I’ve posted about this before, you can grab my post history and you’ll find it. In short the people you need to worry about don’t care about VPNs, they use heuristic matching of behaviors. If I can write one in a weekend that can identify folks at a company with 95%+ accuracy using nothing more than mysql, Squid, and router logs you know damn well an actual trained programmer has made something miles better then I did 20 years ago.
Really Short version:
How many people out of 8 billion around 7 AM open 3 tabs with Drudge Report, Slashdot, and Reddit?
Lets Say 400 million.
We’ll call that pattern DSR@7
Then who at 1 PM CST checks ESPN? Lets Say another 400 million.
Well Call that pattern E@7.
But the magic is who has both DSR@7 AND E@7 Thursdays and Sundays But not Mondays?
The answer is 8. 8 people out of 8 billion open those three tabs only on Thursdays and Sundays with a confidence greater than 95%.
This gives us three things:
An identity, An Address, a Behavior.
The question is linking the three. Eventually you screw up and leak something that allows the 4th part: A person, to be associated with the first three at a given time.
No one cares if the address changes a billion times.
If 10.0.0.3 has ABBADC@7d4 on a Thursday and the next day Friday 192.168.2.66 also has ABBACD@7d4 there is a chance that is the same identity. The more behaviors, the more likely.
So if you sampled the traffic at a major core switch and could build a table of behaviors you find out real quick that despite 8 billion people on the planet only a few will share complex behaviors if you take 1 hour sample blocks.
So yeah regardless of VPN unless you can really shake up your viewing habits good old Pr0nhub will help them ID you every time as you search for the same types of videos and those favorite 3 stars with those 2 specific kinks at 11 PM EST because your spouse went to bed an hour ago and it is me time. You then fire up the same 2 hour rain video to help you sleep but don’t check Drudge on Holidays because you work for the state and sleep in on holidays.