Hacker News Reader

Comment by wintermutestwin | Hacker News Reader

When the topic of VPN comes up, there are often posts which criticize the use of a VPN for the use case of privacy. These posts are often absolutist in nature and fail to address specific threat models. Of course a VPN isn't going to protect your privacy from state level actors - I doubt that it is possible anyway.

Why I use a VPN:

1. I don't want many of the sites I browse to know my IP.

2. My US ISP corrupted my government to allow them to steal my data. I don't know if I can trust my VPN provider, but I know for certain that I can't trust my thieving ISP.

3. I frequently connect through untrustworthy networks when traveling. Yes, SSL helps, but going through a VPN is an added layer of abstraction.

I am not a network security expert, so criticism of these three use cases is highly welcome.

View on HN

All of this can be achieved through a person VPN rather than a commercial subscription one by ssh -D whateverPort user@ip_address and setting up a SOCKS proxy in Firefox on that same port.

>there are often posts which criticize the use of a VPN

Often they specifically critique the likes of NordVPN etc. The off the shelf solutions rather than personally setup VPNs. What disgusts me is that they charge fees that are multiples of what it costs to run a basic Linode or DO Droplet for a month and a virtual machine is far more useful than a commercial VPN.

I agree with this completely. However, in this particular instance, I could make an argument for using – or at least subscribing to – Mozilla VPN simply as a method of supporting the organization. It's vital that Mozilla maintains a strong engineering force counteracting monopolies who push loss-leading products to capture markets like web browsing and email.

You don't have to even use it, but every dollar of revenue that Mozilla can attribute to their privacy products and services means one less dollar is needed from their hostage deal with Google.

A basic droplet is $5 this is $7 dollars plus it gives you email relay.

If you already have a droplet unused sure but otherwise being able to change ip in different countries adds some additional value for 2 dollars more.

I used to self-host VPN on different public clouds but most of the time got many captcha challenges (even banned, depends on websites/CDN) and I gave up, then switched to Mullvad the captcha challenges reduces a lot.

That's the premium you pay for not having to deal with hosting and configuration. There are plenty of people - even in the tech community - who lack the knowledge to handle this themselves.

A personal VPN hides my "True IP", but it doesn't mix my traffic with thousands of others and shift that ip randomly over a few days.

That's the great, albiet unfortunate, value of retail VPNs; other people are using them and your traffic mixed with theirs. Being a totally anonymous but unique individual is less valuable in today's marketing morass is less valuable than being one of many in a VPNs IP space.

The one and only thing a VPN does is that it switches your IP to another. It has absolutely nothing to do with privacy or security. An IP-address is just a single metric among hundreds that are used on the web to track users. IPs are also typically not equal to a user. It is common that an IP is a set of users and IPs often change when it comes to consumer ISPs. VPN makes sense in TCP-scenarios like Bittorrent but for web it is pretty much useless in itself.

You are incorrect.

If you use any currently standard protocol such as wireguard, openvpn, IPSEC with Suite-B ciphers you are getting 'enhanced-privacy'* from eavesdroppers on your local network, which eliminates alot of low-tier/easy MiTM attacks.

A two-layer/double tunnel is pretty-good for mitigating against most commercial data collection by eavesdroppers. (Though your tunnel-exit/last-VPN-hop, (varying by client-destination protocol), and the destination IPs/sites will still be able to collect data of course).

*Consider privacy a vector. Suite-B ciphers are not perfect, letalone their freely-available implementations.

My primary use case for a VPN is staying relatively secure while connected to wifi in a coffee shop. Maybe I am just basic though.

I have had this argument too many times. It is a combination of cargo-culting and a flawed understanding of basic security principles.

I use paid VPN services a lot as well as cloudflare warp. I understand and accept the risks the anti-vpn crowd keeps repeating. In the US, your local ISP and like you pointed out sites that sell and mine info about you are much higher risk of compromising your privacy or posing a security risk.

My traffic enters hostile network territory once it is delivered to my ISP router or the remote end of a VPN tunnel. Take NordVPN for example, I don't use them but it is more difficult but still possible for law enforcement or surveillance/ad companies to coerce or collude with Nord than with site owners and ISPs. TLS metadata including timestamp, SNI and other details along with my IP are known to Nord. To my ISP, they know my current location, usually social security number , birthday and whatever info their router can gather is known to them. Sites I visit without a VPN have my IP user-agent and whatever they collect with JS. A VPN removes the IP collection by sites and traffic sniffing by ISPs that can and do sell to whoever can pay them a fee.

VPN providers pause a significantly reduced risk than ISPs and they reduce risk from sites you visit. If you research a VPN provider and pick ones that have the most to lose by working against your interest, you reduce the risk even further.

Setting up a VPS and maintaining is a hard dealbreaker for me since I don't have the time and even if I did there is a shit-tom of more productive things I would rather do. But even if that is the case, which VPS provider should I trust more than a VPN provider? Digitalocean or cloud providers?

You know, few months ago I needed to setup a VPS fast, I must have tried 5+ including DO amd OVH. They needed to collect my email, some of them were picky about what card I used, others like DO wanted my phone to be valid, it was crazy! Only one weird vps provider let me but they didn't provision it after waiting a while. OVH wanted more info back and forth eventually after a few days supposedly they let me have a VPS but I no longer needed it after wasting money at so many places. Whether for anti-abuse reasons or anti-privacy VPS providers these days are hostile, they need too much info from you so how can you trust them with all your traffic?

Mullvad, PIA and Proton along with many others let you sign up with cash or giftcards and you can use a fake name/address. The only info they have TLS sni/metadata and your IP. They purposely get the least amount of identifying information from you.

I said cargo-culting because the people that oppose VPNs had some setup work for them and they think that and only that is ideal.

I see extremely talented security folk say that and similar cargo-culting on other subjects like how you shouldn't have an AV/EDR or just use only mac and Linux if you want to be secure lol.

Reply on news.ycombinator.com