Hacker News new | ask | show | jobs
by xioren00 1910 days ago
"User > VPN > Tor > VPN"

This suggests to me the author is giving advice based on paranoia rather than technical knowledge.

4 comments

>This suggests to me the author is giving advice based on paranoia rather than technical knowledge.

I noticed that immediately on the home page. The author suggests installing and running some sort of python package to verify the pdf is harmless. That sort of makes sense, until you realize that installing a random python package and running it is exposing you to far more risk than a opening a pdf ever will.

> exposing you to far more risk than a opening a pdf ever will

Have you looked into pdf vulnerabilities? I'd say they're about equal

There are javascripts exploits as well. Do you never enable scripts? If you do enable scripts, do you vet the websites you enable scripts on as thoroughly as you random executables off the internet?
Are we in disagreement here?
Why is do you suspect this?

It makes sense to me that you would want to hide from your ISP and whatever service you're using that you're using Tor.

More complex =/= more secure. Tor, Whonix, Tails, et all have sections in their wikis covering potential tunneling setups and their thoughts on efficacy and rationale behind them.

From the Tor wiki:

> You -> X --> Tor --> X

> No research whether this is technically possible. Remember that this is likely a very poor plan because [#You-Tor-X you -> Tor -> X] is already a really poor plan.

Fair enough. While I'm comfortable saying I'm more competent at such things then a layperson, I'm definitely not actually competent.
I don't think the author is recommending that, just discussing it...

The guide recommends using a VPN over TOR in "specific cases", for example "when your destination service does not allow Tor Exit nodes", and for "VPN over TOR over VPN" they say it's not recommended because "it is just VPN over Tor but slower".

The whole "guide" is just constant surface-level knowledge. Looking over the "Don't roll your own crypto" made my brain ache.

Although, I didn't expect much considering the guide is created by the same people who made privacytools.io. Another hilarious site.