Hacker News Reader

Comment by dheera | Hacker News Reader

I totally understand using a VPN service if you're trying to access the internet from another location, e.g. to get past the China firewall or get access to content from a different copyright jurisdiction.

However, I don't fully understand the privacy argument. It would seem to be that instead of handing over your entire DNS query history and unencrypted HTTP history to your own corporate IT department or the Starbucks Wi-Fi router, you're now handing over all that data to Mullvad. Are people okay with that?

I usually create my own VPNs. I realize that involves handing data over to AWS or whoever I use for my servers but I somehow feel slightly better about that than handing it over to some Mullvad dude.

Google tries to impose its VPN on Android too and my first insinct is: do I really want all my traffic going through Google?

View on HN

> However, I don't fully understand the privacy argument. It would seem to be that instead of handing over your entire DNS query history and unencrypted HTTP history to your own corporate IT department or the Starbucks Wi-Fi router, you're now handing over all that data to Mullvad.

Well, you're of course right that the privacy argument for VPNs doesn't make a lot of sense. But there's a whole industry living from people believing it does, and ad partners of that industry willing to proclaim that VPNs are essential for your personal privacy.

VPN ads remind me of supplement ads.

The VPN providers promise not to keep logs. They go to different lengths to prove this claim to you.

If you do believe that, it's more private. If you don't, they still might have access to that data. Otherwise AWS or someone else will.

However, even so it will be more difficult for third parties to track you since you will generally not be assigned a dedicated IP address. You are probably NATed with a bunch of other customers from all over the world. If you set up a VPN in a VPS you'll most likely have a permanent public IP.

Personally, I believe that Mullvad is truthful about its privacy claims, but I'm not a customer.

Why do you think corporate IT or Starbucks or AWS is more trustworthy than "some Mullvad dude"? Isn't it possible that Mullvad is more trustworthy? Isn't it more possible to know about Mullvad than what's going on at Starbucks or AWS?

I don't consider corporate IT or Starbucks to be trustable.

AWS I would "trust" slightly more only because I get to implement the infrastructure and among the sea of trillions of requests they serve it would be a bit more of a challenge for them to figure out which of those requests are VPN browsing data and clean that data. I can also mildly obfuscate and pollute requests using their own infrastructure and make it hard for them to extract anything meaningful about me unless they really wanted to.

Basically AWS isn't already set up as a VPN service, so they'd have to put in a nonzero amount of time to extract, parse, collate, and analyze VPN logs, let alone figure out which instances among their billions are actually VPN instances, especially if I run a non-standard, modified protocol. Unless I was some Snowden-like target it's unlikely they would waste a couple weeks of engineer hours to wireshark and clean the data from my instances.

Mullvad on the other hand handles 100% VPN browsing data so if they unscrupulously keep logs, they would have clean logs to begin with, nicely organized by username, which is scary. They wrote the client and they control the protocol. They also rent their instances from various providers (the names of which they disclose on their website) and I could presumably just bypass them and rent an instance with one of those providers directly.

Why would AWS need to Wireshark your traffic? If law enforcement came to them with IP logs from some target machine, it's just a matter of looking at AWS outbound NAT logs to find your account.

Of course, either approach should work if the goal is merely to disassociate your traffic from your identity in order to keep marketing companies knowing your interests. Your approach is more provably reliable, but some VPN providers do provide 3rd party audits and such which seems a reasonable way to establish trust.

> I don't fully understand the privacy argument.

Hiding IPs while engaging in piracy.

Other than that, I think it's mainly geoblocking evasion, which might have overtaken piracy recently as the most popular reason for using a proxy service.

Any use where the slowness of tor is a dealbreaker, and where criminal liability is not so high that law enforcement will attempt to unmask proxy users in realtime.

The privacy argument simply haven't stood the test of time. However, the first reason is still valid: some companies think they can segregate people based on their IP address, and VPNs offer a simple solution to that - even if it often doesn't work, and in many cases becomes a mouse-and-cat game with the service provider.

Personally if I'm going to hand over my history to someone, I'd rather it be anyone but Comcast.

This is my feeling too. Also, I know for a fact that my ISP would be watching me browse (thanks for nothing, Ajit Pai!), while a VPN at least promises not to. The uncertainty of whether they're telling the truth on that is still better than knowing 100% on the ISP side.

>However, I don't fully understand the privacy argument.

Yes, it's crap, and any techbro worth their salary should know this.

It's also incredibly annoying when VPN this and VPN that pops up on youtube.

I personally like the irony of VPN companies getting around adblockers by getting paid youtuber sponsorships.

SponsorBlock!

https://sponsor.ajay.app/

Could you elaborate on this? How do you create your own VPN on aws (or any other server)?

Makes for a fun little project.

https://www.digitalocean.com/community/tutorials/how-to-set-...

I'd say it's probably worse privacy wise, corporate IT or your ISP are at least accountable since you share the same jurisdiction. Some dody VPN company which you should prefer to be overseas if your main objective is piracy is much less accountable in regards to your data.

> I don't fully understand the privacy argument

It's mostly moot. In the days of HTTPS and DoH, they're essentially selling snake oil. It was a lot more useful in 2010.

Torrents and related traffic is still good send over a VPN.

Also getting around some geoblocking.

Reply on news.ycombinator.com