Comment by falcolas | Hacker News Reader

Comment by falcolas | Hacker News Reader

This is silly. But let's take it seriously for a moment, and talk about threat models, the ones that Troy Hunt has brought up specifically.

1) Threat: Unencrypted Traffic

An international VPN doesn't solve this. If the traffic is not requested over HTTPS, it will be equally unencrypted once it exits the VPN tunnel. At which point your traffic is not only vulnerable to the VPN and the VPN's ISP, it's vulnerable to the various national firewalls and interconnects your traffic is traveling over that it wouldn't normally.

2) Threat: Phishing

Troy Hunt's Nord VPN only prevents this because the VPN is intercepting and changing DNS requests. It won't help with DNS over HTTPS, as an aside.

3) Threat: Privacy

As pointed out in 1 and 2, using the VPN doesn't increase your privacy; it actually decreases it. All a standard VPN does is change your source IP.

A couple of other threat models:

4) Rogue ISP

Now, if your ISP is truly rogue, a VPN might help lessen some of the problems, but no more than conscious awareness while browsing the web will. If it's not a secure page, it's not a secure page, whether it's been served over a VPN or the most hostile ISP known to man.

5) Government Wiretapping

A VPN, even an international VPN, will never stop a state level actor if they really want your traffic. International agreements (such as 5 eyes) exist to make these kinds of requests easy.

IMO, the only real use of a VPN is to bypass IP based region checks. But since VPN endpoints can be detected, that kind of fix is a cat and mouse fight at best.

There are three legitimate use cases for a VPN of some sort, one of which is well solved by using a browser extension like https everywhere and enabling dns over https in a modern browser.

1. Coffee shop WiFi: if an adversary ARP poisons your WiFi hotspot (or is the coffee shop owner), and you are browsing http websites, you can get owned pretty easily. This can be solved through things other than a VPN (see above).

2. Bypassing region locks

3. Piracy. If you live in a region where your ISP will snitch on you, using a VPN gives you some safety from that, especially if your VPN provider knows little about who you are, and couldn’t really snitch on you if it tried (see Mullvad paid in cash for instance). Most VPN providers will just throw out copyright infringement notices.

I thought a lot of people use VPNs specifically to avoid DMCA requests? From what I understand, it works extremely well in those cases and I imagine that most VPN use-cases stem from region check bypassing and DMCA request avoidance (but I could be wrong).

In all seriousness, what would be the best way of increasing both anonymity and privacy online? Not from nation-states, but hackers/data breaches/ad-tech/local law enforcement?

It's an interesting but frustrating topic. It seems like every potential solution has some major caveat that someone will invariably point out as making the solution useless.

For example, I am wanting to export all of my data from my social media (texts, posts, location data from Google, etc) for posterity and then delete the accounts. But I also want to keep it safe and secure. So I use VeraCrypt containers. But then what if my Kinesis keyboard has some firmware embedded reading my passwords? Now I'm screwed. And if I backup online with Backblaze, and use their E2E encryption but one day they change their software so that it records the password when typing it in. It almost feels helpless.

> It seems like every potential solution has some major caveat that someone will invariably point out as making the solution useless.

You have to come up with a threat model. You have to decide what threats are the most important to you.

I'd group them into three domains, based on the amount of effort involved in mitigating the threat. From the most work to the least: Threats you absolutely and utterly must avoid at any cost and effort. Threats you want to avoid, but you're not willing to the extent of fighting a state-level actor. Threats where it would be nice to have them mitigated, but it's not worth exceptional effort or cost.

For your backblaze (BB) example, your threat is "BB's client can't be trusted" and the sanctity of the data falls in bucket two.

To mitigate your distrust of BB's client, you'd want to make sure it never sees unencrypted data. And so, you'd do something like encrypt the data with your own key, and then send it to BB. You'd want to use a second computer (or a dual boot system) to ensure that the OS which hosts BB's client is not running when the encryption is happening, and share the resulting encrypted binary files with the computer that will do the upload.

The keyboard on the encrypting computer could still be a threat, but that's getting into the "state-level actor" levels of effort to counter.

I've found that, in 2020, the best VPN is one given to you by a friend.

If it's truly located in their house and uses their IP, there's no chance it ends up on a list

Reply on news.ycombinator.com