Hello everyone,
I already created this topic on the QubesOs forum, but I was advised to post here to get answers from the leading experts in the field.
This is the original thread : forum.qubes-os[.]org/t/ai-analysis-and-vpns/42711/4
First off I apologies for asking a question very similar to other threads that have been posted before, but I did not find the exact answer to my doubts.
What I wonder is the following, in an era with increasingly feasible worldwide communication monitoring and analysis thanks to AI, in a scenario where the adversary is a powerful government or similar global observer, what would be the disadvantage of using a VPN before Tor, given that the VPN is bought with Monero or similar privacy focused methods?
I often see this setup regarded as ‘possible’, but never openly recommended in any official guide. Why is that? In what scenario would that not add another (although questionably effective) layer of protection?
In the absence of a VPN, the adversary either suspect you, and have X amount of real IPs to monitor, and in that case they would see real IP > Guard when the right one is picked,
or alternatively they would start from the exit node IP, hypothetically break Tor, and get to the real IP directly.
On the other hand a VPN, bought responsibly, that is also not a honeypot, could add plausible deniability or maybe not even collaborate at all with hostile dictatorships.
The only cases which I could think of in which a VPN could make it easier to correlate traffic are the following:
Let’s take:
User > Tor > Goal
and
User > Vpn > Tor > Goal
If the Goal can be monitored, and the adversary can monitor the VPN location, but not the User ISP for some reason, for example jurisdiction, then it would be worse, as correlation attacks could then happen. But this seems like a very unlikely scenario to me, and given that the adversary is a global observer, this would never be the case, as a VPN is always better then a collaborative or state-owned ISP.
Also an user that often changes real IP networks, but re uses the same VPN profile, would also increase the attack surface.
So again I am not an expert in this field, and I might be missing something very obvious, but given the threat model of an adversarial global observer, and a securely acquired VPN, I do not see the possibility of worsening security, if anything internet speed would be reduced for questionable benefits, right?
Thanks in advance for your time.
Ps: I already consulted
www.whonix[.]org/wiki/ +
Hide_Tor_from_your_Internet_Service_Provider
Warning#Use_of_Tor_is_Obvious
Tunnels/Introduction
Whonix_versus_VPNs
Whonix_versus_Proxies
And the only credible issues, given the above threat model was:
‘On the other hand, in some circumstances this may result in making you, more unique, easier to track because the IP address is known to belong to a VPN provider but only few users are using it.’
But even then, how would it be worse then just using the real ISP IP? They log absolutely everything.