Hacker News Reader

Comment by ohthehugemanate | Hacker News Reader

Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. Azure even has a preconfigured option in their marketplace that's easy to set up in a legal jurisdiction of your choice.

Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is https://github.com/microsoft/service-fabric/). After the free year, a minimal always-on VM costs about $13/mo.

View on HN

First that costs too much for many.

Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP.

Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content).

Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead)

Fivth, some sites block you if you use cloud provider IPs

Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically).

Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss.

VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation.

For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.

It depends on your threat model. If you're worried about threats below the level of major nation-states a big company could make more sense. If for example a VPN company was caught bundling malware with their VPN client they would be over, but their owners would loose much less than Google would under the same circumstances.

Google will cooperate with big governments, but you can be confident they aren't owned by the Russian mafia.

If you're dealing with nation states, all the big cloud providers have NSA presence in their network. Even without that,secret warrants are a thing and VPS providers rent datacenters from someone else ,that someone else (azure,hetzner,ovh,etc...) also rents out infra to VPN providers. The only differrence is VPN providets sell VPN while VPS providers let you access the whole vm.

The only differnce is how a VPN provider can be incompetent or malicious. It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious.

I guess it does depend on your threat model but I would say for most people who don't have specific threat in mind they should exclude highly sophisticated attackers much like how you don't secure your housr against sophisticated bank robbers that might pull a heist on you.

> The only differnce is how a VPN provider can be incompetent or malicious.

Agree completely

> It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious.

Yes, but as I argued in the comment you replied to the difference in maliciousness is effictively infinitesimal because the govt can get access to any VPN provider.

There are different factors to consider,even if Microsoft intentionally infected people with ruddiam malware, at worst they get a fine and bad PR with tech circles -- their cash cows windows and azure remain unaffected. With a VPN provider like say Freedome , any sign of malice will cost them not only their VPN business but Fsecure's ability to provide infosec services. Same with ProtonVPN and ProtonMail, and unlike Microsoft the CEOs are much more likely to be held accountable since they reside in countries like Finland and Switzerland where privacy laws are very strict. Those countries may not like it if Microsoft did the same thing but they can't extradite Microsoft's CEO and even if they do the company is not incorporates in those countries. You want a VPN provider to be run by well known people that are not too powerful or too connected and reside in countries that will hold them accountable. Their main revenue stream needs to also depend on the reputation of the VPN service.

> Their main revenue stream needs to also depend on the reputation of the VPN service.

I disagree with your last statement completely. A company dependent on VPN revenue will be incentivized to do whatever they can to get and monetize VPN customers. A company that offers VPN services as a side operation that isn't financially key to their operations won't be incentivized to lie to gain users, cut costs to compete with other VPN operators, or use malware to monetize their user base.

Microsoft could not care less if you pay them a few dollars a month for a VPN. They're certainly not writing software to target people running VPNs on Azure and inject tracking and ads to make a minuscule profit. But - if news broke that they were abusing any Azure users - Microsoft would lose a significant amount of corporate and government business.

Can you name a single example of Microsoft exploiting anyone with malware? No, because the resulting reputational crisis would devastate their ability to sell their "cash cows".

Fsecure's infosec business is worth a minuscule fraction of Microsoft's businesses, and thus the potential losses from being exposed as a scam are much less.

In contrast, 57% of the top 150 free VPN apps on the Google Play Store contain code to get the user's last location, and a small number request permission to read SMS messages and take pictures https://www.bleepingcomputer.com/news/security/malware-user-...

Your comment on extradition isn't particularly relevant. Users abused by Microsoft could sue Microsoft in US court, and Microsoft would face significant legal and reputational penalties if they broke the law.

In contrast, while Finland and Switzerland do have strong privacy laws, that doesn't mean it's impossible for a "Finnish" or "Swiss" VPN provider to get away with violating user privacy. A criminal VPN provider could for example claim to operate in a country they didn't, or incorporate in a country while residing in a country less likely to prosecute them. Not saying I have evidence this happened, I am however saying that the fact that European countries in general care more about privacy doesn't make it impossible for a European company to get away with violating user privacy.

>For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.

This summarizes my thoughts very well.

If the reason you are using a VPN is to avoid potentially untrustworthy middlemen, sure. But if you are after the privacy benefits of sharing an IP address with thousands, then a self hosted VPN won't help you.

Why not ? Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic. The actual problem with such setups and VPNs is the constant captcha because you are not using a residential IP range

> Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic

On which cloud provider do you share an outbound IP with others? AWS, Linode and Digital Ocean all assign a public IP per instance.

To add: with my own DigitalOcean VPN I rarely see captchas, but some sites block that ASN (like crunchyroll).

Isn't $13/mo quite expensive compared to the cheapest VPS on any cloud providers ?

The bandwidth on Azure might be better, but the first tier on OVH, DigitalOcean and Scaleway begins at 3$/mo and you still have 100mbps.

>Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server.

No, it's not. Both have zero or very low amount of free egress (5GB max). After that you're paying $0.1 per GB of egress traffic.

>After the free year, a minimal always-on VM costs about $13/mo.

It's $5 at Linode, and that's not run by a company known for spying on users.

I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic. Scaleaway offers similar options, too.

Also see a recent news.yc discussion on cheaper hosting: https://news.ycombinator.com/item?id=21172818

>I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic.

AFAIK that option uses NATed ipv4, so it could dicey unless you know that you have ipv6 everywhere you go.

Kinda defeats the purpose though?

You lose the benefit of your traffic being aggregated with lots of other traffic.

AWS bandwidth is a killer though

Use a LightSail instance and get 2 TB of data transfer included for $5/month.

Digital ocean would be $5 per month. I’m not sure what their logging/privacy policy though because I found their terms documents so broad and confusing

I pay ~$3.5 for my dedicated server and already consider it expensive...

For a dedicated server? Or a VPS?

dedicated server

Reply on news.ycombinator.com