Hacker News Reader

Comment by ghughes | Hacker News Reader

It'd be neat if there were an app for one-click deployment of OpenVPN using one's own AWS or Azure account. That would be much safer than picking from a list of shady VPN providers.

View on HN

That seems like that could get rather expensive in terms of bandwidth. From some napkin math I did using https://aws.amazon.com/ec2/pricing/on-demand/, even 100GB of data would cost $9. That doesn't even include the cost of reserving the instance itself, just the bandwidth costs.

Azure costs the same for network, apparently (up to 40TB), providing that you stay within US/UK/Canada. [0]

Google Cloud is supposedly cheaper in terms of network ($0.01/GB -> $1 for 100GB) if you're primarily visiting US sites [1]. Still potentially expensive either way, depending on your network usage.

You could use an always-free f1-micro GCE instance [2] and run OpenVPN on it 24/7, although configuration might take a bit of time (read: half an hour, tops? I'm assuming it's no harder than the equivalent software-based option on EC2).

I know on the other hand, Amazon's always-free tier doesn't include EC2 (it is included in their free tier, but that only lasts for 12 months). [3]

Disclaimer: Google pays me money to write code and stuff, so I'm probably biased. I've also never actually used GCE, but that's because I still have a bunch of AWS credits, among other reasons.

[0] https://azure.microsoft.com/en-us/pricing/details/bandwidth/ [1] https://cloud.google.com/compute/pricing#general [2] https://cloud.google.com/free/ [3] https://aws.amazon.com/free/

Here you go. https://github.com/Angristan/OpenVPN-install

No, it wouldn't. You're the only one passing traffic through such a VPN, which means it's trivially reduced to unique bits of information that can identify you for anyone on the other end of your browser.

When many people share a VPN, your traffic is far more noisy and obfuscated .

Except in the context of the FCC ruling, the purpose of the VPN is not to obfuscate your IP from the websites you go to.

The purpose is to hide the traffic from your internet provider.

You're just shifting that responsibility to the server provider in that case. You have more privacy protections from your ISP than you do from someone you rent a server from.

> You have more privacy protections from your ISP

What protections do we have from ISPs now?

They aren't allowed to sell or release personal identifiable information. That's not the case for server providers as they aren't considered carriers, and thus aren't beholden to the Telecommunications Act of 1986 in the same way your ISP is.

literally first result on google for "aws openvpn" :-)

https://aws.amazon.com/marketplace/pp/B00MI40CAE/ref=mkt_wir...

I've used this. Setup is trivial.

Not quite one-click, but https://github.com/jlund/streisand

Would Streisand [0] meet your needs?

[0] https://github.com/jlund/streisand

There are only 2 trusted solutions in this space: Algo [1] and Streisand [2], and Algo is generally considered safer.

[1] - https://github.com/trailofbits/algo

[2] - https://github.com/jlund/streisand

Who has decided all others are not trusted? What makes one safer than the other? What does 'safer' even mean in this context?

Industry experts like Kenneth White, who wrote the following: https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa

Damn, I wish that people would stop citing this without providing context. He is writing here about bog-standard IPsec with shared PSKs. He is not talking about OpenVPN. See where he writes:

> Yes, I know. Many/most of these offer OpenVPN, or special clients for IPSec. But for all of the above, they are actively placing a significant portion of their user base (particularly those with older Androids and desktops) at risk by not using per-user PSKs.

Reply on news.ycombinator.com