Hacker News Reader

Comment by AyyEye | Hacker News Reader

If I ran a spy agency or specialised in blackmail the first thing I'd do would be to run a VPN service. We have no way of auditing their trustworthiness.

View on HN

Anybody expecting to get enough privacy to commit crimes using a VPN is definitely naive. I think most people doing important privacy stuff like being whistle blowers in authoritarian regimes knows that well enough. As part of a multi-pronged strategy to reduce the surface area exposed to creepy data brokers, though? Works fine for me.

Exactly the point. It's a security measure for regular people, who don't commit crimes and aren't a high value target for government agencies.

With a VPN your employee can't track what websites you're visiting over the WiFi in the break room (looking for a new job, visiting the union website for legal advice).

The hotel can't track what you're doing on their WiFi.

While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal).

Right. A lot of folks sacrifice the good because it’s not unattainably perfect in tech, especially with security. I think the pressure to improve, on a whole, is a positive thing, but it often makes terrible practical advice.

> regular people, who don't commit crimes and aren't a high value target for government agencies.

> While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal).

Aren’t these two threat models already completely different?

IMHO if an authoritarian government considers what you’re doing to be a crime, you should not be doing it over a VPN you saw advertised on a billboard

I think they’re mostly referring to bypassing countrywide web filters.

If VPN providers would do that, it would soon be public knowledge.

For some ISPs the abuse of user data is a known fact. So VPN is just the safer bet. But don't get me wrong, I'm not claiming this is impossible, it's just less likely.

How long did Israel’s supply chain attack on Hezbollah’s pager source stay clandestine?

How long did the USA keep it hidden that they owned the Swiss company that manufactured encryption devices for other countries?

They are extremely adept at finding ways to use the secret knowledge without blowing their source. A good example of this is the scene in _The Imitation Game_ after they break the Enigma code for the first time, but Alan Turing explains that they can’t notify the allied ship convoy without leaking that fact.

This may be a useful notion and term to start using when thinking about these things: https://en.wikipedia.org/wiki/Threat_model (not being smirky; I should use apply it more often myself, e.g.)

With this in mind, I'll link my prev comment: https://news.ycombinator.com/item?id=43095936

> Israel’s supply chain attack on Hezbollah’s pager source

You know, James Mickens, a CS researcher at Microsoft had a very related article (PDF), "This world of ours": https://www.usenix.org/system/files/1401_08-12_mickens.pdf

See Figure 1. He calls it the "Mossad / Not-Mossad threat model" :) (but, joking aside, it's good to identify oneself on a scale, or expectations for some system scale-wise and property-wise (incl. which security properties, esp. privacy vs. anonymity!) before looking closer at it.

As long as you are not a terrorist, all those surveillance programs will never be used against you. It would put those programs to risk, by exposing them.

If you need to protect yourself against the most sophisticated surveillance programs, a lot of opsec will be required.

VPNs can protect you against some creep in a public WiFi spying on your DNS request. It can protect against some low-tech state run mass surveillance.

Good thing the US doesn't have an administration that will happily criminalize any opposition

If this is your threat model, then VPNs are definitively not enough. Still a European VPN provider might be better than nothing.

> As long as you are not a terrorist, all those surveillance programs will never be used against you

Can you say "as long as you have nothing to hide"?

We’ve known since WW2 and maybe further that governments have used surveillance against innocents and people they didn’t like.

So you're suggesting to use Tor for everything? Or what's your solution?

All those surveillance programs are a threat to everyone who wants to keep the technology he and his company develops.

There is nothing preventing programs of that sort being used for industrial espionage.

CryptoAG was owned by spooks for decades.

What makes you think VPN is different.

https://www.washingtonpost.com/graphics/2020/world/national-...

It might be true. But I know that the shady cop in my neighborhood could easily put in a request to my ISP to get some data about me. But he could never get the same data from the NSA. I'm not a terrorist, so I don't feel threatened by the NSA. The thing I need to protect myself against is corrupt law enforcement.

So you're saying you have nothing to hide? Gotcha.

Please tell me how to do it right.

Reply on news.ycombinator.com