Hacker News Reader

Comment by warmlagoon | Hacker News Reader

IMHO Even thought the provider would log it is still better than not using one in a lot of cases. If whoever can see my VPN address, he would otherwise see my real address directly.

In that way he has to find a way to get the VPN provider to give out my real address. What might be possible with a lot, but for sure not with all of them.

Also think countries, my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data.

In most situations we are already way over the realistic damage done in forms of costs to catch the individual.

View on HN

Yeah, GP is right in that you can't trust VPNs (for example, PIA is probably a massive honeypot for all we know.) However, if you're using a VPN outside of the jurisdiction of the "Fourteen Eyes", you've substantially increased the effort required for anyone outside of that VPN to monitor you.

> for example, PIA is probably a massive honeypot for all we know.

Why the 'probably'? Of course, no VPN-provider should be trusted at face value, but do you know of any sources that claim that Private Internet Access is in fact an elaborate honeypot?

I was just thinking that PIA would be the perfect candidate for a honeypot, especially since it's under USA jurisdiction. Does the "probably" make it sound like I'm making a claim? I can change it if you'd like.

Yes, "PIA is probably a massive honeypot" is equivalent to "more likely than not, PIA is a massive honeypot." I don't think you mean that since you followed it with "for all we know."

> Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal.

One shot? Backdoor and reconstruct in parallel.

You meant to reply to tomjen3 https://news.ycombinator.com/item?id=10888244

I would have to agree with extra88, saying "for all we know PIA could be a honeypot" or "PIA would be the perfect honeypot" is every different from saying "PIA is probably a honeypot".

Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. The users are never going to trust PIA nor any other VPN that makes similar claims ever again. That means that they probably wouldn't spring the honeypot, if it is one, for anything but the biggest fish.

He did say "for all we know"; albeit that followed "probably a honeypot" rather than preceded it.

Frankly, I think you're all splitting hairs. Most of us understood the point he was making even if the phrasing of that sentence didn't flow as well as you may have liked.

This is not an attack on someone's use of language; merely a polite request to clarify a piece of ambiguous phrasing. If there are indeed sources that claim that PIA is acting as a honeypot, then that would be very interesting to know.

Tbh, even if PIA is a giant honeypot, if you use public wifi and pay with a gift card you purchased with cash...it doesn't really matter in any substantial way unless they are willing to put boots on the ground to find you.

If they are willing to do that, even TOR isn't real protection due to the fact it can and will be breached in the event of an active attack by malicious nodes on both ends of the circuit.

A VPN you can buy relatively anonymously [e.g. disposable gift cards bought with cash] and use with common sense [e.g. Not via your home LAN] are an effective privacy tool.

However, 99% of people aren't going to go through that level of effort which makes them nearly useless for privacy purposes.

If you're going to use public wifi, what's the point of using a VPN? Are doing it so they need to subpoena one more person before they catch you?

MitM on public wifi is a thing.

As is MitM on VPN services.

Yes but we've established the concern is someone knowing who you are, not what you are doing.

A MitM at the local wifi shop is going to know you are and what you are doing.

A MitM at a VPN you paid for with a gift card you paid with cash is just going to know which wifi shop you were at. If you never go back, odds are they can't figure out which customer you were.

Well, PIA has completely neglected to acknowledge the fact that their entire customer db was compromised recently.

I guess that sums up exactly how trustworthy they are.

Do you have a source for this?

Not any public sources, but I've personally seen a copy of the database and know that PIA was using a ridiculously vulnerable version of Kayako Fusion at the time.

"my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data."

As far as you know. And that's exactly where the problem lies. You are trusting your adversaries to be honest about who they cooperate with, which is a great way to get screwed over, because your adversaries are adversaries.

So no, it still wouldn't necessarily be "better than not using one". The tradeoff is far more complex than that.

Reply on news.ycombinator.com