Why is Tor anonymous and other things aren't?

Hi, I currently use Tor, but I was wondering what makes Tor anonymous when other things, like VPNs aren’t.

For example, I make an account on a website via a VPN, I use an alias email and a fake username. How could this account be tied to me?

  • There are many things that tor provides over a VPN. Though i am still learning about the cryptography it uses to keep your full Tor circuit route to yourself , but i can say that incase of a VPN you are simply trusting the VPN provider to not share your logs. Here logs mean the time, date and IP address from which you tried to access the VPN server and possibly the requests made by your IP in accessing any websites.

  • Whereas a TOR will uses multiple nodes/servers to route your traffic so , even if one node decides to log your activity ,it won’t come to know the original source of the traffic.

  • Incase of a VPN even if you use fake username and alias or even a random code allotted to you to authenticate with server (which Mullvad offers) , they can still in theory log the IP addresses from where you made the requests. A government can then go forward and ask the ISP to reveal which customer was accessing that IP at that timestamp ,along with other unique identifiers to track you , even you were on a shared public IP.
    There would much more advance mitigation in place with TOR , other than just masking your IP address.
    I hope it helps.
    Cheers :+1:

How would a VPN’s multi-hop compare? Would that help with any of those issues?

Does really change anything, the VPN provider could still be able to find you though your real IP. The reason VPN providers have access to +2000 servers in different counties is that they buy access to them, they network providers they use would also be able to learn your real identify though your IP address.

Ok, thanks for the help!

mhh i think i forgot to mention that , you are still trusting the vpn provider to abide by their no log policy and also their efforts to resist any goverment orders including gag order to handover your information or asist/collude in targeted tracking.
Even if the service is audited ,it doesn’t assure that the company’s management or ownership won’t over-ride controls/permission required for logging data.
Nor their is any way you could verify that the claims of your vpn provider at any point of time.
Another question that people would be asking is “what if i host my own vpn” , but unfortunately it will have the same set of privacy issues , now from the vps providers side.

2 Likes

VPNs are very useful, they prevent big tech companies from tracking you by IP address, etc.

Don’t expect a VPN to protect you against law enforcement, if you think you can be charged with a crime, use Tor. That would be whistleblowers, journalists, etc, but it could also be someone living in a country where wanting basic freedom is a crime.

It’s the difference between privacy and anonymity.

1 Like

Just for clarification simply masking your ip doesn’t solve the problem of big tech tracking you.

  • In my personal opinion , VPN incase of individuals are mainly useful for the purpose of bypassing geo restrictions. I don’t find much use case for it other than that.
  • Unless you have a static IP , logging your ip address by the big tech would be a useless activity.
  • IP just gives the rough location of which region/city you belong to. A big tech would easily come to know about your region anyways , so its not much of a benefit in spoofing your IP location too.
  • Most of us have dynamic ip and are behind a NAT , so all the adverts about vpn protecting you against “hackers” are just bullcrap.
  • By using a VPN you are just shifting the trust of not logging your internet traffic , like SNI ,IP address etc from your isp to the vpn provider. Assuming your threat model is that of an average citizen, and your goverment doesn’t have a long history of blocking access to certain ip address/domain (or detaining users based on their online activity) then there would be even less reasons for you to use a VPN.
1 Like

As a browser Tor takes the stance of Anonymity, not privacy. By default, it doesn’t block a lot of tracking. It just makes what’s tracking you, not tell the difference between Tor users. It does this via strong fingerprint protection, and its Tor circuit. Its why you shouldn’t resize the window, mess around in about:config, sign in, or use Addons.

Now to explain the circuit. Think of the circuit like layers (of an onion) of encryption, with each Tor node, holding only one key. The only node who knows its your data, is node 1, but it doesn’t know what data it is. It then passes that data along more nodes, each removing a layer of encryption, until it reaches its destination. The sites data gets sent back encrypted, just in the other way around. Unlike a VPN, no singular Node has access to who you are, and what you’re doing. If you were using a VPN, all that Tor data would be readable by your VPN.

1 Like