Hacker News Reader

Comment by Jonnax | Hacker News Reader

Ask yourself why you want a VPN.

Is it to avoid your ISP collecting browsing data off you and selling it?

Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

Is it to watch geo region blocked videos?

Then pretty much any service will work for you. Except that video streaming sites have caught on and blocked hosting provider IP blocks. So that might require you to shop around.

Do you want the most privacy or want to get around blocking?

Then get a VM from a provider and configure a VPN to it. Wireguard works fine.

Want to do something illegal?

Don't expect a VPN to save you.

View on HN

>Want to do something illegal? Don't expect a VPN to save you.

I'm not condoning piracy, but VPNs are generally a foolproof way to avoid DMCA letters from your ISP. Privacy means something different to every individual, everyone's threat model is different. And many models can benefit from a VPN; journalists, activists, and many others might find benefit from using a VPN.

Are DMCA letters still a thing?

It seems like Torrenting died out significantly over the last 5 years.

I moved to Germany and apparently they're still very much a thing here. Torrenting popular shows sans VPN is -- at least according to Germans on reddit -- an easy way to get sued, and forced to pay hundreds of euros.

Obviously, I have no interest in testing this out myself, so I take their word for it.

I lived in Germany for years, and this is absolutely the case. Don’t mess with torrents in Germany without a VPN.

Except for those Linux ISOs, of course.

I got C&D from Daedalic Entertainment. They demanded 1.1k or something along the lines. I was on welfare at the time, so a lawyer was not within my means,so I objected. I'm not sure what happened next because I probably didn't open the letter from the court (getting a manila envelope is fucking scary in addition to the stress of already being broke) but they seemed to have got a verdict against me and suddenly I owed over 2k. That being said I got a few letters from lawyers and replied with a legal note promising not to do it again (with any clause concerning automatic fines removed) and beat them by simply ignoring their demands afterwards. So it's entirely possible that I simply fucked myself with Daedalic by not opening their first letter and replying with a note. I haven't pirated in years but have gotten a VPN and will start back up because the fragmentation in the streaming space pisses me off too much especially since there's stuff I can't legally get here.

Just go to any popular torrent site and see the number of people in the swarm. A little harder for less popular stuff but nowhere near dying out.

Maybe in the US. Definitely not in ex-USSR. I don't know of any single person who's paying for anything other than Steam games (and that's only because they have prices adjusted to our ridiculous wages.)

Can't wait for the "you don't need a VPN" folks to acknowledge that they don't understand why lots of people actually use VPNs. It's DMCA, man. DMCA.

Rather ironic that people pay for VPN services to access content that they won't pay for.

Just don't bother with Big Media content and they won't need a VPN...

There's plenty to do in life other than torrenting the latest HBO series.

Rather, it is used for accessing content that you can't pay for, given that Amazon Prime, Disney+, HBO Go, and I'm sure many more are (or were in the past) simply not supported on linux devices.

And, "Plenty to do in life" is a value judgment, and isn't relevant to this discussion.

They'll go after you for downloading something you already paid for, or was free to begin with.

"Millions for defense, but not one cent for tribute." -- Robert Goodloe Harper

I got one about a month ago (United States, the smallest of the three ISPs available in my area). My ISP had a screwy way of injecting the complaint, which I almost missed. I had to call them and actually request the complaint be sent by mail so I could see the details, which I don't understand why they didn't do in the first place... They actually served it to a guest in my house, who thankfully told me about it, so I could investigate.

i torrent from home, i also work from home.

i just never wanted my job to hire some dumb IT consulting firm to do some cross between IPs on a swam and IPs VPNing in as a "threat analysis" and my dumb name getting dragged into an office. I know it's far fetched, but $40 a year of PIA keeps my mind at ease.

if you work from home and your company provided computer do not talk exclusively to a VPN tunnel into their network, I doubt they will pay a threat analysis.

They're too busy working through Twitch at the moment.

It goes w/o saying but most if not all the cloud providers map IP to account, so using a VPS may have get your account sanctioned or revoked.

Defiantly don't spin up these VPN/VPSs on an account you don't mind losing.

Have received DMCA emails from DigitalOcean for torrenting on their boxes. Can confirm.

There are seedbox services that allow public torrents and don't forward DMCA emails.

If you're going to do that kind of stuff, make sure the provider is based in another country. That gives you a pretty strong layer of protection against these kinds of things. Of course, nothing is entirely foolproof...

I used to work at an ISP, and once a month I would stuff envelopes with DMCA letters. I can assure you, that the only thing your ISP is doing with this letters is laughing at whatever porn you downloaded. They're just a scare tactic, and if you get one, you can almost certainly ignore it.

Didn't Cox recently lose a big lawsuit for not actually doing anything to punish repeat DMCA offenders? I'd be cautious about assuming those letters are still harmless today.

No.

They got a $1bi shakedown in a local court because they successfully fought the RIA in 2015 and won (it was $25mi then).

This time, Cox legal team tried to simply stand behind the DMCA safe-harbor (just like google does) and somehow lost.

it will appeal and win (or likely settle out of court as RIAA already got what it wanted, a hole in safe-harbor)

This varies between ISPs. Some will shut off your connection after a certain number of DMCA letters.

I've had a connection shut off because of three letters. Spectrum.

Spectrum is a joke. They constantly call me and expect me to provide them my address and payment details like it is a sane thing to ask.

Which is sad because their pricing model is less stupid than most of the competition.

Yeah, I think "VPNs won't protect you from the law" is far too broad a brush to paint with. There's no credible evidence that these services won't prevent a court or regular law enforcement from tracing an IP to a name without some specific arrangement to unmask you beforehand (there's a specific case where Private Internet Access replied to a subpoena saying they had nothing to provide), so people worried about that might benefit from a VPN, but of course it does nothing for the rest of the threat model. Torrents are pretty much the perfect crime in that it's a simple exchange of bits between parties that have nothing to do with each other, most other types of illegal activity involve myriad other ways to get caught that have nothing to do with a VPN. People who rely on VPNs alone to protect them from getting prosecuted for things like hacking and people who say VPNs are useless are wrong in exactly the same way: they don't have a complete/realistic threat model.

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

8.8.8.8 is Google’s DNS so you’re really just trading being tracked by an ISP to a giant advertising company...

The privacy policy for 8.8.8.8 is actually really good: https://developers.google.com/speed/public-dns/privacy I wish more google products were so explicit in what they log and for what purposes.

(Disclosure: I work for Google)

Not related to this thread: Do you have any way to communicate with actual humans inside of Google who can do anything? There are demonstrable issues with 8.8.8.8, yet I cannot get anything but the occasional form response from every address I've tried.

Could you point what you believe to be the issues in the thread?

If you wanted to describe what was wrong, in a way that I can reproduce it, I could file a bug, yeah

Complaining about a reproducible issue on a public forum works. Even if you don't get direct feedback, there's a good chance it will get quickly forwarded to an teams' internal mailing list.

A lot of google engineers read hacker news comments, reddit threads, etc. all the time, and generally try and route good feedback where it belongs.

And then it's a shitty trade, because your ISP still can track you without much difficulty.

Not just track you, some ISPs will simply redirect all UDP port 53 DNS packets to their own DNS anyway.

Which ISP?

People arguing against DNS over HTTPS claim stuff the doesn't happen so it'd be good to have definite examples.

The best argument I've heard about DoH (at least Firefox's forced implementation) is that it turns a distributed collection problem for the bad guys with guns into one-stop shopping for the bad guys with guns.

I know until recently Sky broadband was doing this.

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

Wouldn't your ISP still see what IP's you are visiting? Then, your ISP could just reverse DNS that IP to get the domain name, right?

Not necessarily, many sites are hosted on the same VPS, or the IP could just be one of 5000 CloudFlare servers serving up the page you requested.

Maybe, but most ISPs are lazy/cheap and can't do a full-take packet capture of all customers data at the same time. The ones that I have seen usually have a custom or logging DNS server that associates each domain request with a customer account. So yes, in many cases, changing your DNS server is enough to avoid the larger DNS sniffing operations. You should also use an IP check query to make sure that you are really using the DNS server you think, and that you're not being DNATed back to your ISP's DNS server.

DNS is super trivial to redirect. I've been on ISPs that redirect _all_ DNS traffic to their servers regardless of where it was sent. The best solution here is to switch to DoH. Of course then your DoH provider gets to log all of that sweet info instead.

Not if you run your own DoH endpoint on a VPS!

I have my own unbound running on a VPS. My network intercepts all port 53 traffic, filters out ad servers, and then forwards over wireguard to my VPS. I should probably enable DoH as well. I'm feeling kind of lazy about it though.

I think ceasing to use your ISP provider's unencrypted DNS services will already bring quite some boost in privacy for the average internet user. That's why I recently switched to using DNSCrypt (https://github.com/DNSCrypt/dnscrypt-proxy) with one of the public providers listed here: https://dnscrypt.info/public-servers (pick one run by some university or internet activism organization).

It also brings an increase in recaptcha puzzles lol

Most ISP's wouldn't care... and they shouldn't

This time when I changed internet service providers from Cox to AT&t fiber, I was shocked to find that I could not change my DNS to point to the OpenDNS servers!

AT&T requires you to use their DNS? Did you try doing DoH to bypass?

Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests to their own DNS.

If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS.

Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.

T-Mobile US was definitely doing this at one point: silently rerouting popular third-party DNS services back to their servers

Unless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc....

At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.

Doesn’t work with a large number of sites because of Cloudflare.

Edit: it _is_ easy to read the destination address from TCP packets though.

Yea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.

Additional use case: you want to self host at home ? A VPN will give you a public, stable IP address without having to fiddle with your router and opening ports and NAT-punching and friends

As long as you don’t use encrypted DNS (e.g. DoH) it doesn’t matter which DNS server you use - the ISP sees your requests and the replies, and the sees you accessing the returned IP within 10 seconds.

Also, unless it’s behind Cloudflare. Most nontrivial sites today have a unique IP so even with DoH there’s a good probability any specific site will be identified.

If you want your ISP to stay ignorant of where you surf, you MUsT have a VPN.

Though the last option doesn't give you anonymity. It just gives you privacy from your ISP. Any services you connect to can tie you to the IP of your VM. Sometimes the shared IP of a VPN provider might be desirable.

Your ISP can sniff your DNS traffic as it is just a plaintext protocol.

Reply on news.ycombinator.com