Comment by _l4jh | Hacker News Reader

Comment by _l4jh | Hacker News Reader

Parent Full thread

>is a great option for casual VPN users who just want to unblock content

Honestly that is all you should ever use these VPN services for. Convenient access to blocked content (or flip to a different region to access alternative content).

Sure your own VPS running WireGuard or OpenVPN is better but that isn't as easy as just picking a different country on a pretty map in an app to get access to a show on BBC iPlayer or Netflix a second later.

Nord, Express, etc. are close to worthless from a privacy aspect but they're very convenient for watching blocked content and that is all anyone should use them for.

If you want/need privacy because you're on a network you don't trust (hotel, airport, whatever) then your own VPS and WireGuard are what you should be looking into. If you trust you home ISP and have decent bandwidth (both ways) you can easily run your own WireGuard server on pretty much anything from home and just connect into that so cost is pretty much zero.

How is your own VPS + WireGuard better for privacy? You're exchanging one IP (from your ISP) for another IP (from your VPS provider), both of which are directly attributable to you.

In terms of just masking your source address from services that you actively chose to connect to, a self-hosted VPN may reduce your traceability for many – going from potentially many source addresses (your home ISP's range if they use NAT, your mobile provider's range as the almost certainly have you behind CGNAT, and any wireless networks you pass through if you use public networks) to a single fixed address.

But for other details, more significant in many use cases, a private VPN wins because you are protecting your activity from being viewed by those potentially untrusted networks.

Of course once traffic leaves your VPN it is once again at the mercy of the wider Internet between there and the destination sites & services, so use secure transports like HTTPS where-ever possible even over the VPN.

It all depends on what your threat model actually is.

In fact the advertised “access different media” use case isn't addressing an active threat at all, it is about gaining access to something rather than protecting you from someone/something.

The use case is more usually that the first IP is a wifi hotspot in a public place, or at a hotel, or in a different (perhaps less liberal) country.

different jurisdictions, pick a VPS in a country that doesnt exchange data with the one you live in.

Plus most people are going to not be able to do everything a VPN provider does privacy-wise… kill switch, no log servers, IP rotation, etc, etc

If you’re going with a VPN provider one might as well go for a more privacy aware one like Mullvad.

How safe and secure are the default settings of hosting a WireGuard or OpenVPN server?

I think that is the other side of it: You might have to know what you are doing, to get to similar security of a professional service. Trust is of course its own issue, as you are sort of hinting at, but I think it needs to be stated, that maybe not everyone is able to securely run their own VPN, depending on how hard it is to make it secure.

A good start is something like https://github.com/Angristan/openvpn-install which has pretty good defaults and isnt impossible to understand for a normal techie user.

With american ISPs (specially mobile ones) moving more into tracking and advertising I think you can still get a privacy boost from using a reputable VPN. If you want to access things that are banned or illegal in your country (either for free-speech or piracy reasons) using a VPN will definitely help with that too. I'm definetly aware that I'm just moving trust from my ISP to the VPN, but most ISPs do not even consider privacy as a selling-point or a feature, while a reputable VPN often will.

So far I haven't seen anything about mullvad that makes me doubt them.

> I'm definetly aware that I'm just moving trust from my ISP to the VPN, but most ISPs do not even consider privacy as a selling-point or a feature, while a reputable VPN often will.

This. However the critical point is that VPN providers are virtual, so there is in theory infinite competition; ISPs are an oligopoly in every country, so there is no real competition - If you don't like something about your ISP, like selling your metadata, it's usually tough shit because the other few will follow knowing there is no real competition and seeing a way to extract more money.

I'd say that cloud service providers serving billion dollar contracts definitely have much more at stake with regards to confidentiality. This is in contrast to whatever unaccountable colocation provider and residential IP botnet swarm a typical consumer VPN provider would rely on.

AWS Lightsail costs the same as a consumer VPN service while also giving you always-on compute and storage for sync and long-running jobs.

Mullvad does not use residential IP botnets. They also own at least 150-ish of their 800 servers, and the rest are rented. 45 of their servers also run diskless: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur.... If you still don't trust their datacenters a multi-hop will probably hide your actual traffic source.

Having a stable, unchanging, unique IP (that is also tied to your identity via billing, etc.) for all of your traffic (like you would with a VPS VPN) is terrible for privacy and the cloud provider will often give out your info for any legal or governmental request.

Let's say some Hollywood lawyer finds the IP address of your Amazon VPN in the list of seeders for some big movie torrent. They send a threatening legal letter to Amazon. Will Amazon forward them your contact information? Will they lock your AWS account?

So this has happened to me. On holiday, hotel surprisingly had a decent firewall in place to block torrenting, used my personal server to download a tv series.

Had a copyright notice and warning email within 6 hours. Deleted the content and they were happy. Learnt my lesson not to try that again.

Wasn't AWS but a reasonably big vps provider.

What country was your VPS in?

Can't speak to AWS, but I used a dedicated box at another US-based provider as a seedbox for nearly two decades.

When they received a DMCA complaint they didn't provide our information and generally just didn't seem to care as long as we provided the bare minimum of ass-covering for them. We'd get a ticket opened against our account with a copy of the notice, reply "We've identified one of our users operating in violation of our TOS and have banned the offending user. All copyrighted materials referenced have been deleted." and they'd close the ticket every time.

I imagine if this was more than a once-every-three-to-six-months kinda thing the support burden would have had them drop us as a customer, but at no point did they share our information or did any rights-holder take it further.

The confidentiality required by businesses with billion dollar contracts is far removed from the confidentiality required by a VPN user. Do you think Ebay or Uber would care that their web traffic can be linked to them?

Even in the low stakes situation of a lawyer going after you for torrenting, I see a high risk of a cloud provider giving out your information. They'd just have to reveal who rented your VPS instance.

Not only would companies not care about discretion when it comes to catching torrenters, they especially would not care for confidentiality about who rented their infrastructure.

They serve competitor workloads as well, I'd say they there is a huge incentive for cloud providers to put in backdoors if they could get away with it. They are deeply entrenched in rigid processes and rigorous compliance audits.

If torrenting is the basis of your risk profile, seedboxes are a lot more safer.

But you don't need a backdoor. Log incoming and outgoing traffic from a VPS and you'll have all the information you need to deanonymize you.

This is something that they will probably do as a policy, simply because "AWS used for torrenting, storing and seeding CP" is a headline that can do far more damage to their business than some logging ever will.

Reply on news.ycombinator.com