Hacker News Reader

Comment by nfbyte | Hacker News Reader

You can also set a proxy per container (and assign specific websites to always use it), and when you combine that with an ultra-cheap VPS running e.g. a Shadowsocks server you have what I think is the real way to circumvent censorship and bypass regional restrictions (as opposed to using snake oil "VPN" providers or even the Tor Browser).

View on HN

Are most VPN provides unreliable? I don’t know - never researched this.

I use Proton VPN because it is bundled with ProtonMail. I very much like preventing my national Internet service provider from selling my browsing history.

Most VPN providers you typically see pushed are very suspect at best. Especially the ones you see commonly pushed by Youtubers like NordVPN, ExpressVPN etc. I think the only VPNs that have actually been externally audited are Mullvad and ProtonVPN.

What's is the concern about VPNs being "suspect" or "reliable"? I hear this a lot about VPN providers but not sure why. If the VPN is logging your activity/IP you'd have to be doing something super illegal for the police to want to get a search warrant for your data.

As always, the answer is it depends on your threat model.

It's not just that they're suspect or unreliable. They're complete bullshit.

The actual use of VPN technology is to create virtual networks that are private (hence the name). It's a system level technology. There are several types of network topologies you can set up, when I was learning about this I found this article which is quite nice: https://www.procustodibus.com/blog/2020/10/wireguard-topolog.... You can proxy traffic through a VPN, but the only scenario I can think of in which it makes sense is if you are an OSINT researcher and you need a safe system on which to conduct your research.

If you need to proxy traffic and "hide" your IP, just use a flipping proxy. It's an application level technology (e.g. for torrenting, every torrent client under the sun supports a SOCKS5 proxy). If you don't have the patience to set up a VPS yourself, you can even use something like Outline (https://getoutline.org) which automates that (and it has a mobile client app as well).

If you need privacy (and to actually hide your IP), then use Tor.

Unfortunately that doesn’t fix the real reason most people use VPNs, which is torrenting. Nobody should be using NordVPN to hide from a nation state, but for torrenting they add one level of obfuscation.

I specifically mentioned torrenting, please re-read. There is no reason to have all the network I/O of your computer go through an extra hop just for one application (e.g. a torrent client) when that application can be configured to use a proxy instead. It increases the network latency, complexity and attack surface of your system.

If the main use case is torrents,

I think the reason why the method you mention isn't commonly used is that it is complicated to understand/set up and hard to verify.

I've seen more advanced users encapsulate everything in a VM so that non-VPN traffic can be blocked globally by the OS.

> Most VPN providers you typically see pushed are very suspect at best.

Ironically (I hope?), Mullvad is by far the one I see pushed the most.

I don't think I've ever seen a Mullvad ad or paid promotion (eg sponsored YT videos). I mostly see happy customers praising them (including myself).

Between sponsorblock and ublock origin, I never see ads or paid promotions on youtube or any other website like that. That mostly leaves [presumably] unpaid promotion of Mullvad on sites like HN.

Funnily, both ExpressVPN and NordVPN which you call out have been externally audited.

NordVPN had the clients audited by VerSprite last year, and their No-log policy audited by PwC in 2018 and 2020. And a bug bounty program on HackerOne. [1]

ExpressVPN - Windows Client was just audited by F-Secure in March, and server side audits by Cure54, and PwC in 2021 and 2019 respectively. And a bug bounty program on Bug Crowd. [2]

---

For comparison

Mullvad has been audited (Client security and Infrastructure (for privacy)) by Cure53 through 2020, and first was in 2018. Has no bug bounty, but they do still have a vulnerability disclosure program. [3]

ProtonVPN, audits of the no-log policy in April, and clients in 2020. And they run their own bug bounty program.[4]

---

I actually find it kinda interesting that while they've all had audits regarding privacy on the server side, only ExpressVPN has had a security audit of server side components. (Granted I've not look that deeply at this)

[1] Annoying, you can only download the audit reports if you Login then click Reports in the menu

[2] https://www.expressvpn.com/blog/?s=audit

[3] https://mullvad.net/en/blog/tag/audits/

[4] https://protonvpn.com/blog/?s=audit

Mulvad seems to be very reliable.

https://mullvad.net/en/

I have both, but prefer Proton;

I frequently have DNS issues with Mullvad, and also speeds are lower. Proton is also more expensive though...

Also, there's a long outstanding issue (on their Github [1] ) which they have confirmed) that the Mullvad app causes iCloud services to stop syncing (bookmarks, Files, etc.). That's a showstopper if you use Apple devices...

[1] https://github.com/mullvad/mullvadvpn-app/issues/2401

Reply on news.ycombinator.com