New: a threat-model-first guide to choosing your network defence, plus the nym-smoldvpn dVPN package and nym-swizzle sender hygiene.
Network
Threat Model
Configurations
VPN

Centralised VPN

✅IP hidden · P1@L2❌Req-unlink · P2@L2❌Local net · P1@L3L❌Global net · P1@L3G✅Fast
L2The destination✅P1❌P2

Sees

  • VPN exit IP
  • All requests and contents

Can't see

  • Client IP

Residual / countermeasure

  • Within a session requests stay grouped by connection state; across sessions the exit IP re-identifies the client.
L3LLocal network observer

Sees

  • Activity fingerprint (no in-transit protection)
L3GGlobal network observer

Sees

  • Both ends: a single operator can act as a global observer

Pros

  • Fast

Cons / mitigations

  • A single operator sees both ends
  • Add timing and content discipline

Fit

  • Fast IP hiding, but weak unlinkability and a single trusted operator

Verdicts and the latency implied by the path are an illustrative model, not measured values.

UnprotecteddVPN · single exit