Which one is better ? TOR + VPN or VPN + TOR?

Which one is better ? TOR + VPN or VPN + TOR ?

What about just using tor?

Generally speaking, unless there’s a specific reason to, it’s not usually necessary. There are some situations where connecting to a VPN first is beneficial (provided you are using a privacy-respecting VPN).

On the latter point, you can pretty much exclude any free VPN because they will be selling your data.

If it’s a paid VPN, or they otherwise have any data on you, then Tor + VPN is a catastrophically bad idea. The VPN will be in a position to know who you are, and see all the traffic from the exit node that’s associated with you. Tor may as well not be there at all.

Every VPN depends on who is operating the other end of your VPN and what they’re doing

I don’t understand why this keeps being brought up, we’ve been talking about it for years now.

How about operating our own vpn Server anonymously (first time access over tor to buy with monero) so we can trust the vpn Server.
What’s the case for Tor + VPN now?
Cheers :clinking_glasses:

Edit: The goal would be to establish a pseudonymous identity based on the servers ip & location where it’s very hard to track back the real operator

VPN → TOR can slow you down and is generally useless thanks to bridges. and can be unsafe depending on configuration and what you are relying on it to do.

TOR → VPN DO NOT DO. worst case scenario you have completely compromised yourself. this also provides very slim benefits.

Can people finally stop these “Tor + VPN?” posts i literally see them everyday here now and it just sucks answering all of them with the damn same text. Here, educate yourself: https://support.torproject.org

Using Tor alone means you have to trust your guard node. If you run a guard and then a bunch of middle relays you’re in a good position to deanonymize anyone who picks your guard and middle relay in their circuit. Tails users are much more vulnerable to this type of attack because they don’t select a persistent guard.

VPNs do some things that Tor/onion doesn’t do, such as support UDP traffic. And if by “Tor” you mean “Tor Browser” and not “onion gateway”, then “Tor Browser” doesn’t protect traffic from other sources such as email client, services, app and OS updaters, etc.

Much of that is nonsense. Tor over VPN is okay. It doesn’t increase the security of the Tor session, but it doesn’t hurt it either. It does increase the security of your non-Tor traffic, hiding it from other devices on the LAN, the router, and your ISP, and hiding your home IP address from web sites.

Here we go again. What data?

I use Windscribe VPN. How about that ?

That’s true in VPN-over-onion mode, where traffic goes browser->VPNclient->oniongateway->onionnetwork->VPNserver->destination. VPN company sees both ends of the traffic, so any benefit of using onion network is lost.

The more typical configuration of TorBrowser-over-VPN is okay. Traffic goes TorBrowser->VPNclient->VPNserver->onionnetwork->destination. All the VPN company sees is “someone at IP address N is doing onion traffic”.

In “Tor Browser over VPN” configuration, VPN doesn’t help or hurt Tor Browser, and VPN helps protect all of the non-Tor traffic (from services, cron jobs, other apps) coming out of your system while you’re using Tor browser (and after you stop using Tor browser). Using a VPN and letting the VPN company see some info is better than letting your ISP see the same info, because the ISP knows more about you. So leave the VPN running 24/365, even while you’re using Tor Browser. [PS: I’m talking about running TB in a normal OS; Tails is a different situation.]

Uh a VPN can’t see Tor exit node traffic.

Alright listen, For all purpose i suggest you to use A TRUSTED PAID VPN (Express, Nord, Windscribe, Surfshark etc) and ALWAYS STAY CONNECTED TO IT. Also use privacy centric WEB BROWSERS like TOR or BRAVE BROWSER. (TOR might feel very slow but it’s more secure). Also, KEEP SEVERAL EMAIL ADRESSES, One for VERY PERSONAL AND OFFICIAL USE, ONE FOR GENERAL USE and ONE FOR GIVING ON OTHER SITES THAT MIGHT ASK FOR SIGN UP. All this should solve all the problems like NO ISP RESTRICTIONS, NO GEO BLOCKS BECAUSE OF VPN, NO TRAFFIC FINGERPRINTS AND COOKIES BECAUSE OF BROWSERS I MENTIONED.

Years of misinformation.

It’s the same with every topic on every sub, tech-related or not. New people cycle through, topics get rehashed. And this particular topic is not straightforward, there are subtleties and multiple configurations etc.

Every data from unecnrypted connections. They also can know that you visiting a certain site if you route VPN through Tor.

So which data do they not have?