When Data Leaves Your Network

What Happens When a Packet Leaves Your House

• Your ISP sees everything unencrypted and all metadata for everything else
  • DNS queries unless you're using DoH/DoT — which ISP DNS resolvers log by design
  • Which IPs you connect to, when, how much data, how often — retained by law in many countries
  • In the USA: ISPs legally sell this to data brokers — your browsing history is a product
• The destination sees your real IP address
  • Geolocation to city level is trivial — any IP lookup service does it in milliseconds
  • Correlating your activity across multiple sites using the same IP is standard ad-tech practice
• Every router hop between you and the destination sees packet headers
  • Source IP, destination IP, port, timing — all visible even with full HTTPS encryption
  • Traffic analysis attacks are real: volume plus timing alone can fingerprint what you're doing
• Nation-state and large carrier surveillance
  • Deep packet inspection at backbone level — not hypothetical, documented in Snowden disclosures
  • Bulk metadata collection correlates millions of users — you don't need to be a target to be in the data
• Your browser and apps leak identity by fingerprint
  • Font rendering, WebGL, screen size, extension list, timezone — unique without any cookie
  • JavaScript fingerprinting identifies you across sessions even with a VPN and fresh cookies
• The core insight: HTTPS encrypts content, not identity
  • HTTPS hides what you're reading — it does not hide who you are or who you're talking to
  • Everything above happens to HTTPS traffic — encryption is necessary but not sufficient

The Fundamental Truth About All of This

Every privacy tool moves trust somewhere. None of them eliminate it.

• When you use a VPN
  • You stop trusting your ISP with your traffic — you start trusting your VPN provider instead
  • The VPN provider sees everything your ISP used to see, plus your real identity from payment
  • If the VPN logs and cooperates with authorities, you have less protection than you thought
  • If the VPN is operated by an intelligence agency — some are — you have none at all
• When you use Tor
  • You distribute trust across three relays — no single relay sees both who you are and your destination
  • You trust that your adversary does not control enough of the Tor network to correlate
  • Exit node operators see your unencrypted traffic if you're not using HTTPS at the destination
• When you use I2P or a mesh network
  • You trust the peers in your network — fine if it's your own infrastructure
  • A fully decentralized network means your traffic routes through strangers you can't vet
• When you self-host
  • You trust your own infrastructure, your operational security, and your VPS provider's honesty
  • The strongest model for specific use cases — and the most work to maintain
• The question is never "does this give me perfect privacy?"
  • It doesn't. Nothing does. The question is: who do I trust, and with what specifically?
  • Define your adversary before choosing your tool — the right answer depends entirely on your threat model

VPNs — Moving Your Trust to the Tunnel

Source: windscribe.com · riseup.net/en/vpn · mullvad.net

Tor — The Onion Router

Source: torproject.org/download

I2P and Lokinet — Deeper Anonymity Networks

XRAY — Your VPN Is a Website

Source: github.com/MarcusHoltz/hidden-vpn-that-looks-like-a-website

VPN over Port 53 — When Every Port Is Blocked

Source: github.com/MarcusHoltz/vpn-over-port-53

Private Mesh Networks — Build Your Own Internet

Choosing Your Tool — The Honest Comparison

• Daily ISP privacy: Windscribe or Mullvad VPN — simple, effective, specific guarantee
• Sensitive browsing: Tor Browser, always with HTTPS at the destination
• Bypassing national censorship/DPI: XRAY Trojan self-hosted on a VPS you control
• Your own infrastructure: Tailscale (easy) or NetBird/Nebula (self-hosted control plane)
• Maximum metadata protection: I2P or Tor hidden services — never touch clearnet for sensitive activity

Tor Hidden Services — Put Yourself on the Onion Network

Source: github.com/MarcusHoltz/tor-hidden-service

Opsec — The Part the Tools Can't Fix

• The weakest link is almost never the cryptography
  • Tor is secure. Logging into your real Gmail over Tor is not. The cryptography held; you didn't.
• Compartmentalization — keep identities strictly separate
  • Never mix real-name accounts with anonymous ones — not in the same browser, not on the same device
  • Tor Browser handles session separation automatically: fresh identity on every restart
  • For strong separation: create accounts only over Tor, never reuse usernames across contexts
• Metadata is content — take it as seriously as the data itself
  • "I only care about the metadata" — former NSA Director Michael Hayden, on why metadata is enough
  • Who you talk to, when, for how long, how often — tells a complete story without reading content
  • Timing attacks: you send a message, a suspicious person receives one seconds later — correlation possible
• The browser fingerprinting trap
  • Tor Browser standardizes fingerprint across all users — that's the protection, not the Tor circuit
  • Installing extensions, changing settings, or maximizing the window breaks the uniformity
  • Use Tor Browser exactly as it ships — resist every urge to customize it
• The account problem — the most common failure mode
  • Any service requiring account creation links your activity to that account permanently
  • Anonymous Tor traffic provides zero protection if you then sign into a Google account
• Physical layer — often overlooked entirely
  • Where are you when you connect? Coffee shop cameras. WiFi MAC address visible to the AP.
  • Randomize your MAC address — most modern OS support this — especially on untrusted networks
  • Burner devices and SIM cards exist for situations where the physical layer matters

The Full Stack — Device to Network to Beyond

YOUR DATA
    |
    ▼  ← TrackerControl / WFC / OpenSnitch / Little Snitch
[ Device firewall ]  — blocks apps from calling home on your device
    |
    ▼  ← OPNsense: ntopng, Suricata, DNS blocklists, IP blocklists
[ Your router ]  — network-level visibility and blocking for all devices
    |
    ▼  ← VPN / Tor / XRAY / Tailscale
[ Encrypted tunnel ]  — hides traffic from ISP, obscures destination IP
    |
    ▼
[ Exit point / Relay network ]
    |
    ▼
[ Destination ]

• Just ISP privacy + ad blocking: OPNsense + DNS blocklists + Windscribe or Riseup VPN
• Sensitive browsing: Tor Browser for sensitive sessions; VPN + device firewall for everything else
• Self-hosting without IP exposure: Tailscale for device mesh + Tor hidden service for public access
• Bypassing censorship/DPI: XRAY Trojan on a self-hosted VPS with a decoy website on the same IP
• Every port blocked (hotel/corporate NAT): VPN-over-53 stack — WireGuard → DNS tunnel → XRAY/443
• Maximum separation, high threat model: Tails OS + dedicated hardware + MAC randomization

Resources