0

Ok, I've got a few things that are bugging me about TOR proxy and VPNs. More specifically how they keep you annonymous, for example, say that I'm using VPN and that my internal IP address is 192.168.0.1, which from now on I'll refer to as localhost.

When I send data from my localhost to the internet, how does the VPN encrypt my public IP, my data would always first go through my ISP no? As following

Localhost > ISP > VPN > ENCRYPTED DATA > Localhost, or am I thinking of this in a completely wrong manner?

Same with a proxy, doesn't the data 1st go through the ISP before you can connect to the proxy?

I find this to be confusing and it's doing my head in.

Or does a VPN encrypt your data before sending any packets out on the internet?

Any sources that I can read or simplified answers are obviously appreciated

8
  • There's a fundamental flaw here: Tor and a VPNS act pretty differently Aug 27, 2015 at 6:50
  • The VPN tunnel will only encrypt the data between you and the VPN entry point. Meaning that the data content will be encrypted and you will communicate with the broker using a secure tunnel, but the broker itself is still aware of your real IP address. From there on and out into the world, only the brokers IP address is seen and you are hidden behind that gateway. The TOR part I am not so sure off.
    – Mogget
    Aug 27, 2015 at 6:53
  • 1
    Tor is a bit different. Basically it uses onion routing so it peels away layers of encryption as it travels, identifying a new node each time it "peels". The big flaw here is that the exit node (the final node) knows exactly what's coming out. But you also don't pick your exit node, Tor does. There's been attacks to try to force an exit node and attacks regarding timing on this. Aug 27, 2015 at 6:56
  • @Mogget combining our comments since it feels like enough for a full answer. Aug 27, 2015 at 7:00
  • Ok, thanks, the VPN part I understand, but I'm still quite puzzled about proxys, for example on linux there is a program called proxychains which you can use to create a proxy through the TOR network. So am I right in thinking you'd create a daisychain kind of network going: localhost > Proxy > ISP > (optional VPN). If so, I still don't get how you can connect to the proxy without first connecting to your ISP. Thanks for the answers already though!
    – user489000
    Aug 27, 2015 at 7:00

2 Answers 2

0

Per @mogget: "The VPN tunnel will only encrypt the data between you and the VPN entry point. Meaning that the data content will be encrypted and you will communicate with the broker using a secure tunnel, but the broker itself is still aware of your real IP address. From there on and out into the world, only the brokers IP address is seen and you are hidden behind that gateway." (To add, the typical VPN establishes a tunnel via IPSec if you wanna look into the actual protocol it uses.)

Tor uses onion routing so it "peels" away layers of encryption as it travels, identifying a new node each time it "peels". The big flaw here is that the exit node (the final node) can know exactly what's coming out. But you also don't pick your exit node, Tor does. Also why the browser probably ships with https everywhere plugin. And because it's just a good overall practice. There's been attacks to try to force an exit node and attacks regarding timing on this.

Proxies aren't inherently encrypted. It depends on the protocol you're proxying through (like the different between HTTP and HTTPS). Tor is encrypted. Neither protect against bad user end practices. If someone can execute arbitrary JavaScript in your browser for instance they can likely identify your location. This is why the Tor Browser ships with stuff to prevent stupid user-end moves, but you can't really make it bulletproof.

Fun fact, for how much the government tries to break into Tor, onion routing was developed at the Naval Research lab.

A lot of the people who get caught do really dumb or anti-best practice stuff on the Internet. Like how Silk Road went down a few times and got busted. At the end of the day it's still a website, just your traffic to and from it is encrypted. What happens at each end remains to be seen. There's almost always a varying degree of user error whenever there's some big Tor bust.

0

There is a decent amount of nuance here. Let me start with your example setup and explain in detail. If you want a summary, you can skip to the end and reference above as needed.

for example, say that I'm using VPN and that my internal IP address is 192.168.0.1, which from now on I'll refer to as localhost.

First, let's call this IP address "internal", as "localhost" has a specific meaning in network terms.

There is another, more relevant, IP address that is your public IP address. Let's refer to that as "external"

There is also the remote system you are trying to communicate with, let's call that "remote".

There is an IP address associated with your VPN provider or TOR tunnel that you connect to. Let's call this IP: "entry"

There is also an IP address associated with the exit of whatever VPN or privacy enhancing tool (e.g. TOR) you use. Let's call it: "exit"

VPN CASE

Let's say you have a VPN configured and running. I'll work through how the traffic looks through each step, and then show the default (no VPN) setup at the end.

VPN setup, traffic going from "internal" to "remote"

Inside your network, between "internal" and your router:

  • Traffic appears to be going from "internal" to "entry" (and back)
  • Traffic is encrypted, so only the source and destination are visible, not contents.
  • This is typically a trusted network, so usually this is considered limited risk.

Outside your network, between "external" and "entry" (your ISP, and any intervening ISPs):

  • Traffic appears to be going from "external" to "entry" (and back)
  • Traffic is encrypted, so only the source and destination are visible, not contents.
  • This is typically an UN-trusted network. You are protected against ISPs observing the contents of your traffic, and you are protected against any of these ISPs knowing the final destination of your traffic ("remote").

Outside your network, between "entry" and "exit":

Here it matters what tool you are using. For a typical VPN provider (NOT TOR):

  • Traffic appears to be going from "external" to "remote"
  • Traffic is unencrypted, so the apparent source, destination and contents (unless also encrypted, e.g. SSL/TLS) are visible to the VPN vendor.
  • This is typically a trusted network; you are paying the vendor to protect your privacy. Whether this is wise is up to you.

For TOR, they manage to do this in such a way that:

  • Traffic to any individual node either appears to be going from "external" OR going to "remote", but NOT BOTH.
  • Traffic is encrypted most of the way, so the contents are unencrypted (same caveats as above re: SSL/TLS) only for the exit node, which knows "remote", but doesn't know "external". Only the entry node knows "external", and it doesn't know the contents of the network traffic.
  • This is typically an untrusted network, designed to avoid you having to trust it.

Between the VPN provider ("exit") and "remote":

  • Traffic appears to be going from "exit" to "remote".
  • Traffic is NOT encrypted (same caveats as above re: SSL/TLS).
  • This is typically an untrusted network (the Internet) and includes the remote host. Notably, the remote host does not know your "external" IP address.

NO VPN CASE

The unprotected communication is much simpler and looks like:

Inside your network, between "internal" and your router:

  • Traffic appears to be going from "internal" to "remote" (and back)
  • Traffic is unencrypted, so the source, destination and contents are visible on the wire.
  • This is typically a trusted network, so usually this is considered limited risk.

Between the your router ("external") and "remote":

  • Traffic appears to be going from "external" to "remote".
  • Traffic is NOT encrypted (same caveats as above re: SSL/TLS).
  • This is typically an untrusted network (the Internet) and includes the remote host. Notably, the remote host DOES know your "external" IP address.

So, what are you getting from a VPN or TOR?

  • Your ISP knows you are using a VPN, but doesn't know the contents of the traffic, or what remote hosts you are communicating with.
  • The remote hosts you are communicating with MAY know you are using a VPN, but don't know your external (Internet side) IP address.
  • The VPN provider may know what sites you are communicating with and be able to observe the traffic. They are now effectively in the same role as your ISP was before you set up a VPN.
  • A TOR node cannot associate your external IP address with the remote site you are visiting, and cannot automatically associate the contents of the traffic with your external IP address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .