Hacker News Reader

Comment by blindriver | Hacker News Reader

I don't think there is any way that any VPN company can convince me they aren't secretly run by the CIA or some other country's equivalent.

View on HN

The way I look at it is that my ISP is very open about collecting and selling "anonymized" data based on users' internet usage.

On the other hand, a reputable VPN provider has everything to lose if word got out that they collect or sell information.

The privacy calculus is: 100% chance vs some small chance.

Legit question: What can an ISP collect when most of the time I'm going to secure "https:" websites? I mean, they can only see the website I'm going to, but not what is going on there, right?

Is just collecting where people are going that lucrative to sell?

That + other data can be used to build a behavorial profile so it's not what your ISP is doing necessarily but what the people they sell the data to are doing with it (or the people they sell to)

There's what websites/apps you use, but also your behavior patterns. Are you a night owl? How often do you check some website or app. I'm sure there's a lot of other information they do gather based on the "metadata"

Vpns wouldn't hide the fact you're a night owl, though? The fact of traffic+time is still visible to the ISP?

VPN will hide what you’re doing at night, though.

DNS records and net flow data. They can also inject JS in http sites, hijack domaijs to do the same, do traffic shaping. But I am biased, I work for a VPN company.

Not what they can, what they MUST as required by law. Assuming US, see DTA aka CALEA - at any time little green men with a warrant can ask for tranparrent packet capture of ISP client's traffic.

Also, in many places (Europa) there is collection and retention requirements for ISPs.

The DNS data is super useful for developing a demographic profile.

For example, they could pretty trivially assert with high confidence that a pregnant woman is in your home or that you’re shopping for a car. The tinfoil hat scenarios are interesting as well.

That's assuming the financial incentivize of an intelligence agency is not sufficient to cover the risk.

Even if the VPN provider is doing something naughty-ish, just decoupling netflow info from your IRL id/address/financials/probably TV habits info has value. Even if you can’t control the usage of behavior data by multiple organizations, you can try to “anonymize” it at the boundaries between them. Indirection, to minimize how much becomes associated with your identity.

Really only valid for individual company adversaries though, depends on your threat model I guess.

Edit: it’s sad that I need a threat model

Not even https://mullvad.net/en/why-mullvad-vpn? (The only VPN I've heard of that allows you to pay anonymously with cash)

Proton takes cash.

https://proton.me/support/payment-options#cash

Just for completions sake, IVPN takes cash too

https://www.ivpn.net/en/pricing/

It's more most smaller VPN brands are surprisingly owned by one company Nord.. It's not all vpns it's just if you took 100 brands 90 of them are owned leased from Nord

Well, it wouldn't be the first encryption-related Swiss company run by the CIA. :-)

https://en.wikipedia.org/wiki/Crypto_AG

I don’t know about CIA, but something about Proton has always felt off.

The fact that it's shown in all Hollywood films as "secure" email, and Navy Seals guys on youtube are recommending it in unison—should tell you all you need to know... Not to mention the DDoS protection racket the Israelis (coordinated with the BND) pulled on Proton for traffic analysis. See their own statement on the matter: https://proton.me/support/protonmail-israel-radware

DE-CIX is a known SIGINT collection site.

How about iCloud Private Relay?

or MPR (https://invisv.com/articles/relay) in general.

Reply on news.ycombinator.com