Hacker News Reader

Comment by busterarm | Hacker News Reader

I don't know why anyone advocates using a VPN provider when it's so trivial to set up your own VPN now.

https://github.com/trailofbits/algo https://github.com/Angristan/OpenVPN-install

Either of these options, depending on your preferences (protip: use Algo, unless you're in a place that blocks IPSEC VPNs...It's cheap enough to have both available). This at least covers the basics of what they're talking about being snooped in the post. Then you don't have to worry about trusting the VPN provider (but you do have to worry about trusting your cloud provider).

If your threat model is different, you might want to be in a pool of users, but you can use the same service and solve this problem socially...

View on HN

> I don't know why anyone advocates using a VPN provider when it's so trivial to set up your own VPN now.

..links to github repos...

You are blessed with technical skills and experience so this is trivial to you (and many people on HN), but there are tons of people out there for whom this is not a trivial task.

If you can get through the steps to sign up and use a VPN service, you can likely get through these with a bit more time invested and a helping hand.

Agreed - 99% of people don't know how to understand whats in a github repo.

> I don't know why anyone advocates using a VPN provider when it's so trivial to set up your own VPN now.

That won't give you any privacy as anyone who wants to de-anonymize its traffic can correlate the fact that you connect to it with your IP (asking the VPS provider for logs) and that you bought it (asking the VPS provider for your banking info).

But that's not really the threat model described when people are talking about their ISP snooping on what they do. A private VPN solves exactly that problem.

Also you still have the same issue with virtually all of those paid VPN services (that you connect from your IP and that you paid for the service). Oh, and Vultr takes Bitcoin, btw (not that that's privacy but it is potentially a layer of separation from your bank account).

> But that's not really the threat model described when people are talking about their ISP snooping on what they do. A private VPN solves exactly that problem.

It only solves it against a particular ISP.

> Also you still have the same issue with virtually all of those paid VPN services (that you connect from your IP and that you paid for the service).

I completely agree, that's why I always maintain that only privacy by design solutions should be relied on (Tor and i2p for example).

> Oh, and Vultr takes Bitcoin, btw (not that that's privacy but it is potentially a layer of separation from your bank account).

But they know the IP, so that's still identifiable information.

You can combine Tor and a VPN though, though you'll want to rotate through VPNs to avoid timing attacks.

Use of one doesn't exclude another.

> You can combine Tor and a VPN though, though you'll want to rotate through VPNs to avoid timing attacks.

I don't think that adds any privacy, setting up your own non-exit relay and connecting to it may significantly increase your privacy depending on your threat model (since then you can be sure that no single point in your Tor circuits controls both the entry node and exit node, and hence can't correlate your traffic. You're still vulnerable to a global passive adversary (GPA) of course).

For anyone who uses OSX and DigitalOcean, easily deploy your own personal VPN server with DNS adblocking running on DigitalOcean: https://github.com/dan-v/dosxvpn.

I heard a ton of sites block traffic coming from the AWS IP range, do you know if that's true?

I've been putting off setting one up for a while.

There are a small handful of sites that treat me like a spammer and make me go through extra hoops to sign in, but I have not found what you said to be the case.

A lot of folks are doing their automated testing with AWS systems and blocking those IPs would likely cause a lot of people some headaches.

The DNS blackhole that Algo by-default puts ad providers in causes me more problems than that, in all honesty, because occasionally I have to log into service like Hubspot that are blocked.

Reply on news.ycombinator.com