vpn and tor.... why data is not secure?

Question

question comes from reading a lot of articles, especially the ones describing pros and cons.

But each one of them is saying that even though connection itself is secured, data transfers are not. How's that even possible? I mean in both cases you set a essentially a tunnel between your host and remote location, obviously (aside from constant change of ips) that last outgoing connection might not be connected by tunnel itself but still last sign of incoming data should stop on that server -> when data is going back to you it should be already "covered" with vpn/tor tunnel right? And since some companies have based on rules in their country they don't keep logs all should be fine. So why then people are still saying that it's not secured?

Answer 1

" even though connection itself is secured, data transfers are not"

This is very simple to explain. If you drive a car through an old and crumbling tunnel, it may collapse and crash you. That's like a general non-secure connection. Imagine the VPN tunnel as a nice concrete-steel perfectly safe tunnel that you drive through. You will not ever be crashed by a tunnel collapse, but it's still your responsibility to drive carefully.

In the case of the VPN, although the tunnel is safe, the content can be dangerous. So if someone that connects through your VPN starts to sends viruses, malware and such, then you are nor safe by any means and neither is you data anymore. This is what it's all about: not the safety of the VPN, but the quality and safely of the data delivered through it. Practically, VPN is no use if someone sends you a virus .exe file to you through the VPN and you get the file and execute it.

Answer 2

If you're connecting to a website via Tor, they might not know your IP; but then you still click on that 'sign in' link and provide your details, you've just identified yourself to the website.

By doing things like this (and there's far more to it and just sign in links such as cookies, timing attacks and other issues) you can expose information about yourself without meaning to - this is what they mean.