this post was submitted on 06 Sep 2026
23 points (100.0% liked)

Privacy

50825 readers
1470 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
23
SHOULD you use vpn and tor? (sh.itjust.works)
submitted 3 days ago* (last edited 3 days ago) by lemmingsareawesome@sh.itjust.works to c/privacy@lemmy.ml
19 comments fedilink hide all child comments
 

asking for the kind that vpn hides tor and not the other way

i have a framework with whonix in qubes using tor browser (real one i think not brave) and idk if im safe.

i want to use wifi in public (food places and schools) and be hard to spy on and not have anything blocked (videos are blocked). my home network is also phoning home because my family is using a google wireless access point (cant change it they dont like having internet down for more than 5 seconds)

would vpn and tor fix this? should i pick just one? or is there a better way? (all things have to be on device since you cant change someone elses network)

top 19 comments
sorted by: hot top controversial new old
[–] AnnaFrankfurter@lemmy.ml 1 points 1 day ago* (last edited 1 day ago)

Just VPN is sufficient and don't get fooled by a lot of VPN adverts. Almost all of the internet uses SSL so even if you directly connect to public WiFi no-one can just snoop on your passwords or anything else. The only thing they will be able to see is the website you are visiting. Same as your ISP whether it's some telco, VPN, or Google.

I can understand you not wanting to share which website you visit to google but if you are not careful Google will find out one way or the other. Even if you use VPN or Tor

And as already mentioned never do Tor over VPN or VPN over Tor unless you know exactly what you are doing and what are the risk associated with them.

If you are worried about state actors with compromised rootCA and DNS then Tor can help you there but if they are using this to spy on you then just bypassing it can also put you on a list

[–] TrollAccount69@lemmy.ml 13 points 3 days ago (1 children)

You just need a vpn. Based on your other tech support threads you need the one with the fewest ways to mess up (I do too). You should try mullvad. If it turns out that you have to shuffle around different servers too often and can’t tolerate being blocked, switch to a geofencing bypass style vpn like nord or something.

Bear in mind I’m recommending mullvad because it’s really hard to use it in an unsafe way, which it unique in the vpn world. If you go with something else you’ll have to make sure you understand the choices you’re making which is often a tall order.

[–] lemmingsareawesome@sh.itjust.works 1 points 2 days ago

ill try it 👍

[–] provectus@lemmy.ml 7 points 3 days ago* (last edited 3 days ago) (2 children)

Never use tor with a VPN because it can make you easier to identify on the tor network.

Edit: https://support.torproject.org/tor-browser/general/vpn-with-tor/

Also, it is only fine to use a VPN with tor if you know what you are doing.

[–] lemmingsareawesome@sh.itjust.works 2 points 2 days ago (1 children)

i heard you can if you use vpn to hide tor and not tor to hide the vpn

do you mean easier to identify by advertisers, malicious nodes, or isp/gov?

(i dont know what im doing yet)

[–] dreamy@lemmy.ml 1 points 1 day ago

Yeah, you're correct. Using Tor over (a trusted) VPN just helps with hiding the fact that you're connected to Tor from your ISP. It won't affect your privacy on the Tor network.

I recommend using iVPN or AirVPN (though I've had slowness issues with AirVPN).

[–] ISOmorph@feddit.org 4 points 3 days ago* (last edited 3 days ago) (1 children)

I use Mullvad + Tor myself from time to time. So I read through the article to understand what issues might come up. Turns out it's actually advantageous in most cases with a few exceptions. If you use Mullvad (0 logs) and pay through monero/cash/vouchers (no money trail) you're (slightly) better off.

[–] Tenderizer78@lemmy.ml 4 points 3 days ago (1 children)

I'm not sure the topic is really about privacy, but if your threat model requires a VPN + Tor, you're already screwed.

The government can see the metadata of your requests. With enough metadata they can identify what you're doing. Adding a second layer doesn't really change that.

[–] hirihit640@sh.itjust.works 2 points 3 days ago (1 children)

What metadata are you talking about?

[–] Tenderizer78@lemmy.ml 2 points 3 days ago (1 children)

They can see the timing and packet size for your requests to the VPN server, as well as what your VPN provider is. On the VPN's end they can see what sites the users (collectively) are visiting, the packet sizes, and the timing. That information alone is enough to identify who is doing what with reasonable accuracy.

This is before issues of using the government's massive resources to brute-force encryption, possible government backdoors in VPN servers, and browser fingerprinting.

There are various steps that can be taken to mitigate this, and this of course assuming the government has access to the ISP's metadata from both your network and the server's network (not a stretch, but not necessarily guaranteed).

[–] hirihit640@sh.itjust.works 4 points 2 days ago (1 children)

A VPN is basically just a replacement ISP. They see everything your ISP traditionally sees.

Many ISPs are already selling your traffic data. So if you trust that your VPN isn't selling that data, then you'll be more private using them. And if the VPN is in a different country, then your government is less likely to be able to force the VPN to give up data.

You can defend against timing attacks and other traffic correlation attacks too, using techniques like cover traffic.

[–] lemmingsareawesome@sh.itjust.works 1 points 2 days ago (1 children)

cover it with what?

[–] hirihit640@sh.itjust.works 2 points 1 day ago

Are you asking what cover traffic is? It's just adding extra traffic to obfuscate the real traffic. There's many ways to do this, you can look it up online

[–] RheumatoidArthritis@mander.xyz 2 points 3 days ago

You should be good with just a VPN. Tor over VPN (not the other alway round!) makes sense if you want to hide your use of Tor from whoever is watching, and especially if you use Tor Browser for something you want to hide, the timing of when you open and close Tor Browser could be correlated with the thing you're doing. Overkill for just watching videos in privacy.

[–] ShutUpWesley@piefed.zip 3 points 3 days ago (1 children)

No, combining them is pointless.

[–] Sixseven@sh.itjust.works 1 points 3 days ago (2 children)

Can you elaborate? A VPN would hide their IP address from the entry node which is a good thing, right?

[–] StumblingWasabi@lemmy.today 4 points 3 days ago

The point is if you want to hide the fact you use tor, while yes it will hide you from the entry node, the beauty of the tor system is it has more than one point of failure, using a VPN makes the VPN a single point of failure since knows who you are and what website you are going to. That being said, I'm to lazy to split tunnel when I feel like using Tor, my traffic doesn't really need that level of animinity anyways

[–] ShutUpWesley@piefed.zip 2 points 3 days ago

I think Mental Outlaw did a good video on the subject. I've also seen several good talks that cover it from conferences like Defcon. They'll do a much better job than I could in a comment.

[–] davad@lemmy.world 3 points 3 days ago

Just do one