8 ms·

This is pretty useless. Put them all under the category of "centralized one-hop VPN." Each of these is a sitting duck for surveillance, law enforcement, hackers

by dguido 11y ago

This is pretty useless. Put them all under the category of "centralized one-hop VPN." Each of these is a sitting duck for surveillance, law enforcement, hackers, and more! It doesn't even matter who runs it, each one is an attractive enough target for someone to learn how to subvert. And then what? You'll never find out all your data is being scooped up or potentially modified. If you want to protect your network communications, run your own endpoint. Projects like Streisand and Tinfoil's OpenVPN setup scripts let you stand up and tear down VPN endpoints instantly (just remember to ditch Tor from Streisand, see why here: https://news.ycombinator.com/item?id=10735529 https://news.ycombinator.com/item?id=10735529). https://github.com/jlund/streisand https://github.com/jlund/streisand https://www.tinfoilsecurity.com/vpn/new https://www.tinfoilsecurity.com/vpn/new I would be truly interested if someone developed Ansible scripts that setup an OpenIKED server (http://www.openiked.org/ http://www.openiked.org/) on your choice of cloud providers, and spit out the configuration instructions for your mobile phone. iOS 9 and OS X 10.11 support IKEv2 out of the box now: https://www.ietf.org/mail-archive/web/ipsec/current/msg09931.html https://www.ietf.org/mail-archive/web/ipsec/current/msg09931...

chuckit 11y ago
Your comment is pretty useless to the majority of people who want to simply protect their internet activity in the most easily accessible way.
- mjs7231 11y ago
  His argument is also flawed in that he says you need to roll your own because the VPN service providers can be compromised. Well, where are you going to run your server then? Any endpoint can be compromised by the business that owns it weather it be your ISP, AWS, or whatever else you plan to use.
- bigiain 11y ago
  Agreed. You need to determine who your adversary is (at least the category of adversary they're in). If your adversary is The NSA, you're probably fucked already - get off the internet. If your adversary is your local drug or anti-terror law enforcement, they're probably getting "hints" from the NSA and likely parallel reconstructing evidence against you based on that. If your adversary is closer to local cops, MPAA/RIAA, your boss, your parents, your ex-wife's lawyer, or your ISP - this list provides a great deal of useful information.
  - narrowrail 11y ago
    What if your adversary is the pervasive data collection entities in the business of selling eyeballs (aka ad networks and that related ecosystem)?
    - bigiain 11y ago
      Good question - I guess the quick answer is "the most anonymous and secure VPN in the universe isn't going to help if you browse to pages with Facebook like buttons in the same browser where you've got an actively logged in Facebook session - or even non-logged-in session cookies". (Substitute Twitter/Google/Yahoo/whoever as appropriate) Browser/cookie hygiene is orthogonal to VPN/network hygiene.
- borski 11y ago
  I'm not convinced signing up with one of the existing VPN services is any significantly easier than signing up with Digital Ocean or Rackspace, and using the Tinfoil creator service. Have you tried it?
  - chuckit 11y ago
    Nope. Sounds too complicated.
    - borski 11y ago
      Not entirely certain how one signup form is more complicated than another, but I recommend trying it before judging it.
      - chuckit 11y ago
        I'm sure it's simple for someone who is familiar with the technology, but what about everyone else? How would your average Joe know which DigitalOcean plan to sign up for, or which settings to apply?
        borski 11y ago
        We tell them, right on the page. We even give you a coupon so it's free. There are no settings to apply. The steps are: 1) Make a DigitalOcean or Rackspace account. 2) Make an API key by clicking <link> and hitting the button. 3) Insert it in this box. 4) Hit go. That's it. Then you download/install the client (like you would with any other VPN service) and you're done. You don't need to know anything about the droplet size, or anything else. Quite literally, my mom has done this, and she sells clothing for a living and is not technically adept.
  - rue 11y ago
    It’s less work if you need to use multiple locations for geocircumvention, at least. I’m happy to pay somebody 5/mo to handle that + patching etc. etc.
mirimir 11y ago
Well, but then there's no crowding. You're the only user. And VPS providers are just as vulnerable as VPN services. You can setup an OpenVPN server on a VPS that's only reachable as a Tor onion service. You lease the VPS through Tor, as anonymously as possible. You pay with Bitcoin that's been mixed at least twice through Tor. See http://dbshmc5frbchaum2.onion/OpenVPN-Onion-VPS.html http://dbshmc5frbchaum2.onion/OpenVPN-Onion-VPS.html (using Tor, or a tor2web proxy). Alternatively, or in addition, you can use nested chains of multiple VPN services. See https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano...
- dguido 11y ago
  I'd rather be one of a million EC2 nodes for a day, then share a single egress point with hundreds of thousands of other people for a year. I guess in a way they're somewhat of the same thing, right? How much traffic do you think EC2, DigitalOcean, etc push out each day? Probably harder to tap that entire pipe.
  - mirimir 11y ago
    Why is that? I'm guessing that Amazon knows who you are. And I'm sure that they keep logs, for accounting and debugging. So being "one of a million EC2 nodes" doesn't hide you, in any way. That EC2 node has an IP address. While you're using it, it's your IP address. When you "share a single egress point with hundreds of thousands of other people", determining whether some activity at some time was yours takes substantive analysis of logs. And often, those logs will be long-gone by the time anyone wants to crunch them. But it depends on your goals, really. If you want security from local threats for doing real-name stuff (business, banking, etc) then you're better off with a private VPN. If you want a little casual anonymity, for torrenting or social media or whatever, then a VPN service is better. And if you want stronger anonymity, use Tor through VPN(s).
    - dguido 11y ago
      > I'm guessing that Amazon knows who you are. And I'm sure that they keep logs, for accounting and debugging. So being "one of a million EC2 nodes" doesn't hide you, in any way. That EC2 node has an IP address. While you're using it, it's your IP address. I'm not as concerned with law enforcement as I am with hackers and surveillance. > And if you want stronger anonymity, use Tor through VPN(s). Tor is basically a honey-trap for law enforcement and others. It's trivial to get your own exit node and sniff or modify traffic (proven in practice!), hidden services are a hack that don't adequately protect your privacy, and it's trivial to identify tor users from non-tor users. I like tor the technology, I don't like tor the network. As with my guidance on VPNs, if you want to use tor right then setup your own network of routing nodes. Don't use the horribly insecure public one.
MobiKid 11y ago
I'm wondering how much interest there is for an application that will put up a new AWS or Azure instance with the proper VPN access points. Which can then be torn down when you're done, so if you didn't have too much data pumping through your VPN you could set it up for $0.02 an hour. I'm 90% done, just need motivation to spend another 90% to finish up the last %10.
- dguido 11y ago
  That's what I'm asking for. Check the Tinfoil Security link.
- mirimir 11y ago
  It's an interesting idea. But there's no exit crowding. And so everything is easily linked to the user. What might be effective would be an app that created multiple instances, with multiple providers, and then shared them with other users. So you were all using multihop VPNs, with the hops changing frequently. The https://www.softether.org/ https://www.softether.org/ project allows users to share their VPN servers. You'd just take that to the next level.
- lighttower 11y ago
  very cool. fill time usage at $0.02/hr ~ $0.50/day ~ $15/mth. reasonable usage, say 5%-10% of the time, $1.00 / month. totally reasonable.
borski 11y ago
If anyone has any questions about the Tinfoil VPN creator, I'm here (cofounder and CTO) and happy to answer. :)
- mirimir 11y ago
  That's very cool! I'm freaked by the idea of using third-party generated PKI, I must admit. But that's arguably no worse than trusting third-party VPN providers. And then there's the absence of crowding. Unless users share their VPNs.
  - borski 11y ago
    By all means, feel free to run the script yourself. It's open source. We just provide a nifty UI so you don't have to :)
    - mirimir 11y ago
      True. Maybe add ta.key?
      - borski 11y ago
        Pull requests are welcome! :)
jlund 11y ago
I'm planning on implementing IKEv2 support in Streisand soon. I wanted to get OpenConnect/AnyConnect implemented first. I had not heard of OpenIKED until your comment, and I got really excited, but it looks like the portable version for Linux has been deprecated? If that's the case, it is really unfortunate; I love OpenBSD and their security track record. I will likely use Libreswan for both L2TP/IPsec and IKEv2, and give the user a choice between those options at installation. L2TP/IPsec support is still a little more ubiquitous, but IKEv2 will be set up by default. It's a much better protocol with significantly less legacy baggage. Your comments on Tor are thought-provoking too. I can look into making that optional as well, either through a prompt or command-line flag. Thanks for the feedback! Let me know if you have any other suggestions.
- dguido 11y ago
  Thanks, that would be great! Yes, I would very much like to see options to strip down Streisand. I'm not worried about getting my packets filtered by the Great Firewall. I'd rather have the minimum number of agents necessary: IKEv2, SSH, and maybe stunnel. I consider every additional agent to add risk of compromise to the entire setup. Sidenote: Ubuntu's security posture appears slightly better than Debian's, but I'm a little vague on the details. Historically, Ubuntu has had people like Kees Cook working on security of their distro and relentless pursued AppArmor policies, adoption of exploit mitigations, and reducing the footprint of the default install. Any way you can make it more distro-agnostic so I could run the installers on Ubuntu instead would be appreciated! Btw, I didn't notice that portable OpenIKED was deprecated :-(.
  - jlund 11y ago
    Yeah, I will probably make it possible to choose the list of services instead of singling out Tor specifically. I have heard from some users who only want to run Shadowsocks, for example. The diversity of services really helps keep things flowing in restrictive environments. Not everyone falls into that category though. Good news! Your Ubuntu dreams are already a reality. The playbooks are currently designed for Ubuntu 14.04. I was using Debian 7 at launch (which might be what you saw previously) but I switched the base distribution late last year. Ubuntu 16.04 is the frontrunner for the next upgrade. The playbooks and roles are complicated enough that it's not terribly practical to target multiple distros, especially given the wide support that Ubuntu enjoys.

by dguido 11y ago

chuckit 11y ago

Your comment is pretty useless to the majority of people who want to simply protect their internet activity in the most easily accessible way.

mjs7231 11y ago
His argument is also flawed in that he says you need to roll your own because the VPN service providers can be compromised. Well, where are you going to run your server then? Any endpoint can be compromised by the business that owns it weather it be your ISP, AWS, or whatever else you plan to use.
bigiain 11y ago
Agreed. You need to determine who your adversary is (at least the category of adversary they're in). If your adversary is The NSA, you're probably fucked already - get off the internet. If your adversary is your local drug or anti-terror law enforcement, they're probably getting "hints" from the NSA and likely parallel reconstructing evidence against you based on that. If your adversary is closer to local cops, MPAA/RIAA, your boss, your parents, your ex-wife's lawyer, or your ISP - this list provides a great deal of useful information.
- narrowrail 11y ago
  What if your adversary is the pervasive data collection entities in the business of selling eyeballs (aka ad networks and that related ecosystem)?
  - bigiain 11y ago
    Good question - I guess the quick answer is "the most anonymous and secure VPN in the universe isn't going to help if you browse to pages with Facebook like buttons in the same browser where you've got an actively logged in Facebook session - or even non-logged-in session cookies". (Substitute Twitter/Google/Yahoo/whoever as appropriate) Browser/cookie hygiene is orthogonal to VPN/network hygiene.
borski 11y ago
I'm not convinced signing up with one of the existing VPN services is any significantly easier than signing up with Digital Ocean or Rackspace, and using the Tinfoil creator service. Have you tried it?
- chuckit 11y ago
  Nope. Sounds too complicated.
  - borski 11y ago
    Not entirely certain how one signup form is more complicated than another, but I recommend trying it before judging it.
    - chuckit 11y ago
      I'm sure it's simple for someone who is familiar with the technology, but what about everyone else? How would your average Joe know which DigitalOcean plan to sign up for, or which settings to apply?
      - borski 11y ago
        We tell them, right on the page. We even give you a coupon so it's free. There are no settings to apply. The steps are: 1) Make a DigitalOcean or Rackspace account. 2) Make an API key by clicking <link> and hitting the button. 3) Insert it in this box. 4) Hit go. That's it. Then you download/install the client (like you would with any other VPN service) and you're done. You don't need to know anything about the droplet size, or anything else. Quite literally, my mom has done this, and she sells clothing for a living and is not technically adept.
- rue 11y ago
  It’s less work if you need to use multiple locations for geocircumvention, at least. I’m happy to pay somebody 5/mo to handle that + patching etc. etc.

mirimir 11y ago

Well, but then there's no crowding. You're the only user. And VPS providers are just as vulnerable as VPN services. You can setup an OpenVPN server on a VPS that's only reachable as a Tor onion service. You lease the VPS through Tor, as anonymously as possible. You pay with Bitcoin that's been mixed at least twice through Tor. See http://dbshmc5frbchaum2.onion/OpenVPN-Onion-VPS.html http://dbshmc5frbchaum2.onion/OpenVPN-Onion-VPS.html (using Tor, or a tor2web proxy). Alternatively, or in addition, you can use nested chains of multiple VPN services. See https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano...

dguido 11y ago
I'd rather be one of a million EC2 nodes for a day, then share a single egress point with hundreds of thousands of other people for a year. I guess in a way they're somewhat of the same thing, right? How much traffic do you think EC2, DigitalOcean, etc push out each day? Probably harder to tap that entire pipe.
- mirimir 11y ago
  Why is that? I'm guessing that Amazon knows who you are. And I'm sure that they keep logs, for accounting and debugging. So being "one of a million EC2 nodes" doesn't hide you, in any way. That EC2 node has an IP address. While you're using it, it's your IP address. When you "share a single egress point with hundreds of thousands of other people", determining whether some activity at some time was yours takes substantive analysis of logs. And often, those logs will be long-gone by the time anyone wants to crunch them. But it depends on your goals, really. If you want security from local threats for doing real-name stuff (business, banking, etc) then you're better off with a private VPN. If you want a little casual anonymity, for torrenting or social media or whatever, then a VPN service is better. And if you want stronger anonymity, use Tor through VPN(s).
  - dguido 11y ago
    > I'm guessing that Amazon knows who you are. And I'm sure that they keep logs, for accounting and debugging. So being "one of a million EC2 nodes" doesn't hide you, in any way. That EC2 node has an IP address. While you're using it, it's your IP address. I'm not as concerned with law enforcement as I am with hackers and surveillance. > And if you want stronger anonymity, use Tor through VPN(s). Tor is basically a honey-trap for law enforcement and others. It's trivial to get your own exit node and sniff or modify traffic (proven in practice!), hidden services are a hack that don't adequately protect your privacy, and it's trivial to identify tor users from non-tor users. I like tor the technology, I don't like tor the network. As with my guidance on VPNs, if you want to use tor right then setup your own network of routing nodes. Don't use the horribly insecure public one.

MobiKid 11y ago

I'm wondering how much interest there is for an application that will put up a new AWS or Azure instance with the proper VPN access points. Which can then be torn down when you're done, so if you didn't have too much data pumping through your VPN you could set it up for $0.02 an hour. I'm 90% done, just need motivation to spend another 90% to finish up the last %10.

dguido 11y ago
That's what I'm asking for. Check the Tinfoil Security link.
mirimir 11y ago
It's an interesting idea. But there's no exit crowding. And so everything is easily linked to the user. What might be effective would be an app that created multiple instances, with multiple providers, and then shared them with other users. So you were all using multihop VPNs, with the hops changing frequently. The https://www.softether.org/ https://www.softether.org/ project allows users to share their VPN servers. You'd just take that to the next level.
lighttower 11y ago
very cool. fill time usage at $0.02/hr ~ $0.50/day ~ $15/mth. reasonable usage, say 5%-10% of the time, $1.00 / month. totally reasonable.

borski 11y ago

If anyone has any questions about the Tinfoil VPN creator, I'm here (cofounder and CTO) and happy to answer. :)

mirimir 11y ago
That's very cool! I'm freaked by the idea of using third-party generated PKI, I must admit. But that's arguably no worse than trusting third-party VPN providers. And then there's the absence of crowding. Unless users share their VPNs.
- borski 11y ago
  By all means, feel free to run the script yourself. It's open source. We just provide a nifty UI so you don't have to :)
  - mirimir 11y ago
    True. Maybe add ta.key?
    - borski 11y ago
      Pull requests are welcome! :)

jlund 11y ago

I'm planning on implementing IKEv2 support in Streisand soon. I wanted to get OpenConnect/AnyConnect implemented first. I had not heard of OpenIKED until your comment, and I got really excited, but it looks like the portable version for Linux has been deprecated? If that's the case, it is really unfortunate; I love OpenBSD and their security track record. I will likely use Libreswan for both L2TP/IPsec and IKEv2, and give the user a choice between those options at installation. L2TP/IPsec support is still a little more ubiquitous, but IKEv2 will be set up by default. It's a much better protocol with significantly less legacy baggage. Your comments on Tor are thought-provoking too. I can look into making that optional as well, either through a prompt or command-line flag. Thanks for the feedback! Let me know if you have any other suggestions.

dguido 11y ago
Thanks, that would be great! Yes, I would very much like to see options to strip down Streisand. I'm not worried about getting my packets filtered by the Great Firewall. I'd rather have the minimum number of agents necessary: IKEv2, SSH, and maybe stunnel. I consider every additional agent to add risk of compromise to the entire setup. Sidenote: Ubuntu's security posture appears slightly better than Debian's, but I'm a little vague on the details. Historically, Ubuntu has had people like Kees Cook working on security of their distro and relentless pursued AppArmor policies, adoption of exploit mitigations, and reducing the footprint of the default install. Any way you can make it more distro-agnostic so I could run the installers on Ubuntu instead would be appreciated! Btw, I didn't notice that portable OpenIKED was deprecated :-(.
- jlund 11y ago
  Yeah, I will probably make it possible to choose the list of services instead of singling out Tor specifically. I have heard from some users who only want to run Shadowsocks, for example. The diversity of services really helps keep things flowing in restrictive environments. Not everyone falls into that category though. Good news! Your Ubuntu dreams are already a reality. The playbooks are currently designed for Ubuntu 14.04. I was using Debian 7 at launch (which might be what you saw previously) but I switched the base distribution late last year. Ubuntu 16.04 is the frontrunner for the next upgrade. The playbooks and roles are complicated enough that it's not terribly practical to target multiple distros, especially given the wide support that Ubuntu enjoys.