> So a better option would be to use your Comcast / AT&T / Verizon connection to leak data to the press?
A better option is to use technology that might be better able to provide some verifiable anonymity guarantees, like Tor.
A better option is to use technology that might be better able to provide some verifiable anonymity guarantees, like Tor.
It's better, as in closer to trust-no-one, but of course it's not perfect. Especially when we're talking about endpoint security concerns.
Preferably use a VPN for the host machine's connection too, at least to first download the tor client (the subset of IPs which have downloaded a recent tor bundle is quite small). At the very least, firewall the VM so traffic can only go to a tor bridge IP; even then, https (non tor) from a compromised host can identify the tor user, as all tor entry point traffic is logged and possibly has active mitm boxes (varying packet timing, fingerprinting tor versions).
Given the overall complexity of getting it right, and the enduring consequences of a single opsec failure, I'm not sure tor is a great option. Sending USB sticks through the mail would probably be safer. (Even then, encrypt them, use a dedicated laptop, don't lick the stamp or leave fingerprints, don't be observed/CCTVed posting them, purchasing the USB sticks, etc.)
> all tor entry point traffic is logged and possibly has active mitm boxes
That's a broad claim. You need cites for that. Tor relays are run by a large collective of volunteers, and keeping something like that secret would be quite some achievement.
This is yet another reason to hit Tor through a VPN service. Or better, a nested chain of VPN services.
Edit: I do recall a post by Virgil Griffith about the situation in Singapore.[0] He says nothing explicitly about logging, but does note that Singapore's "love of anti-corruption exceeds its apprehension about human-rights-laden privacy enhancing technologies." And I don't find anything about logging of Tor relays there. But then, I'm searching in English :(
0) https://medium.com/@virgilgr/tors-branding-pivot-is-going-to...
That "hypothetical" the OP referred to is the VPN provider keeping logs (or more logs than they advertise) and providing them when asked to the authorities.
It's not really that hypothetical. There was a link here today about a "no log" VPN service that apparently did that.
> I understand that sentiment but a technological work around (that probably also has captured data points)
Tor is a technology that specifically answers the issue the OP brought up, which is over-trust in a single entity to preserve anonymity. Nothing's perfect, but Tor is better than both the "VPN provider" option the OP was warning people away from and from your snarky "what and use Comcast?" option.
> but a technological work around ... seems at best naive to this layman.
You'll have to elaborate why the use of better (if imperfect) technology is "at best naive."
But imagine instead that your friend was connecting to Tor through a VPN service. Even if CMU attackers had been running your friend's entry guard, they would have just seen the VPN exit IP address.
Better yet, your friend could have been connecting to Tor through a nested chain of VPN services. Then the FBI would have needed to do lots more work to get your friend's ISP-assigned IP address.
The Tor Project, I note, will not agree with my assessment. But so it goes.