Thank you! Your reply made me realize I had some things mixed up in my head. Please let me know if I've understood things correctly as outlined below. Sorry for long text.
4 scenarios seen from the perspective of the first party one communicates with
Tor browser over Tor network - We don’t know who the visitor is, it can be anyone. * While we do have previous visits from this IP and this browser fingerprint we don’t know if those visits were made by the same 1 person or 10 000 different persons so we cant build a profile
Tor browser over VPN - We might know who the visitor is * While the visitor have a Tor browser fingerprint he is coming from a IP we have had visits from before, and a VPN only have a limited amount of users and our website isn’t that popular so with x% probability it is the same person as visited us before. Can build a semi-probable profile depending on how the amount of visitors we have
100% session spoofed Firefox over VPN - We don’t know who the visitor is, it can be anyone * While we do have previous visits from this IP the browser fingerprint have been completely unique on all those visits so we don’t know if they were made by 10 000 real different persons or just 1 person faking all of them. Cant build profile
“Generic” Firefox over VPN - We probably know who the visitor is. * Yes the visitor uses a VPN but it doesn’t matter because we have seen this browser fingerprint before, as no matter how much the visitor tries to make its browser generic it is impossible and will still be unique in like 1 of 100 000 browsers which is enough to identify it (combined with added uniqueness of limited number of IPs the VPN provides to connect from). Can build profile
Best options for different activities:
Type 1: Browse youtube, reddit etc anonymously Good: - Tor browser over Tor network - 100% session spoofed Firefox over VPN
OK: - Tor browser over VPN
Bad: - Generic Firefox over VPN
Type 2: Doing things where I want/need to provide personal information, eg bank, facebook, amazon
Good (doesn’t really matter which one since you identify yourself anyway?): - 100% session spoofed Firefox over VPN - Generic Firefox over VPN - Tor Browser over VPN
Bad: Tor Browser over Tor network
Conclusion: This reasoning leads me to a 100% session spoofed Firefox being a Good method for both Type 1 and 2, but in practice impossible to setup, so a 2 browser setup is a good stratergy? Tor Browser over Tor Network for anonymous Type 1 browsing like youtube and a Generic Firefox Browser over VPN for personal browsing like online shopping (better than Tor Browser over VPN as would want to use Ublock etc to prevent 3rd party tracking)