This question pops-up frequently, so here is my take on it.
Thinking about posting if/how to use "Tails over VPN" this is the post for you to read.
I hope you will not have to remember reading this post when it's too late.
You need to look at the bigger picture.
At the start it's always good to ask few questions:
- Is it likely you are being monitored by your gov?
-- Do you actively use VPN to protect your privacy?
--- Does your VPN provider collect any logs/user details = is it good VPN provider?
- Do you use Tails/TorBrowser regularly?
-- Have you visited Tails or similar website without using decent VPN from your $HOME IP address?
Should you be trying to compromise your identity and connect from $HOME IP address???
NO
Does yours device/browser leak IPv6 even when using VPN???
You should check! [test-ipv6.com or any of their mirrors at random]
Change your habits slowly so it does not stand out and get the alarm bells ringing when someone is querying your records
(always assume you are being monitored and your devices are compromised already).
Like with everything there is a tier system (simplified) ... let's call it gold, silver and bronze.
- Gold tier is for bad ass hackers, vendors with large turnaround etc. causing huge monetary losses and substantial efforts are being made to identify/capture
- Silver tier is for stuff that has not got highest priority, but are to be tackled next
- Bronze is low yield, individuals that purchase for their own, etc. but helpful to monitor habits/vendors used to purchase
Imagine that you are working for LE and trying to win gold, silver and bronze, suck up to your boss and get bonus/promotion or recognition in a macho environment ;)
Any result is great for the media and citizens feel that LE is doing something without actually having a clue what exactly.
If you want to avoid being targeted you need to start thinking it through from the start.
Like a takeover of a competing company that you can not win by competing with them.
Is it better to adopt OPSEC of a gold tier actor?
YES
(With the use of AI our adversary has a new powerful tool in the bag)
Can you always get it right especially if you are new?
DEFINITELY NO
Should everyone IMHO use Tails(Tor) over VPN to protect?
YES
(It adds another layer)
Does using Tails(Tor) over VPN give you another layer of protection?
YES
(I'm talking about using decent VPN that does not collect/store any data/personal details
and running a system that can not expose any customers).
Is it easy to implement Tails over VPN? safely?
NO
Does Tails offer dynamic Bridge auto connection?
NO
Which Tor Bridge is better (obfs4 or WebTunnel)?
WebTunnel tcp/443 is less obvious then random port on obfs4
Is there a database of Tor entry points (Bridges/guards)?
Highly likely
Is there a public database of Tor Exit Nodes
YES, as they are public
When connecting to Tor (The Onion Router) Network (using Tails or TorBrowser) your guard (first hop - there are three sometimes four) is always RANDOM,
but your ISP can see where your device IP address is connected and what port, using TCP (Transmission Control Protocol) [Tor NETWORK] or UDP (User Datagram Protocol) [Blocked on Tails].
If you live in the country that collects all the data/metadata/14 eyes then there is permanent record or let's face it, now there is always a "permanent record",
how else can you assert tech dominance?
"Read the "Permanent Record (autobiography)" by Edward Snowden from 2019 about his leak in 2013.
Watch Citizenfour from 2014, documentary by Laura Poitras at least, there is more if you look, this could be your start,
as it will not be part of your course (unless you work in specific field and you will be brainwashed into thinking what Ed done is bad).
- purchase the book with cash
- download the documentary from library/public WiFi
(don't let them build a profile)! Collect all, decrypt/ab(use) later.
Using Tails over VPN to protect yourself has risks. Let me explain.
When using VPN and Tails = Tor or Tor Bridges (with Tails/TorBrowser) users forget about the RANDOMNESS that Tor provides
and always connect to the same VPN location or use same bridge, as a result this substantially weakens/compromise your OPSEC!
(and few already paid the price for doing so).
http://rzuwtpc4wb3xdzrj3yeajsvm3fkq4vbeubm2tdxaqruzzzgs5dwemlad.onion/tor-browser/circumvention/unblocking-tor/
obfs4 | makes Tor traffic look random, and also prevents censors from finding bridges by Internet scanning. obfs4 bridges are less likely to be blocked than its predecessors, obfs3 bridges. [random tcp/ports that stands out]
meek | transports make it look like you are browsing a major web site instead of using Tor. meek makes it look like you are using a web site from a CDN (Content Delivery Network) or cloud provider. (TorBrowser ONLY)
Snowflake | routes your connection through volunteer-operated proxies to make it look like you're placing a video call instead of using Tor. (TorBrowser ONLY)
WebTunnel | masks your Tor connection, making it appear as if you're accessing a website via HTTPS = [port tcp/443].
Pluggable transports are lyrebird, snowflake and conjure.
If you really want to get the gold tier OPSEC there is more work to be done,
it should be gradual, not to show any patterns of suddenly trying to protect all of your information ;)
If you must, you should have TWO on-line identities (only having one is really hard but you may eventually get there):
A)
- one that you had up until now (but perhaps luck of time to participate due to other commitments...is going to make it less interesting from now on)
-- at school/home/friends
-- associated email/bank/social media etc. if you must
-- your mobile phone even if it is prepaid/pay as you go
-- your Credit/Debit/Prepaid Cards & other Bank accounts
-- never ever check your second identity post/messages/communication with this identity, remember "permanent record" [Collect all, decrypt/ab(use) later.]
B)
- second and separate for the dark web/net
-- no association with first one at all
-- different identities for different websites
-- use ephemeral identities (crypto related questions/post will have one / OPSEC second / purchase/questions about substances third ...)
-- always connect/post at random times
-- separate devices (Laptops/USBs/(μ)SD cards)
-- only connecting from RANDOM Wi-Fi spots (NEVER EVER AGAIN Visit the same one - mind the CCTV/ANPR/Ring ..)
-- you can NOT purchase ProtonMail/VPN account or any other service with your Credit/Debit Card !!!!!
-- get some XMR
-- leave your mobile phone at home, let the battery die so its not obvious
-- no smart watch/car etc. on you when looking for Wi-Fi to connect
-- never EVER tell anyone about this identity (kind of hard if you bag a huge trophy, but you must resist, if you don't there will be consequences)
Always think, everything now is collected, AI is used and will be abused.
["Permanent record" - Collect all, decrypt/ab(use) later.].
- Never connect from $HOME/Your mobile phone to Tor (The Onion Router) Network
-- or check your Dark Web/Net communication/posts/comments
- Use laptop that has never connected to Internet from your $HOME ISP (current or before switching over)
-- purchased with CASH (you should have a cash fund, keep it growing, you never know when you may needed it, large CASH amounts have a trigger)
-- running Tails/Whonix/Qubes OS
-- Using LUKS (Linux Unified Key Setup) to encrypt partition, (only device that is safe is one that is powered off)
--- VeraCrypt to create hidden volume
--- Age to encrypt all files on USB storage devices
(never ever store any files on USB/(μ)SD cards/SSD without encryption !!!)
- Need to use VPN that does not log activity/user account details (Mullvad)
-- VPN location (entry/exit) always need to be RANDOM!
--- Turn on the Multihop / DAITA
--- Connect only via Quantum-resistant VPN tunnels
-- keep a log/mental note to preserve RANDOMNESS!
If you live in the West, you should buy/use products that are not backdoored/made in west or for western markets.
(and are still supported by the manufacturer and have Up-to-Date OS/firmware)!
!!! WARNING !!!
It is possible to use VPN along with Tails (Tails over VPN), but unless you know 100% what you are doing (changing the firewall rules)
and installing the VPN will weaken or destroy your OPSEC and Tails, DON'T DO IT.
!!! WARNING !!!
If you feel that you need an VPN, get another device [router/laptop] (running open source OS) as a middle man VPN.
(DON'T FORGET TO CONNECT TO RANDOM LOCATIONS, rather then same location all the time)!!!!!!
Tor does not make you anonymous. Using it correctly does.
Learn about Metadata left behind in documents/pictures/video files if you must share any on Dark Web/Net.
Learn about different types of digital Fingerprinting of everything ... Browsers/Cars/electronic devices/VPN servers ....
All external USB drives/(μ)SD cards should be encrypted with Argon2 LUKS (Linux Unified Key Setup), have a VeraCrypt hidden volume and all files should be Age encrypted.
(macOS FileVault/ Windows BitLocker will not protect you 100% - Tails that are ON/Sleep/Suspend will neither).
One important thing is SECURE password/passphrase, please consider visiting
the below website that has extensive information on this subject:
http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Passwords | https://www.kicksecure.com/wiki/Passwords
~64 Bits of Entropy | Five Word | ~165 days Estimated Brute-force Time (Classical Computing)
~78 Bits of Entropy | Six Word | ~3,505 years Estimated Brute-force Time (Classical Computing)
~90 Bits of Entropy | Seven Word | ~27,256 millennia | Future-proof Safety YES
~103 Bits of Entropy | Eight Word | ~15 x age Universe | Future-proof Safety YES
~116 Bits of Entropy | Nine Word | ~119,441 x age Universe | Future-proof Safety YES
~129 Bits of Entropy | Ten Word | ~928,773,415 x age Universe | Post-quantum Secure NO
~194 Bits of Entropy | Fifteen Word | ~26,405,295,715,806,668,059,525,829,264 x age Universe years Estimated Brute-force Time (Classical Computing) | Post-quantum Secure YES
~259 Bits of Entropy | Twenty Word | ~750,710,162,715,852,378,145,230,792,130,183,941,981,164,925,924 x age Universe years Estimated Brute-force Time (Classical Computing) | Post-quantum Secure YES
I hope you will not spill the beans under pressure. Always put yourself in the other person shoes and think what is she/he trying to achieve/messing with your head.
- Results, conviction, promotion, extra bonus or holiday time ....
Say no to Windows OS
Say no to macOS
Say "YES" to Qubes/Whonix/Tails OS
Say no to iPhone/iPad
Say no to outdated Android OS ""13"" or less if you must, only use Pixel with GrapheneOS
Say "YES" to no mobile phone at all [because Pegasus spyware/Cellebrite digital forensics & intelligence platform are used more often and by many now]
(Read more about work from Citizen Lab]
Say no to Smart Watch/Car/Speaker
Say "YES" to devices that are not connected
Say no to Telegram, SimpleX, Session, WhatsUp, Viber, Snap..., Tik.., FB, Google/Microsoft/Proton accounts
Say "YES" to XMPP (Jabber) account with OMEMO - Multi-End Message and Object Encryption / RiseUp account
Helpful links:
# Qubes OS
http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/
# Whonix OS
http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/
# Tails OS
http://tzoz3bensgxyzs7da7lpgsn3a74h7hlbm4wa6ytq2tg6ktd57w22vqqd.onion/
# Mullvad VPN
http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion/
# Exit IP fingerprinting between VPN servers
http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion/en/blog/exit-ip-fingerprinting-between-vpn-servers
http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion/en/help/exit-ip-vpn-servers-mitigation-rollout
# VeraCrypt
http://tzoz3bensgxyzs7da7lpgsn3a74h7hlbm4wa6ytq2tg6ktd57w22vqqd.onion/doc/encryption_and_privacy/veracrypt/index.en.html
https://www.veracrypt.fr/
https://veracrypt.io/en/
https://amcrypto.jp
# AGE (Actually Good Encryption)
https://age-encryption.org
# Riseup Ⓐutonomous tech collective since 1999
http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion/
# Citizen Lab (world-renowned research unit led by Professor Ronald J. Deibert at the University of Toronto’s Munk School of Global Affairs & Public Policy)
https://citizenlab.ca/reports/
# Tor Supporters
http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/about/supporters/
https://www.torproject.org/about/supporters/
Please do not post comments on how to install such and such VPN on Tails and modify the firewall rules.
Comments below should be related to [ONLY]:
- VPN devices that can run as middle man and help to protect Tails user.
- Mistakes/Inaccuracies/Omissions in the above post.
(Please don't forget to like and subscribe ... ;)
RELATED PAST POSTS:
# Regarding Tor and VPN's
/post/c9299bbfabf3529e628b/
# Should i use vpn to hide my tor use from isp?
/post/0ecc572199fe9357baf6/