Tor vs VPN: Which one is better for Privacy, Anonymity and Security

The Onion Router and Virtual Private network are both the tools which people are looking for better Privacy, Anonymity and Security. In this post; I will be covering all the technical and conceptual aspects behind TOR and VPNs, and by the end of this post you will understand which technology is better suited for which purpose. So, let’s get started.

Anonymity

The first marketing point of most consumer grade VPNs as well as TOR , both of them are effectively shielding your true IP address and giving you a new one that supposedly can’t be linked back to your true location. VPNs do this by rerouting your connection through a single relay also known as hop, this relay is a server that in best case scenario is owned by the VPN provider itself and the more usual scenario is just a rented space on some other company’s server. Most providers give you the option of multiple hops but this is not a standard nor does it improve the anonymity in any way and here is why?

Your VPN provider acts as your entry and exit node they know your true IP address and they know what websites you visit, if they want to, they can log this activity at any time if they are required by law enforcement. They can hand over all your browsing data to them because many VPN services are paid and they have a money trail that leads straight to your bank account or credit card. Most cryptocurrencies aren’t anonymous anyway even worse for most VPNs signup requires providing some personal information such as your email, account name and password. These identifiers are forever tied to your browsing activity while using the VPN service.

On the contrary TOR by default reroutes your traffic through three relays, each one of the relays is operated independently and it is chosen at random. In the meantime VPN providers can create new hops anybody can run relay on TOR network, the benefit is that no single relay knows the full traffic, they only know the nearest entry and exit points. The random choice of these harps makes it very difficult for a single actor to operate more than one hub in your tour circuit and to mitigate that TOR automatically creates a new random circuit with a completely new set of relays each time you restart TOR network or roughly every 10 minutes.

So, connecting to a malicious exit node doesn’t compromise their security in the long run, this makes persistent tracking on TOR prohibitively costly and it renders mass surveillance and economical. The only successful way for a law enforcement to compromise a TOR user would be to correlate timings between their entry and exit connections. This is a lot of guesswork that requires precise targeting and loads of resources to be able to collect the data at both ends of the connection, this can’t be done on mass with current technology and only global adversaries such as the NSA or GCHQ have the capacity to successfully target TOR users. Because they already monitored the entire internet traffic. If done right, TOR can be used to escape even these targeted attacks but such option is simply not possible with any VPN provider. So the anonymity goes without any doubt to TOR .

Privacy

Privacy is a different concept than anonymity, while anonymity shields your identity, privacy hides your
activity. Many regular people that choose VPNs do so to prevent their eyes fees from spying on their browsing history and selling it to advertisers. What they don’t realize is that they are not enhancing their privacy they are just delegating the trust to a different company. Many VPN providers have been caught making money off of selling people’s browsing records but there are some reputable providers that don’t do that. However that doesn’t guarantee your ISP still can’t track your browsing history, Internet is just a network of networks, in the only way it works globally is because these networks are willing to give each other access into each other’s network through peering or transit connections or it places called internet exchange points. If your ISP meets with your VPN server on a pure network or an internet exchange point, if they can see what websites you’re visiting from that VPN server, as a matter of fact anybody within the reach of these points can do that.

TOR on the other hand is made to avoid building circuits within the same peering networks or internet exchange points that means when TOR reroutes or packets through three relays, it is traveling on three independent networks that don’t talk to each other and don’t exchange each other’s data. This successfully
mitigates the threat of adversaries like your ISP trying to snitch your browsing activity at remote servers. So, Privacy is also in favor of TOR.

Security

VPNs are all about encryption, they encrypt your data, that’s true but what’s also true is that encryption has to be supported at both ends in order to work. And VPNs encrypt your traffic on your device and decrypted on the server that they control, that means your traffic leaves your VPN network without the VPN encryption. Consumer-grade VPNs are not self-sustained overlay networks, they’re basically just tunnels that transfer your traffic to a different place before it enters the internet. TOR does the same but just about three times better, TOR encrypts our traffic three times once for each relay to individually prevent relay operators from eavesdropping on your traffic much like with VPNs. Once your traffic leaves TOR exit node, it enters the internet unencrypted, however TOR is more, than that it’s an overlay network which means tor can host onion web sites, these onion web sites are part of the tour encryption so if you are using TOR to access onion servers your entire traffic from the moment your device initiates the connection all the way through to the encrypted onion server is fully encrypted and hidden from the clear internet. You can’t do that with consumer VPNs and so TOR wins this round again.

Trust