Hacker News Reader

Comment by jolux | Hacker News Reader

I stopped trusting VPNs that weren’t hosted by me years ago. Wireguard is simple enough that any reason to is rapidly diminishing.

View on HN

> If you wanted to see what the most paranoid, security-conscious people are connecting to, and you wanted to install software on their systems that is designed to read all their network traffic and then redirect it through a single choke point, then setting up a VPN service with a huge advertising budget would be a great way to do it.

https://www.youtube.com/watch?v=WVDQEoe6ZWY

Security conscious people aren't installing proprietary VPN trapware, nor routing all of their traffic out one VPN.

What are “security conscious” people doing instead, out of curiosity?

TOR

I suppose the traditional paranoid answer is TOR.

Running generic OpenVPN/Wireguard/TOR/etc, and segmenting traffic by purpose/nym.

Sure, that's what I recommend. Wireguard specifically.

I assumed this was meant to target a particular cross-section of people that were security conscious, yet not tech savvy.

Lots of use cases aren't covered by a self-hosted VPN. Public VPN servers allow you to blend in with other traffic coming from a shared IP giving you plausible deniability for things like piracy.

My use case is not piracy.

A few other major use cases I've used them for:

- Scraping, when my scraper gets blocked from the real estate site, wallpaper site, etc, I click next IP, change my UA and I'm ready to go for another round. You can play cat and mouse all day without worrying about all your IPs getting banned.

- Avoiding DDoS attacks, if you're doing something that makes you likely to become the victim of a DDoS attack, like say, joining a script kiddie's botnet IRC server, not giving a crap if your public IP gets dropped is pretty handy.

- GeoIP bypasses, allows you to work around everything from region locked content to discriminatory pricing

- Country-wide and default blockades, many countries censor the internet only in minor and weak ways, blocking things like BitTorrent tracker websites by domain or IP that commercial VPNs will trivially bypass

An legitimate users still wonder why using a VPN makes the internet harder to use in terms of being on blacklists and having low IP reputation.

What is the benefit of self-hosted VPN? No, security benefit I know of, unless you primarily consume HTTP or other unencrypted communication and even then it saves you from MITM or other attacks between you and your VPN server and not till the content server. Anonymity is only a benefit in public VPNs.

If what you want is anonymity, VPNs are the wrong tool, as evinced by these leaks. My main use case is privacy on unsecured networks such as that of coffee shops.

> VPNs are the wrong tool, as evinced by these leaks.

Are they? So far every leak I’ve read of, has been by pretty shady companies. This seems more like evidence that if you buy a pacemaker from aliexpress (or in the case of NordVPN from Wirecard or Theranos), you might die from it failing.

My ISP has been quite open about selling my information. Therefore, I'm fond of encrypting everything they see, including destination IPs, DNS, and non-TLS traffic; a VPN is a simple solution.

EDIT: To clarify, I know my ISP's spying on me. Therefore, in some models, trading that against a VPN service that might be spying on me in the same way could be a favorable trade. YMMV.

Hang on... If you use a self-hosted VPN through a VPS, the hosting company that's providing the VPS could still log ir MITM traffic from the VPS. So you still need to trust someone, no?

If you have an encrypted channel to the VPN server, it'd be quite difficult to extract any meaningful data from it.

The hosting provider can still monitor egress, which is what's more valuable anyway. Hypothetically, they could also snapshot the RAM for deferred analysis, though that's usually more trouble than it's worth. You have to trust someone in the end.

Well, if you want 100% security, you have to build your own internet. But hosting your own VPN is reasonably safe, unless you have reasons to believe a government-sized entity is specifically targetting you, in which case, yeah, just don't use the internet.

Well, that's what VPNs were designed for in the first place - building your own private network!

However, it's a misconception that VPNs provide privacy for browsing the public internet. As we see, there are many weakness.

Other than wanting an IP that's not directly tied to you?

Not sure what you mean by “directly,” there are going to be strong financial ties to any VPN provider one chooses, and as such, they are no better than running your own in a lot of circumstances.

If the VPN provider doesn't keep logs, you have plausible deniability that it was in fact your traffic coming out of that exit node.

How can I trust they don’t keep logs?

Same way you trust hey.com not share all your email with everyone publicly. By building some kind of trust, describing how they work, their policies, being clear about how they make money and so on.

I don’t know of any VPN provider as trustworthy as DHH and Basecamp.

That's not relevant.

Sure it is! All of my network traffic is going over a VPN. Not the case with email.

It’s sad to think VPN logs might be accepted as a source of truth. They probably are in most countries, but they really shouldn’t be.

If your crime is downloading Frozen, and the authorities can’t find any trace of the movie on the device the logs claim was used, then it would be shameful if the logs alone were enough to convict the person.

In which country is downloading a copyright film a crime, punishable by fines or prison sentences?

Did you miss https://www.youtube.com/watch?v=HmZm8vNHBSU

It shouldn't be trivial to find you if someone wants to file a lawsuit. Everyday p2p shouldn't be dangerous.

If you have a server, allocated an IP, and someone sees that IP... that's a pretty direct tie.

> there are going to be strong financial ties to any VPN provider one chooses

Not if you pay with cash (such as Mullvad). Then it depends on what they can infer from your traffic.

Reply on news.ycombinator.com