Hacker News Reader

Comment by eterm | Hacker News Reader

I'm not sure how VPNs are a solution.

Politically, it means that people who should be getting angry about reduced privacy are "comfortable" with the fact they can work around it, while a new generation grows up with fewer and fewer expectations of what privacy means. It's short term protection in return for normalization of anti-private behaviours and long term damage.

But I also have a problem with it technically:

Issue: You don't trust ISPs to not sell browsing history.

Solution? Provision a virtual server, set-up a VPN and tunnel.

But your server still has a service provider. It might not be literally tied to your billing information but that was never going to be anyway.

You've shifted which ISP gets to sell the data from "home provider" to "virtual server provider", but there is still browsing data isn't there and it's just as valuable from a private single-use VPN as it is from your home connection.

View on HN

> But your server still has a service provider. It might not be literally tied to your billing information but that was never going to be anyway.

The idea is to use a VPN provider that keeps no logs and runs many concurrent connections NAT'd behind the same public IP address. That way your traffic is mixed in with everyone else's who's using the service and provides you with an additional layer of anonymity.

You might not realize just how easy it is to track users behind NAT.

You might also not realize just how shady and willing to sell you out many of these VPN services are. They tend to be un-audited, un-regulated.

I don't realize it. I'm genuinely asking, how are users behind a NAT tracked? Browser fingerprinting?

That would be one way. In the VPN provider scenario if the ISP can snoop on both the incoming and outgoing traffic that can correlate the two by analyzing the timing and packet sizes. This is how Tor can be defeated as well but it's much simpler to do to a VPN service since they prioritize speed over privacy more than Tor.

This could be as simple as connecting the dots between you logging into your ISP account to pay your bill via the VPN.

This is one specific way in which a VPN is a poor solution to protecting privacy. It means the user has to constantly be on guard to which traffic should go over the VPN and which should not. Even one single slip up could negate all the benefits you think you are getting.

Edit: This reply should have been a couple levels higher, addressing the general tracking discussion rather than NATs specifically.

Assuming it's possible to make it easy to companies to become VPN providers, and since the problem is trust, shouldn't a service from a trusted non-profit be good ? one that must share any financial information, as some non-profits do ?

There are no foolproof security solutions, only varying degrees of who you trust with what. There are many VPN providers who claim to keep no logs on user activity. If their claims are true, that is a better option than Comcast or AT&T since the VPN provider with no logs has no data to sell or share.

* edited for spelling error

* fool-proof

whoops. thanks!

Those VPN providers need to get their internet connection somewhere and if you terminate your VPN inside USA (which you'll have to - to get decent speeds and pings), you'll just move the point of data collection.

Sure but if you have a VPN from a provider with enough customers I and use TLS to connect to websites, associating the browsing activity to a particular customer is difficult even for their ISP. Some of it could be traced back by traffic analysis, but it's at least more obscured than if you are using TLS from your own connection without a VPN.

In the US most folks only have a handful of service providers to choose from. There are a huge number of VPN/PaaS/HaaS providers you can choose from, it shouldn't be hard to find one that respects your privacy.

I plan on automatically switching VPS provider for my VPN on a monthly basis. So even if they get one month of data, they won't get it all.

I think that actually increases your exposure, as a monthly snapshot will likely be as good as any other month's snapshot and just as damaging (or not) if it got out. If all providers sell your data, that means that purchasers of aggregated data will always have up to the date info anyhow.

I would say the "better" solution would be to find a provider with a good reputation and stick with them, and leave them in a heartbeat if it appears that they've sold your data. It gives them an incentive to continue behaving well through referrals and recurring revenue.

Reply on news.ycombinator.com