4 ms·

In that case, tunnel your VPN inside of a public VPN. Trusting a remote VPN service not under your control, defeats the purpose of communication channel encryp

by txutxu 11y ago

In that case, tunnel your VPN inside of a public VPN. Trusting a remote VPN service not under your control, defeats the purpose of communication channel encryption. Calling it "VPN service" makes it look appealing, without realize that you are breaking the "P" in "VPN". If you want the "P", the master keys and certificates, and the systems where they live (client/server) should be under your control. Dot.

FiloSottile 11y ago
Security is not binary. (I'm becoming boring, most of my comments start like this.) The question is what are you trying to protect against? If you are trying to protect against the local network, any VPN does the job. If you are trying to protect against tracking, ONLY a public VPN does the job (having a static private IP is a disaster in this scenario). If you are trying to protect against any organization seeing your traffic, then your argument might make sense. However, unless you can run that "private" server on metal you own on a network you own, there will still be a VPS provider and an ISP that can see your traffic as much as the VPN provider would. So you might want Tor a at this point.
- txutxu 11y ago
  I can use public proxy lists since the 90's If I want to mix my output IP with other users (futile while my browser is fingerprint-able), I don't even need any VPN, and much less a third party one. I use VPN for what it is. Mostly to connect to my network (personal or professional) from the outside. If I still want to mix my traffic, I can do it, without "VPublicN services", without VPrivateN daemons, and without NSA's Tor. You are free to trust Tor and "Public VPrivateN services", and I'm free to do not trust them. Not sure if security is binary or not, but totally sure it's about trust.
  - akerro 11y ago
    >without NSA's Tor. Please explain your thought.
    - txutxu 11y ago
      The news are explaining it for me.
mirimir 11y ago
Once the traffic hits the Internet, nothing is trusted. Why worry so much about the VPN service? Everything important should be end-to-end encrypted, anyway. The VPN service is just for obfuscation.
DavideNL 11y ago
>> shared public IP for dozens of users make them harder to track and their network traffic is mixed > In that case, tunnel your VPN inside of a public VPN. That doesn't solve anything: #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic
- txutxu 11y ago
  > That doesn't solve anything: It solves the (lack of) trust on the Public virtual Private whatever provider. > #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. For mix your IP with others (are the VPN users visiting the same sites?), I said there are open proxies since the beginnings of internet. It's not the purpose of an VPN. > #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic They will always, in ANY case and scenario that involves them. But in this case, at least, now you're sure that your channel uses your encryption and policies. With a third party channel, you're never sure if the guy near you in starbucks with a headphone, also has the signing key of your "private thing".
akerro 11y ago
I understand the issue of making my traffic public to service provider, there are other issues I had to consider: Using Tor - you make your traffic public to SOMEONE, activists, hackers, maybe governments. No one knows. Running own VPN - you still expose traffic somewhere and you can still be easily tracked and monitored. Here comes another problem - I can administrate simple servers, I do it as a hobby... but I'm not sysadmin, and I would make mistakes and expose everything my start and endpoint traffic that can be 100% correlated. Not using VPN or Tor at all = exposing myself to local government/council, neighbours and GCQH.

by txutxu 11y ago

FiloSottile 11y ago

Security is not binary. (I'm becoming boring, most of my comments start like this.) The question is what are you trying to protect against? If you are trying to protect against the local network, any VPN does the job. If you are trying to protect against tracking, ONLY a public VPN does the job (having a static private IP is a disaster in this scenario). If you are trying to protect against any organization seeing your traffic, then your argument might make sense. However, unless you can run that "private" server on metal you own on a network you own, there will still be a VPS provider and an ISP that can see your traffic as much as the VPN provider would. So you might want Tor a at this point.

txutxu 11y ago
I can use public proxy lists since the 90's If I want to mix my output IP with other users (futile while my browser is fingerprint-able), I don't even need any VPN, and much less a third party one. I use VPN for what it is. Mostly to connect to my network (personal or professional) from the outside. If I still want to mix my traffic, I can do it, without "VPublicN services", without VPrivateN daemons, and without NSA's Tor. You are free to trust Tor and "Public VPrivateN services", and I'm free to do not trust them. Not sure if security is binary or not, but totally sure it's about trust.
- akerro 11y ago
  >without NSA's Tor. Please explain your thought.
  - txutxu 11y ago
    The news are explaining it for me.

mirimir 11y ago

Once the traffic hits the Internet, nothing is trusted. Why worry so much about the VPN service? Everything important should be end-to-end encrypted, anyway. The VPN service is just for obfuscation.

DavideNL 11y ago

>> shared public IP for dozens of users make them harder to track and their network traffic is mixed > In that case, tunnel your VPN inside of a public VPN. That doesn't solve anything: #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic

txutxu 11y ago
> That doesn't solve anything: It solves the (lack of) trust on the Public virtual Private whatever provider. > #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. For mix your IP with others (are the VPN users visiting the same sites?), I said there are open proxies since the beginnings of internet. It's not the purpose of an VPN. > #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic They will always, in ANY case and scenario that involves them. But in this case, at least, now you're sure that your channel uses your encryption and policies. With a third party channel, you're never sure if the guy near you in starbucks with a headphone, also has the signing key of your "private thing".

akerro 11y ago

I understand the issue of making my traffic public to service provider, there are other issues I had to consider: Using Tor - you make your traffic public to SOMEONE, activists, hackers, maybe governments. No one knows. Running own VPN - you still expose traffic somewhere and you can still be easily tracked and monitored. Here comes another problem - I can administrate simple servers, I do it as a hobby... but I'm not sysadmin, and I would make mistakes and expose everything my start and endpoint traffic that can be 100% correlated. Not using VPN or Tor at all = exposing myself to local government/council, neighbours and GCQH.