VPNs are not the solution to a policy problem
asininetech.com
asininetech.com
The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i'm guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.
I personally believe in user responsibility for personal privacy and security, where you can't and shouldn't depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:
1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn't apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they're privacy rights have been violated, that same advice doesn't apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.
2. Governments are a major party in privacy violations and are conflicted, so they can't be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.
3. Similarly, government can't be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama's campaign promises and what he delivered[1], and this isn't unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.
4. Tech solutions to privacy doesn't imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.
5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer's reporting in the NYTimes on data brokers[2]
6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.
7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]
It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn't a waste of time but it can't be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of what 'use WhatsApp, use Signal' is for user security, what 'install antivirus, don't click on attachments' used to be for user security and the growing popularity and awareness of ad blockers.
I'm not sure what that will be or what it will look like, but warning people away from VPN's probably isn't going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS/encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.
Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.
[0] https://www.wired.com/2016/11/despite-trump-fears-snowden-se...
[1] https://www.forbes.com/sites/thomasbrewster/2016/11/10/edwar...
[2] http://www.nytimes.com/2013/09/01/business/a-data-broker-off...
[3] https://www.techdirt.com/articles/20150115/07074929705/remem...
I think this is a bullshit argument. Nobody looks after their home security or personal security the way we expect users to be careful of their privacy, nor do we accept the amount of intrusions into our house or personal space as we are told is reasonable in information.
Imagine you could get a free pizza every week, you just need to let the driver go through your house and correspondence. Imagine if you had to sign over the risk that your house might be burgled if you signed up for a bank account...And the police didn't act on it.
These examples seem ludicrous, but that is not because I'm making them like this, it's because the premise that we all do "personal responsibility" is a myth.
We have police, laws, community rules, all of these things to protect our houses and personal security. If you leave the door unlocked, robbing it is still a crime. Likewise, if you walk around on an unsafe neighbourhood and get robbed, it would be ludicrous to hear "well, the city warned you that part is unsafe, so the police isn't going to investigate"
The irony of this statement is that this actually happens quite often in certain east of the track neighborhoods, especially when the victim is a minority. It goes to show that this attitude, while I don't agree with it, isn't so far from the reality as you might think.
Coming from out west, this is one of the cultural reasons I am pro-gun. The police are just there to draw the chalk line around your body, it is your responsibility to defend yourself, your loved ones, and your home.
Always remember that the constitution was created to protect, not establish rights, rights that you have independent of the constitution itself, and of these rights, the right to self defense is one. The second amendment is simply about defense against tyranny. Even if you got rid of the second amendment I still have the right to bear arms.
Which makes me wonder, how well could the right to self defense argument be applied to encryption?
It's almost like everyone forgot about the 90's crypto wars, but it makes me think of something Eben Moglen said about the 90's crypto wars being just a temporary setback to TPTB;
And coming from Europe, we create new rights all the time
It's naive to think of oneself as strong enough to self-protecting. I know there's a certain appeal in the lone wolf myth that speaks to the (mostly male) psyche. But never in the history of mankind has it been the winning strategy to be strong and independent.
Since we were apes in trees, our security has relied entirely on a strong net of social bonds. Cooperation is the strongest force multiplier, and no matter how many guns you have, you wouldn't have chance against even against a small group. Laws are nothing but a formal manifestation of group behaviour.
Then, there's the attacker-defender asymmetry: defending yourself means defending yourself 100% of the time. There is no middle-class home in the US that I couldn't get into if I really wanted, nor are there any non-famous people that I couldn't kill with a bit of dedication.
It wouldn't be possible to protect against such threads without the rule of law. And even if it were, it would amount to a giant collective waste of resources. Personally, I also don't want to think of any stranger as a thread, but that's what it would require.
Honestly, the latter. I don't believe laws prevent thieves from breaking in, nor do they keep honest people honest. I don't really buy the deterrent theory of law in general, anyway: law exists to punish in a civil and orderly fashion, not to deter.
Agreed, and it still amazes me how these advertisers and startups can simply hand-wave away any responsibility for any compromising data about you ending up in the wrong hands with a simple shrug.
This policy fight isn't a fight to regulate the market (like the automobile regulations you mentioned). It's a fight for a fundamental right to privacy. Any technology improvement that can protect privacy can be made illegal, and enforced by a boot on the face (see China).
If the government makes encryption without government key escrow illegal (not at all outlandish, has been discussed in many countries), will you personally, nikcub, continue to use encryption without key escrow? If you are willing to risk imprisonment to do so, you are among the bravest people. It is a small group.
The policy fight is massively more important than the tech. A tech that takes 100 years to develop can be made illegal in a day.
If everyone starts using VPNs, ISPs will ban them. There might be some game of cat and mouse, but eventually the same lobbyists that lobbied to remove these privacy rules are going to lobby to take some of tech options off the table.
> a fight for a fundamental right to privacy
Many don't consider this to be a fundamental right.
> A tech that takes 100 years to develop can be made illegal in a day.
As the recorded history goes, I think it was always the other way around - a new technological development suddenly invalidating a set of laws, and lawmakers playing catch-up with its use.
I wish governments of the world got their collective shit together so we could have sane privacy laws, but as it is now, technology is an important leverage to push the policymakers in the right direction. Maybe you can't focus 100% on it, but it would be foolish to just ignore it. It's the single most powerful tool we have here.
If the US and Europe change to be like China, all that tech is worthless because the spooks can come knock down your door if they suspect you're "hiding something."
"Engineering around" the failures of democracy in the West won't work. We need to fix the issues with our democracies and change the policies.
Is that why everyone agrees that the constitution protects this right in the physical domain?
If someone follows me in the street for hours (days, weeks, life) and note everything that I do, I'd be right to call that a violation of my privacy ?
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.
https://www.un.org/en/universal-declaration-human-rights/
There is Warren and Brandeis, "The Right to Privacy", 1890, which specifically addresses the publication of private aspects of citizens' (and residents') lives:
* Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual what Judge Cooley calls the right "to be let alone" [10] Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that "what is whispered in the closet shall be proclaimed from the house-tops." For years there has been a feeling that the law must afford some remedy for the unauthorized circulation of portraits of private persons;[11] and the evil of invasion of privacy by the newspapers, long keenly felt, has been but recently discussed by an able writer.[12] The alleged facts of a somewhat notorious case brought before an inferior tribunal in New York a few months ago,[13] directly involved the consideration of the right of circulating portraits; and the question whether our law will recognize and protect the right to privacy in this and in other respects must soon come before our courts for consideration.*
https://en.m.wikipedia.org/wiki/The_Right_to_Privacy_(articl...
https://groups.csail.mit.edu/mac/classes/6.805/articles/priv...
The only possibly validity to your nit is that it might be applied to any subject of human discernment: some will differ.
Those differences are quite frequently exceedingly poorly founded.
Where did this right come from? and since when is this a thing? Don't mean to be condescending but "the right to privacy" isn't really a thing in this particular domain (legally speaking)
I can't pretend to do justice to the long history of the concept, but we can at least say that for the latter, privacy has been considered an important human right since at least the UN declaration of 1948. This has been carried over into European law, see all the iterations on EU data protection laws. The UN statement is Article 12: "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."
For the US, this dimension of human rights did not deeply inform policy. Here discussion around a "right to privacy" really began in a different context with Brandeis and a right to be "left alone", largely meaning from the press. Many of the cases that inform privacy law in the US are oriented towards such scenarios and do not necessarily translate well to the context of data. See http://groups.csail.mit.edu/mac/classes/6.805/articles/priva.... There is rather a discussion on the accuracy of financial data about a person that stems from credit reporting.
The other area that would have to be discussed is of course wire-tapping laws, but leave that for another day... In sum, the question of a "right to privacy" has a long tangled history even just within the West, but is decidedly a thing in the EU.
I think we should fight for it because I think it makes life better and because I don't want to live under an oppressive government.
The idea of basing our sense of right on what is law, rather than basing the laws we write on our sense of right seems to be bafflingly common.
Another archaic concept, I fear, most days.
In my mind:
ethics = definition of what improves the common weal
law (should)= enforcement of said ethics
I also wanted to note that your dismissal of Fundamental Rights is a good point. I'm finding far more agreement with the Pragmatists (Dewey, James, etc.) than various Natural / Fundamental Rightists. If only because any idiot can jump up and claim "This is My Fundamental Right" and ... all rational discussion stops.
The problem is that while home security and personal security is something everyone understands on a basic level, the impact of personal information being public or being available to others is not.
Many people believe that whether other people, companies or government agencies or advertisers know some details about their private life doesn't matter much, but many don't understand the potential impact. Perhaps insurance policies go up inexplicably because you googled backache or headache remedies a few times. Perhaps certain political affiliation or opinions can be outlawed and put you on watch lists in the future (think of the McCarthy era in the US).
Many people also don't realize how much information can be derived from your network traffic, even if it is not explicitly present in the data itself.
Educating people on this kind of complexity and nuance is much more complicated than explaining what a fence does, or how curtains work. It would be expensive and hard, and many people won't understand the need for it anyway.
When you put it that way, I think we should warn people away from "VPN" just like we (now) warn people against "military-grade encryption" because that term is more likely to indicate snake oil than working privacy. So there needs to be a brand like Signal that delivers what VPNs promised.
Some VPNs do deliver what they say. They proxy your traffic, and they don't keep logs. Some, such as AirVPN and IVPN, have changed jurisdiction to protect user privacy. PIA has demonstrated in court that it doesn't keep logs.
Regarding VPNs, one issue that I'm sure you're aware of but didn't discuss, is that VPNs aren't really a technical privacy solution. Rather, they're a technical solution for moving your privacy concerns from one policy jurisdiction to another that you see as more favorable. That can be private policy (your VPN provider has a better privacy policy than your ISP), or public policy (the Netherlands have better privacy policy than the US). But the policy issues still matter. If every government had a dystopian privacy policy, and enforced it on all of their ISPs and VPN providers, then a VPN would be useless.
Now that is a very insightful and illuminating observation.
While I agree with your point, home and personal safety are completely broken analogies for this problem. They are regulated heavily by policy (criminal law) and violations enforced by the government (law enforcement).
"Everyone is responsible for their own security" is a wild-west fantasy land that we don't live in. And just because you take actions to increase your personal security farther than normal (e.g. guns, dogs, better locks, etc) doesn't mean you get to put fingers in your ears yelling "lalalala" and pretend externally provided security doesn't exist.
A hybrid approach as you suggest seems agreeable to me.
How else could we be so confident in our technical abilities, allowing us to just dismiss attempts to influence policy as useless.
If you're more into the finance side of things, CXO's home clickstreams would probably be enlightening. Or hedge fund managers. Some will be fully encrypted and secure, but just the dns would be a strong signal about what companies they're researching.
That is the kind of business that will drive privacy legislation.
But really, i don't think it would take very long to figure out where he and his staff in DC and in Tennessee live. I don't know what the data purchase rates are, so that could be expensive. But buy the data for a bunch of neighborhoods. Perhaps 50,000 people. watch the data for a while, query strings with Lamar would be good indicators.
Heck, make some really finely targeted ads on Facebook.
I think the reality is most news sourced this way would be super tabloidish. i mean, you're going to figure out what porn they look at faster than what policy they're developing.
There are all sorts of problems like this. What could you learn from the browsing history of people that work in sensitive areas? i.e. nuclear facilities, national labs, financial/industry regulators, etc. City and state representatives probably give away a lot through browsing. There's plenty of low lying fruit ripe for exploiting in huge ways.
Another avenue: merely knowing when someone is likely to browse the internet tells you:
-they're awake
-they're at home/indications of their location
-their level of awareness (think security workers or even prison guards)
Imagine being able to figure out the best time of day to hit a bank by browsing history? In an aggregate way you could probably figure out staffing (corporate level) or whether someone's home (residential level).
https://searchinternethistory.com/ (currently 500 errors)
I think it's only fair that these folks get to be the first ones to live in the kind of world they are creating. And none of them should have a problem with any of this, because I'm certain none of them ever do anything wrong and therefore have nothing to hide.
The big deal is when you drop a report full of embarrassing information you collected without their knowledge and they are powerless to stop it because of their own bill they passed.
Matt Green's audit of OpenVPN, when completed, may lead to more light on the matter. Otherwise, we're just relying on informed intuitions.
https://en.m.wikipedia.org/wiki/IPsec#Alleged_NSA_interferen...
As a "security people" I think me and tptacek could split a great number of hairs and get not too far on this one, but I am open to new info. I know a lot can hide in the complexity of OpenSSL. Maybe the whole thing with IPSEC was to sway us toward OpenVPN likes. Regardless, I still lean slightly towards OpenVPN
But honestly I am out to defeat ad networks. I only aspire to give nation states indigestion (at a mass scale). Individually if a well funded adversary wants any one of us I think they have us.
The ssh configs contained within do not enable ed25519 for instance.
Not sure why anyone isn't proposing this. Far better than dealing with the hassle and performance issues with a VPN. Want my browsing data? Fine, how's 1 million URLs a day grab you?
I've been looking at AWS and GCE but I'm having a hard time figuring out the actual bandwidth costs.
This should help figure things out: http://calculator.s3.amazonaws.com/index.html
The solution is getting strong, enforced laws that protect our privacy and punish those who break them.
But for the moment, with advertisers viewing themselves as gods gift to the internet who think that all your information belongs to them simply by virtue of existing, and who will go to great lengths to acquire and store it all (for perpetuity), a solution is needed, and part of that is VPN's.
If there are blisteringly strong penalties to holding and trading in personal data, the incentives to do so will largely disappear. Unfortunately, statutory regimes, particularly in the United States, seem to be going in the opposite direction.
With the ability to seek out and purge disclosed data, at least some of the damage can be mitigated. Considering that there is far too much information for humans to ever process but a small portion of it, that might actually be sufficient -- we won't be needing the Men in Black eraser pens.
At least when thinking about individual defenses, I tend to treat the regulatory landscape as a lost cause - currently I'm just hoping that privacy tools won't be actively outlawed.
Whether it's concern of your data going out, or bad genetics patterns coming in, your best bet is to cut off the routes of transmission.
In a plague-infested land, it's practicing exceedingly good hygiene which is in your best interest. If that means walling yourself off from the rest of society for a few years (as one royal household in Europe did), so be it.
Keep in mind that the Black Death even eventually reached Iceland, though some years after it scorched over the rest of Europe (4-5 years as I recall).
There are domains of problems which are intrinsically personal. Though rather more which manifestly are not.
(Though you've also got me thinking about what equivalents to own information spreading out there are, epidemiologically.)
This seems like a really good question, actually. The disease model of information is quite effective, at least in terms of ideas like herd immunity, transmission rates, quarantine, etc.
But at the "patient zero" level it's quite strange, with personal information being a thing you know you have and don't want to spread unintentionally. It definitely changes some things compared to the standard model, though I think you have a point that you can invert things fairly effectively (i.e. 'hygeine' is to avoid spreading info, instead of contracting it).
I also wish there was more good writing on information hazards, which follow the epidemiology model almost precisely. So much of what's out there descends into Cthulu references or 'fake news' rants, rather than looking at the actual metaphors for things like "herd immunity".
(Surely someone has written an ironic essay about "vaccinating against anti-vax ideas"?)
For information specifically, it's interesting in that there are at least three possible goals:
1. Restricting or combatting the spread of toxic information.
2. Encouraging the spread of useful or helpful information. There's a great deal of this under the rhubric of "diffusion of information".
3. Limiting, for socially beneficial or malevolent purposes, the spread of generally private information.
The first two instances have clear epidemiological and evolutionary cognates: limiting the spread of disease or disease agents (bacteria, viruses, prions, contaminants), or the process of evolutionary advance or propogation of fitness adaptations.
The question of concealment ... thinking through here, I'm coming up with concepts such as camoflage, mimickry, colour or shape-shifting (e.g., cuttlefish, octopus). There are bacteria and viruses which evolve or mutate rapidly making various antibodies or antibiotics less effective quickly (another element taken up by fake-news and propaganda sites -- one article I was reading yesterday noted how new most such outlets were, earlier pieces I've seen noted how new sites were emerging late in 2016 and growing to million+ daily user). I need to think more about that.
As for the antivax situation, I've pointed out that information campaigns to refute anti-vax ideas regarding the efficacy (and safety) of vaccines against viruses which attack DNA/RNA, are an information attack on an information attack on an information attack on an information attack on information.
Tangential point, I've heard from a friend how much you can earn by being involved in a "premium" ad network, and it's basically around 100x what I can make as a SWE freelancer. I also remember a HN user claiming they make $30k/month from a simple "YouTube downloader" kind of site.
Edit: Also, you can pick VPN providers outside your adversary's sphere of influence. That's standard advice for users in China, for example.
If you chain VPNs, however, it certainly makes sense to lease the second/indirect VPN anonymously.
https://news.ycombinator.com/item?id=13676600
You can also tunnel to Tor through domain fronting.
https://trac.torproject.org/projects/tor/wiki/doc/AChildsGar...
https://www.fireeye.com/blog/threat-research/2017/03/apt29_d...
If it really matters, you use nested VPN chains. Three deep is my standard, and I've managed six. Latency can be a couple seconds, but hey.
> But now the VPN provider can
> just track you
Audits and reputation may help.
What a sorry state of affairs.
There is a learning curve, and extra steps in configuring a working environment. But once the host and VMs are configured, uptime is no worse than with typical LANs.
I miss the idealism and optimism of the past. The only hopeful thing I can find in the new "quote" is that it seems that the tech world is finally aware of the need to work with policy makers and the public in addition to building new systems.
I think it's a Trojan horse from politicians to start legislating where nobody needs legislation. The net will still route around censorship, but it's becoming increasingly harder in a world where a high percentage of global bandwidth transits through a small number of large deployments by centralized corporations.
The pessimist in me sees this as a sure sign that the "Balkanization of the internet" train has long since left the station. However I remain optimistic that "information wants to be free." As long as information exists somewhere (and people know to look for it), decentralized tools like torrents, ipfs, Tor, etc will continue to enable access to it.
What I worry most about is the public's increasing dependency on sandboxed devices. We celebrate sandboxing as a win for security, which it certainly is, but the more we depend on it, the more we are subject to the whims of its corporate gatekeepers. How long before laptops are as sandboxed as phones?
Software can only solve the technical problems so long as it can run on the hardware in your possession.
When the technical solutions became criminalized. End-to-end encryption is only now becoming common, and English MPs are already talking eagerly about outlawing it. The need for political fights isn't exactly new - think of the Clipper chip in the 90s - but it hasn't abated either.
I see lots of suggestions that we can solve this with keeping tech ahead of law, but I don't think that's a realistic answer. People have tried that in banking and finance and a lot of other domains, and the result is that you eventually get stuck with whitelists (only access the internet these 3 ways) or intent criminalization (banning access the government can't see). You have to win some political fights, if only to carve out space for the technical solutions.
The problem in this case is that morality (Norms) has gone AWOL, architecture is insufficient, and market incentives are buying statutory cover to pursue privacy eviceration with impunity.
https://en.m.wikipedia.org/wiki/Code_and_Other_Laws_of_Cyber...
If you meant to convey a different meaning, you might have clarified. I stand by my statement that that appears to misrepresent Lessig's argument, which is a good one.
As for the range of opinions ... from John Gillmore to Staticsafe ... views differ. It's helpful to keep in mind that Gillmore, Lessig, and Staticsafe are all presenting arguments as challenges to conventional wisdom. To that end, presenting any of them as indicative of the CW is also ... misleading.
Unless you meant another argument.
Again: I'm not trying to tell you what you meant, but I'm telling you what I'm reading from that. And ... between exposition, clarity, and/or argument, it could be better.
Cheers.
I guess I will just have to live with your disappointment.
And obviously, you gain a good deal of latency, especially if you use an overseas exit point.
And now we get to deal with shitty services like Netflix punishing privacy-conscious users and blocking access to paid accounts while your VPN is up.
I notice little if any change in speed. If anything, download speeds seem more consistent in speed without long pauses (or momentary bursts in speed).
It's very easy to install and configure, but I'm not sure how good it is at addressing the point of having a VPN, since I don't know how well the software has been audited by other people, and I wouldn't know where to begin. The same goes for how I must trust the VPS provider.
Maybe they'll even offer pay for privacy on consumer accounts? It's just the price you pay when most people don't know about the issue, or don't understand the issue, or don't care about the issue.
OpenVPN can be fairly slow if you are sharing CPU usage (ex. VPS provider) with other users. You are also most likely implementing NAT on your VPN server which is probably not accelerated unless you are paying for an expensive appliance that does so.
There's a couple of things that do this actually: the AdNauseum plugin will hide ads for you, but will also click through on them often as well which helps pollute advertiser data capture. It won't of course be able to replicate you browsing on the page, but it'll go a long way to frustrating the efforts of 3rd parties who won't have access to the landing page metrics anyways.
There was also a post on /r/InternetIsBeautiful that was supposed to do something similar: essentially destroy your browsing habits by performing additional searches and following links in the background, but I think that relied upon a hardcoded list of searches, so it's ongoing functionality was somewhat limited.
A big challenge to making something that continually obfuscates your browsing habits is making sure it doesn't accidentally end up going throw actually sketchy or illegal stuff (i.e. sites/etc that could get you on lists/attention) and making it work in a way that isn't easily detectable/filterable as 'machine traffic'. I guess that means you'd have to build in functionality to replicate following pages several links deep, not making successive requests immediately (sleeping execution/simulating scrolling), simulating some kind of 'natural' interaction: mouse movement + hovering over things + other things that users might do?
I'm sure most of that stuff is totally possible, probably even easy, might make for a fun personal project...
But data poisoning is relatively easy and offers an "additive" solution. Every use decreases the value of all the information you spill, which is way more appealing than demanding flawless defense at every turn.
While I also prefer a system which assumes no trust in government policy, it is still prefferable provide legal protections for the little guys whenever possible. In this case, the little guy is the vast majority of people who don't understand how the internet works.
We can't assume VPNs will always be legal for individuals with the horrible direction things are going.
I would like to add however that it would be really nice if the super-intelligent programmers on HN could come up with an open solution that is super easy to use that actually preserves the little guy's privacy. Like just a tickbox in Firefox that makes your whole PC untrackable.
Something so easy that anyone can use it, yet as secure as all the complicated technical solutions that are being presented in these comments.
I believe policy is important as a part of the solution because it is a matter of protecting the general public not just a select technically capable.
Yes, policy is hard and can be useless but I still believe it is an important goal to fight towards.
You can care about your privacy, use a VPN and use the democratic process to enact policy change. Those things need not be mutually exclusive. VPNs are only a part of the solution and incomplete, not the solution.
Furthermore just what would their end game be? Per all the DOCSIS whitepapers I've read: my residential ISP intends to sell me any number of "over the top" services: a plethora of cable channels, their own streaming services, VoIP, alarm systems, whole home DVR, etc. There is a lot of money to be made there in terms of equipment rental, upkeep, and paid programming. More importantly most of it goes right into their pockets. The way I see it, it's not about selling the data, it's about using it themselves.
Compare that to a tier-1 provider who has one job: get a drop to my network fabric. Their business revolves around (A) doing that regionally, (B) maintaining good peering, and (C) being extremely competent network engineers. As I see it a tier 1 provider has far less incentive to spy on their users compared to a residential ISP. This doesn't obviate the need for caution of course, since nation-state level actors have all the more reason to spy on tier-1 providers simply due to the volume of traffic that can be intercepted.
It would be costly to maintain the interception/analysis infrastructure required for such data collection.
I daresay it would cost more than what they would make off the data.
I don't want to speculate further as I don't know what margins for transit providers in NA look like.
Personally, with the Investigatory Powers Bill in the UK, I will "wave the wand of a technology solution" to conserve and protect my own privacy.
Sure, if the policy was changed upstream then a lot more people would benefit than the technically inclined folks, but if there's a bug upstream we don't all sit with it and wait, we fix it locally and vendor.
The last paragraph, about holding the House accountable in 2018? That deserved the preface about "not understanding US politics". The privacy voting bloc is small, and the vast majority of it lives in places that already elect pro-privacy reps - Boston and SF are incredibly limited in what they can achieve.
I'd like to see internet privacy enshrined in US law. I'll fight to make that happen. But it's an "empty the ocean with a teacup" situation, and in the meantime it makes total sense for people to help themselves and those around them.
The router could talk to a standard web api to get information to configure itself. The web service behind the scenes could set up and teardown digital ocean droplets as necessary running streisand. The web service IP's wouldn't be blocked because they'd only be used to periodiy get configuration.
So then you buy a non technical person this router, they create an account on the configuration website and as Ron Popeil would say, set it and forget it.
You still need the technical know-how to set up a DNSCrypt recursive resolver. The resolver then talks to the respective recursive chain in plain text as DNSCrypt is not something that is widely adopted.
I think that the SNI note below is probably the bigger hole.
Example: any traffic to 17.0.0.0/8 = user probably has an Apple device
The limitations are: no ipv6 support :(, sometimes leaks dns, and always crashes shortly after it is first started (then works fine when you start it again). There seems to be little active development.
To work around the limitations, I mostly use SOCKS (curl also supports SOCKS), plus run sshuttle to try to catch any additional traffic. For that matter, SOCKS alone would at least catch the most sensitive traffic for most people (and would make it easy to have another browser profile for watching netflix).
I get a $15/year OpenVZ account from ramnode.com, which supports VPN usage. I haven't had an issue with bandwith (it seems to undercount quite a lot) but don't watch netflix or otherwise use that much bandwidth.
The main issue I've had is that some websites (google, amazon, gog) will default to various other languages that I assume other people who are doing the same thing speak. Fixed by logging in to the site and they then seem to remember for a while even if you don't log in, but eventually they switch again.
The nice thing is that the remote server can be configured to just have an SSH server on port 80 (in case you ever want to use it from restrictive public wifi; I first stated to do this after seeing SSL downgrade errors on public wifi) with public key authentication, so there is much less to worry about in terms of being responsible for a system open to the internet all the time. In SSH, I set:
KexAlgorithms=curve25519-sha256@libssh.org
HostKeyAlgorithms=ssh-ed25519-cert-v01@openssh.com,ssh-ed25519
Ciphers=chacha20-poly1305@openssh.com
MACs=hmac-sha2-256,hmac-sha2-512
Edit: Speed is quite good with this setup and while I haven't done extensive comparisons, it does not seem to lower the connection speed by much.
UDP is not tunneled at all.
Clearly I'm mistaken.
</s type="because it is necessary>
Do you trust any VPN providers? Or your ISP? Or the programmers of the browser that you're using? Or your CPU manufacturer? It's turtles all the way down.
Perfect is the enemy of good. If that protocol was open, it might foster a way to fold VPNs into the everyday person's internet connection, with the possibility to easily change VPN providers down the track.
Adding more players to a game that perverts and corrupts virtually every player on the field doesn't strike me as a particularly wise and enlightened approach.
How well might connectivity limitation work? It took China immense centralization and a lot of technical effort to build the great firewall, which is not exactly impenetrable, though.
I used a droplet on DigitalOcean to configure an Algo server. Very seamless setup, highly recommend. There's a $10 promo floating around: DROPLET10. You can self host too.
[1] https://europa.eu/european-union/about-eu/countries_en
[2] https://www.purevpn.com/blog/data-retention-laws-by-countrie...
I'm not in the US, so the local advantages don't apply, only the three-letter agency illegal snooping disadvantages.
PIA has been dissed over their promotional practices. And for using weak encryption, which allowed them to minimize resource use, and undercut competition.
But I gotta say that their no-logs victory in court is impressive!
[1] http://www.cnn.com/2013/07/05/world/europe/france-surveillan...
There are a lot of lists of VPNS and though this one didn't help me choose mine, and ranks mine very low, I thought it answered the question the best.
On that site he has a massive spreadsheet of many if not all VPN providers and the various pros and cons.
The possibility for blackmail exists and therefore the possibility of your freedom being curtailed.
So that I dont have to have every computer in my home hook into the VPN when I start it up. Just one account for my whole house?
I imagine you could setup a linux box to do that for you, but I am lazy...
Here's another: https://www.flashrouters.com/?gclid=COzwtN-B_NICFZcbgQodMdAP...
Though your kids won't be able to snoop you from the internal interface.
I found that none of the WRT powered routers could really handle a home 1Gbps connection and that the WRT is getting a little out of date and unmaintained.
Additionally there will be some who take an extreme view to this "zero knowledge" approach offering all forms of payment and workarounds to preventing down-stream ISPs/backhaul from tracking/identifying/classifying user traffic.
Maybe VPNs "are not the solution" but they still can do a lot of good in the mean time yet.
VPN tech is cheaper and more likely to succeed.
When I tried again with Lollipop last month, the VPN's preferred DNS was not being set on the phone despite being sent from the VPN server, hence DNS lookups were leaking to whatever DNS server had been set before establishing the VPN. Quite a nasty gotcha. Workaround is to run a script to set the DNS, but that requires root privs which 'normal' users won't have.
If you are using Firefox, be sure to follow everything mentioned in the "about:config" hacks section.
The impossible task of creating a “Best VPNs” list today https://arstechnica.com/security/2016/06/aiming-for-anonymit...
That being said I used it and ended up choosing one that they recommended basically due to lack of info from other sources that is timely. Was a couple months ago.
I wonder if people would be interested in dedicated browsing VM. Unfortunately there is no good mobile client.
I think the market for VPNs that have a policy for not keeping logs and easy-to-use will grow exponentially in the common days or weeks. For the more technically inclined, VPS providers.
https://news.ycombinator.com/item?id=13982966
* False dichotomy: that the solution lies in only one sphere. (Lessig, Code). This is lightly moderated, but resurfaces at several later points in the argument.
* Personal responsibility. Check. Never mind that the source article states concisely and specifically why this doesn't work or scale.
* Hybrid system. Or as I prefer, the worst of both worlds. In the healthcare example, a guarantee of emergency room services is posited as a sufficient mitigation for mandating individual responsibility in all other areas. Disregarding the fact beneficial health outcomes comes from public or preventive measures, not acute (read: late, expensive, heroic measures) interventions:
"In all, 86 per cent of the increased life expectancy was due to decreases in infectious diseases. And the bulk of the decline in infectious disease deaths occurred prior to the age of antibiotics. Less than 4 per cent of the total improvement in life expectancy since 1700s can be credited to twentieth-century advances in medical care."
― Laurie Garrett, Betrayal of Trust: The Collapse of Global Public Health
* As with all good Techno-Libertarians, nikcub "personally believe[s] in user responsibility". Despite some 50+ years of experience that user responsibility for security simply does not work or scale.
Nikcub continues with specifics:
* Universality of policy. Which seems to boil down to "since every jurisdiction cannot offer the same high levels of protection, no jurisdiction should". What ever happened to the concept of a competitive marketplace for ideas, including legal and moral frameworks? Isn't the very idea of liberal democracy that its principles, premises, and protections are so manifestly self evident that all people everywhere would want them? (And hence: why it's such a major pain in the ass of tinpot despots everywhere.)
* Some governments are bad ... so no governments can be trusted. Again: a slope so slippery nikcub loses his footing instantly. We can apply the same argument to ... anything. Including his proposed technological solutions: Software is a major party in privacy violations and is conflicted (and buggy), so it cannot be expected to behave in the interest of users. In government as with software, the proper response to buggy implementations is to fix the bugs, not burn the house down and abandon the domain completely.
* Government trust. Where do I even start (the concept and questions of trust are ... a whole 'nother essay). If liberal democratic government, the agent and agency* of The People, cannot be trusted, then what can?* Private, self-interested business? Which, I'll hasten to add, has landed us in the present kettle of fish? If you're finding that your government (or parts of it) aren't trustworthy, then you have two problems. But the one doesn't invalidate proper approaches to the other, and fixing the problem of government trust gives you an exceptionally powerful tool to apply in remedying privacy and other policy failures. Say, such as single-payer, universal, socialised medicine.
* Tech solutions that are universal ... are called policy. And, to add to that, a primary reason for approaching such policies through government is that governments have the clout and scale to make policies stick. Keep in mind that this need not be at national or international scales. Policies at the sub-national scale -- say, Northern Ireland or Scotland within the UK, or California or New York within the United States, could have major impacts. Given the option of adopting multiple and conflicting regulatory standards, or a unified and coordinated standard, companies will often prefer the latter. The case of US EPA and California EPA emissions standards would be an excellent study in same.
* Good policy is hard work. Yes, well, hard problems are hard. This doesn't make them not worth pursuing. And remedying the specific problems highlighted would be a key goal of any privacy regulatory overhaul.
* Penalties are small. Well, duh: embiggen them. I thought yuuuuge!!! was in now, anyways....
* On information disclosure: yes, it's very hard to un-leak data. On the other hand, comprehensive and pervasive regulations against the storing or transmission of personal data, stiff penalties for doing so, and sufficient rewards for reporting on such violations, will tremendously decrease the incentives for doing so. Given that the value of vast troves of personal information to firms such as Facebook is ... roughly $12/year per person, those penalties need not be tremendous, though they do need to be sufficient given scales of detection. This isn't dissimilar to present approaches against counterfeiting of money or goods: the fundamental capability to violate norms exists, but with appropriate penalties, and incentives, against transacting in such money or goods, it can generally be tamped down to an acceptable level. The more so if technology and other means are applied in concert with policy.
The argument continues spewing the additional canards of perfect worlds (no policy world is perfect, at best it is sufficient), sole reliance, and of mis-casting the argument as warning people away from VPNs (it doesn't, it merely points out that VPNs alone are grossly insufficient).
And for the capper, we have free-market it harder. As if it wasn't free-market interests, and failures, which haven't landed us precisely in the present situation.