Because if I was running SIGINT at the NSA and collaborating with the FBI to arrest activists, the very first thing I would do is start up a bunch of VPN providers that bill themselves as "private" and then log everything aggressively.
The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes about Tor users being "de-anonymized" when VPN users are never "anonymized" to begin with. I would make sure these anecdotes never clarify whether it's "Tor users accessing Hidden Services and getting popped by a Firefox exploit" or "network attack that enables traffic correlation" so everyone fills in the blanks and assumes Tor is dangerous, when it isn't, thereby pushing activists to my VPN services.
After all. There is no real enforcement mechanism if a "private" VPN lies.
https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...
An unfortunate factor at play in these matters (and that I note in the article) is that the intelligence services are known to run the occasional shell company [0]. It seems likely that some privacy-oriented providers are actually intelligence fronts - because if you were running an intelligence collection agency an obvious thing to try would be a privacy-focused email company or something.
If it isn't built on a trustless model it isn't trustworthy.
My first post in this thread has a link that explains why VPN services aren't trustworthy.
But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN.
Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor.
The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model.
https://www.malwarebytes.com/blog/news/2024/10/tor-browser-a...
Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN.
If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate.
Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.
https://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-lea...
Sure. But with a limited budget (of both the financial sort and the effort sort), this just isn't feasible. Who the hell wants to manage not one but twenty seemingly private industry vpn companies? Can they even reach break even status so that it's not a drain on the budget? How long for that? Worse, it entangles their revenue with that of the NSA, making the NSA more vulnerable to the sort of leaks they don't like to have, exposing them to foreign intelligence services and even journalists.
>spread vague anecdotes about Tor users being "de-anonymized" when V
Ulbricht found out the hard way. When you've got every fiber tapped around the world, it becomes trivial to deanonymize Tor users. Granted that it's nearly impossible to climb to the top of the US government's shit list like he did, but if you do manage the feat, they'll know who you are within days.
They didn't find Ulbricht by hacking the Tor network to deanonymize users.
Once he was identified, they trolled through his internet history to find something that if they were luckier than any investigators ever they might have found without cheating. Then claimed they actually did that. It was all horseshit. None of this is controversial. Didn't even have to hack Tor, traffic analysis sufficed.
> When you've got every fiber tapped around the world, it becomes trivial
These phrases are in conflict.
If their budget is limited, we shouldn't expect them to be able to trivially tap the whole world.
If tapping the whole world is trivial, they probably have the resources to spin up some VPN front companies. Or more likely, suborn existing VPNs.