N5 // Direct connection to VPN then Tor

The most argued about substitution in this subject and the one where the gap between feeling and effect is largest. It changes one thing, and that one thing is rarely what people bought it for.

Awazon Market // onion addresses

The three strings below open the same market. The same account, the same balance, the same open orders sit behind each one. Copy a string, paste it into Tor Browser, and read the last six characters in the address bar before you type a password.

awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

NOTHING HERE IS RANKED. THE ORDER IS THE ORDER THEY WERE WRITTEN IN.

Baseline

Tor Browser connecting directly, no VPN.

Substitution

A commercial VPN client running first, Tor Browser on top of it. Everything else identical.

What moves

Your internet provider sees a connection to a VPN rather than a connection to a Tor relay. The guard relay sees the VPN instead of your address.

Does not move

Which Awazon address you open, whether it is real, what the market records, the reversibility of any transfer, and whether your password was reused. Also unchanged: that a Tor connection exists, which the VPN operator can see.

Cost

A subscription, a slower path, a new party who knows both who you are and that you use Tor, and a large amount of unearned confidence.

Verdict

Buys nothing in the ordinary case. The observer it removes is the one that already saw the least.

IWhat each party sees, with and without

Party	Direct	Behind a VPN
Your provider	You used Tor	You used a VPN
VPN operator	Nothing, not involved	Who you are, and that you used Tor
Guard relay	Your address, and that you use Tor	The VPN address, and that it carries Tor
The onion service	A Tor connection	A Tor connection
Whoever owns the address you opened	Everything you type there	Everything you type there

IIThe row that decides it

Read the last row twice. The party with the most complete view of a bad session is whoever runs the address you opened, and that row is identical in both columns. If the fifty six characters you pasted belonged to a clone, the VPN carried your password to the clone with the same care it would have carried it anywhere else.

This is why the verdict is what it is. The substitution is not fraudulent and it is not useless in every possible situation. It is aimed at the layer that already reveals the least, while the layer that reveals the most is untouched.

IIIThe trade you actually made

You removed one observer and added another. The provider no longer sees Tor; the VPN operator now sees both your identity and your use of Tor, in one place, under a subscription with a payment attached to it. Whether that is an improvement depends entirely on which of the two you would rather hold that pairing, and that is a question about jurisdictions and billing records, not about security.

IVThe confidence problem

The measurable cost of this substitution is not the subscription. It is that people who make it behave differently afterwards. They skip the tail check because they are protected. They accept an address from a chat because they are protected. They fund a wallet from an exchange account in the same sitting because they are protected. Nothing in the VPN reaches any of those decisions, and the decisions are where the losses come from. A change that raises confidence more than protection has a negative balance.

VThe one shape that is defensible

If using Tor at all is the risk you are managing, because your network operator treats it as grounds for action, then hiding the fact of Tor from that operator is a coherent goal and a VPN or a bridge both address it. The bridge does it without adding a paid party who knows your name, which is why it is usually the better instrument for the same job.

IN ONE LINE

It hides Tor from your provider and shows Tor to a company you pay. Everything that decides whether an Awazon session goes badly is on the other side of it.