Hacker News Reader

Comment by nullc | Hacker News Reader

No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it.

Public VPN services have to be the one of the greatest lemon markets to have ever existed:

You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

People realize this, so you end up getting a disproportionate number of customers that don't worry about you getting their data because they're only using the service to behave abusively... which drives up costs.

So an honest provider has to deal with dishonest competition selling below cost and a customer base that is saturated with problem customers because good customers are savy enough to avoid VPNs.

View on HN

Running your own VPN provides no privacy, since you're the only user.

Of course other VPNs don't provide privacy either. The belief that they do is due to marketing, and misunderstanding what the "Private" part of VPN means: it means that two non-publicly routable IP networks (10/8, 172.16/12, 192.168/16) are virtually joined into one network. VPN companies took advantage of this (and that the connection is usually encrypted) to imply that they offer a privacy product.

The main use of a commercial VPN is to bypass region locks and other legal controls that depend on location. Pick a VPN provider (or VPS host) in a jurisdiction that won't cooperate with your home law enforcement. Assume the VPN provider spies on all your traffic.

This is such a deeply misleading statement.

Privacy fundamentally is about keeping things private ... from someone.

If that someone is everyone, then nothing is private. Any sufficiently powerful entity can just overpower you, torture you into submission, guarantee a backdoor into a system you thought was cryptographically private, etc.

I for one do pay for a VPN service, because it keeps my home traffic stream private from some people - namely my ISP - with high probability.

It also obfuscates various types of traffic I generate and makes it harder, though I agree not impossible, to collate my traffic into a usable form for spying agencies.

For me that’s easily worth paying ~$100/year for someone else to manage, and if they base their business reputation on not collecting logs, etc., there’s enough incentive to trust that while also staying vigilant to verify what I can and switch providers if they are shown to be lying.

Self-hosting a vpn is utterly not an alternative for my use case, not even for technical reasons as I am an engineer who works on production web services all day. Just from a cost effectiveness / value POV, third party vpn vendors are a good solution for me.

Right, I overspoke. It provides no extra privacy, against anyone except your ISP. If they're the threat, AND you're able to safely assume that the VPN provider is less of a threat, THEN it provides some privacy.

How does that help? If you're the only one with traffic from that IP, how does that give any privacy? Especially if you pay with something tied to your identity. And why does a VPS have any less likelihood of logging your traffic?

it's good for things like public wifi and other untrusted networks since your data is encrypted from your machine to the vpn server

it's 2020. if you're still relying on vpn connection to provide encryption, you are doing it wrong. (I understand there are certain cases you have to deal with unencrypted traffic, but those should be really rare now).

you don't have any control of what protocols your apps use and if they're encrypted or not

If you are talking about apps, recent versions of Android and iOS both deny apps to use unencrypted connections, with only a few exceptions (like browsers)

> Especially if you pay with something tied to your identity.

Then don't do that.

Though VPN are not really a strong solution for hiding your identity period. Tor is a more effective tool, but hiding your identity is extremely difficult to do effectively.

> And why does a VPS have any less likelihood of logging your traffic?

They may be too but at least you should expect their business to be viable without doing that, which is better than you can say for VPN services.

>Then don't do that.

You'll be stuck with the shadiest, slowest, most remote VPS in the world if you're unwilling to either give up your personal identity, or lie about it.

>You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

The amount of "private data" as a VPN operator isn't a lot. Most sites nowadays are https, so at best you're getting browsing habits on a per-site basis. On the other hand, using a commercial VPN does confer advantages in some cases:

* geo restrictions: commercial vpn have servers in multiple countries, so you can easily switch to one that works. you can achieve the same with cloud servers, but you'll have manually spin them up/down, which isn't convenient

* anonymity: commercial vpns usually have dozens/hundreds of users on one server. You can also switch servers/regions to increase your anonymity set further. This is a much bigger anonymity set than your own private server, which is linked solely to you.

* bandwidth: if you're a heavy traffic user, you'll probably end up paying more. most cloud providers only give you around 0.5TB for a cheap server (within the price of a vpn subscription)

* DMCA/abuse: they handle the DMCA/abuse letters for you. With a self hosted server you'll have to at the very least respond to the ticket they sent otherwise they'll take down your server.

Practically all traffic over a VPN is encrypted because most traffic going over them is encrypted, so I'm not sure how much traffic a VPN provider is really going to be able to sell. They aren't really going to be see very much of what you do if you take even some basic precautions like using HTTPS websites, or using SSL newsgroups, etc. Maybe bittorrent isn't encrypted? I can't imagine that it wouldn't be encrypted but I am not as familiar with how that works.

Your proposed alternative does not address the threat model that most people have when looking for a "VPN".

The threat model you're referring to is, I assume, mostly DMCA warnings. (As in: You want your service to not get disconnected in response to them)

It does address it, when you factor in an appropriate choice of non-US VPS provider.

Not just DMCA warnings, but full extortionary lawsuits. From what I can tell, these exist in most countries. Jurisdiction hopping won't protect you from a determined attacker.

Most VPS providers generally insist on recording your identity, probably with government ID, to limit abuse that would otherwise fall onto them. Whereas VPN providers have already made the choice to weather mild abuse complaints.

I have looked into bulletproof VPS providers. They're drastic overkill, expensive, and getting in bed with the wrong sorts of people.

Reply on news.ycombinator.com