Hacker News Reader

Comment by haunter | Hacker News Reader

Every single time I start researching VPN services I end up more confused and with more questions than before because basically every vouched service has the same amount of negative comments too. Like feels like the whole sector is a honeypot (lol) of shady stuff and also they figthing against each other (or not?). So I just wait until when turns out Mullvad is also one of the bad guys.

View on HN

Ask yourself why you want a VPN.

Is it to avoid your ISP collecting browsing data off you and selling it?

Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

Is it to watch geo region blocked videos?

Then pretty much any service will work for you. Except that video streaming sites have caught on and blocked hosting provider IP blocks. So that might require you to shop around.

Do you want the most privacy or want to get around blocking?

Then get a VM from a provider and configure a VPN to it. Wireguard works fine.

Want to do something illegal?

Don't expect a VPN to save you.

>Want to do something illegal? Don't expect a VPN to save you.

I'm not condoning piracy, but VPNs are generally a foolproof way to avoid DMCA letters from your ISP. Privacy means something different to every individual, everyone's threat model is different. And many models can benefit from a VPN; journalists, activists, and many others might find benefit from using a VPN.

Are DMCA letters still a thing?

It seems like Torrenting died out significantly over the last 5 years.

I moved to Germany and apparently they're still very much a thing here. Torrenting popular shows sans VPN is -- at least according to Germans on reddit -- an easy way to get sued, and forced to pay hundreds of euros.

Obviously, I have no interest in testing this out myself, so I take their word for it.

I lived in Germany for years, and this is absolutely the case. Don’t mess with torrents in Germany without a VPN.

Except for those Linux ISOs, of course.

I got C&D from Daedalic Entertainment. They demanded 1.1k or something along the lines. I was on welfare at the time, so a lawyer was not within my means,so I objected. I'm not sure what happened next because I probably didn't open the letter from the court (getting a manila envelope is fucking scary in addition to the stress of already being broke) but they seemed to have got a verdict against me and suddenly I owed over 2k. That being said I got a few letters from lawyers and replied with a legal note promising not to do it again (with any clause concerning automatic fines removed) and beat them by simply ignoring their demands afterwards. So it's entirely possible that I simply fucked myself with Daedalic by not opening their first letter and replying with a note. I haven't pirated in years but have gotten a VPN and will start back up because the fragmentation in the streaming space pisses me off too much especially since there's stuff I can't legally get here.

Just go to any popular torrent site and see the number of people in the swarm. A little harder for less popular stuff but nowhere near dying out.

Maybe in the US. Definitely not in ex-USSR. I don't know of any single person who's paying for anything other than Steam games (and that's only because they have prices adjusted to our ridiculous wages.)

Can't wait for the "you don't need a VPN" folks to acknowledge that they don't understand why lots of people actually use VPNs. It's DMCA, man. DMCA.

Rather ironic that people pay for VPN services to access content that they won't pay for.

Just don't bother with Big Media content and they won't need a VPN...

There's plenty to do in life other than torrenting the latest HBO series.

Rather, it is used for accessing content that you can't pay for, given that Amazon Prime, Disney+, HBO Go, and I'm sure many more are (or were in the past) simply not supported on linux devices.

And, "Plenty to do in life" is a value judgment, and isn't relevant to this discussion.

They'll go after you for downloading something you already paid for, or was free to begin with.

"Millions for defense, but not one cent for tribute." -- Robert Goodloe Harper

I got one about a month ago (United States, the smallest of the three ISPs available in my area). My ISP had a screwy way of injecting the complaint, which I almost missed. I had to call them and actually request the complaint be sent by mail so I could see the details, which I don't understand why they didn't do in the first place... They actually served it to a guest in my house, who thankfully told me about it, so I could investigate.

i torrent from home, i also work from home.

i just never wanted my job to hire some dumb IT consulting firm to do some cross between IPs on a swam and IPs VPNing in as a "threat analysis" and my dumb name getting dragged into an office. I know it's far fetched, but $40 a year of PIA keeps my mind at ease.

if you work from home and your company provided computer do not talk exclusively to a VPN tunnel into their network, I doubt they will pay a threat analysis.

They're too busy working through Twitch at the moment.

It goes w/o saying but most if not all the cloud providers map IP to account, so using a VPS may have get your account sanctioned or revoked.

Defiantly don't spin up these VPN/VPSs on an account you don't mind losing.

Have received DMCA emails from DigitalOcean for torrenting on their boxes. Can confirm.

There are seedbox services that allow public torrents and don't forward DMCA emails.

If you're going to do that kind of stuff, make sure the provider is based in another country. That gives you a pretty strong layer of protection against these kinds of things. Of course, nothing is entirely foolproof...

I used to work at an ISP, and once a month I would stuff envelopes with DMCA letters. I can assure you, that the only thing your ISP is doing with this letters is laughing at whatever porn you downloaded. They're just a scare tactic, and if you get one, you can almost certainly ignore it.

Didn't Cox recently lose a big lawsuit for not actually doing anything to punish repeat DMCA offenders? I'd be cautious about assuming those letters are still harmless today.

No.

They got a $1bi shakedown in a local court because they successfully fought the RIA in 2015 and won (it was $25mi then).

This time, Cox legal team tried to simply stand behind the DMCA safe-harbor (just like google does) and somehow lost.

it will appeal and win (or likely settle out of court as RIAA already got what it wanted, a hole in safe-harbor)

This varies between ISPs. Some will shut off your connection after a certain number of DMCA letters.

I've had a connection shut off because of three letters. Spectrum.

Spectrum is a joke. They constantly call me and expect me to provide them my address and payment details like it is a sane thing to ask.

Which is sad because their pricing model is less stupid than most of the competition.

Yeah, I think "VPNs won't protect you from the law" is far too broad a brush to paint with. There's no credible evidence that these services won't prevent a court or regular law enforcement from tracing an IP to a name without some specific arrangement to unmask you beforehand (there's a specific case where Private Internet Access replied to a subpoena saying they had nothing to provide), so people worried about that might benefit from a VPN, but of course it does nothing for the rest of the threat model. Torrents are pretty much the perfect crime in that it's a simple exchange of bits between parties that have nothing to do with each other, most other types of illegal activity involve myriad other ways to get caught that have nothing to do with a VPN. People who rely on VPNs alone to protect them from getting prosecuted for things like hacking and people who say VPNs are useless are wrong in exactly the same way: they don't have a complete/realistic threat model.

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

Wouldn't your ISP still see what IP's you are visiting? Then, your ISP could just reverse DNS that IP to get the domain name, right?

Not necessarily, many sites are hosted on the same VPS, or the IP could just be one of 5000 CloudFlare servers serving up the page you requested.

Maybe, but most ISPs are lazy/cheap and can't do a full-take packet capture of all customers data at the same time. The ones that I have seen usually have a custom or logging DNS server that associates each domain request with a customer account. So yes, in many cases, changing your DNS server is enough to avoid the larger DNS sniffing operations. You should also use an IP check query to make sure that you are really using the DNS server you think, and that you're not being DNATed back to your ISP's DNS server.

DNS is super trivial to redirect. I've been on ISPs that redirect _all_ DNS traffic to their servers regardless of where it was sent. The best solution here is to switch to DoH. Of course then your DoH provider gets to log all of that sweet info instead.

Not if you run your own DoH endpoint on a VPS!

I have my own unbound running on a VPS. My network intercepts all port 53 traffic, filters out ad servers, and then forwards over wireguard to my VPS. I should probably enable DoH as well. I'm feeling kind of lazy about it though.

I think ceasing to use your ISP provider's unencrypted DNS services will already bring quite some boost in privacy for the average internet user. That's why I recently switched to using DNSCrypt (https://github.com/DNSCrypt/dnscrypt-proxy) with one of the public providers listed here: https://dnscrypt.info/public-servers (pick one run by some university or internet activism organization).

It also brings an increase in recaptcha puzzles lol

Most ISP's wouldn't care... and they shouldn't

This time when I changed internet service providers from Cox to AT&t fiber, I was shocked to find that I could not change my DNS to point to the OpenDNS servers!

AT&T requires you to use their DNS? Did you try doing DoH to bypass?

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

8.8.8.8 is Google’s DNS so you’re really just trading being tracked by an ISP to a giant advertising company...

The privacy policy for 8.8.8.8 is actually really good: https://developers.google.com/speed/public-dns/privacy I wish more google products were so explicit in what they log and for what purposes.

(Disclosure: I work for Google)

Not related to this thread: Do you have any way to communicate with actual humans inside of Google who can do anything? There are demonstrable issues with 8.8.8.8, yet I cannot get anything but the occasional form response from every address I've tried.

Could you point what you believe to be the issues in the thread?

If you wanted to describe what was wrong, in a way that I can reproduce it, I could file a bug, yeah

Complaining about a reproducible issue on a public forum works. Even if you don't get direct feedback, there's a good chance it will get quickly forwarded to an teams' internal mailing list.

A lot of google engineers read hacker news comments, reddit threads, etc. all the time, and generally try and route good feedback where it belongs.

And then it's a shitty trade, because your ISP still can track you without much difficulty.

Not just track you, some ISPs will simply redirect all UDP port 53 DNS packets to their own DNS anyway.

Which ISP?

People arguing against DNS over HTTPS claim stuff the doesn't happen so it'd be good to have definite examples.

The best argument I've heard about DoH (at least Firefox's forced implementation) is that it turns a distributed collection problem for the bad guys with guns into one-stop shopping for the bad guys with guns.

I know until recently Sky broadband was doing this.

Though the last option doesn't give you anonymity. It just gives you privacy from your ISP. Any services you connect to can tie you to the IP of your VM. Sometimes the shared IP of a VPN provider might be desirable.

Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests to their own DNS.

If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS.

Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.

T-Mobile US was definitely doing this at one point: silently rerouting popular third-party DNS services back to their servers

Unless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc....

At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.

Doesn’t work with a large number of sites because of Cloudflare.

Edit: it _is_ easy to read the destination address from TCP packets though.

Yea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.

Additional use case: you want to self host at home ? A VPN will give you a public, stable IP address without having to fiddle with your router and opening ports and NAT-punching and friends

Your ISP can sniff your DNS traffic as it is just a plaintext protocol.

As long as you don’t use encrypted DNS (e.g. DoH) it doesn’t matter which DNS server you use - the ISP sees your requests and the replies, and the sees you accessing the returned IP within 10 seconds.

Also, unless it’s behind Cloudflare. Most nontrivial sites today have a unique IP so even with DoH there’s a good probability any specific site will be identified.

If you want your ISP to stay ignorant of where you surf, you MUsT have a VPN.

VPN’s just mean you’re trusting someone else than your ISP. Instead of your ISP seeing you go to site.com, now your ISP sees you connecting to a VPN and the VPN sees you connecting to site.com.

For this reason I am highly suspicious of any VPN service that markets itself as some “magical privacy wormhole”, which is 99% of VPN providers.

Honest ones I know of are Encrypt.me and Mullvad, who both tell you they should be mainly used to secure yourself on open WiFi and to circumvent geo blocks.

If you want a private internet connection, use TOR.

I regularly think that claims of astroturfing are overblown, but it is common in the "privacy" focused industry to FUD competitors to gain market share.

I'm immediately reminded of some shady search engine CEO going on OAN and other fringe shows posing as a security researcher to spread FUD about DDG to drive traffic to his site (can't find the link for it now.) That OAN video even went around the security industry (among compliance and less technical folk) who were persuaded DDG was now worse than Google for consumer privacy.

Some reasons you might get some negative vibes from looking into consumer VPN services:

* Some consumer VPN services have been found to be doing sketchy things. And you can imagine the business is attractive to people intending to do sketchy things, since it's a powerful/lucrative position to be in right now. (In addition to the business possibly being attractive to people just wanting to provide a useful and honest service for a fair price.)

* There seem to have long been referral kickbacks by some consumer VPN services, which I assume is the cause of some of the huge amounts of noise on the Web and such about them (e.g., search hits on some non-VPN topics, such as some home theatre search terms, overwhelmed by SEO articles, the purpose of which is to then herd the reader towards particular VPN services with a kickback). Even some endorsements by organizations might essentially be more about revenue than about merits.

* I speculate that it doesn't help if one of the main historical uses of consumer VPNs has been for activity that would be considered copyright-violating in the US (e.g., unauthorized trading of video files, or circumventing region restrictions). Without making any moral judgments, I think it's fair to say that constitutes "conscious rule-breaking" for some, so I wouldn't be surprised if there's an disproportionate culture of rule-breaking around the whole space.

The hypothetical culture of rule-breaking might not be convinced by a culture of rule-breaking surveillance. Seriously, I think government has gone to far with surveillance and that just means that I want to minimize my data collection on a domestic level.

I use ProtonVPN. Same company as ProtonMail. Highly reputable with a business model around doing privacy and encryption well.

NordVPN shares offices in Estonia with ProtonVPN. For that reason I find it sketchy.

I would like to read more about this, do you have a source?

I cannot find anything reliable that suggests this! Thanks.

https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

This suggests the opposite of what you say in your original comment.

https://vpnscam.com/tesonet-data-mining-company-owns-nordvpn...

You should also link the HN thread where proton categorically denies the claims.

In particular, the claim that tesonet controls protonvpn's release signing key.

https://news.ycombinator.com/item?id=17258203

They clearly put a lot of effort in cleaning the mess, as I later discovered myself by being from the same city:

https://news.ycombinator.com/item?id=18611863

It seems very likely now, that ProtonMail just decided to use NordVPN's white-label solution to bootstrap its ProtonVPN business:

https://nordvpn.com/white-label/

I was not the original person that replied to you. I was just providing with you with information on the incident they were referring to. Proton denied the claim but it is up to you whether you believe them or not.

Link. Please.

>NordVPN shares offices in Estonia with ProtonVPN

What really? Some proof for that? ProtonVPN and ProtonMail is located in Switzerland Genève, i dont see any open positions for estonia

https://careers.protonmail.com/

I don't think NordVPN is sketchy, even with their latest hic-ups. They are however located in Panama as far as I know, which probably gives the US access for "drug trafficing".

IMHO ProtonVPN (and Mail) are the perfect honeypots

How/why?

ProtonVPN provides the source code for their desktop and mobile clients in their GitHub organization [1]. Yes open source != safe; however this level of transparency is at least a step in the right direction.

They also have regularly been audited by independent organizations that are openly available for the public to see their compliance [2][3][4][5][6].

Do you have any evidence to suggest that they are honeypots?

[1] https://github.com/ProtonVPN

[2] https://protonvpn.com/blog/wp-content/uploads/2020/01/Proton...

[3] https://protonvpn.com/blog/wp-content/uploads/2020/01/Proton...

[4] https://protonvpn.com/blog/wp-content/uploads/2020/01/Proton...

[5] https://protonvpn.com/blog/wp-content/uploads/2020/01/Proton...

[6] https://protonvpn.com/blog/open-source/

And how do you know if what they built is exactly what's in that source?

Hehe, exactly, oldest trick in the trade

You seem to not have read my comment. I said open source != safe or trusted.

You can download the entire repository, and self compile yourself after you inspect the code.