In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure.
Thoughts?
1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer.
2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time.
3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in).
4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them?
5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
That's what NordVPN thought as well
Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP is absolutely nowhere the same as running a paid VPN service for millions of users across the world.
ISP advantage over VPN:
- More regulated - Bigger, thus could have better focus on security - Less of a tasty target, because ISP customers do not specifically seek out to hide themselves, whereas VPN customers do.
Advantages of VPN over ISP
- Choice of jurisdiction (i.e. who can force the company to do stuff) - Company claims a focus on security - Choice of point where plaintext becomes available (for if you don't trust the beginning of your pipe)
I think this is a wash in general, but the jurisdiction point could matter if you don't like your local jurisdiction. Similarly, if you do like your local regulator, probably better to go with the ISP.
I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.
When you use a VPN service, though, you really don’t have any real insight into what’s going on on their servers. Run your own and you can be sure you’re running the most recent, audited version of OpenVPN on an updated operating system.
My main point up there was just that I'm always kind of surprised and honestly have trouble believing it when I hear someone whose career is in network security say they don't trust themselves to secure a VPN server. If a person can tout creds securing an entire organization, a little ephemeral Linux instance that you can blow away and rebuild at will should be cake.