4 ms·

It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get. https://www.getcloak.com/ https://www

It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get. https://www.getcloak.com/ https://www.getcloak.com/ I would prefer that carriers didn't do this kind of nonsense, but I'd also prefer that companies like Facebook & Google didn't have the core of their business built around the same function. We live in a world where people expect miraculous technology for "free." It's trivial to get around this.

intopieces 11y ago
Cloak is pretty, but my goodness their site is light on technical detail. I can't tell where their servers are located, what protocols they support, who owns the servers. It's so vague and hand-wavy that I'm not sure why I'm supposed to trust them.
falcolas 11y ago
With DPI, it's also rather trivial for WiFi providers to block normal VPN traffic - and they do. There are ways around the DPI with SSL wrapping and such, but it's not always "trivial". Point in case, I'm living in a town with a population under 40k, and I know of at least 3 places so far which block OpenVPN traffic over both UDP and TCP.
- droopybuns 11y ago
  That is novel to me. Thanks for sharing. Are they really doing flow inspection & identifying protocols? Or is it just that they're watching for standard ports?
  - intopieces 11y ago
    The comments on this post: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469 feature technical information about the technology used to block VPNs.
- blacksmith_tb 11y ago
  I have seen a fair number of public APs blocking VPN traffic, but my instinct is it's due to incompetence, not malice. It appears they are blocking everything but traffic to 80 and 443, likely due to some sort of turnkey wifi-in-a-box which makes bad assumptions. It is frustrating, as I won't use a public AP if I can't VPN (but I have unlimited data, so it's not a huge problem for me, at least).
  - falcolas 11y ago
    It's not just incompetence - the VPN can connect and authenticate, but all actual traffic is blocked. SSH also works properly, and I can use a SOCKS proxy over that.
jwise0 11y ago
I downvoted this, but I'd like to explain why. It's not reasonable to expect people to go and get VPNs of their own unless we, as technologists, make it so completely trivial that it's the default. If you ask the average person whether they need a VPN for public wi-fi, they will give you a blank stare. If we believe that it is something that they need, it's our fault that they don't know about it. And, if we believe that they shouldn't need it, it's our fault for not building secure solutions to begin with. This is either a failure on our part to educate, or a failure to build secure systems, or a failure to regulate the people who would do these things. But either way, it's our failure -- not a failure of the users.
- droopybuns 11y ago
  I totally disagree, obviously. :) At least in this situation, you have a mechanism to opt out if you pick up a VPN and disrupt traffic injection. Your only solution with companies like google & facebook is not to play. I agree that it is disappointing that the laymen isn't going to be able to disrupt this traffic injection. We are already so deeply into a privacy dystopia that I think think you're focusing on the wrong fight. Some of the most successful companies have more users than customers. They are using TLS to avoid MITM attacks between the client & their infrastructure, but then harvesting data & injecting traffic till the cows come home. Arguing for other mechanisms to disrupt carrier traffic injection is in essence an argument for defending the privacy invasive business cases of google & facebook.

intopieces 11y ago

Cloak is pretty, but my goodness their site is light on technical detail. I can't tell where their servers are located, what protocols they support, who owns the servers. It's so vague and hand-wavy that I'm not sure why I'm supposed to trust them.

falcolas 11y ago

With DPI, it's also rather trivial for WiFi providers to block normal VPN traffic - and they do. There are ways around the DPI with SSL wrapping and such, but it's not always "trivial". Point in case, I'm living in a town with a population under 40k, and I know of at least 3 places so far which block OpenVPN traffic over both UDP and TCP.

droopybuns 11y ago
That is novel to me. Thanks for sharing. Are they really doing flow inspection & identifying protocols? Or is it just that they're watching for standard ports?
- intopieces 11y ago
  The comments on this post: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469 feature technical information about the technology used to block VPNs.
blacksmith_tb 11y ago
I have seen a fair number of public APs blocking VPN traffic, but my instinct is it's due to incompetence, not malice. It appears they are blocking everything but traffic to 80 and 443, likely due to some sort of turnkey wifi-in-a-box which makes bad assumptions. It is frustrating, as I won't use a public AP if I can't VPN (but I have unlimited data, so it's not a huge problem for me, at least).
- falcolas 11y ago
  It's not just incompetence - the VPN can connect and authenticate, but all actual traffic is blocked. SSH also works properly, and I can use a SOCKS proxy over that.

jwise0 11y ago

I downvoted this, but I'd like to explain why. It's not reasonable to expect people to go and get VPNs of their own unless we, as technologists, make it so completely trivial that it's the default. If you ask the average person whether they need a VPN for public wi-fi, they will give you a blank stare. If we believe that it is something that they need, it's our fault that they don't know about it. And, if we believe that they shouldn't need it, it's our fault for not building secure solutions to begin with. This is either a failure on our part to educate, or a failure to build secure systems, or a failure to regulate the people who would do these things. But either way, it's our failure -- not a failure of the users.

droopybuns 11y ago
I totally disagree, obviously. :) At least in this situation, you have a mechanism to opt out if you pick up a VPN and disrupt traffic injection. Your only solution with companies like google & facebook is not to play. I agree that it is disappointing that the laymen isn't going to be able to disrupt this traffic injection. We are already so deeply into a privacy dystopia that I think think you're focusing on the wrong fight. Some of the most successful companies have more users than customers. They are using TLS to avoid MITM attacks between the client & their infrastructure, but then harvesting data & injecting traffic till the cows come home. Arguing for other mechanisms to disrupt carrier traffic injection is in essence an argument for defending the privacy invasive business cases of google & facebook.