Hacker News Reader

Comment by mirimir | Hacker News Reader

I always assume that they might be. So I always use my own perimeter router/firewall running pfSense. Plus I use VPN services. And so my ISps don't end up seeing anything except encrypted streams. And have no visibility into my vLANs.

View on HN

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.

scummy often by law, if it was up to many ISPs, like in the early days of the internet, they only cared if you paid your monthly bill.

> there's only a handful of residential ISPs available in any given area

Depends on where you live, I haven't exactly counted them but I have at least 20 options. Worst-case you can start your own ISP.

> and they are almost univerally scummy

Source? I do not think most of the ISPs in my area are particularly scummy. They provide reliable plain internet service with no data caps (and also TV/phone service if you so desire) for a reasonable monthly fee, and in my experience, most of them hire enough customer service workers on their support phone. All of them also resisted internet filtering until the legal system forced them to do so. What more is there to ask of an ISP?

Good for you.

In my area none of them provide reliable internet service, most of them enforce some censorship and have poor customer service, and all of them perform the legally-mandated surveillance.

> What more is there to ask?

Taking care of insecure IoT devices would be a start: https://news.ycombinator.com/item?id=15946095

> there's only a handful of residential ISPs available

Where I live the nationwide fiber network has around 100 ISPs available of varying reputation.

Wikipedia says that PPPoE "offers encryption" but now I'm curious if this is effective, and actually used by anyone...

Having the wire, especially if it's fibre, between your home and ISP encrypted is probably of extremely limited value. Your ISP has access to the (unencrypted) endpoint anyway, and any adversary with the resources to actually tap your fibre probably have higher value and more easily accessible means of spying on you anyway.

Personally I very much agree that using a vpn service for all your traffic is probably not a good idea. As well as other objections, some have been confirmed to sell fine grain traffic information, and may have an easier time justifying that as it is arguably anonymised.

That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies network that you end up trusting is less likely to be set up to spy on you then a consumer isp.

I get bad speed though when I do this. The processibg speed required to encrypt a connection at 300mbps just isn't there in my router.

> in my router

That's probably the issue. A general purpose machine (with AES-NI), slap OpenBSD on it, disable DHCP server on your ISP router, let OpenBSD handle that... and done! (not for the faint of heart though)

You might even add a NIC to it, and act as another physical hop for firewalling, etc.

Thanks for the tip - I'll try out a connection with AES-NI CPUs at both ends and see if that helps...

I've had good luck with pfSense as a VPN client. Either as VMs, or on dedicated hardware with a decent CPU. If you're wanting more than 100 mbps, however, you probably also want a cryptoprocessor chip.

You should not trust anyone handling your traffic, that's why things like HTTPS and SSH exist.

The problem here is not that the ISP can not be trusted, you should never trust them anyway. The problem is that the ISP is using their router to force their way into what is supposed to be the trusted part of your network, your LAN.

This is exactly why I don't use the ISP provided router, and every piece of equipment of theirs I have to use (mainly the IPTV box) is in a separate, untrusted, VLAN.

Sure I am, but they're a VPN service with a long history of protecting users from snooping. And they don't do business from the jurisdiction that I'm subject to. So targeted surveillance would be harder. Not impossible, of course, by major national intelligence organizations. But hey.

Also, I dont rely on just the one VPN service. I use nested chains of VPNs, and so distribute trust among multiple providers. Doing business from different jurisdictions. Just as Tor does with three-relay circuits. Sometimes I use private VPNs running on anonymously leased VPS.

Finally, each of my personas uses a different nested VPN chain, or Tor (Whonix) through other nested VPN chains. So linking my various personas would be nontrivial.

mikrotik devices are also very nice for this (router). not too expensive, stable and well supported

Commercial VPN services are not a good idea in the first place https://gist.github.com/joepie91/5a9909939e6ce7d09e29

As discussed in the thread[0] on this from the other day it's largely FUD.

Fundamentally a VPN service allows you greater control over who you trust with your traffic. You always have to trust someone[1]. For example I trust F-Secure and the Finnish court system much more than I trust Virgin Media, GHCQ and the British court system which is why I run Freedome and route my traffic through Finland. As pointed out in another subthread here UK ISP are required to collect a bunch of data by the Snooper's Charter, the same is not true in Finland.

0: https://news.ycombinator.com/item?id=16371030

1: The default for many people is their local ISP which might or might not be a good entity to trust based on where you are. In many place you also have very few choice when it comes to your ISP.

Reply on news.ycombinator.com