07/12/2019
Re: why exactly is it bad to use VPN + TOR?
One of the core tenets of building secure systems is that you minimize the attack surface, and resist additional components and features wherever possible to keep in line with this. As such, if one cannot identify a strong reason to include a component in the system, and quantify that reason against the threat model, the additional component should not be included. This question is worded in a way that assumes that the VPN provides some benefit, and that removing it is what should be questioned, when in fact the inverse is true: the correct question should be whether adding a VPN layer to Tor provides any tangible benefit. Only when such a benefit has been affirmed should we entertain including it.
This depends on your threat model, local laws, OS setup, behaviour, and a number of other factors.
For example, let's assume you're a journalist trying to keep your identity quiet because you're studying a police corruption case. If your country's ISPs are protected by common carrier rules (i.e. the messages sent are legally protected in the same way that physical mail is) then transmitting content via the VPN is risky - the VPN provider isn't a common carrier and therefore doesn't have the same legal protection, but certainly does have information about you (billing information).
You've also got the problem that you're adding an additional point of failure. Your security relies upon both the VPN and Tor being safe - compromising one of the two means you're identifiable. Additionally, by connecting to a VPN you usually have routing rules which send LAN traffic through the VPN. This means that non-Tor data (e.g. NetBIOS, WINS discovery packets, DNS, OS / application update queries, etc.) might get sent through that same VPN channel, resulting in a log of your Tor and non-Tor behaviour occurring at the same time through the same endpoint.
The other problem is that commercial VPNs marketing themselves as privacy tools are obvious targets for threat actors. This means that by using the VPN, you might actually end up in a situation where someone has already compromised the server - it's not like you've got annual pentest reports from the VPN provider to take a look at and check they're running sensible and up to date systems. The benefit of Tor, in this regard, is that the communications are decentralised and distributed, which makes it much more difficult to focus attacks and traffic analysis from a logistics perspective.
I'd argue that the benefits of running Tor over a VPN are tenuous at best. The promise of additional privacy or security isn't backed by anything tangible or measurable, aside from the perception that complexity adds security.
Regarding your edit, if the person is using Tails and safely uses Tor, it makes no difference whether you just use Tor or use a VPN with Tor through it really. Which comes down to the crux of it: what does adding a VPN give you? I can't see any case where it provides any additional anonymity, particularly against a nation state, and then you've got the problem that if you're connected to some open WiFi somewhere (e.g. a cafe) you're then potentially tying your identity (from the VPN billing details) to your location, and the fact that you're using a VPN plus Tor. Not ideal if you're a journalist in an oppressive state, or a drugs trafficker trying to keep himself hidden.
Regarding your comment below as to why the VPN might be an addition point of failure, consider that some states would consider you in violation of a law if you simply used Tor. If you only use Tor, it becomes quite difficult to identify who you are if you're using public infrastructure like open WiFi or municiple networks. Once you add the VPN in, you add a direct purchase record back to your name and address. Not ideal.
At the end of the day, designers of secure systems should be resistant to adding additional components and features, due to the additional complexity and potential for unforeseen problems. This means that you should consider what benefit is added by including a VPN in your chain. I can't really see one, aside from a situation where use of Tor would be illegal but use of a VPN to another country would not be illegal (I'm unaware of such a case existing).
One additional potential issue, which I forgot to mention above, is the increase attack surface against the client-side. By adding in a VPN client on top of the Tor client, you've got another piece of software which may contain bugs (e.g. remote code ex*****on).
As an aside, I'd also like to point out that VPNs are not and never were designed to be privacy or anonymity tools. They are marketed as such by people who sell VPN services, but any anonymity or privacy you gain from them is incidental rather than purposeful. They cover but a fraction of the threat landscape in this space; mostly they're only useful as a tool for avoiding ISPs' blocking of certain sites (e.g. torrents). Nobody who is serious about anonymity and privacy, particularly in a situation where their safety, freedom, or even life is on the line, should ever use a VPN as their privacy solution.
Additional edit: There is one very specific circumstance where adding a VPN does provide additional security, and that's when VPN traffic won't draw attention but Tor traffic would. This is the only case where a VPN offers a benefit, at the potential cost of increased identifiability should someone actually take a look at what was sent through the VPN.
