Hacker News Reader

Comment by pushedx | Hacker News Reader

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible.

On the other hand, if you are using an ISP provided gateway device..

View on HN

> arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible

Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings.

The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust.

> A.k.a merely the no. 1 selling point for most VPN offerings.

I thought the selling point was protection against hackers. No, was it your ISP seeing your (basically always HTTPS encrypted) traffic? Or facebook/google harvesting your data? Or russian hackers? Or watching netflix from other countries? Or data-harvesters watching your traffic? Or if you just really like downloading linux ISOs? I also think I heard something about snowden and NSA tracking in a few ads. Something something cheaper airplane tickets?

Either way, it's all scary and for the low fee of 5$ per month (sign up for 3 years and you get 3 months free with my code!) you don't have to worry your pretty little head about it anymore. Don't worry about that our company is registered in Bermuda and is just 3 months old.

There are super shady VPN providers but that doesn’t mean local network risks can be ignored. For example, how frequently do you hear about compromised networks of routers and access points? Attackers could be using those for far more stealthy means.

Also, remember when Verizon decided to helpfully inject cross-domain tracking cookies into their customers’ traffic? Do you really want to gamble that some MBA wouldn’t start to think about ways to monetize activity collection from VPN users? Some provider won’t sell schools, coffee shops, etc. a service which will block the “wrong” traffic and that just quietly expands to cover, say, women looking for family planning advice or college students in Florida looking for trans support?

> The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust.

Sadly, there are carriers on this planet who think it's a good idea to charge ridiculous prices for mobile data (Germany) or to block hotspot functionality unless you pay up (US, see [1] for the technical background - both Apple and Google are complicit). In a world where politicians would care about their people, there would be no need for wifi hotspots to exist in the first place.

Additionally, there are certain advertising brokers such as utiq that cooperate with major phone networks to provide detailed tracking, so they and advertisers know pretty precisely who you are just because you tethered your laptop to your phone.

And finally, you can't trust your phone ISP either - Verizon got caught red-handed injecting tracking "supercookies" into their customers' traffic [2], thank God at least that vector got closed with everyone and their dog going HTTPS.

In general: anything involving residential ISPs is rife with scams.

[1] https://news.ycombinator.com/item?id=20460438

[2] http://webpolicy.org/2014/10/24/how-verizons-advertising-hea...

> Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings.

Isn't the #1 selling point of general consumer's (not Enterprise) VPNs to stream video and audio from another country?

"the DCHP server" implies it is somehow a special device on your network, which is a flawed assumption. DHCP works on an broadcast protocol and your device will accept the first offer. The fact that the most common residential configuration is for your DHCP to be hosted on your router and thus likely the first to respond is inconsequential to the fact that any hostile device on your network could use this exploit.

not implying anything in that regard, I can imagine a clever attack which involves a local malicious dhcp implementation

That's not at all guaranteed. The residential gateway most likely contains a hardware switch and a CPU, which also does the routing. The CPU is attached to the switch like any other device, though probably with less physical-layer bits, and some of them aren't all that fast.

Surely one of the big use-cases for a VPN is that the network you're connected to is untrusted?

Or become the DHCP server on whatever third party wifi you're connected to.

That's one of the commonly advertised reasons to use VPNs: protection in untrusted WiFi networks.

what are you insinuating? I still need to be spelt out. Are you saying that ISP's gateway device have any incentives to decloak my vpn traffic? Sounds like a huge liability for no reason? Surely they will be out of business it sounds so bad?

You mean like a pwned home router?

The risk is outside the home: Using a VPN at the coffee shop, hotel, office, etc.

Reply on news.ycombinator.com