Hacker News Reader

Comment by furyg3 | Hacker News Reader

I feel pretty double about VPN as a solution for masking my online activities. My reasons for using a VPN break down into these (related) categories:

1. Security. I don't trust this network at all, such as unsecured wifi in coffeeshop.

2. Access. This network has draconian restrictions I need to get around, such as corporate proxy servers or country firewalls.

3. Privacy. It's none of this network's business what I'm doing.

4. Legal. I don't want to get in trouble here. Especially when traveling where I don't know the laws, but increasingly in my own country. Hell, the courts in NL haven't figured out if TPB is legal, how should I know?

VPN can solve many of these problems most of the time... but always using a VPN means that I have a single point of failure for all four of these.

View on HN

Regarding "3. Privacy", it's not just the network you're on, you're protecting your privacy from, it's every single service your device regularly polls or connects to. If you find yourself hopping on and off wifi at home and work and else where, every service your device polls is building up a log of your movements.

This is mainly why I have a VPN on my phone. Apps that make internet connections from my phone always appear to be coming from the same IP address as far as the end service is concerned. It doesn't matter if I'm on wifi at home, on wifi at work, or on 3G. All of the connections are routed over an encrypted channel to a box I control before hitting the Internet.

Any recommendations on VPN Providers?

EDIT: I saw this further down: https://www.getcloak.com

I use http://www.goldenfrog.com/vyprvpn

Presumably, vyprvpn logs user activity for 90 days so users are not protected if there is a court order.

A fair amount of research suggests this company subscribes to the GoDaddy school of thought about your privacy.

http://torrentfreak.com/which-vpn-providers-really-take-anon...

My personal choice is privateinternetaccess.com: $40/year, unlimited bandwidth (cloak and many others limit bandwidth), multiple platforms (Windows/MAC/*nix/iOS/Android), multiple protocols (PPTP, OpenVPN and IPSEC/L2TP), multiple gateways (US/UK/Switzerland), and most importantly, NO user activity logs.

It's beyond me how providers who operate in the EU space, hence under the 2006 Data-Retention Directive, can claim "no user activity logs" are kept. Either they do retain logon-logoff times, or they're technically breaking the law -- unless the directive has not been adopted yet in the specific country, in which case they're just exploiting a temporary loophole. I'm pretty sure any VPN operating on UK nodes would need to retain logon/logoff times linked to individual subscriber data; they won't have to log website access, but that's about it.

Company's response:

We utilize shared IP addresses rather than dynamic or static IPs, so it is not possible to match a user to an external IP.

Also:

We maintain logs describing the time at which a client connects, length of connection time, source IP, as well as payment information. We use custom hashing to maintain separation between our payments database and user database.

My interpretation is, under a court order, authorities can, with considerable difficulty, force a match between a criminal request and several users, but not one user.

Reasonable enough for me - I believe in good-enough security through obscurity given enough obscurity - YMMV of course.

Reply on news.ycombinator.com