Hacker News Reader

Comment by diminoten | Hacker News Reader

Host your own. The only way to be sure.

That said, what exactly is your threat model? Protecting yourself against literally every possible threat is a pointless effort...

View on HN

If you host your own, there is now a dedicated IP address with only your one client connected.

Even assuming that's true (it's not), why is that a problem?

Not the op, but unless you're constantly recycling vms or changing reserved ips, how is that not true?

I think it'd only be a problem depending on your threat model. If your traffic only comes from one ip, then it makes it easier to look for traffic from you if you're trying to be anonymous or hide your traffic from a.

If you're just trying to browse safely/privately on public wifi, then it doesn't matter.

You don't have to route directly from your VPN to your client.

Sounds expensive and complicated.

What's a valid "threat model"?

Hosting wireguard on a VPS is neither expensive nor complicated. However, you then must trust a VPS provider, and the other tenants. If you use a dedi host you still have to trust the machine, network to not be tampered or bugged. If you use a colo you still have to trust the network and the staff.

If you start your own data center, lay your own fiber, and peer with ISPs and hosts, well, everyone knows who you are again.

There’s no escaping trust issues 100%. The idea of a threat model is all about the trade offs, what things you will decide to trust or how you will defend yourself in depth.

Once I started really paying attention to security I thought I was being quite paranoid; you're right, there are threats that exist at every level, and tradeoffs to be made. Once I started learning about things like this I realized that tradeoffs are a must:

https://thehackernews.com/2018/04/hacking-airgap-computers.h...

The threat model is figuring out what you're protecting yourself from. If you're just worried about someone snooping on public Wi-Fi, creating a VPN connection to your home router and using your ISP connection should be fine.

Trying to be completely secure often is both expensive and complicated. That's why you figure out your threat model first, to avoid spiraling costs and complexity.

Hint: You're probably not trying to thwart the most sophisticated branches of a nation state.

Reply on news.ycombinator.com