Hacker News Reader

Comment by snacktaster | Hacker News Reader

Reminder to NOT use any 3rd-party VPN service if you truly value your privacy. ProtonVPN, PureVPN, Private Internet Access, etc. Do not use those services if you're intending to do some "shady shit". I know first hand that Google has a (semi)-automated web-based process for law enforcement to submit their subpoenas and get the entire access history of a particular Google/Gmail account. They don't get access to the contents of the account, but they get to see IP addresses and user agents that accessed that account in the last N days. A warrant to see the contents of the accounts would be trivial if the investigators wanted to pursue it.

View on HN

Private Internet Access has been subpoenaed by the FBI before for user logs and they were unable to comply due to not saving any [1]. That's probably the best reassurance you can get for a VPN.

[1]: https://torrentfreak.com/vpn-providers-no-logging-claims-tes...

That's going too far, I think. Sure, you can run your own VPN server, on an anonymously leased and managed VPS. But then, how do you anonymously lease and manage that VPS? As far as I know, your options are pretty much limited to VPN services, Tor and I2P. Also, VPS traffic is readily logged by providers, so your "anonymity" is pretty fragile.

Your best bet is distributing trust among multiple parties, such that no one of them can compromise you. VPN use is common, so start with nested VPN chains. Then Tor. If either the VPN chain or Tor resists compromise, then you're still safe.

After that, you can use any PM or email that you like. Because it's not connected to your meatspace identity. If content is end-to-end encrypted, the provider has nothing useful to share with adversaries. You and correspondents must, of course, avoid leaking metadata through account names and subject lines.

> But then, how do you anonymously lease and manage that VPS?

At least on DigitalOcean, it’s possible to create an anonymous account (no name required, not even by their TOS) connected to an anonymous email provider and funded by a cash-purchased Visa gift card. And a $5/mo droplet running IKEv2 VPN traffic (see Algo) is very secure and provides more than enough bandwidth/throughput for several people.

That would only leave the traffic itself (particularly the IP address(es) that initiate connections to your droplet). DO has a policy of not logging traffic unless an abuse alert is triggered.

> DO has a policy of not logging traffic unless an abuse alert is triggered.

I'd be willing to bet they log all the info about the signup process though, including the IP address used. It's how you prevent abuse.

The question then becomes, how do you hide your IP address from the DO signup process. I know, used a VPN! Wait a second...

Mullvad.net (a VPN provider) gives 3 hour accounts for free. You solve a captcha and they give you an account id to use to connect to their servers. If you want to keep using that account id for more than 3 hours you have to add money to that account. You can pay them in cash (they're in Sweden though) or Bitcoin, credit card, etc. They don't even ask you for your email and they claim to not keep logs that would allow to match an IP and a time stamp to a user [1].

[1] https://torrentfreak.com/vpn-services-anonymous-review-2017-...

One more thought - connecting via a temporary Mullvad account from a public or obscured entry point (perhaps during an international trip or at a McDonalds) would probably be the most straightforward method. The worst you're giving away is that entry point (to Sweden's loggers), but the DO/VPS fraud detection is less likely to fire if you're going through Mullvad.

To be clear, my own goal in all of this is primarily to get through residential ISP snooping -- I don't trust them not to sell my personal info. Staying out of the state dragnets is also a plus (I don't like the idea of snoops in a building somewhere reading my personal emails; same reason I close the living room curtains in the evening).

Yes, one can "anonymously" use WiFi APs. But it's hard to get close enough without becoming observable. And more and more, without being videoed. I've played with a Ubiquiti radio and parabolic antenna, and can hit APs at several km. But then, the dish is pretty big, so you need a large window. And unsecured APs have become harder to find.

It’s a lot easier to escape surveillance in the suburbs and rural areas. That being said, the ratio of McDonalds franchise density to population density goes higher the further out you go (at least in the US).

Note - Sweden is one of the “14 eyes”, so your browsing session (origin and destination IP, date/time) very well may be logged by their backbone, if not by Mullvad itself.

You can use pre-pay internet or public wifi to sign up

Public library?

Is that you, Dread Pirate Roberts?

blimey!

Why can't you just sign up via tor?

Ordering any server from a tor IP, even dirt cheap shared hosting plans, will trip their fraud detections 100% of the time. You'll likely get an email asking for photo ID.

I buy all my vpses via Tor, it takes some effort. But after a while I always manage to find a provider where I can complete the process. So, not all the providers all the time. Just some of them some of the time.

It depends on the hoster. BitHost has no problem with Tor exit IPs. Neither does Host Sailor. I know a few others, but sharing names would be imprudent.

Could using tor for the signup process work?

Or just use bithost.io, and get DO droplets for well-mixed Bitcoin. There's a premium, I admit.

But even with all that, there's the risk of logging. I don't get how DO differs from whatever "no logging" VPN service, in that regard.

I don’t trust them implicitly, but I do trust them more than any “VPN service” — to me, those are all honeypots (whether intentionally or not).

The point is that you can't trust anyone. And so you distribute trust.

That works only if each additional layer properly covers the whole surface.

A few years ago I tried that as an experiment. I wanted to see if I could setup completely anonymous Tor exit nodes. It didn't work.

I bought a prepaid debit card at a grocery store with cash. I tried to sign up for a few VPS providers using coffee shop WiFi. All wanted additional verification or wouldn't allow me to use the card. All providers use 3rd party services (eg MaxMind) to prevent fraud and prepaid cards is one of the things they look for.

Has anyone had luck doing this?

I've run into the issue as well. You just need to find providers that don't ask.

In the US you have to provide a Social Security number to activate your cash-purchased Visa gift card.

Not true. There may be some that do, but not all - just know ahead of time before you walk into the store.

It looks like your correct. I was under the impression that the USA PATRIOT Act required all cash cards to collect that information, but looking up the details it appears to only apply to reloadable cards in that they "establish a banking relationship" with the provider.

Algo

You're over thinking it. Just set up an email server in your house and use that.

if you use your house connection how are you going to stay anonymous?

Can you explain this a bit more?

Are you saying that

- Google’s policy could unmask users behind a VPN, via an IP+time correlation attack[0]

- VPN providers who say they don’t keep logs, are actually keeping logs in secret, because of what you’ve seen at Google

I’m straining to make the connection you’re hinting at.

[0] You can now basically buy these from telcos as an identity verification measure, so a VPN seems useful here.

AFAIK basically all legal VPN providers keep logs. If you're providing a service on the net, it is likely that you are required to log all access to your services.

The law inforcement officers or prosecutors can simply ask for the history of your traffic.

As it does not contain the content of your communication, in most legal systems they do not need any warrant to request this data.

That's not so in the US. And generally not so in the EU, as far as I know.

What jurisdictions are you speaking of? Cites would be cool too.

> And generally not so in the EU, as far as I know.

As far as I know the EU does have data retention laws on the books for ISPs.

https://en.wikipedia.org/wiki/Data_retention#European_Union

The last paragraph under that heading says the directive was declared invalid 2014.

> On 8 April 2014, the Court of Justice of the European Union declared the Directive 2006/24/EC invalid for violating fundamental rights. The Council's Legal Services have been reported to have stated in closed session that paragraph 59 of the European Court of Justice's ruling "suggests that general and blanket data retention is no longer possible".[18] A legal opinion funded by the Greens/EFA Group in the European Parliament finds that the blanket retention data of unsuspicious persons generally violates the EU Charter of Fundamental Rights, both in regard to national telecommunications data retention laws and to similar EU data retention schemes (PNR, TFTP, TFTS, LEA access to EES, Eurodac, VIS).[19]

I'm speaking of Turkey, and as far as I know my country adapted the regulations following the EU-Directives.

I'll have to look them up on Eurlex, I'll post them here if I find the time.

Well, Turkey is rather repressive, so I wouldn't be surprised.

Due to the increasing amount of downvotes, I wanted to provide you with some EU legislation. [1] There is also a reddit thread asking the same question [2]

  DIRECTIVE 2006/24/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
  of 15 March 2006
  on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC

Some citations from the preamble showing the purpose of data retention

  On 13 July 2005, the Council reaffirmed in its  declaration condemning the terrorist attacks on London the need to adopt common measures on the retention of telecommunications data as soon as possible.

  Given the importance of traffic and location data for the investigation, detection, and prosecution of criminal offences, as demonstrated by research and the practical experience of several Member States, there is a need to ensure at European level that data that are generated or processed, in the course of the supply of communications services, by providers of publicly available electronic communications services or of a public communications network are retained for a certain period, subject to the conditions provided for in this Directive.

The citations of the corresponding paragraphs:

Article 3 para. 2 (data necessary to trace and identify the source of a communication):

  The obligation to retain data provided for in paragraph 1 shall include the retention of the data specified in Article 5 relating to unsuccessful call attempts where those data are generated or processed, and stored (as regards telephony data) or logged (as regards Internet data), by providers of publicly available electronic communications services or of a public communications network within the jurisdiction of the Member State concerned in the process of supplying the communication services concerned. This Directive shall not require data relating to unconnected calls to be retained.

Article 5 Categories of data to be retained para. 1/a/2

  concerning Internet access, Internet e-mail and Internet telephony:
  (i)the user ID(s) allocated;
  (ii) the user ID and telephone number allocated to any communication entering the public telephone network;
  (iii) the name and address of the subscriber or registered user to whom an Internet Protocol (IP) address, user ID or telephone number was allocated at the time of the communication;

Article 5 para. 1/b/2 ( data necessary to identify the destination of a communication):

  concerning Internet e-mail and Internet telephony:
  (i) the user ID or telephone number of the intended recipient(s) of an Internet telephony call;
  (ii) the name(s) and address(es) of the subscriber(s) or registered user(s) and user ID of the intended recipient of the communication;

Article 5 para 1/c/2 data necessary to identify the date, time and duration of a communication:

  concerning Internet access, Internet e-mail and Internet telephony:
  (i) the date and time of the log-in and log-off of the Internet access service, based on a certain time zone, together with the IP address, whether dynamic or static, allocated by the Internet access service provider to a communication, and the user ID of the subscriber or registered user;
  (ii) the date and time of the log-in and log-off of the Internet e-mail service or Internet telephony service, based on a certain time zone;

Note: Legislation is said to be anulled in 2014 by the European Court of Justice. [3] I don't know how EU legislation works. But many countries adapted the regulation in their national law. The EU anulment doesn't automatically change the regulations in other legislations. For more info on how data retention is implemented in different countries, you could look at the wikipedia link jacquesm provided.

[1] Link to the directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

[2] Link to the reddit thread: https://www.reddit.com/r/VPN/comments/7x07am/if_a_vpn_doesnt...

[3] Decision of the anulment of the directive: http://curia.europa.eu/juris/liste.jsf?language=en&num=C-301...

Yes, I know about the DRD. But it was declared invalid in 2014. If any EU member attempted to enforce national law requiring general data retention, I presume that the target could appeal to the CJEU.

I looked into this fairly carefully some months ago, consulting with Nick Pestell, IVPN's CEO. In writing for their blog.[0] And I got from him that data retention requirements are now rare in the EU.

0) https://www.ivpn.net/blog/collection-of-user-data-by-isps-an...

Thanks again for the link, was very informative. I admit I didn't know much about the regulations outside of Turkey and to some extent EU. I just had a criminal procedure law class and I learned that in Turkey the prosecutors can request any communication logs without a warrant.

As we import our laws from other European countries (for example criminal procedure law was imported from Germany) I thought that this must've been the case in many law systems.

This discussion has been eye-opening for me.

I didn't dowvote, but my guess for why some have would be:

> in most legal systems they do not need any warrant to request this data.

From a quick read of your law extract, it doesn't seem to cover that aspect of your original claim (and if it does, I'd warmly suggest you highlighted the controversial bit for those who like me have a hard time grokking through such a long text)

Request does not compel compliance the way a warrant does.

Law enforcement is generally allowed to request just about anything just like everyone else.

In the UK at least, authorities can access data without a warrant.

https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016#...

After the CJEU declared the DRD invalid in 2014, the UK enacted the Data Retention and Investigatory Powers Act (DRIPA).[0] The CJEU annulled that in 2016, and the UK proposed amendments.[1] However, in January 2018, the court ruled those amendments insufficient.[2] I'm not aware of further developments, and I expect that I'd have seen anything relevant on Wilders, but please do share if I've missed something.

0) http://www.legislation.gov.uk/ukpga/2014/27/contents/enacted

1) https://www.theguardian.com/technology/2017/nov/30/police-to...

2) https://www.theguardian.com/uk-news...ruled-unlawful-appeal-...

Thank you for sharing the links. But as far as I can understand, the new regulations do not abolish the need to record the data. They only set up safeguards for which data can be used.

I think a VPN provider in this case is still obliged to keep logs, albeit only hand them over if the necessary conditions are met.

Coming from Turkey, I could not imagine a state, where the communication logs are not saved. But it seems the US does this only through intelligence agencies and does not force the ISPs to keep logs.

That's true, moreover in the legal systems I know, prosecutors also have the authority to request such documents that means the documents requested can be used as evidence. If you do not comply with it a judge can compel you to give up the document. In which case you also might get in legal trouble, because you refused the initial request of the prosecutor.

Furthermore, at least here in Turkey, communication records are also used in civil cases. For example, in a divorce case, the parties sometimes request the phone log through a judge and prove disloyalty by showing call history and duration of each call.

Yes. While details vary between countries and languages, I believe the general interpretation is that a warrant involves a judge.

The fact that they only need a subeona for metadata might change very soon, depending on how the SCOTUS case Carpenter is decided:

https://www.oyez.org/cases/2017/16-402

What's your alternative suggestion? ISPs will surely give over that information outright. At least a VPN touting privacy has the incentive to avoid putting its entire business at stake if it can't make good on its raison d'être.

So a better option would be to use your Comcast / AT&T / Verizon connection to leak data to the press?

Everything on the internet (and really in life) is a chain of trust - there are going to be weak links however far down the rabbit hole you go.

> So a better option would be to use your Comcast / AT&T / Verizon connection to leak data to the press?

A better option is to use technology that might be better able to provide some verifiable anonymity guarantees, like Tor.

True. But Tor has pwned people too. Most recently, there was the bug that CMU researchers exploited, and then shared with the FBI. Also, many users of Tor browser have been pwned by phone-home malware, which leaked their ISP-assigned IP addresses. Hitting Tor through nested VPN chains would have protected them.

If you use Tor you can't really trust the machine it is on, all sorts of potential web browser vulnerabilities. (And please don't do GPGing on the same box.) At a minimum, run it in a VM so its upstream IP is an internal NAT address, and so it won't have unique phys IDs like MAC address, which can be traced through the supply chain.

Preferably use a VPN for the host machine's connection too, at least to first download the tor client (the subset of IPs which have downloaded a recent tor bundle is quite small). At the very least, firewall the VM so traffic can only go to a tor bridge IP; even then, https (non tor) from a compromised host can identify the tor user, as all tor entry point traffic is logged and possibly has active mitm boxes (varying packet timing, fingerprinting tor versions).

Given the overall complexity of getting it right, and the enduring consequences of a single opsec failure, I'm not sure tor is a great option. Sending USB sticks through the mail would probably be safer. (Even then, encrypt them, use a dedicated laptop, don't lick the stamp or leave fingerprints, don't be observed/CCTVed posting them, purchasing the USB sticks, etc.)

Good points. I should have emphasized use of Whonix, which comprises Tor gateway and workspace VMs. Forwarding isn't enabled on the gateway or workspace, the gateway is firewalled, and it doesn't just use TransPort. It exposes a bunch of SocksPorts to the workspace VM, so each app gets its own SocksPort.

> all tor entry point traffic is logged and possibly has active mitm boxes

That's a broad claim. You need cites for that. Tor relays are run by a large collective of volunteers, and keeping something like that secret would be quite some achievement.

Okay, not all gateways. But top by volume, yes. Not by the people running them, but at the network/ISP layer. There was some open source reporting about it in Singapore (not a democracy admittedly) I'll try to dig up. But on the 5th anniversary of the Snowden leaks, why do you find it strange?

OK, maybe at network/ISP level. There's no way for relay operators to know, of course. But if an operator learned of logging, I'd expect to see that reported on tor-relays@lists.torproject.org, and I don't recall that.

This is yet another reason to hit Tor through a VPN service. Or better, a nested chain of VPN services.

Edit: I do recall a post by Virgil Griffith about the situation in Singapore.[0] He says nothing explicitly about logging, but does note that Singapore's "love of anti-corruption exceeds its apprehension about human-rights-laden privacy enhancing technologies." And I don't find anything about logging of Tor relays there. But then, I'm searching in English :(

0) https://medium.com/@virgilgr/tors-branding-pivot-is-going-to...

^^^ I've been repping physical data transfer to people for a while. Veracrypt is a great option.

> True. But Tor has pwned people too. Most recently, there was the bug that CMU researchers exploited, and then shared with the FBI. Also, many users of Tor browser have been pwned by phone-home malware, which leaked their ISP-assigned IP addresses. Hitting Tor through nested VPN chains would have protected them.

It's better, as in closer to trust-no-one, but of course it's not perfect. Especially when we're talking about endpoint security concerns.

Yes, totally agree. I love Tor :)

I understand that sentiment but a technological work around (that probably also has captured data points) that would entirely alleviate whatever hypothetical issue the OP is referring to seems at best naive to this layman.

> alleviate whatever hypothetical issue the OP is referring to

That "hypothetical" the OP referred to is the VPN provider keeping logs (or more logs than they advertise) and providing them when asked to the authorities.

It's not really that hypothetical. There was a link here today about a "no log" VPN service that apparently did that.

> I understand that sentiment but a technological work around (that probably also has captured data points)

Tor is a technology that specifically answers the issue the OP brought up, which is over-trust in a single entity to preserve anonymity. Nothing's perfect, but Tor is better than both the "VPN provider" option the OP was warning people away from and from your snarky "what and use Comcast?" option.

> but a technological work around ... seems at best naive to this layman.

You'll have to elaborate why the use of better (if imperfect) technology is "at best naive."

Ehem, asking for a friend - is using Tor in conjunction with a third-party VPN service like the ones mentioned above any safer than using Tor regularly?

OK, so imagine that your friend was using Tor in 2014, while CMU attackers (OK, "researchers") were deanonymizing users and onion sites. They exploited a bug ("relay-early") in Tor, which allowed them to communicate among malicious relays through a back channel. That led to a number of prosecutions.

But imagine instead that your friend was connecting to Tor through a VPN service. Even if CMU attackers had been running your friend's entry guard, they would have just seen the VPN exit IP address.

Better yet, your friend could have been connecting to Tor through a nested chain of VPN services. Then the FBI would have needed to do lots more work to get your friend's ISP-assigned IP address.

The Tor Project, I note, will not agree with my assessment. But so it goes.

Reply on news.ycombinator.com