6 ms·

> I see this questioned regularly, and yeah it is generally a good idea. If you have a VPN provider that you trust to not keep logs, it can be a very good addit

> I see this questioned regularly, and yeah it is generally a good idea. If you have a VPN provider that you trust to not keep logs, it can be a very good addition for your security setup. Therein lies the problem. You can't trust VPN providers. https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29

warmlagoon 11y ago
IMHO Even thought the provider would log it is still better than not using one in a lot of cases. If whoever can see my VPN address, he would otherwise see my real address directly. In that way he has to find a way to get the VPN provider to give out my real address. What might be possible with a lot, but for sure not with all of them. Also think countries, my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data. In most situations we are already way over the realistic damage done in forms of costs to catch the individual.
- Throwaway23412 11y ago
  Yeah, GP is right in that you can't trust VPNs (for example, PIA is probably a massive honeypot for all we know.) However, if you're using a VPN outside of the jurisdiction of the "Fourteen Eyes", you've substantially increased the effort required for anyone outside of that VPN to monitor you.
  - Freak_NL 11y ago
    > for example, PIA is probably a massive honeypot for all we know. Why the 'probably'? Of course, no VPN-provider should be trusted at face value, but do you know of any sources that claim that Private Internet Access is in fact an elaborate honeypot?
    - Throwaway23412 11y ago
      I was just thinking that PIA would be the perfect candidate for a honeypot, especially since it's under USA jurisdiction. Does the "probably" make it sound like I'm making a claim? I can change it if you'd like.
      - extra88 11y ago
        Yes, "PIA is probably a massive honeypot" is equivalent to "more likely than not, PIA is a massive honeypot." I don't think you mean that since you followed it with "for all we know."
        elithrar 11y ago
        > Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. One shot? Backdoor and reconstruct in parallel.
        extra88 11y ago
        You meant to reply to tomjen3 https://news.ycombinator.com/item?id=10888244 https://news.ycombinator.com/item?id=10888244
      - tomjen3 11y ago
        I would have to agree with extra88, saying "for all we know PIA could be a honeypot" or "PIA would be the perfect honeypot" is every different from saying "PIA is probably a honeypot". Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. The users are never going to trust PIA nor any other VPN that makes similar claims ever again. That means that they probably wouldn't spring the honeypot, if it is one, for anything but the biggest fish.
        laumars 11y ago
        He did say "for all we know"; albeit that followed "probably a honeypot" rather than preceded it. Frankly, I think you're all splitting hairs. Most of us understood the point he was making even if the phrasing of that sentence didn't flow as well as you may have liked.
  - fweespeech 11y ago
    Tbh, even if PIA is a giant honeypot, if you use public wifi and pay with a gift card you purchased with cash...it doesn't really matter in any substantial way unless they are willing to put boots on the ground to find you. If they are willing to do that, even TOR isn't real protection due to the fact it can and will be breached in the event of an active attack by malicious nodes on both ends of the circuit. A VPN you can buy relatively anonymously [e.g. disposable gift cards bought with cash] and use with common sense [e.g. Not via your home LAN] are an effective privacy tool. However, 99% of people aren't going to go through that level of effort which makes them nearly useless for privacy purposes.
    - gruez 11y ago
      If you're going to use public wifi, what's the point of using a VPN? Are doing it so they need to subpoena one more person before they catch you?
      - fweespeech 11y ago
        MitM on public wifi is a thing.
        joepie91_ 11y ago
        As is MitM on VPN services.
        fweespeech 11y ago
        Yes but we've established the concern is someone knowing who you are, not what you are doing. A MitM at the local wifi shop is going to know you are and what you are doing. A MitM at a VPN you paid for with a gift card you paid with cash is just going to know which wifi shop you were at. If you never go back, odds are they can't figure out which customer you were.
  - ryanlol 11y ago
    Well, PIA has completely neglected to acknowledge the fact that their entire customer db was compromised recently. I guess that sums up exactly how trustworthy they are.
    - saltedshiv 11y ago
      Do you have a source for this?
      - ryanlol 11y ago
        Not any public sources, but I've personally seen a copy of the database and know that PIA was using a ridiculously vulnerable version of Kayako Fusion at the time.
- joepie91_ 11y ago
  "my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data." As far as you know. And that's exactly where the problem lies. You are trusting your adversaries to be honest about who they cooperate with, which is a great way to get screwed over, because your adversaries are adversaries. So no, it still wouldn't necessarily be "better than not using one". The tradeoff is far more complex than that.
celticninja 11y ago
Cryptostorm are a decent VPN as they claim no logs are kept, however even if this is not accurate, their payment/token system allows you to access the service without linking it to you via a payment mechanism. To further cloud things you can pay with Bitcoin.
- chinathrow 11y ago
  Aren't such claims moot without the ability to verify this?
  - aioprisan 11y ago
    How do you propose to be allowed to verify that no logs are being kept?
    - michaelt 11y ago
      It's impossible to do that - hence the article above saying you can't trust any VPN service.
- sarciszewski 11y ago
  Yes, Cryptostorm is good for identity compartmentalization, and it's run by people who are passionate about privacy. That still doesn't mean their servers can't be compromised, or they can't suddenly decide to log everything one day. Their passion might even make them a target. (I was able to find some information leaks in their forums, which I reported responsibly, but a malicious actor could have used to exploit an outdated module.) Despite my less-than-chilly feelings about the service operator, I certainly wouldn't recommend anyone else trust them. An SSH tunnel over Tor (or even better, something like PORTAL) to protect against malicious exit nodes, where the endpoint is a VPS you rent with bitcoin not connected to your real identity, is preferable.
- valarauca1 11y ago
  Cryptostorm (I love these guys) refuse to answer how they are in legal compliance with Canadian laws, which require VPN's to keep logs (they're Canadian fyi). Best case scenario: They're an illegal operation who's defying local laws. Worse case scenario: We're being lied too.
at-fates-hands 11y ago
>> Therein lies the problem. You can't trust VPN providers. Your link is borderline nonsense. The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011. However, it very clearly states in the hidemyass TOS that their service is not to be used in illegal activity, which is exactly what the hackers who they gave up were doing. They only gave up the information after receiving a court order, even though they had seen the hackers in chats saying they used their service, at which point they did nothing until the government stepped in. http://www.theregister.co.uk/2011/09/26/hidemyass_lulzsec_controversy/ http://www.theregister.co.uk/2011/09/26/hidemyass_lulzsec_co...
- icebraining 11y ago
  The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011. Yeah, and you have no evidence that I don't have a nice bridge to sell you, so will you buy it? Trusting by default and requiring evidence to distrust is a poor way to protect your privacy. VPNs - unlike Tor, for example - have no protection against logging by the operators, so why would one trust them? Because they pinky swear they won't log?
  - at-fates-hands 11y ago
    >> Trusting by default and requiring evidence to distrust is a poor way to protect your privacy. Which is pretty much the default for anything you use on your computer. - You ever install a software program? - You ever click on a link in your email? - You ever go to a site that contains malware that installs itself covertly on your PC? - You ever open a JPG file? - Use a cloud service? - Save your pictures to Flickr? - Ever use social media of any kind? - Use any Google product or service? - Use any Microsoft product or service. The world is FILLED with UNVERIFIABLE information, the fact that people seem to put so much mistrust in a VPN provider when there's thousands of other ways and means to get to your data is well. . .absurd. Talking like you suddenly need some high level of verification that a VPN doesn't log your information when there's literally thousands of other ways to get at that information is completely myopic. Just like your example with TOR, which recently has been shown to be not only insecure, but readily hackable, yet you seem to trust that far more blindly. https://theintercept.com/2015/07/16/hackingteam-attacked-tor-browser/ https://theintercept.com/2015/07/16/hackingteam-attacked-tor... https://pando.com/2014/12/26/if-you-still-trust-tor-to-keep-you-safe-youre-out-of-your-damn-mind/ https://pando.com/2014/12/26/if-you-still-trust-tor-to-keep-... http://siliconangle.com/blog/2013/09/09/not-even-tor-is-safe-from-the-nsas-prying-eyes/ http://siliconangle.com/blog/2013/09/09/not-even-tor-is-safe... If you're concerned about having "verifiable information" to protect you, you're living in a dreamland.
necessity 11y ago
This is simple to overcome by hosting your own.
- fancy_pantser 11y ago
  I think that defeats part of the purpose in this case.
samstave 11y ago
You need a GUI to hop through 7 proxies -- then you'll be safe.

warmlagoon 11y ago

IMHO Even thought the provider would log it is still better than not using one in a lot of cases. If whoever can see my VPN address, he would otherwise see my real address directly. In that way he has to find a way to get the VPN provider to give out my real address. What might be possible with a lot, but for sure not with all of them. Also think countries, my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data. In most situations we are already way over the realistic damage done in forms of costs to catch the individual.

Throwaway23412 11y ago
Yeah, GP is right in that you can't trust VPNs (for example, PIA is probably a massive honeypot for all we know.) However, if you're using a VPN outside of the jurisdiction of the "Fourteen Eyes", you've substantially increased the effort required for anyone outside of that VPN to monitor you.
- Freak_NL 11y ago
  > for example, PIA is probably a massive honeypot for all we know. Why the 'probably'? Of course, no VPN-provider should be trusted at face value, but do you know of any sources that claim that Private Internet Access is in fact an elaborate honeypot?
  - Throwaway23412 11y ago
    I was just thinking that PIA would be the perfect candidate for a honeypot, especially since it's under USA jurisdiction. Does the "probably" make it sound like I'm making a claim? I can change it if you'd like.
    - extra88 11y ago
      Yes, "PIA is probably a massive honeypot" is equivalent to "more likely than not, PIA is a massive honeypot." I don't think you mean that since you followed it with "for all we know."
      - elithrar 11y ago
        > Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. One shot? Backdoor and reconstruct in parallel.
        extra88 11y ago
        You meant to reply to tomjen3 https://news.ycombinator.com/item?id=10888244 https://news.ycombinator.com/item?id=10888244
    - tomjen3 11y ago
      I would have to agree with extra88, saying "for all we know PIA could be a honeypot" or "PIA would be the perfect honeypot" is every different from saying "PIA is probably a honeypot". Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. The users are never going to trust PIA nor any other VPN that makes similar claims ever again. That means that they probably wouldn't spring the honeypot, if it is one, for anything but the biggest fish.
      - laumars 11y ago
        He did say "for all we know"; albeit that followed "probably a honeypot" rather than preceded it. Frankly, I think you're all splitting hairs. Most of us understood the point he was making even if the phrasing of that sentence didn't flow as well as you may have liked.
- fweespeech 11y ago
  Tbh, even if PIA is a giant honeypot, if you use public wifi and pay with a gift card you purchased with cash...it doesn't really matter in any substantial way unless they are willing to put boots on the ground to find you. If they are willing to do that, even TOR isn't real protection due to the fact it can and will be breached in the event of an active attack by malicious nodes on both ends of the circuit. A VPN you can buy relatively anonymously [e.g. disposable gift cards bought with cash] and use with common sense [e.g. Not via your home LAN] are an effective privacy tool. However, 99% of people aren't going to go through that level of effort which makes them nearly useless for privacy purposes.
  - gruez 11y ago
    If you're going to use public wifi, what's the point of using a VPN? Are doing it so they need to subpoena one more person before they catch you?
    - fweespeech 11y ago
      MitM on public wifi is a thing.
      - joepie91_ 11y ago
        As is MitM on VPN services.
        fweespeech 11y ago
        Yes but we've established the concern is someone knowing who you are, not what you are doing. A MitM at the local wifi shop is going to know you are and what you are doing. A MitM at a VPN you paid for with a gift card you paid with cash is just going to know which wifi shop you were at. If you never go back, odds are they can't figure out which customer you were.
- ryanlol 11y ago
  Well, PIA has completely neglected to acknowledge the fact that their entire customer db was compromised recently. I guess that sums up exactly how trustworthy they are.
  - saltedshiv 11y ago
    Do you have a source for this?
    - ryanlol 11y ago
      Not any public sources, but I've personally seen a copy of the database and know that PIA was using a ridiculously vulnerable version of Kayako Fusion at the time.
joepie91_ 11y ago
"my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data." As far as you know. And that's exactly where the problem lies. You are trusting your adversaries to be honest about who they cooperate with, which is a great way to get screwed over, because your adversaries are adversaries. So no, it still wouldn't necessarily be "better than not using one". The tradeoff is far more complex than that.

celticninja 11y ago

Cryptostorm are a decent VPN as they claim no logs are kept, however even if this is not accurate, their payment/token system allows you to access the service without linking it to you via a payment mechanism. To further cloud things you can pay with Bitcoin.

chinathrow 11y ago
Aren't such claims moot without the ability to verify this?
- aioprisan 11y ago
  How do you propose to be allowed to verify that no logs are being kept?
  - michaelt 11y ago
    It's impossible to do that - hence the article above saying you can't trust any VPN service.
sarciszewski 11y ago
Yes, Cryptostorm is good for identity compartmentalization, and it's run by people who are passionate about privacy. That still doesn't mean their servers can't be compromised, or they can't suddenly decide to log everything one day. Their passion might even make them a target. (I was able to find some information leaks in their forums, which I reported responsibly, but a malicious actor could have used to exploit an outdated module.) Despite my less-than-chilly feelings about the service operator, I certainly wouldn't recommend anyone else trust them. An SSH tunnel over Tor (or even better, something like PORTAL) to protect against malicious exit nodes, where the endpoint is a VPS you rent with bitcoin not connected to your real identity, is preferable.
valarauca1 11y ago
Cryptostorm (I love these guys) refuse to answer how they are in legal compliance with Canadian laws, which require VPN's to keep logs (they're Canadian fyi). Best case scenario: They're an illegal operation who's defying local laws. Worse case scenario: We're being lied too.

at-fates-hands 11y ago

>> Therein lies the problem. You can't trust VPN providers. Your link is borderline nonsense. The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011. However, it very clearly states in the hidemyass TOS that their service is not to be used in illegal activity, which is exactly what the hackers who they gave up were doing. They only gave up the information after receiving a court order, even though they had seen the hackers in chats saying they used their service, at which point they did nothing until the government stepped in. http://www.theregister.co.uk/2011/09/26/hidemyass_lulzsec_controversy/ http://www.theregister.co.uk/2011/09/26/hidemyass_lulzsec_co...

icebraining 11y ago
The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011. Yeah, and you have no evidence that I don't have a nice bridge to sell you, so will you buy it? Trusting by default and requiring evidence to distrust is a poor way to protect your privacy. VPNs - unlike Tor, for example - have no protection against logging by the operators, so why would one trust them? Because they pinky swear they won't log?
- at-fates-hands 11y ago
  >> Trusting by default and requiring evidence to distrust is a poor way to protect your privacy. Which is pretty much the default for anything you use on your computer. - You ever install a software program? - You ever click on a link in your email? - You ever go to a site that contains malware that installs itself covertly on your PC? - You ever open a JPG file? - Use a cloud service? - Save your pictures to Flickr? - Ever use social media of any kind? - Use any Google product or service? - Use any Microsoft product or service. The world is FILLED with UNVERIFIABLE information, the fact that people seem to put so much mistrust in a VPN provider when there's thousands of other ways and means to get to your data is well. . .absurd. Talking like you suddenly need some high level of verification that a VPN doesn't log your information when there's literally thousands of other ways to get at that information is completely myopic. Just like your example with TOR, which recently has been shown to be not only insecure, but readily hackable, yet you seem to trust that far more blindly. https://theintercept.com/2015/07/16/hackingteam-attacked-tor-browser/ https://theintercept.com/2015/07/16/hackingteam-attacked-tor... https://pando.com/2014/12/26/if-you-still-trust-tor-to-keep-you-safe-youre-out-of-your-damn-mind/ https://pando.com/2014/12/26/if-you-still-trust-tor-to-keep-... http://siliconangle.com/blog/2013/09/09/not-even-tor-is-safe-from-the-nsas-prying-eyes/ http://siliconangle.com/blog/2013/09/09/not-even-tor-is-safe... If you're concerned about having "verifiable information" to protect you, you're living in a dreamland.

necessity 11y ago

This is simple to overcome by hosting your own.

fancy_pantser 11y ago
I think that defeats part of the purpose in this case.

samstave 11y ago

You need a GUI to hop through 7 proxies -- then you'll be safe.