This is troublesome.
I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable
I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable
- Cheaper than most VPN providers
- You won't be using a known VPN IP
- VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government), specifically because they seek out traffic from people trying to hide
- You get to pick the port/protocol/software you use, rather than being forced to accept the provider's ones
- You can run other small servers you may need on the VPS as well
In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure.
Thoughts?
1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer.
2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time.
3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in).
4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them?
5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
That's what NordVPN thought as well
Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP is absolutely nowhere the same as running a paid VPN service for millions of users across the world.
ISP advantage over VPN:
- More regulated - Bigger, thus could have better focus on security - Less of a tasty target, because ISP customers do not specifically seek out to hide themselves, whereas VPN customers do.
Advantages of VPN over ISP
- Choice of jurisdiction (i.e. who can force the company to do stuff) - Company claims a focus on security - Choice of point where plaintext becomes available (for if you don't trust the beginning of your pipe)
I think this is a wash in general, but the jurisdiction point could matter if you don't like your local jurisdiction. Similarly, if you do like your local regulator, probably better to go with the ISP.
I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.
When you use a VPN service, though, you really don’t have any real insight into what’s going on on their servers. Run your own and you can be sure you’re running the most recent, audited version of OpenVPN on an updated operating system.
My main point up there was just that I'm always kind of surprised and honestly have trouble believing it when I hear someone whose career is in network security say they don't trust themselves to secure a VPN server. If a person can tout creds securing an entire organization, a little ephemeral Linux instance that you can blow away and rebuild at will should be cake.
So it all depends on what you want to use the VPN for.
A compromise is a compromise, don't get me wrong, but it can happen to absolutely anyone. If you're paying ~$5/month for anonymous browsing with unlimited bandwidth, then you're probably not getting top tier security researchers running your servers.
Not acceptable.
Giving realtime public status updates makes your attacker privvy to your actions and how much you know. Fix first, publicly announce when safe to do so.
Same reason why SWAT etc. don't want media crews covering their actions in real time. It's broadcasting your view of the situation and intent to the opponent.