Hacker News Reader

> I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't

Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is.

Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.

> But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back.

how will they prove it in a year?

and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?

Logging data costs money, but selling data earns money. Also, if the parent company is known for malware then getting mitm-attacked by your VPN sounds like an actual risk if you have any unencrypted traffic passing through it.

Or encrypted traffic for that matter -- a lot of VPNs install root certs on your OS.

Would you be alright if a VPN profiled and sold your browsing habits, engaging in very traditional, even benign business model similar to what everyone else is (e.g. credit cards, etc) doing -- but with the knack of keeping your real identity strictly anonymous and detached from these activities?

In other words, would you be alright if the VPN built a profile of your VPN identity? The corollary, I think, asks if you're interested in a VPN to separate your activities, or to thoroughly diffuse them for actual information loss.

No. You could associate the two profiles later on

So what’re the recommendations for alternatives? It seems like quite a lot of VPNs play their cards close to the vest - and at the end of the day, all I want is a modicum of privacy and to safely torrent a movie for my PLEX server instead of having to dig up my Blu-ray reader and rip it myself once in a while.

I can't give you a checklist for how you should determine who you trust -- that's one of the reasons why I don't advocate for or endorse any particular VPN, and one of the reasons why I don't disclose which VPN providers I use. The difficulty of determining which VPNs to trust is why I call them a "least-bad solution" rather than a "good solution."

There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start:

- What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities?

- Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic.

- What's their privacy policy look like? Do they make public commitments to destroy logs? Are their claims on-their-face absurd? There's no such thing as a VPN that does zero logging at all, so if someone is claiming perfect anonymity, I distrust them from the get-go.

- Have they had data breaches in the past (for example, NordVPN)?

- Are there any high-profile cases of them refusing to provide logs to someone?

- What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts.

- Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims.

- Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches?

That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."

You come off rather imperious in your comments here. Between the number of "I" self-references in your first post, to this saccharine checklist that is more show-off than informative.

As usual, I think the reaction of PIA's corporate restructuring is a lot of hot air over nothing. Typical of most hot air, it is released to draw attention to the source and not convey any real concern.

The wirecutter did an article [1] on VPNs and recommended tunnelbear. I’m not sure who to trust but I’m going to at least give it a re-read

[1] https://thewirecutter.com/reviews/best-vpn-service/

People should be really careful before they jump to a VPN provider. The amount of data transmitted over the connection and exposed to the VPN as an intermediary is grossly underestimated. The only real explanation for so many iffy VPN providers popping up over the last few years is that they're mining the data for something, whether its selling analytics, setting up a honeypot, manipulating traffic/piggybacking on VPN users as a botnet (cf. Hola), or whatever.

That said, if you really need a third-party VPN, FoxyProxy's branded VPN service available through https://getfoxyproxy.org is probably pretty good odds. I've never used personally so I can't vouch all the way, but it's supporting an open-source project by someone who seems to really care about his users and has put more than a decade into supporting a great extension, so that puts it far ahead of most of 'em from the get-go.

If we're talking spending extra for switching flexibility, just abandoning PIA midway through your year-long subscription term and writing off whatever you paid, works too.

>and unlike Tor, VPNs actually scale well for regular Internet browsing

What is "regular internet browsing"?

Streaming, downloading multi-GB files like games or HD movies, playing games online while avoiding (at least some) latency, uploading content or hosting your own file-sharing servers.

It's not just a speed problem. Within the Tor community I personally still see a lot of people saying that behaviors like these are selfish because they take up too many volunteer resources. Maybe it's a little unfair of me, maybe those people are misinformed -- but I interpret that as meaning that the community doesn't think Tor can scale to meet those demands.

With either a 3rd-party or a self-hosted VPN, you can reroute literally all of your network traffic from all of your devices without giving it any thought, and the only time you'll really need to get off is if you're accessing a blocked website or doing something that demands very low latency.

> playing games online while avoiding (at least some) latency

Also at most some latency. /pedantism

IMO defining all of those things as "regular usage" is problematic.

In regards to your specific list, that's above average internet user, in which case I think a better solution is diversifying your network connection methods. Trying to use one tool for that entire range of traffic centralizes it needlessly, and you'll get more effective privacy by avoiding that.

Furthermore, if you want more speed out of tor I'd argue step one is running a node and contributing and/or donating at least.

Unless this has changed in the last few years, anyone can set up an exit node on Tor and begin proxying your traffic. It's just a switch in the config.

The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection -- then you at least know that it's $LOCAL_TELCO sniffing the packets.

Tor is excellent and it has uses, but I've had to explain to many people over the years that day-to-day browsing like checking email, checking bank accounts, etc., is far less safe through Tor than through a direct connection (at least for people in the US -- if you're using Tor for its intended purpose of thwarting oppressive regimes, crossing your fingers on the exit node lottery is probably preferable).

I don't really understand your point. I think most people would agree that TLS ought to be considered baseline, as sites are often (even in this thread) ridiculed harshly on HN for NOT using TLS.

>The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection

I think this is simply wrong, and lacks any threat model at all. Why do you care that encrypted bits can be sniffed by an exit node? The node can't even determine the 2nd hop, much less the origin.

> The node can't even determine the 2nd hop, much less the origin.

The point is that users should be cautious about what they do over Tor because exit nodes can eavesdrop on (and potentially manipulate) the conversation.

The onion mechanism isn't relevant here. It prevents peers from identifying each other within the onion, but it doesn't do anything to prevent the exit node from accessing the raw packets involved in the conversation -- indeed, the exit node must access those packets to proxy them. It's true that some of the traffic will be protected via HTTPS, but even encrypted packets can be made useful in various ways.

The reality is that you're introducing a random computer into your network path and that you're trusting that computer to proxy your connection without a) eavesdropping; or b) modifying contents. The prevalence of HTTPS may or may not be sufficient mitigation for some, but any analysis of the propriety of Tor to access non-onion sites is fundamentally incomplete if it doesn't acknowledge, contemplate, and address the implications of inviting a random computer to MITM the connection (as the Tor FAQ has done for at least the last 10 years: https://2019.www.torproject.org/docs/faq.html.en#CanExitNode...).

>The point is that users should be cautious about what they do over Tor because exit nodes can eavesdrop on (and potentially manipulate) the conversation.

No, they can't. Unless you don't use TLS...which is addressed in the FAQ you linked. Who is it that can break TLS that you're concerned about? Again, without threat modeling this is all lacking a lot of context and purpose.

HTTPS doesn't change the attack surface, it's just assumed to make it inaccessible. The exit node is still in the middle, and they absolutely can still listen.

TLS will probably defeat script kiddies that are just after the "thrill" of voyeurism, but more advanced operators will make use of the attack surface you're offering them, even if they aren't ever able to decrypt the payloads (not necessarily a guarantee). There's lots of room to analyze and manipulate encrypted HTTPS traffic in interesting ways (SNI, non-secure cookies probably good starting points).

TLS depends on correct configuration on both the client and server-side to be effective (and an interested proxy could try to modify the handshake to downgrade the connection's security). Whole versions of SSL/TLS have been deprecated after fundamental flaws were discovered; things like Heartbleed, POODLE, and Debian's low-entropy key debacle were all real things that made TLS much less secure than expected. An exit node operator that knew about these flaws prior to disclosure could've been having a heyday while users just said "Welp if I use HTTPS Everywhere it'll be fine".

Even without bugs, when TLS is ostensibly working completely properly, the trust model is frequently hijacked. See the CACert wiki [0] for a list of several dozen well-known attacks on CAs, many of which allowed imposters -- on multiple occasions state-level actors -- to issue fake certificates for specific domains, which a malicious exit node could inject.

The incontrovertible point is that using exit nodes exposes some prime attack surface to literally anyone, and yes, that's still attack surface, even if you're 1000% sure that your encryption is so super-duper strong that literally no one will ever be able to break it.

The exposure is real, the risk is real even if not necessarily always immediate, and it needs to be considered along with the other factors. Any risk analysis that involves accessing clearnet resources via Tor exit nodes should contemplate this.

[0] http://wiki.cacert.org/Risk/History

You're clearly not a novice in this domain, but I'm having difficulty understanding your assessment without any sort of threat model.

The risks you're detailing are likely insignificant for 99% of users right now. Using TOR doesn't imply a specific threat model, and that notion weakens tor security and anonymity as a whole.

Fully agree with all of the above. I've been a happy customer of PIA's for years now and, as such, they've built up relatively solid trust with me (for a third-party VPN company). Even still, I only renewed only a yearly basis because a) things in tech, especially security, change quickly and b) companies also change quickly and like today, that change can be greatly for the worst.

I can't personally understand buying in to such a service for a timespan measured in years.

I paid $60 for 3 years of PIA access. From a convenience standpoint alone, I’m happy to think about it and update config every three years.

If things sour over the course of that time, I’m probably only out a few bucks over the annual payment price.

I don't follow here. PIA is a paid third party VPN. So you're advocating to use one just like this, but not PIA?

Yes. He advocates for third party VPNs, but PIA was acquired by a shady company, so not them anymore, because there’s now a reason to distrust them specifically.

It seemed pretty clear to me.

PIA meets 100% of the criteria outlined in that post however with no discussion of how to determine or measure additional criteria like future possible bad behavior based on corporate ownership, which was the genesis of the whole thread.

Ostensibly the "paid" portion of the criteria is a proxy for incentive to not do shady things like show ads or distribute malware.

The lengthy commentary was done more to draw attention to himself rather than convey any real threat by PIA's corporate changes.