Don’t Use VPN Services (2015)
gist.github.com
gist.github.com
1. The VPN is being honest. No tracking. All is well.
2. The VPN is lying, tracking, maybe even reselling your traffic. Fair enough, but they’re not in any more privileged situation than your ISP. They still can’t see inside your TLS connections and whatnot. And you still get the ancillary benefits of:
A. Geographic diversity of IPs;
B. Easy to get a new IP;
C. Security at potentially unsafe access points.
So, worst case, for $80 a year you get some IP flexibility and security at Starbucks. Best case, you also get the whole no-tracking thing.
> you get some [...] security at Starbucks
This keeps coming up. What additional security do you get if everything is HTTPS nowadays? If you connect to unencrypted endpoints somewhere, why is a potentially untrustworthy VPN better than a potentially untrustworthy Wifi access point?
Its all about how far you spread your information. Giving it all to a VPN or spreading it across every wifi access point you need to use.
My Linux box (NetworkManager on Arch) does it, but I don't remember whether I had to manually turn it on.
edit: according to [0], NetworkManager defaults to randomized for scanning, but not for connections.
[0] https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoof...
Does it help if you're one of 2 people in the Starbucks, and the other person is the one logging the IPs you visit?
They don't have to. They see you right there.
If you are a target, how likely is it that whoever's after you only has control over the coffee shop wifi, but not over the possibly untrustworthy VPN provider?
Because I'm not talking about some state actor. Just the kind of people (some stalker, private dick, con artist or script kiddy looking for a random target and see you with your laptop, whatever) that might want to eavesdrop on your IP visits while you're on a coffee shop.
There are several cases for which a VPN offers some protection, and the ones I mentioned are among them. If the agency/person you're a target of also controls the "VPN provider" you have bigger problems than choice of VPN.
Personally, I don't want my data sold at all. It's not Starbucks specifically who I want to prevent from selling my data. If it's totallynotshadyvpn.com who does it, it's just as bad.
That ship has sailed
I know my ISP in Australia tracks my internet usage, as required by the Government.
I don't know if my VPN provider (Mullvad) truly doesn't track.
But either way, I'm no worse off, most likely I'm better off.
A TLA that isn't running at least half a dozen VPN companies isn't doing its job, IMO.
Also, yes TLA's run many of the major VPN's behind the scenes.
But a proxy doesn’t have to be a web proxy. Socks proxies were pretty common at one time.
Court orders. They might be lying to customers, but they're unlikely to lie to a court. So if a court approaches them and they respond with "we have no data", they have no data.
Okay it's never gonna be no data, they'll still supply email address, payment method, registration date and similar things, but that's not my concern.
That's incorrect, they can see your traffic if you are connecting without tls which basically never happens. Otherwise they see what your destination is, obviously.
And anonymizing VPNs literally are proxies, noone is denying this.
> The $10/month that you're paying for your VPN service doesn't even pay for the lawyer's coffee, so expect them to hand you over.
Another nonsensical argument because subscription fees add up. A VPN provider with a 10 $ per month fee and a large userbase like the common providers makes an incredible amount of money.
> VPNs don't provide privacy, with a few exceptions (detailed below). They are just a proxy. If somebody wants to tap your connection, they can still do so - they just have to do so at a different point (ie. when your traffic leaves the VPN server).
Okay, get back to me with directions on how I install a blackbox at the Datapacket datacenters
> If you absolutely need a VPN, and you understand what its limitations are, purchase a VPS and set up your own (either using something like Streisand or manually - I recommend using Wireguard). I will not recommend any specific providers (diversity is good!), but there are plenty of cheap ones to be found on LowEndTalk.
If you've actually ever browsed Lowendtalk you'd absolutely not be confident in stating that none of the providers log. These are all super small fish without their own infrastructure. And you have a dedicated IP adress which defeats the user pool benefit per server. And additionally you'll need to maintain the OS and software yourself which isn't something a layman can or wants to do.
> Because it's easy money. You just set up OpenVPN on a few servers, and essentially start reselling bandwidth with a markup.
So OP suggests here, contradicting their previous claim, that VPN providers do indeed make a lot of money and as such wouldn't have issues with legal procedures.
Also no, you'd still need to develop your clients. Anonymizing VPNs absolutely are a lucrative business but it's not that simple.
> Because a VPN in this sense is just a glorified proxy.
I feel comment-grandparent's pain.
They also had a recent audit of their VPN servers and no leakage or logging was found. Among other factors they're the only such VPN I'm aware of to hold up under scrutiny.
Do I even use a third-party VPN? No; but they're the only one I've seen that are as close to trustworthy.
Of course that requires trusting the police report and the auditor (and that the audit process didn't happen while they were on a different operation mode than their usual, and that the police case wasn't on some class of persons who they don't log, while for others, e.g. when they get "special orders" they do)...
If the baseline position is that any company can and will lie, regardless of available knowledge about law enforcement intervention or audits then one could say nothing can really be trusted (even hardware we utilize everyday), since there's always some potential undisclosed 'gotcha'. Otherwise it's where one draws the line of verifiability.
There have been other VPNs that haven't held up under scrutiny and been found logging (and had poor security), while Mullvad goes into detail about their infrastructure, mitigation methods (including some quite paranoid anti-tamper hardware techniques, which anecdotally the founders were into prior to forming the company), has had various audits, resisted a warrant and apparently doesn't spend on advertising.
Could all these things be some elaborate ruse? Possibly. There will always be some judgment call.
I think it's a good starting assumption if you need full trust.
For regular Joes however, it's more about being able to trust the raw technical mechanics (that the data won't go to the wi-fi in the open or to your ISP and in-betweens, but to some remote VPN).
If you can assume those targetting you don't (or can't) buy your non-anonymized data from that VPN service, you're OK, even if the VPN service logs and lies that it doesn't log.
Because, sure, they can lie about that (and even the audit service can), but in-betweens can't just bypass SSL (unless you're compromised otherwise, in which case VPN or not is the least of your problems).
Conflating "I use a VPN because my commercial ISP would probably sell my data if given the chance" with "I'm a potitical dissident being directly attacked by a nation-state actor".
You can still use a VPN despite it being vulnerable to your governments quantum computer...
Sure, it's hard to find a trustworthy VPN provider, but that's not to say they don't exist
I've been using mine for years and it cost me less than $2/month.
(And it's fun to setup)
Then you can use ssh socks proxy
ssh -D 8080 login@ip
And turn it on in firefox
You've merely switched your home IP with your VPS IP, both pointing to you.
There doesn't seem to be any performance difference.
Although with sophisticated adversaries like the Great Firewall, even VPNs don't work very well.
Most people use VPNs because they are a glorified proxy.
>Doesn't matter. You're still connecting to their service from your own IP, and they can log that.
This is true, although it can be possible to connect to the VPN from Tor (when using OpenVPN or WireGuard-over-TCP). Obviously, all traffic could be associated with your account so don't use multiple identities if you want reasonable anonymity. And it's slow, so it's usually not worth it.
>VPNs don't provide privacy, with a few exceptions (detailed below). They are just a proxy. If somebody wants to tap your connection, they can still do so - they just have to do so at a different point (ie. when your traffic leaves the VPN server).
Your ISP cannot. Some (many?) countries like Australia have data retention laws. A VPN will hide your traffic from your ISP (although probably not a large sufficiently motivated adversary like a government out to get you), which can be useful even if your VPN provider can log your traffic.
(there may be some things like traffic analysis where they might be able to guess the type of traffic you're using, though I'm not sure how effective if is or if many ISPs actually attempt this)
>Your IP address is a largely irrelevant metric in modern tracking systems. Marketers have gotten wise to these kind of tactics, and combined with increased adoption of CGNAT and an ever-increasing amount of devices per household, it just isn't a reliable data point anymore.
>Marketers will almost always use some kind of other metric to identify and distinguish you. That can be anything from a useragent to a fingerprinting profile. A VPN cannot prevent this.
This is true, though the impact can be somewhat minimized with Tor Browser with the Tor proxy disabled (or Mullvad Browser), which have decent fingerprinting mitigations.
>In the second case, you'd probably just want a regular proxy specifically for that traffic - sending all of your traffic over a VPN provider (like is the default with almost every VPN client) will still result in the provider being able to snoop on and mess with your traffic.
Do any regular proxy (socks5/http) providers provide the same quality of service as VPN providers? And you can't port forward over a socks5 proxy, which can be useful for torrenting. (if you're downloading popular content you don't need it, but if you're downloading torrents with only a few seeders or maximizing the amount of upload you get on a private tracker, port forwarding can be useful).
Also, if you're on Linux you can use network namespaces to use some applications over VPNs and not others. (remember to refresh private keys and use a different server before using the namespace for a different identity)
>If you absolutely need a VPN, and you understand what its limitations are, purchase a VPS
>A VPN provider specifically seeks out those who are looking for privacy, and who may thus have interesting traffic. Statistically speaking, it is more likely that a VPN provider will be malicious or a honeypot, than that an arbitrary generic VPS provider will be.
VPSes are arguably worse for some use cases as most probably don't handle DMCAs as well as commercial VPNs, you don't have access to a large amount of servers and countries to change your IP address, and you have less people to blend in with. I see your point, though I'm not sure how true that is.