>
Kind of highlights that in this age, it's not enough to say "I'm neutral." You need to be able to say "I can guarantee that I'm neutral."> Consider two VPNs, one of which promises never to misuse client-side IP data, while the other refuses to store that data in the first place. If both VPNs are infiltrated by a bad actor, the one that doesn't store data can guarantee slightly more privacy than the one that keeps data but promises not to use it.
> Similar case: I think it's interesting to note that German usage of Tor dropped off when the Snowden revelations took place, while many other countries experienced greater uptake. Perhaps they recognized that Tor may not be as secure as it's claimed to be -- especially considering who initially funded it.
Your point is absolutely correct. Claiming security is useless, it should be guaranteed in some way from the properties of the system itself. However, I think VPN services are the worst offenders. The architecture of a VPN (single point of failure) itself guarantees that achievable privacy facing an attacker is decidedly bad. It's impossible 3rd-party to show whether a VPN provider is keeping logs, it has a verifiability of 0. Governments can issue a subpoena to the VPN provider to force it recording traffic. You don't even need to plant any backdoor or technically compromise the system. And historically, law enforcement agencies have successfully used subpoenas to arrest many people.
On the other hand, Tor offers a much greater level of privacy guarantee that is better than all the large VPN providers, and this remains true regardless of who is funding Tor - unlike a VPN, you can't issue a subpoena to the Tor network, you must compromise the system technically using one way or another. This alone is already a good advantage. The architecture of Tor gives a clear map of exactly what can and cannot be compromised by whom. Since the protocol is publicly documented, we can know quite a lot of things. This list is not meant to be a exhaustive or comprehensive review, don't complain if something is missing, just to make a point on verification.
* The 3-hop entry-middle-exit design with randomized selection and layered encryption offers robust guarantee of security and privacy. The protocols have been reviewed by many cryptographers and relevant researches are available in various journals. There's no crypto vulnerability at the protocol level, and architecturally, the biggest flaws are end-to-end correlation (but it's a problem in all low-latency anonymizing networks) and its inability to defend itself from a global adversary (a well-known limitation). Assuming there's no implementation vulnerabilities, the attacker must control a large number of Tor relays (The classic attack of deploying malicious exit nodes is only a special case) and/or monitor multiple Internet backbones to reliably monitor or anonymize users at considerable expense [0]. Sure, we can assume the NSA has the resources to do targeted attacks, but it's not possible to magically decrypt the traffic or obtain a list of IP addresses. Nevertheless, it's possible to do it to a VPN service and the barrier is close to 0.
* Like VPN, law enforcement agencies have a record of arresting Tor users, but so far, the vast majority of attacks on the Tor networks that have been deployed in practice is browser exploits, software exploits, and social engineering. The fact that law enforcement agencies are exploiting the browser and userspace software rather than Tor indirectly proves that targeting the network itself is at least expensively.
* Assuming that the NSA wants to sabotage the security of Tor, implementation vulnerabilities can be introduced, allowing the NSA to perform a "magic encryption/deanoymization", but it has a non-zero probability of detection by auditing its source code. Certainly, the question is whether someone is able to find it or not, but a VPN doesn't even give you a chance.
* There are multiple (currently 8?) trusted authorities in the Tor network that officially certificates the system consensus (list of available Tor relays and their status). If the NSA can compromise 5 of them, forged lists of Tor relays can be distributed. But there's no evidence that it has happened [1] in the past 20 years, unless the NSA is doing an unimaginably good job to hide it, but then, the consensus data is public and archived, it's likely only to be a targeted attack).
Overall, technically speaking, the architecture of Tor clearly offers quite a lot of technical guarantees that are significantly stronger than any VPN. Thus, I consider replacing Tor with a VPN (as in Germany) is mostly a bad idea.
[0] But more and more new relays are running on AWS, GCP, Digital Ocean, Linode, this is a potential problem.
[1] The closest call was the Debian's defective OpenSSL patch incident. Only 1 more vote was enough to control the network.