Hacker News Reader

Comment by mat_b | Hacker News Reader

I don't understand why so many people are using / trusting VPNs

"Let us handle all your internet traffic.. you can trust us.. we're free!"

No thank you.

ISPs are so heavily regulated that the will give any federal or government agency free access to future and past internet connection information that are directly tied to your real identity.

Meanwhile reputable VPN provider like mullvad offer there service without KYC and leave feds empty handed when they knock on there doors.

https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

For the same reason you trust your ISP? It handles all your internet traffic; and depending on where you live, probably has government-mandated back doors, or is willing to cooperate with arbitrary requests from law-enforcement agencies.

That's why TLS exists, after all. All Internet traffic is wiretapped.

I'd be significantly more suspicious by default of ISPs that charge no money.

> That's why TLS exists, after all.

That protects you if you're using standard methods to connect. Installed software gets to bypass it.

And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh).

But it's cumbersome.

You should run VPN on your gateway instead.

Well, if someone want to cover a large set of psychological profile, they can always have a full range of virtual brands, going from freemium+ to luxurious-esthetics.

Maybe some

TLS doesnt hide IP addresses

> I don't understand why so many people are using [Cloudflare].

> "Let us handle all your internet traffic.. you can trust us.. []"

TLS does not help, when most Internet traffic is passed through a single entity, which by default will use an edge TLS certificate and re-encrypt all data passing through, so will have decrypted plain text visibility to all data transmitted.

I have a contract with my ISP, I can know who runs the company and I can sue the company if they violate anything they promised.

Yeah, and in your contract with ISP you explicitly agree to file any lawsuit against them in small claims court only. Although you can probably go and complain to FCC about them?

Because I pay the ISP, it is heavily regulated, and they actually make a lot of money from being an ISP?

The use case is people that are urged to view something that is blocked (torrent / adult / gambling). They want it now, and they don't want to get involved with some shady company that slaps on a 2 year contract and keeps extending indefinitely. These people instead find "free vpn" in the web store and decide to give it a try.

VPNs are just one example. How many chrome extensions do you have that you don't use all the time, like adblockers, cookie consent form handlers or dark mode?

Me personally? I'm using Firefox with EFF privacy badger. No others.

A lot of people from poor countries where they can't access a lot of websites/services and also can't pay for a VPN use these "free" VPNs

but other than that I would never trust anything other than Mullvad/IVPN/ProtonVPN

Yeah free VPN is totally a problem, but there's TLS so at least those users aren't getting their bank account information stolen.

TLS works when app is installed somewhere else, but not in browser itself. Browser actually handles TLS termination.

Does tls means certificate pinning ? Can't a vpn alter dns queries to return a proxy website to your bank, using a forged certificate ?

Only if you've added a signing certificate the VPN controls to your CA chain. But at that point they don't have to do anything as complicated as you described.

TLS means “there’s a certificate”. Yeah, if a VPN/proxy can forge a certificate that the user’s browser would trust, it’s an issue.

But considering those are browser extensions, I think they can just inspect any traffic they want on the client side (if they can get such broad permissions approved, which is probably not too hard).

Reply on news.ycombinator.com