Ask HN: What are good ways to hide metadata from your ISP? | Hacker News Reader

Ask HN: What are good ways to hide metadata from your ISP?

Even with HTTPS, my ISP can still:

A) see the domain names of sites to which I connect

B)the time at which a connection was made

C) the volume of data moving over a connection

So even if I use a VPN, my ISP can still see that I connected to https://vpn.com around the same time https://vpn.com connected to https://embarrasingNSFWsite.ru. They can also see that the data from https://embarassingNSFWsite.ru is pretty similar in size to the data I recieved from my vpn.

So, are there any tools or techniques that can eliminate these inferences, or at least reduce their accuracy?

View on HN

So even if I use a VPN, my ISP can still see that I connected to https://vpn.com around the same time https://vpn.com connected to https://embarrasingNSFWsite.ru.

Your ISP is very unlikely to have access to any traffic logging from your VPN endpoint, unless you are using the same ISP for both.

My solution to this has been to spin up a VPN server on Digital Ocean and just route all traffic through that. Bonus: native IPv6 over the VPN.

What's the easiest way to set up a VPN on DO? Is there an image available?

Look at OpenVPN.

I'm not aware of one, and I keep meaning to write a blog posts about the process.

There is a document on the Digital Ocean site about how to do it, though: https://www.digitalocean.com/community/tutorials/how-to-set-...

There's a couple of docs on the DO site itself, failing that though just find any 'OpenVPN' server guide and build it on whatever flavour of Linux they build it on using DO.

You can use Algo [1]. It packages everything you need to create a VPN on DO droplets and many other cloud platforms.

[1] https://github.com/trailofbits/algo

Can highly recommend Algo, it's rock solid.

OpenVPN is a "risky server"? I'd like to see a cite for that.

Ars Technica posted a guide on this last month: https://arstechnica.com/gadgets/2017/05/how-to-build-your-ow...

That's not true - you're ISP can't see the onward connection.

VPN's like PIA do provide a layer of abstraction; you could save a small amount of money running your VPN NAT on a VPS.

So, now you've shifted the privacy issue from your own ISP to DO's ISP (and indeed DO)? Now two entities can see everything you're doing!

I'm not sure if you are being facetious? Isn't the point in the current moment to obfuscate?

By virtue of TCP/IP isn't it futile to think you can achieve "true privacy" without something like TOR? (A different protocol with the obfuscation baked in?)

Someone is always going to have logs of your activity, the goal being not giving them "end to end logs" easily.

Well, you've shifted it for sure, but I still think this can improve the situation:

- It's residential ISPs that are unreasonably tracking metadata, rather than infrastructure providers.

- Even if that no longer applies, it's possible to use a VPN in a friendlier jurisdiction.

- The details of what you are doing are more obfuscated. If you're sharing a VPN, that has obvious benefits. If you use an anonymous VPN, even better.

Ultimately there will always be some data about your internet use available to a determined adversary – it's ultimately just a side-effect of wanting to send data across a network. But I'm personally more interested in opting out of the dragnet-style metadata collection that's being played with in the UK, so keeping my traffic out of sight of my ISP is a benefit.

Residential ISP's often belong to same conglomerates that own web properties, ad networks etc. So they can correlate last-mile VPN traffic with web traffic by correlating IP packet sizes/timings.

I'm not really convinced that this is the case, or that they could practically do that.

I would also guess it's not widely happening currently. But it's certainly feasille and technially easy, and may become lucrative to do if "VPN" use becomes more widespread or other motives enter the picture.

Don't you get a lot of "are you a bot?" captchas (or just outright bans) from google / cloudflare / others? Happens to me with AWS.

That isn't how VPNs work. Your ISP can see that you connected or browsed to your VPN provider, but once you establish a connection, your ISP can not see traffic that moves over the VPN. Of course they can monitor the size of your bandwidth, but they can't see where you connect or similar - that is the point of a VPN.

The logging you have to worry about is the VPN endpoint, hopefully your VPN provider does not keep logs of your activity.

The EFF has a nice brief description [0] on what can be observed and by who. Keep in mind that I believe the meta data of the timestamp of a request and when a server received it was used to put someone in jail -- I am having difficulty finding the article that the moment

The EFF also has na article on fingerprinting [1] which I believe makes using a vpn moot. if you want anonymity I believe the use of tools like Qubes and Whonix would be good place to start.

[0] https://www.eff.org/pages/tor-and-https [1] https://panopticlick.eff.org/

A VPN is the easiest, TOR the next easiest (though with both you have to be careful of revealing yourself accidentally). The only method I haven't seen discussed so far is to create a haystack in which to hide:

- Create a program to crawl and store every link provided by some link aggregator (such as HN or Reddit, or both). wget's mirroring and link rewriting is remarkably good at this.

- Create a secondary program to do Google searches on a set of arbitrary phrases (I'm thinking "go through Wikipedia & pick random phrases) and locally store those results as well. You could (carefully) include phrases you're actually interested in.

- Browse the stored data with your internet disconnected.

Of course, this limits your browsing breadth significantly, creates a delay between knowing what you want to view and being able to securely view it, and will frequently eliminate Javascript App style websites; but it's the one way I know which will make snooping on what you are actually viewing much harder.

You are mistaken about the risks of using a VPN. Your ISP is never going to see that a connection was made from VPN endpoint X and embarassing_site.com. A VPN, preferably one that does no logging, is the solution you are looking for.

Well... I think OP is misstaken also. But if the ISP of your VPN provider (at the endpoint) and your ISP (at home / where you connect to the VPN) is the same, I guess that the ISP theoretically could match metadata as OP suggests?

Usually you choose a VPN in another country than yours.

That's no guarantee. Just from the top of my head: Vodafone exists in many countries. Deutsche Telekom owns T-Mobile (which itself exists in multiple countries) and a few others.

Also, they may be the ISP of the site, in which case they can see your connection to the VPN and a connection from the same VPN.

Your VPN provider could have an ingress point on same ISP and as long as egress was not on same ISP you are still fine.it basically reduces to "don't be an idiot and choose some cheap/un-audited/amateur VPN provider". If worried then use something like Streisand or other roll-your-own option and use a cloud provider unrelated to ISP.

Indeed. Full instructions on a good option here: https://github.com/jawj/IKEv2-setup

The VPN's upstream ISP can, and all the web properties you visit can. There is nothing to prevent your last mile ISP and the those parties from colluding (by correlating the traffic) if they find this information valuable.

What you're describing is not a vpn. A real vpn establishes an encrypted tunnel that obscures all IP metadata except the connection to the vpn provider itself.

You may be describing a reverse proxy, which is not the same thing as a vpn but if it's set up properly it still should mask the metadata of what it connects to.

I think he is talking in case the VPN ISP is the same as yours

I'm wondering what % of an ISPS traffic is going over VPNs.

If it's a very tiny percentage, wouldn't your average VPN user stick out like a sore thumb? I mean if say, authorities were monitoring what was going on, surely a VPN is a strong signal for "extra scrutiny"?

As a % sure, it's going to be small, but I use VPNs all the time to connect to corporate networks and I know I'm not the only one who does so when working from home. So while it may be a % of total traffic, it doesn't mean there is anything nefarious going on with it.

Shameless plug but it will allow you to create on demand OpenVPN Endpoints on AWS. However you will be shifting trust to AWS. https://github.com/ttlequals0/autovpn

If you really need to be stealthy, connect to a public wifi network and do your browsing from there.

If you're really paranoid, buy a dedicated laptop (with cash, preferably in another town and leave your cellphone at home).

Bonus points for using some form of "cantenna" to extend your laptop's wifi range so you don't have to be physically close to the actual wifi access point. Also, use a random algorithm for determining where to connect to wifi from - people are bad at creating random patterns and can actually identify their location by the "hole" in a ring of used locations (see: serial killers).

It's worth remembering; 87% of people can be uniquely identified with a zip code, gender, and their birthdate.

Operational security - remaining consistently anonymous - is hard.

Do you have a paper or article showing the unique identification stats?

Bruce Schneieir talks about it in it's book "Data And Goliath".

Here's when it hit HN:

https://news.ycombinator.com/item?id=2942967

There are a number of good hits on google on the search "uniquely identify person zip code birthdate"

Configure your box as an onion output node. Your own traffic will be masked by the traffic of all others. This may not be very safe legally. Can we have privacy and legal safety at the same time ?

I would say Tor but rumor is the US gov have ways to break it.

I don't think that's some big secret or rumor. Tor has vulnerabilities, namely that it can effectively be de-anonymized by controlling n or n% exit nodes.

tor (and run a tor relay to increase the volume of data). Or pilfer your neighbor's wifi.

Not your neighbor's. The tracks will eventually lead to you.

Public wifi like someone else mentioned earlier.

In some places that's a crime.

https://en.wikipedia.org/wiki/Legality_of_piggybacking

Reading the USA section of that article is saddening. It just sounds like Police trying to bully the citizens they are protecting. What kind of community police goes around trying to find laws to charge people with when no one is complaining.

you also get a shared ip-adress on most vpn services.

Look into DNSCrypt

DNSSEC - your isp will still have ip adresses, but won't know exact domain names

That's not what DNSSEC is. DNSSEC is about signing the data in DNS, not encrypting it in transit. The same metadata analysis is possible.

Also, if they can see your DNS, chances are they can see the TLS handshake, so SNI would leak the domain anyway. But a VPN should encrypt both.

Sorry, that's right, i was talking about DNSCrypt of course.

Reply on news.ycombinator.com