Hacker News Reader

Comment by kinkora | Hacker News Reader

PIA (Private Internet Access) and am a happy customer for 3rd year running.

Why do I choose them? Besides the ease of use over multiple platforms, they are the only VPN (I am aware of) that has held up in court that they do not store any logs when asked to handover personal information.

Sources:

[1] https://torrentfreak.com/private-internet-access-no-logging-...

[2] https://www.scribd.com/doc/303226103/Fake-bomb-threat-arrest

View on HN

PIA's offer and their policy on retention might be good, but they're still a US company and they still tried to smear several other VPN companies (including ProtonVPN).

Their clients are also messy memoryleaky electron apps with outdated chromium embedded.

>Their clients are also messy memoryleaky electron apps with outdated chromium embedded.

You can dial PIA with a openvpn app of your choice

There are new apps that are not based on chromium [1].

[1] https://www.privateinternetaccess.com/pages/download

Interesting point to pick from the ones I bought up. I guess that's an improvement.

Would you mind addressing the other one, particularly who from PIA this is?

https://www.reddit.com/user/common_sense7

Interestingly one of the comments seems to allege that's you. Hm.

I just about dumped PIA for the same reason. Downloaded their newest update, and it is soooo much better.

The stupid fight they had with ProtonVPN and NordVPN did it for me.

Reddit mods had to close some threads because the people copypasting PIAs (mostly baseless) allegations under every comment even slightly positive about either ProtonVPN or NordVPN were getting out of hand.

https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

Here's the account that has done nothing but attack ProtonVPN https://www.reddit.com/user/common_sense7

Has a hint of Mafia to it.

They also donate to FLOSS on a semi-regular basis.

FLOSS?

Free/libre/open-source software.

I have 1GB fiber, do they offer 1GB speeds? How badly would using them as my VPN affect my speed?

IPsec at 1gbps needs a powerful router.

A Juniper SRX 320 that I have can only can reach about 500mbps.

I doubt they cost $3 per month though.

a pcengines apu does just fine, you'll get 900mbps+ easily with ipsec

Oh man, I've been wanting to pick one of those routers up for some time. What did licensing cost you for your SRX 320?

PFSense on a cheapish high clockspeed server will easily get there. Total cost about a grand, a bit more if you want to use a low power no fan solution.

I would like to know a bit more about this as well.

I often play online multiplayer games, my main issue with using a vpn full time would be the performance impact here.

I'm also curious if PIA has a way where if I launch certain apps, it would pause itself while that application is running? Or some way to automate on/off state of the VPN.

I doubt it would affect your speed much. How often are you able to utilise 1Gbps anyway?

Sure in theory you'd see a slow down, but given that most of the sites and service you use aren't able to deliver 1Gbps to you directly, the decrease in speed is most likely lower than you'd think.

>but given that most of the sites and service you use aren't able to deliver 1Gbps to you directly

You would be surprised how wrong this statement is.

Especially if you are a gamer, almost any platform can max out a Gbit connection easily.

Besides at those speeds you start seeing all kinds of issues (like OpenVPN implementation being very inefficient).

If you have 1GB, then forget anything OpenVPN. Use IPSec or Wireguard.

With OpenVPN you will bottleneck at ~300Mbit\s. With IPSec and Wireguard I have had no issues getting ~900Mbit\s to my own server.

> you will bottleneck at ~300Mbit\s.

Any idea where the bottleneck was there? CPU use? Protocol latency? I'd be interested to see some test results around that if you know of any that have been published.

A little anecdotal information: some years ago I did a CPU-load test with OpenVPN on a diminutive Atom-based netbook as the client, and it maxed out at around 95mbit/s on a 100mbit/s network (actually a gbit network, but the netbook only had a 100mbit NIC itself) while just doing simple bulk transfers.

You could start here:

https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_...

>It is easily possible to saturate a 100 Mbps network using an OpenVPN tunnel. The throughput of the tunnel will be very close to the throughput of regular network interface. On gigabit networks and faster this is not so easy to achieve. This page explains how to increase the throughput of a VPN tunnel to near-linespeed for a 1 Gbps network.

I think the protocol just wasn't designed for such high speeds.

Have you read the code? It's woefully unparallelisable and is written to support more platforms rather than work better on any single one of them.

> woefully unparallelisable

It certainly doesn't use multiple cores for a single connection, though I've never tested (or reviewed the code) to see if it does manage to spread the computational load of multiple connections over more CPU resource.

I've not read the above linked article in detail (no time ATM) but there seems to be mention of offloading AES calculations to compatible hardware, so the bottleneck would appear to be CPU use.

Does using multiple cores on a single NIC actually speed up a network connection? If you're doing gigabit with 1500 byte packets, you get 12 ms to encrypt and process each packet -- I'd expect any cross-CPU synchronization to easily blow through that.

If the bottleneck is encryption speed, then you can definitely improve perf by spreading packets across the cores. Inter-core synch isn’t that expensive, and 12us is 24000 cycles on a 2GHz CPU. cmpxchg costs ~20 cycles (https://stackoverflow.com/questions/4187914/average-latency-...).

PS. And you don’t need to submit/receive packets to NIC one by one, either; those things support DMA scatter/gather.

That's a really helpful response; thanks!

Earlier you claim you will only ever hit ~300Mbit, but then you link to an article where the author hit 885Mbit throughput after tweaking a few settings and ensuring OpenSSL was using AES-NI.

Yes. But that article never worked for me.

Do you have any recommendations for wireguard providers? I'd love to try it out, but I don't want to host my own server.

I've been using PIA with gigabit fiber for two years, and anecdotally I've not noticed a difference.

I had the same experience when I had such a good connection a couple years ago.

I'm a happy PIA customer but their app certainly lacks polish and has crappy icons - if you care about that stuff :)

Yeah it looks like an android figure so PIA would use some new designs for sure to stand out in the market a bit. Their website also looks bit too clip-art fakey. Otherwise good service and been using it also

Try the new client, its a vastly upgraded UI

samesies

Reply on news.ycombinator.com