Hacker News Reader

Comment by edraferi | Hacker News Reader

I want a privacy first router. Does such a product exist?

Key features:

  - I pay a subscription for maintenance (so I'm not the product) say $10/mo

  - Automatically routes all traffic over a VPN.

  - Smart VPN bypass for performance-sensitive traffic like streaming video and gaming

  - Provides non-logging DNS service

  - Automatic advertisement blocking

For VPN, DNS, and adblock I want the option to use servers & block lists maintained by the paid service, augment them with my own, or use my own exclusively. Bonus points for rotating requests between providers.

Does such a product exist? I think I could hack together something similar using DD-WRT[1], but I'm confident the maintenance hassle will eventually outweigh my desire for privacy. #shutupandtakemymoney

[1] http://www.dd-wrt.com/site/index

View on HN

> I'm confident the maintenance hassle will eventually outweigh my desire for privacy.

Nothing should outweigh your right for privacy.

Sure, but there's a cost to exercise that right. Right now, the cost of protecting myself from my ISP is quite high. I need to maintain DNS and VPN settings for every device in my home... many of which are personal devices of other family members with little patience for such techno-babble.

I want a product that reduces the cost of exercising my right to privacy, and allows me to pay that cost with money instead of time.

There are commercially-available routers which support running all traffic through a VPN. That should handle all the devices in your house.

A VPN doesn't actually provide more privacy, it just changes who can snoop on your data.

Privacy isn't an either/or. That's like saying closing your window curtains doesn't give you more privacy, because your phone might be wiretapped.

I don't agree with that analogy. The VPN takes away the ISP's snooping abilities, but gives snooping abilities to another company that wouldn't otherwise have it.

You're right, of course, but a VPN at least lets you make sure that the service that can snoop on your data doesn't want to snoop on your data, because they know you'll just leave them for another, more privacy conscious, provider if they do.

VPN providers have incentive to compete with each other and commitment to user privacy is an important selling point. ISPs have zero commitment to privacy and almost no reason to compete since users have no choice.

You're right, of course, but a VPN at least lets you make sure that the service that can snoop on your data doesn't want to snoop on your data, because they know you'll just leave them for another, more privacy conscious, provider if they do.

Only if you can tell that they're doing so. If they create two companies with no apparent connections, how would you know that VPN company A was selling your data through Marketing company B?

We are now getting pretty far down the rabbit hole.

Is this possible in theory, if your packets go in all directions (IPs) encrypted, not sure how you reassemble, but in theory, would the information then be whitewashed? I guess I'm asking, is it possible in principle, can you leak no information (including metadata) from IPv4?

Netflix for example does not work over vpn so the router would have to have a way to manage exceptions.

I would set up a tor endpoint on the home connection (to make the collected data as useless as possible).

Combining this with a regular VPN should be enough effective, with a minimum maintenance burden.

Privacy is weighed against public safety all the time. The question is at which point does it become unreasonable. Warrantless searches of American individuals just so happens to be where we, as Americans, draw the line.

On the other hand, don't mistake my assault on the technical validity of your sentence for disagreement with its intent. We should be outraged.

Shame on us for having allowed this to happen, and for the dangerous precendent it sets for local monopolies to sell your information.

> VPN

This is a political problem. Technology like a VPN or alternative DNS is little more than a placebo. With the ISP as a permanent MitM, modern deep-packet inspection, etc, you are probably still leaking a lot of information.

Worse, you're only moving the problem to a different location. Even if you were able to hide your traffic from your local ISP, your VPN host or DNS service becomes your ISP de facto. Also, if any of your online accounts can be tied back to you on their own, you might not get a choice in the matter; the server's ISP can also sell information. What about TLS? Unfortunately far too many websites are only encrypted to CloudFlare.

However, the real reason that VPNs/etc are not a solution is that privacy shouldn't be limited to people with a technical background. Those of us that do understand the technology have a duty to help the people without that knowledge and experience.

Tell people to use the Opera browser. It has VPN built-in.

So you trust the company involved in the WoSign debacle with your data?

The question isn't about absolute trust.

It's about who you trust more with your privacy.

So yeah, I think I'd trust almost anyone more than my ISP now because they have an incentive to profit off my lack of privacy.

> Worse, you're only moving the problem to a different location

I agree that's true from a technical perspective. However, the VPN provider has an economic incentive to compete on privacy. I would much rather just trust my local ISP, but at least I have a choice in VPN providers.

> privacy shouldn't be limited to people with a technical background

Absolutely. That's why I want this as a product that Just Works instead of my own hacked-up implementation.

Not just that, but being able to choose your VPN+ISP is better than being able to "choose" your ISP.

Excellent point. In the US you likely only have a small number of ISPs you can choose from, but there are huge number of VPN/PaaS/HaaS providers out there that you can route your traffic through. Surely some will compete on privacy.

> Those of us that do understand the technology have a duty to help the people without that knowledge and experience.

No, we don't. The fact that the "common people" don't value privacy enough led to this whole situation. Those that do value privacy, can pay for it with their money (or their time to learn).

I agree with this! I think, should people value their privacy and want to use VPNs then we can teach them about such matters but merely us trying to convince them should not be our problem.

I think the problem is not that most people don't value privacy, it's that most are unaware of the privacy issues that affect them, or have been misled to believe that the cost of having the websites and services that they rely on (facebook, gmail, etc.) is necessarily tied to giving up privacy.

This isn't a new problem. We "know" the common people don't care because all attempts at scandalizing this in the media, for years, have not found much resonance.

If people didn't care about privacy, companies wouldn't be so opposed to regulations requiring them to get consent before selling personal information. Advertisers wouldn't disguise targeting to avoid creeping people out. Uber wouldn't have deleted a blog post mapping one-night stands. Republicans wouldn't have had any reason to spin this bill as being about which agency should have authority.

People do more to protect their privacy when they know it's being violated, understand the impact, and believe they can do something about it.

Some people care about privacy. Most probably may even care about it to some degree, but not to the degree where they sacrifice their convenience for it.

Again, the media has done its best to scandalize the very real privacy concerns with companies like Google and Facebook. Did it hurt their success with the unwashed masses?

If privacy was really such a big deal, why would Uber write that blog post in the first place? Sure, enough people complained online to get it pulled, but that's not representative.

To wake people up, we'd need a real "story" here, like somebody getting fired over googling something relatively innocent.

Finally, if advertisers really try to disguise targeting, they're doing a terrible job at it. Just try turning adblock off for a moment to see for yourself. Yes, even the common folk thinks targeting is creepy, but at the end of the day they don't care that much.

I disagree that the media has done anywhere near its best to bring privacy issues to people's attention. At the same time, many stories that do get published offer lots of vague scares and no practical suggestions, which fuels people's sense that there's nothing they can do.

I don't know many people who have stopped using Facebook. I do know a lot of people who don't post things they would've 5 years ago.

Uber miscalculated, simple as that.

For targeting, I'm talking more about direct advertising. I think most people know by now that the sites they visit don't directly control the ads they see. Seeing the same ads everywhere is annoying but doesn't prove anything. A company you've never given your email address sending you offers for only items you looked at is creepy.

I use a service called Cloak[1], and I'm super happy with it. I'm getting 75MB/s down over my Wifi while VPNd through their service. I often forget that it is on because it _just works_. I have no affiliation with them, I just think they make a good product.

[1](https://www.getcloak.com/)

I seriously doubt you're getting 75 MEGABYTES down over Wifi. Did you mean 75 Megabits (Mb)? There is a major difference between Mb and MB. 75 MB would be equal to 600 Mb per second.

Why not? 5 Ghz connections are capable of delivering > 1 Gbit over the... air.

:eyeroll: Sure, and MIT managed to transmit data wirelessly at 1 Tb/s one time. But we're talking about the real world and regular consumer hardware here.

TP-Link Archer C7 can do up to 1300 Mbps over 802.11ac, and costs about $85.

No university research equipment required.

> - Smart VPN bypass for performance-sensitive traffic like streaming video and gaming

It is highly error-prone to maintain (or expect a company to maintain) essentially a large filter list. In the end you'll end up with a product that gives you neither privacy nor performance. For a real world example, try using a smart dns. They suck at dns on its own. And they have to keep up with the cat and mouse of content sellers blocking them. You'll end up with pretty much the same situation with your smart vpn solution. You'll never know reliably what's going over which route (unless you are making the list), debugging will be a nightmare, and you'll have leaks all over.

For the nerds among us this shouldn't be too hard. A Virtual Private Server can be rented for a few dollars a month. I have seen examples that charge less than $4 for unlimited bandwidth.

Install VPN software on the server and become your own VPN provider. On your home router you can setup a point-to-point VPN connection and you're done - all traffic encrypted and bypassing your local telco.

I assume that network-providers are not included in this legislation though...

Mind divulging on some VPS providers? The one I've been looking at closely is https://www.vultr.com/

Their $2.50/month plan fits me well as my monthly traffic across all my devices (and home) is roughly 100GB. Pair that with https://github.com/trailofbits/algo and it's a reasonable setup.

I'm a fan of RamNode. I've been using them since they launched a few years ago without a hiccup.

There is one issue that your traffic is typically flagged as originating from a VPS provider and you might end up getting denied or have to do annoying challenges.

Still worth it but it's something to consider.

what's a good vpn software to install on a server?

I was mulling over a service like this. Was thinking I'd set it up roughly like so:

1. Create Terraform / Ansible scripting to boot up fresh DigitalOcean droplets with OpenVPN and encrypted DNS / pi-hole to strip out ads.

2. Bulk purchase cheap dynamic DNS domains (or just generate sub domains on command and hit some kind of load balancer).

3. Create scripting to shuffle the various VPN boxes every x time (each night, week, whatever).

I'm not an expert, so I might be missing things here. But I'd pay for that, and I think all you'd have to do as a client is put OpenVPN client on your router and point it to whatever static domain you're assigned by the service.

EDIT: I also figured I'd donate some % of proceeds to OpenVPN / Pi-Hole.

You should try a the NetAidKit. We use them a lot for high risk human rights defenders travelling to various places. It works with VPN and Tor. Has wifi bridging, is portable etc.

https://netaidkit.net

Someone posted on a similar thread yesterday or the day about something that would fit the bill for you. I'll see if I can find it.

Off the top of my head, I think they sold a router, mostly pre-configured with ddwrt, that you plugged in your info for PrivateInternetAccess and used them as the VPN. Could be wrong though.

Edit: Here's what I was talking about: https://easyvpnrouter.com/. May or may not meet your needs

That's great! Good find, thanks.

The website mentions an interesting solution to the streaming media problem: "Keep your existing router and run both networks simultaneously. Connect to your Easy VPN Router when you need safety"

So basically I could have the performance-sensitive devices hook up to the existing router, then use Easy VPN as the main access point for everything else. That's probably a lot more maintainable than trying to choose what goes over the VPN dynamically.

A router only helps you at home. We need a service that protects you anywhere.

An app that enables you to use your home router as a gateway could solve this problem.

I had an idea called 'Home Gateway' awhile back, but i do not have the business acumen and lack part of the technical know-how to complete such a task.

Reply on news.ycombinator.com