Comment by koheripbal | Hacker News Reader

Comment by koheripbal | Hacker News Reader

Parent Full thread

I think you are correct that VPNs are a sort of half-solution.

There are a lot of people that think anything less than 100% isn't worth your time, so they suggest TOR - but TOR has all sorts of annoying limitations that preclude daily usage. Absolute solutions are seldom worth the 10x extra effort they frequently require.

Another set of half-solutions can be seen here which will make you more secure...

https://www.cloudflare.com/ssl/encrypted-sni/

ESNI, DoH, DNSSEC, and TLS1.3 are fairly easy to setup - and worth your time .

Using Firefox with uBlock Origin & PrivacyBadger plus the above gets me to a good enough place.

Illegal stuff on the other hand -> TOR.

The problem with doing illegal stuff with only half-protections is that the authorities don't need to use the metadata to prove your guilt. After they raid your house they'll have all the parallel construction they need to make it stick. ...then again if you're just buying personal use amounts of drugs - no one at the FBI cares.

I think you cut right to the core of where I get lost in the VPN argument.

Tunneling (even through TOR) isn't sufficient if you have someone well funded, highly skilled, and very motivated to watch you. I would posit that purely technical solutions will never solve human problems. Perfect, unbreakable, encryption can be trivially passed with a set of cleverly placed jumper cables.

The key, in my opinion, is trying to align technology with the laws that (mostly) already successfully protect us from jumper cable wielding adversaries.

From my understanding, The U.S. government interprets "metadata" as having no societal expectation of privacy and therefor they don't need a warrant to collect it. These questionable metadata collection programs seem like they can be effectively thwarted through half measures, like E2E encryption of the metadata (use HTTPS and DNS over HTTPS), obfuscation of the metadata through tunneling (use VPNs), etc.

Some metadata I don't have a good answer for, like location data when my cellphone pings the local towers. I can chose to share my location data w/ the tower so it can route calls to me, and submit to that possibly ending up in a government database, or I can keep my phone from talking to the cell tower being unable to send/receive calls. I don't see a half measure...

Encrypted SNI is a solution in search of a problem.

Unencryptable metadata (destination IP) makes it pretty worthless. Even on shared services like Cloudflare, things that are of interest for collection are probably paying enough that they get stuck on dedicated IPs. The 4chans of the world that might not be paying still make sense from a provider perspective to move to isolated IPs for DDoS mitigation.

Censoring proxies actually look at SNI to deconflict shared IPs where pornsite.com and travelblog.com are on the same Cloudflare IP, and will just revert to blocking the destination by default.

(I'm picking on Cloudflare here specifically because they are pushing it - but this applies to MaxCDN, Akamai, etc just as much)

> and will just revert to blocking the destination by default

Good. That's way better than being able to tell which site you were trying to go to. It's more expensive for the misbehaving network operators as well; block some popular sites just because they share an IP address with something you want to censor and people are bound to complain, even if they couldn't care less about the censored sites.

And what happens when the IP address returned by Cloudflare is a random draw from one of several million addresses?

Do you have a good write up on how to get all that setup by any chance? Also, any body has a comparison of Brave vs Firefox when it comes to privacy?

https://www.androidpolice.com/2020/06/07/brave-browser-caugh...

I was using Brave until this story came out and switched over to Vivaldi for the stuff that absolutely demands the Blink engine.

Point one, if they _repeatedly_ continue to do this kind of thing, what kind of stuff are they also getting away with? Or what's the next big surprise around the corner?

The second point is I really no prefer Vivaldi as things like sync work (it's been broken for a long time in Brave) and there's more exposed in the prefs for techie types who like to tinker with that kind of thing.

Firefox continues to be the every day browser and it keeps getting better as time goes on (another +1 for take my money for email, calendar, file storage, etc.).

So you were okay with the Binance widget but not the referral code?

Not OK with any of that crap which is why Firefox + uMatrix is the daily driver.

Not complete coverage, but I setup a piphole w/ DNS over HTTPS a while back and documented it here: https://github.com/retrohacker/knowledge/blob/master/pi/piho...

This has the added benefit of being good for the whole network (your whole house) including gaming systems and smart TVs.

Reply on news.ycombinator.com