tor a bad thing? What's your reasoning? A VPN DOES provide anonymity. Tor is not bulletproof. There have been plenty of cases of users being deanonymized, whether through malicious nodes, zero-day exploits (both in the Tor browser and operating systems such as Tails), traffic correlation attacks with cooperation from ISPs, etc. Using a VPN helps prevent against these and gives an additional layer of protection.
I would argue that even if it's a VPN that keeps logs, it's still better than no VPN. If the attacker that deanonymizes your Tor session has no authority, then they'll only get your VPN IP, and that's where the attack ends lol. If the attacker does have authority (e.g. feds), then it's still an extra step of having to request the logs in order to identify you. Obviously, ideally you would want to use a privacy respecting VPN that doesn't keep logs and can be paid for anonymously.
@@tyler108 A VPN provides Privacy NOT anonymity, I have a ton of videos on my channel about this very issue (people not understanding the difference).
@@tyler108how does a VPN provide anonymity if they have your payment info?
Great stuff…i was wondering about this after i saw that guy’s video.
You denied nothing though -
1. For ISP - you both said that using a VPN could elevate the chance of you being detected by you ISP!
But what he talked more abt had govt at principle unlike you who had ISP -
2. For govt - you both said that in the case of logging data it will be all for nothing - so why would i use VPN now?? If i know that these will be ground 0 again!!
So what did you said, I think nothing!
Use a VPN that doesn't log. It's your ISP you need to worry about, more than your VPN (assuming you use a good one). There's a small chance your VPN might log you, but your ISP is definitely logging you. They are the ones who are going to be actively compiling a list of TOR users for your local government. It's your VPN that stops your ISP from recognizing that you are connecting to TOR. All they know is you were connected to a VPN at certain times and the volume of traffic you had during those times. That should be less suspicious, as using VPNs is mainstream in most places. If you live in a country where VPN use is rare, then you should look at other options.
Good work man!
what vpn do you reccomend that are free
I would be wary of free vpn's
Proton VPN is a VPN recommended by Privacy Guides and if I remember correctly they have free servers too.
Well explained!👍
Well said Jonah!
Excellent video...
Great video.
Cool video, very informative, it is a like
brilliant
Right on! I like you dude you look like a kitten but I’ll bet you’re a savage with a keyboard. Probably a retired scout sniper too. Keep it up.
Have you ever heard about Tor bridges?
what is tor
good vid
😲?
lol
You know, you fellow geeks of the internet need to stop this back and forth. Someone will now make a counter video to yours, and then someone to theirs, and it will go on and on until ∞
This is what happened to Biggie and Pac. Ya'll should just talk and be friends.
Wheres Kenny Lol