Re: Et Tor?

J'avais lu - peut-être même en ces lieux - que télécharger un pdf (ou un autre fichier) pouvait permettre d'aider à identifier qui le téléchargeait.

Cela dit, ça date, et ça a peut-être changé, considérant ce qui est exprimé dans la politique de Tor
(et dans ce cas, au temps pour moi) :

The existing way that the user expects to use a browser must be preserved. If the user has to maintain a different mental model of how the sites they are using behave depending on tab, browser state, or anything else that would not normally be what they experience in their default browser, the user will inevitably be confused. They will make mistakes and reduce their privacy as a result. Worse, they may just stop using the browser, assuming it is broken.

Pour en revenir au sujet initial, la FAQ de Tor donne des arguments intéressants contre l'usage d'un VPN pour naviguer de façon anonyme (ce qui ne supprime aucunement d'autres avantages d'un VPN par ailleurs, sur lesquels ils ne s'expriment pas).:

Is Tor like a VPN?

Do not use a VPN as an anonymity solution. If you're looking for a trusted entry into the Tor network, or if you want to obscure the fact that you're using Tor, setting up a private server as a bridge works quite well.

VPNs encrypt the traffic between the user and the VPN provider, and they can act as a proxy between a user and an online destination. However, VPNs have a single point of failure: the VPN provider. A technically proficient attacker or a number of employees could retrieve the full identity information associated with a VPN user. It is also possible to use coercion or other means to convince a VPN provider to reveal their users' identities. Identities can be discovered by following a money trail (using Bitcoin does not solve this problem because Bitcoin is not anonymous), or by persuading the VPN provider to hand over logs. Even if a VPN provider says they don't keep logs, users have to take their word for it---and trust that the VPN provider won't buckle to outside pressures that might want them to start keeping logs.

When you use a VPN, websites can still build up a persistent profile of your usage over time. Even though sites you visit won't automatically get your originating IP address, they still know how to profile you based on your browsing history.

When you use Tor the IP address you connect to changes at most every 10 minutes, and often more frequently than that. This makes it extremely dificult for websites to create any sort of persistent profile of Tor users (assuming you did not identify yourself in other ways). No one Tor relay can know enough information to compromise any Tor user because of Tor's encrypted three-hop circuit design.

L'argument central est qu'on peut forcer le fournisseur de VPN à céder les informations qu'il détient sur ses clients - cf l'affaire récente avec ProtonVPN - et que l'usage d'un VPN n'empêche pas le traçage des utilisateurs.
Cela dit, je me demande si l'utilisation d'un site sur lequel on doit s'identifier, que ce soit à travers un VPN ou le réseau Tor, n'est pas déjà un risque en soit, puisque le site lui-même peut avoir accès à notre identité. L'IP change peut-être toutes les dix minutes, mais le compte connecté reste le même.