I don't use a VPN provider, but it's tempting as I don't trust my ISP at all.
As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2].
[1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...
I've always assumed VPN providers sell whatever data they can too.
I also remember that Comcast did (and might still do) inject code onto websites to display a “pop-up” indicating that you’re reaching or have reached your datacap. It would even pop up on Steam because most of Steam is really just a webview. I’m not sure exactly how they did/do that.
Again, I’m not a network or security expert, so I’m not really sure of how TLS protects your internet history, which I take to mean a list of websites you visit and when.
But, for most people, that means that the ISP will just see:
• google.com
• facebook.com
• reddit.com
• somebignewspaper.example.com
Etc.
And there’s really nothing much too valuable about that. They won’t even be able to figure out if you’re shopping for something (unlike every other nosy channel provider), because most shopping traffic today just looks like Google + Amazon.
Very educational response though. Thank you.
While it's true that the big platforms dominate web use today, don't forget that the concept of metadata includes when you actively surf on the information superhighway. That's valuable information for advertisers.
So is every DNS lookup related to the API backends of specific apps you use. And every random website outside the massive platforms.
These might reveal tons of information about you. Like:
Are you doing research on politics (and which flavor)? Do you worry about health? When do you access online banking? Which banks? Any tax filing software? Invoicing apps? Do you use shitty payday loans? Are you looking for dates? Are you gay? Which games do you play? Which car dealerships do you consider? Do you gamble? And of course, any particularly.. specific porn sites? Do you access banking, travel/flight booking, investment, shitcoin trading, adult or gambling sites in a specific pattern that might indicate mania or other mental health issues?
With metadata alone, your ISP has a thick dossier on your habits, with stuff therapists don't know about their clients.
I misremembered, it was about 90% -- https://scirate.com/arxiv/1403.0297.
Of course the people that find this problem worthwhile to solve then go on to work for or found surveillance companies, rather than publishing proof of concepts to security lists.
We also already know the type of molds the surveillance companies are trying to fit us in, from their own marketing materials (eg https://www.experianintact.com/content/uk/documents/productS...). Do you really think there isn't enough metadata being leaked to bucket people into these categories?
And yeah, IP proxying is a hack. But it's seemingly the best we can do to mitigate the utterly broken HTTPS/JS protocol stack.
There are other straightforward advantages too, like having location targeting miss the mark which breaks up the coherency of their manipulation. I've got zero intrinsic interest in local/news events for elsewhere.
We can't solve for you the question of how much to use. If you want a snooper to not know if you retrieved file A of 14583 bytes or file B of 14621 bytes maybe a very small amount of padding will get the job done. If file B was 800 Mb that's a lot more padding you're asking for.
If you're responding to my characterization of HTTPS/JS as "broken", I'm referring to the fact it needs to make a connection to a well-known centralized-authority server every time it wants to retrieve a resource, leaving you at the mercy of your transit (and the server itself, which is obviously another major source of surveillance). Whereas something based on ideas like content-centric networking (eg Freenet) allows a user agent to retrieve those resources from peers or broadcasts, perhaps even over virtual constant-bitrate links.
Personally, I don't like the idea of my mobile provider profiting off knowing which applications I am using and what sites I visit.
My point is simply that using a VPN provider doesn't change the fact that an actor has access to your DNS queries and which IPs you connect to (and where you connect from). It just changes that actor from your ISP to a VPN provider, and most VPN providers seem a hell of a lot more shady than any ISP I've dealt with.
If you're using something like NordVPN, you're just swapping one shady outfit for another. Worse, in many cases.
Might be better to just wait until you land.
(Also, if I see you making requests to some websites I can correlate it to others, just on hostname, which I would get from SNI/TLS, not DNS: like, you go to news.ycombinator.com followed by some other websites that are currently on the front page of Hacker News, I can now guess with high likelihood you are clicking on specific website links you just saw.)
As for "the VPN provider can also do that", that is like saying "what can a random stranger do with your secrets that someone you know well can't?", which is "true" sure, but not really interesting: being able to choose the company on whom you rely for security is extremely useful: I don't really have choice over my ISP, but I have choice over my VPN, and so you can't really say "these VPNs are shadier than my ISP" unless you can show the best of all VPNs is shadier than my ISP.
Meanwhile, for many people, your "ISP" on a given day might be "the local coffee shop" or "an airport" or "your brother's friend Bob": people talk about "ISP" as if it always means "AT&T", but I see even extremely technical people who "should know better" happily using WiFi provided by conferences, which is just crazy to me... you are way more likely to get messed with in some scary way by people close enough to you for it to matter than by some random entity.
A VPN won't protect you from these sidechannel attacks.
I don't even live in a country were I have to fear much at all from malicious authorities, but they wouldn't even blink before trading privacy for perceived security.
I might change my opinion if there were actual consequences for sharing user data. I believe it when I see it.
Otherwise I just like privacy, information is power and I don't like to share with the state.
But there are zero controls on US agencies hoovering up data indiscriminately outside US borders.
(Of course, some people give their VPN their credit card info, so the above rationale doesn't apply for them.)
Edit, to add: No VPNs do this.
Yet.
I got a nastygram from the hosting provider I used.
counter-example: https://forum.goldenfrog.com/t/no-longer-feeling-private-aft...
https://arstechnica.com/tech-policy/2011/07/major-isps-agree...
Edit: spelling
It's about choosing between the lesser of two evils.
Agreed - especially when it is so very, very cheap and easy to fire up a handful of VMs - around the world - and run your endpoints any way you like.
By far my preferred technology is 'sshuttle'[1] which allows you to use any host, anywhere, running ssh as a VPN endpoint. That cuts the setup time for your VMs down to almost zero.
You don't have to funnel it all, only data crossing hostile networks like free wifi hotspots (The only real use-case for VPNs in the first place). Alongside this is choice of geolocation so you can watch things like HBO even when in Europe.
You're already doing that with DNS servers. At least VPN providers make the claim that they'll protect you.
My NAS device, uses a VPN - my other machines do not.
My laptop, uses a VPN when I am travelling and using wifi from unknown sources (i.e. coffee shops, airports, etc.)