Can someone point me toward how to get TOR and VPN for my Macbook Air- need to cover my tracks emailing A

[danilion]

I have looked through the resources and searched. I think I saw it somewhere once, but I can't find it now.
I don't even know what a TOR is or how to get a VPN. I am NOT tech-savvy at all. I just know I need them.

If there is a quick explanation you could send to me or point me toward a post that is already written, then I would appreciate it. The only one I could see was for Windows when I searched.

Thank you :)

 

[WhatIsMyLife]

Tor is a proxy browser. You can get it by simply downloading it. A VPN is also easily attainable. Although it costs money. I personally use PIA, but just have a look for reviews of various VPN services, and choose the one that looks best to you.


Also, use Protonmail as an email when emailing A. It encrypts all your email so nosey authorities can't read them.

 

[danilion]

I do use Pronton Mail. I wasn't sure if you can use TOR on iOS systems (I read somewhere you can't)

Tor is a proxy browser. You can get it by simply downloading it. A VPN is also easily attainable. Although it costs money. I personally use PIA, but just have a look for reviews of various VPN services, and choose the one that looks best to you.


Also, use Protonmail as an email when emailing A. It encrypts all your email so nosey authorities can't read them.

 

[Xunnsu]

Have you looked into this?

Onion Browser - Free to be you.

Onion Browser is your trusted connection to Tor on iOS.

onionbrowser.com

 

[danilion]

Have you looked into this?

Onion Browser - Free to be you.

Onion Browser is your trusted connection to Tor on iOS.

onionbrowser.com

No, I havent but I will. Thank you

 

[Living sucks]

Do you think your situation stemmed from not using a secure browser? It was still an encrypted email.

 

[PeachBlossoms2310]

I am not exactly tech-expert, but I think having either TOR or using a VPN would suffice.

 

[TheNorthernSilence]

The Onion Browser seems to be for the iOS only so you can't use with your Macbook because it uses macOS.

The Tor Browser is available for macOS also, you can get it here: https://www.torproject.org/download/

Install that, I think you're good with the default settings it offers. When you open the browser, don't resize the window to full screen because it could give information about your Macbook's resolution.

You don't need to use a VPN with TOR. ProtonMail has a TOR/.onion site which you can find at dark.fail (open with the Tor Browser).

 

[Notabadguy]

I have TOR (I never use it), and I have protonmail. Is it not enough using protonmail to email A?

 

[enjolras]

VPN or Tor are no perfect solutions covering you 100%, even combined

There are different levels of privacy (and non-anonymity if messing up service choices and acquisition steps) to achieve from using one or the other, or both and how they're arranged. In that order (worse to best)

6) VPN service with good practices, namely : no logs policy, can be purchased by creating an anonymous account (w/ a unique disposable / created for the purpose email, why not from Tutanota.com) behind a .onion address (i.e. ExpressVPN) and/or paid by cryptocurrencies (i.e. ProtonVPN, ExpressVPN, AirVPN)

5) VPN service with 6) requirements, plus an extra ability : double VPN server loop (2nd server acting as backup) to secure a disconnection of the 1st server revealing ISP (i.e. Advanced ProtonVPN paid plan, connecting to "Secure Core" servers)

4) Tor browser (offering to hide behind multi-level of nodes, hard to track for LE but not impossible) ...then it's recommended to use .onion version of sites, including for ProtonMail (the address can be found by loading the address dark.fail into the Tor browser), although it will load the site (very) more slowly

3) VPN + Tor ...stacked as "Tor over VPN".
Basically, you first connect to your VPN server (i.e. ProtonVPN, free or paid plans, +/- through a "Secure Core" one if you purchased the Advanced plan), then use the Tor browser to browse the internet, preferably loading .onion address versions of targeted sites (these onion addresses can be found usually on the frontpage of the normal URL site, a search engine research, or dark.fail loaded on Tor for DarkNet Markets + commonly anonymity/privacy oriented sites)

2) VPN + Tor ...configured as "VPN over Tor". This has a pre-requisite to use a compatible VPN service which allows the protocol setup.
Case : the VPS service purchased permits the configuration but requires some involvement with the setup = some difficulty (i.e. AirVPN). Drawback of the specific tunneling : it does not allow to browse .onion sites using the Tor browser, only normal addresses, whether from Tor or regular browsers.

1) VPN + Tor ...configured as "VPN over Tor" (again). This has a pre-requisite to use a compatible VPN service which allows the protocol setup (again).
Alternative case : The VPN service has implemented an arranged implementation behind the scenes to achieve a simplified ease of use (i.e. ProtonVPN paid plans), which will allow to navigate at .onion sites from regular browsers (advised privacy oriented ones are : Epic Browser or Brave) , not requiring to use the Tor browser. Minimal adaptation of the browser might be required to adapt loading .onion sites

How to access the Tor network using Proton VPN | Proton

ProtonVPN has a built in Tor VPN. How to connect through to the Tor network and access Onion sites with a single click. Read our simple step by step guide.

protonvpn.com

By the way, open to debate if there's disagreement on the order, especially the final rankings between 1 and 2 if an assumption error was made about the most secure config, or if you can provide precisions anywhere (for instance, haven't been a client of AirVPN since a long time. It could be complicated before, hence not optimal if fucking up the settings)

—————————

In general, for those who'd want to keep it simple, efficient and free, 3) would be the recommended way to go (then the VPN choice will be ProtonVPN free plan)
Those who are willing to pay and go the extra mile with more efforts (notably VPN purchase through cryptocurrencies instead of card or PayPal), up to solution 1)

———————

Sensibilisation articles

Tor and VPN: how well do they mix?

And which is the best way of implementing them together?

www.techradar.com

How to Combine a VPN and Tor Browser for Online Anonymity

Tor and VPN are both tools for privacy and anonymity, but they work in very different ways. Here’s how to combine them for maximum security.

www.expressvpn.com

Tor over VPN explained | Proton

Tor is a powerful tool for browsing the Dark Web anonymously, but your ISP can still see your activity. By using a VPN you add an extra layer of privacy.

protonvpn.com

 

[Notabadguy]

VPN or Tor are no perfect solutions covering you 100%, even combined

There are different levels of anonymity to achieve from using one or the other, or both and how they're arranged. In that order (worse to best)

4) VPN with good practices, namely : no logs policy, double VPN server loop to secure a disconnection of 1 server revealing
ISP (i.e. paid ProtonVPN plan), can be purchased by creating an anonymous account behind a .onion address (i.e. ExpressVPN) and/or paid by cryptocurrencies (i.e. ProtonVPN, ExpressVPN, AirVPN)

3) Tor browser ...then it's recommended to use .onion version of sites, including for ProtonMail (the address can be found by loading the address dark.fail into the Tor browser), although it will load the site more slowly

2) VPN + Tor ...stacked as "Tor over VPN". Basically, you first connect to your VPN service, then use the Tor browser to browse the internet, preferably .onion site addresses

1) VPN + Tor ...configured as "VPN over Tor". This requires to be involved with configuration so is more difficult than solution 2) and as a pre-requisite equires a VPN service which allows this setup (i.e. AirVPN). It also does not permit to load .onion as a drawback

————-

In general, for those who'd want to keep it simple, efficient and cheap, 2) would be the way to go.

I'm writing a draft guide from memory, that I will refine later from verification (same for this post). Stay tuned

I'm able to do solution 3. Is that enough?

 

[HelensNepenthe]

In the best interest, grabbing a copy of Tails from here and burning it onto a USB using the instructions here would be your best starting point. Once you've burned the image of Tails onto a USB, hold down the 'Option' key on your Macbook. You'll see EFI USB pop up. Launch it and it'll boot up into Tails. Read over the Tails FAQ if you have any questions. Surely some of your questions can be answered from it.

Having a Tails USB will allow you to access Tor while in addition to having everything onto a USB drive. Once you restart your computer, the data on Tails is erased because Tails runs in your RAM. RAM is non-volatile meaning when you restart your computer, data cannot be accessed. Unlike with traditional hard drives or solid state drives those can be accessed if the police had a warrant. If you enable persistent data on your Tails installation, data will be stored onto the USB and you'll have to decrypt it upon startup. More information on persistent data can be found here.

Once you're in Tails you'll want to click on the shield icon in Firefox. Make sure you have the highest security enabled on the slider. If in the chance you come across a site that runs Javascript, your identity could be revealed easily. When you have accessed Tor using your Tails installation, ProtonMail's Tor address is https://protonirockerxow.onion/ and that can be verified using the dark.fail site or ProtonMail's very own website. If A had better intentions for his clients, he would use PGP encryption through email. ProtonMail is not "secure" or email in any sense. ProtonMail at any time could obligate to a warrant. Generally they don't follow any warrants until Swiss law approves them. With COVID-19 going around, state law offices are not all up and running. For the folks who swear by ProtonMail, reminder that they certainly were involved in the process of arresting a 19 year old script kiddy.

- - -

Opinion on VPNs

(Read below)

VPNs are garbage by design. There are few cases where a VPN solution would work (and even enterprise VPNs have their solutions too), but those are limited. If you're on a hostile network at a Starbucks or want to get around geo-region locks. There is little to nothing that is "encrypted" about VPN. They simply don't magically out of thin air encrypt data. VPNs are glorified proxies. All VPN provides are setting up OpenVPN clients and reselling bandwidth at huge markups for people looking for "privacy" or "anonymity". Both which are two different and are not interchangeable.

Generally speaking, your chances that your VPN is a honeypot is a lot more likely, especially when you're wanting "privacy". Logless VPNs? Aren't those an issue if you ever go to customer support? Have you seen a public security audit on the company to verify the integrity that the company you bought your VPN is logless? Probably not.

While a little bit more technical, purchasing a VPS and using this is a way better solution. Of course assessing your threat levels is something to consider. It's unlikely you're a target, anyway. You wouldn't be using a public forum if you were concerned of being on some sort of list.

If you need to use a VPN over your Tails installation, you'll want to use SSH. If you want a recommendation for a VPN provider, I'd use Mullvad. Mullvad only has registrations with a string of numbers. Write on a piece of paper with your account number in addition to the amount you want to pay for. Alternatively you can follow on their site how to use cryptocurrency. Cryptocurrencies like BTC can be linked back to you with forensics. You really should consider purchasing at an ATM or washing your currency. You could also trade BTC --> Monero --> back to BTC. Tails has Electrum wallets built in.

Because you are providing an address to A, you still could be prosecuted under your country's laws. These are ways of covering your ass and having potential legal risks negated. Only a lawyer would be able to give you advice.

Once you've received your N, I would strongly encourage destroying your USB. No sense in having that singular device trace back to you.

 

[enjolras]

@Notabadguy I've edited my message that talks about the various solutions. If everyone could go for 3), it does not take much efforts and would already be a major step forward. (That said, by principle I also agree to take more powerful actions like Tails OS developped by @HelensNepenthe as an alternate first step protection ...but it seems everyone is asking for simplicity, I'm repeated each time :()

I'm currently writing a proposal for 3) with only free softwares (and no extra hardware like USB stick. Reminder : Tails is encouraged beforehand, in priority)

 

[HelensNepenthe]

In overly simplified terms, running a VPN while connecting to Tor will taint your traffic. Tor (and Tails) creates local state separation. This local state separation is protecting you. You're pleading for your life that your VPN won't comply to a police investigation. Your payment method cannot be traced back to you either. If you paid in cash, you could be okay. If you padi through cryptocurrency through an exchange, you can be identified in blockchain and traced back. If for some reason your ISP blocks Tor connections, there are safe ways of circumventing Tor blocks with pluggable transport. In addition that you can only connect to your VPN while on Tor. Otherwise you've ruined any "privacy" or "anonymity". You've given a single point of entry to who you are. You gave a fingerprint to who you are. Unmasking any protections that Tor would have gave you without a VPN.

Proton's advertisement is a little devious to drive sales. This isn't exactly surprising to say the least. See the attached video below.

 

[enjolras]

Yes, a separation is ultimately better, be it from technology (OS / device) or physical (one could also install Tor at the computer of a far hotel lobby room or cybercafe, but then watch out for registration or cameras lol wear a hat and spy glasses ;))

Integrating a VPN indeed requires trust into the provider, regarding the storage of the individual information (if collected), the juridiction that should be out of reach from the predation of invasive administrations (sometimes called "5 or eyes" or 11, which includes anglo-saxon countries, the European Union, etc) and also the fact they're technically competent so you don't suffer from a failure on their side (software program, servers)
ProtonVPN has its headquarters in Switzerland (outside the EU), but I think their datacenters are in Poland (or a nearby country but in the EU). ExpressVPN is established in the British Virgin Islands (or so they say hum). Another example, with Mullvard, located in Sweden

How we handle government requests for user data

What we do when a government entity approaches us for user data, and why.

mullvad.net

You have to do your research to verify the info (that sometimes will be in part hidden due to commercial reasons I agree) and make an educated guess you'll be comfortable with

If it's possible to pay the VPN by cash, do ! (it is possible with ProtonVPN, you send cash in an enveloppe to Geneva in Switzerland, specifying the login you created prior during the registration).
Usually Monero is not accepted directly (Bitcoin, Ethereum, Litecoin typically are) but should be the first crypto acquired then converted into your need (I'm also researching the topic and will share my optimisation of a simple anonymous crypto route with Monero when I'm completed, in order to achieve easy default level of pay,ent protection)