10 ms·
The impossible task of creating a “best VPNs” list
- homero 10y agoIsn't the best simply running your own for $5 on DO?
- mrrsm 10y agoIt is probably very dependent on the reasons you are using the VPN as well as who you trust to keep whatever data you are transmitting safe.
- wyager 10y agoNot if you want privacy or to access content disallowed by DO (torrents).
- api 10y agoAFAIK OVH, Vultr, and several other a la carte VPS/VM providers allow torrents.
- 7ewis 10y agoWould you recommend OVH or Vultr? I've always been a bit suspicious of OVH, not sure why...
- barlo 10y agoI've use both; I have several dedicated servers with OVH in their BHS datacenter and several instances with Vultr in their NJ datacenter. Both are great for the price, although support can sometimes be lacking. OVH also has two cheaper brands for dedicated servers to checkout - SoYouStart and Kimsufi. The two cheaper brands have much more limited support.
- jamesmontour 10y agoIt really boils down to trust, honestly. What VPN you wind up going with greatly depends on the ethics, availability, and reliability of the provider, among other things. Sure, you can always run your own, but that is still ultimately going over someone else's network at some point during transit, plus you still have to be able to trust their ethics and consider any potential disallowed content. From a reliability/availability standpoint you'd be better off getting a VPN service, just have to do some thorough research and/or peruse the great list maintained on thatoneprivacysite.net Edit: words.
- phn 10y agoWell, if you just want to be anonymous, no. That ip/machine is associated to your person through whatever method you used to pay Digital Ocean.
- expression 10y agoAnd if anonymity is of no concern, why not run OpenVPN on Raspberry Pi (or something similar) at home? Cheap to set up, and no running costs (assuming internet access at home).
- falcolas 10y agoNot all wifi points allow VPN traffic. At various coffee shops, I've had both OpenVPN and Cisco Any Connect traffic outright blocked. Getting around such blocks (such as with a SSL tunnel) is possible, but requires more than just a default install. Also, setting up anything other than OpenVPN is a real pain in the arse. Even OpenVPN required a fair bit of Googling to make it fully functional.
- greggman 10y agoHow about an https tunnel? or an ssh tunnel on port 443?
- xufi 10y agoThat's interesting. Maybe thats why my VPN worked at a Starbucks down the street but not one in another city I was in. I wonder if this is the same for airports too. I would assume it would be easier to use a VPN if youre in a smaller airport rather than a big national one because of the amount of security however i havent looked in to this
- h4waii 10y agoI've found the most success with getting passed captive portals on non-free "Free WiFi" is simply OpenVPN over dns/53. It works a lot of the time and sometimes conveniently bypasses throttling/QoS.
- United857 10y agoLots of sites (e.g. Stack Overflow) block IP ranges of cloud providers.
- anonova 10y agoThe worst problem I've had running a VPN on a VPS is that Google tends to think you're a bot and makes you enter captcha every search query.
- mazsa 10y agoCf. https://thatoneprivacysite.net/ https://thatoneprivacysite.net/
- LeoPanthera 10y agoI cannot rate this site highly enough. The guy running it is doing a tireless service to weed out scam reviews and fake service descriptions. He also has a subreddit: https://www.reddit.com/r/vpnreviews/ https://www.reddit.com/r/vpnreviews/
- h4waii 10y agoOne big advantage of using a popular VPN is shared endpoints. Your traffic is mixed in with hundreds of thousands (if not millions) of other users. Using your own VPS means you are easier targeted, tracked (on layer 3) and located -- since your VPS likely has a dedicated IP and you probably have a non-anonymized account with the provider. You're still relying on your VPS provider to not monitor outbound connections as you are on the VPN provider.
- 3pt14159 10y agoMaybe if you're a black hat firing up a brand new computer from a cafe while you left your phone at home. For the rest of us that just want to, say, watch the US Presidential debates from another country going through our own VPS is far better than relying on some possibly skeezy third party VPN. Personally I use HideMyAss when I'm travelling to countries I don't trust or when I'm on wifi networks that I fear may be monitored, but I'd rather spin up a Digital Ocean box if setting up my own VPN were as easy.
- brg1007 10y agoYou can use a script for setting up an OpenVpn on a Digital Ocean box in max 2 min. Check this one https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install .
- Cyph0n 10y ago> but I'd rather spin up a Digital Ocean box if setting up my own VPN were as easy. I thought the same thing, until I found openvpn-installer [1]. You just need to run 1 command - the entire OpenVPN setup process takes 5 minutes. I used it on both Debian and CentOS and it works flawlessly. At the end, you just grab the config file using rsync or SFTP, and load it into your OpenVPN client. Now I have a dedicated droplet for VPN use. Once a month I destroy it and create a new one, because I'm slightly paranoid :P [1]: https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install
- Nyr 10y ago
- bitL 10y agoSo what's the best way to browse anonymously these days? Is it running a hypervised OS (some hardened GNU Linux/BSD Unix variant?) with a randomly changed LAN MAC upon every boot, connected to a VPN operating outside US with OpenVPN & 4k PK (e.g. in Romania), browsing using TorBrowser with NoScript and WebGL turned off? Or even two VPNs at the same time, one in the base OS, the other in the hypervised one?
- sigjuice 10y agoWhat would be the benefit of changing your MAC address?
- api 10y agoMACs are a unique hardware ID and there are various ways they can leak over L3, such as software that uses your MAC to compute its own ID that can be reversed.
- sigjuice 10y agoCan you point me at a concrete example of an application or protocol that does this? Thanks!
- walrus01 10y agoI have heard of HTML5/WebRTC API browser fingerprinting that can expose a user's RFC1918 private IP address (10.x.x.x whatever...) on their client device, but not MAC address. https://network23.org/inputisevil/2015/09/06/how-html5-apis-can-fingerprint-users/ https://network23.org/inputisevil/2015/09/06/how-html5-apis-...
- robocat 10y agoMany applications where a GUID is exposed. "In the OSF-specified algorithm for generating new (V1) GUIDs, the user's network card MAC address is used as a base for the last group of GUID digits, which means, for example, that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa virus." from https://en.m.wikipedia.org/wiki/Globally_unique_identifier https://en.m.wikipedia.org/wiki/Globally_unique_identifier
- wzdd 10y agoI didn't find this article very convincing. 1. "You must trust the VPN." This is true, but you must trust something (your cafe, your ISP, your computer). In fact the entire article really hinges on this point -- the VPN provider could, if it were malicious (or compelled to by a government) log every aspect of your traffic, or even insert malware. However, so could your home ISP or your coffee shop. In particular I found this statement very bizarre: "VPN services require that you trust them, which is a property that anonymity systems do not have." This is true in a vacuum. In the real world, unless you're running your own hardware with software you have written yourself from scratch (on a system which you monitor continuously), you are trusting a huge amount of stuff even with the best anonymity system. The point is knowing what you are trusting, rather than trusting it implicitly. Essentially the point of the article seems to be to point out that VPN providers may be (there are a lot of hedge words) untrustworthy. The only actual example given of an untrustworthy VPN provider is a free one which re-sold its users' bandwidth (point 8). Real-world examples are important, because reputation is important -- at some point it is very likely that you will end up trusting someone, even if you are being very careful. 2. "Some VPNs don't permit peer-to-peer sharing and/or log such sharing". You must rely on reputation, which is not a great option. However, no alternatives are presented for someone who wants to torrent copyrighted or illegal works (TOR is heavily FUDded in the article). You certainly wouldn't roll your own VPN for this -- see below. 3. "VPNs don't protect very much against ad tracking". This is true, but I mean VPNs don't make your teeth much whiter either. 4. "A dodgy VPN could log all your data". This is the same as point 1. 5. Preshared keys. OpenVPN with server certificate checking would seem to address this. 6. "Your VPN provider might log your data". This is the same as point 1. 7. "Leakage". It's useful to inform people about this. However, once informed, it is quite simple to use one of many online services to verify that no information is leaked. 8. "Snake oil" and in particular a free VPN which sold its users' bandwidth. Fairly obviously, be aware that if you are using a free product the company will attempt to monetise you in some way. The suggestion to set up your own VPN seems to be presented as a way to improve privacy. This is very strange particularly since no threat model is presented, and the common one (mass surveillance) gets much worse with a personal VPN. Firstly, shared hosting providers such as DigitalOcean, AWS, OVH and so on are presented. There is no particular reason to suspect that these are more or less trustworthy than any given VPN provider. In particular, shared hosting in the US will certainly be subject to the monitoring whims of the US government. Secondly, using such a DIY solution will associate all your traffic, and only your traffic, with a single outgoing IP address, easily traceable to you (since you're paying for it). Compare this with any shared-endpoint VPN, where your traffic is combined with that coming from many other users, and the owner of the IP address is a VPN company. In the former situation nobody would even need to inform the hosting company -- they could just monitor its traffic (though as discussed in point 1 they certainly could contact the hosting company if necessary). In the latter situation, the VPN company would need to be involved. At this point a certain amount of process is required. If your threat model is mass surveillance rather than targeted monitoring, then the shared VPN provider certainly seems like an improvement over a roll-your-own solution. "The best place to hide an incriminating letter is in a letter rack!" -- Edgar Allen Poe. Thirdly, with a DIY solution you are implicitly claiming that you are better at hardening a system and staying on top of security patches than is the VPN provider you were considering going with. This isn't necessarily true. If you are just concerned about opportunistic data collection from your coffee shop, then a personal VPN would help. But it's quite limited, and significantly simpler solutions like HTTPS Everywhere would get you 90-100% of the way there. If you are specifically concerned about an entity with the resources of a government monitoring specifically you, none of the options presented will be any use.
- hackuser 10y ago> Tor makes people more susceptible due to its reliance on an outdated version of Firefox. Tor uses a current version of Firefox and automatically updates it.
- ck2 10y agoReminder that Opera has a free built-in VPN not private but free and always available
- 7ewis 10y agoI read the news on this but just assumed there would be a catch. Is it for web traffic only? So no torrents? Any logging? Speed?
- alwillis 10y agoIt’s a proxy—not a VPN: https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd10 https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd...
- Dylan16807 10y agoWhat's the practical difference? And don't say it's because it only affects Opera traffic: you can configure a system-wide proxy, and you can VPN a single program.
- rahimnathwani 10y agoWhat happens to outbound UDP packets when the 'VPN' is active? Can they be inspected or modified by your ISP?
- Dylan16807 10y agoI don't think Opera would be sending UDP packets. If if did, they would be encrypted through the tunnel.
- rahimnathwani 10y agoThis is incorrect, at least it was in April this year: The head engineer of Opera for computers Krystian Kolondra: “Currently WebRTC and plugins are still not routed that way”[0] The technical difference between a VPN and a proxy is typically that the proxy works at the application layer (layer 7) of the network stack, whereas a VPN creates a new network interface and operates at the network layer (layer 3). The practical implications (which you asked about) are: i) With a proxy, there's no new system network interface, so no way for other apps to use it ii) A proxy is application-specific (in this case HTTP and HTTPS) so other protocols (even those that opera supports, like WebRTC) can't go through it. [0]https://www.helpnetsecurity.com/2016/04/22/opera-browser-vpn-proxy/ https://www.helpnetsecurity.com/2016/04/22/opera-browser-vpn...
- 7ewis 10y agoThe article recommends 'Streisand' [1]. According to their GitHub page their VPN is resistant to DPI. >Distinct services and multiple daemons provide an enormous amount of flexibility. If one connection method gets blocked there are numerous options available, most of which are resistant to Deep Packet Inspection. I don't know too much about networking, but didn't realise it was possible? How can they do that? What protocol/service can bypass this? The network security team at work challenged me to see if I could bypass their WSA, so would like to give it a try. [1]: https://github.com/jlund/streisand https://github.com/jlund/streisand
- extr 10y agoSo who is this article aimed at? If you intend to torrent, you're not going to roll your own on a VPS that is going to forward DMCA notices right back to you. DO and AWS are not cool with operating as high-transfer seedboxes and will be fairly expensive. If you're trying to remain hidden from a nation-state level actor you're obviously not going to use a VPS, but you also have bigger problems than HideMyAss accidentally leaking your ipv6 address. If you're like most people and don't want to pay $$$ a month for a VPS but want to torrent a bit, you just want a straight up regular VPN recommendation which they never provide. "Choosing a VPN is hard", yeah no shit, that's why I was hoping you would provide some value by doing the work for me. I was in the market recently and ended up going with iVPN for $100/year. Their "18 questions to ask your vpn provider" [1] page is basically a more practical version of this article. Not that I am going to use it, but they also have guides showing you how to created nested and branched chains of tor/pfsense vm clients across countries, if you really did want to hide traffic from a nation state. If putting your trust into a VPN is the issue it's much easier to trust someone that links directly to security forums and openvpn documentation. [1] https://www.ivpn.net/privacy-guides/18-questions-to-ask-your-vpn-service-provider https://www.ivpn.net/privacy-guides/18-questions-to-ask-your...
- thaumasiotes 10y ago> If you intend to torrent, you're not going to roll your own on a VPS that is going to forward DMCA notices right back to you. I've done this very thing. I wasn't trying to avoid DMCA notices; I was working around the great firewall of China, which blocks torrents normally.
- ryanlol 10y ago>you're not going to roll your own on a VPS that is going to forward DMCA notices right back to you Why not? >DO and AWS are not cool with operating as high-transfer seedboxes and will be fairly expensive DO and AWS are certainly the last providers you'd want to use for anything high-transfer. Why would you even consider them over, say, OVH?
- kobayashi 10y agoffs... Just read this https://thatoneprivacysite.net https://thatoneprivacysite.net
- sandworm101 10y agoSomething I consider but most articles do not: jurisdiction. I want and use a VPN in Sweden for a reason. I wouldn't go anywhere near any VPN with even a tiny US footprint. Similarly, I wouldn't use a VPN in my home country. Location location location.
- 2bitencryption 10y agoUS has no mandatory data retention laws, part of the reason I pick PIA specifically over VPNs outside the US.
- sandworm101 10y agoNo written laws specific to that point. But just look at the NSLs Yahoo released a couple days ago. They can do whatever they want whenever they want. While such things may be possible in Sweden, if they do happen they are extremely rare. The US is the surveillance state.
- deleted 10y ago[deleted]
- ryanlol 10y agoYou do that Sweden wiretaps all traffic that crosses their borders, right? They're doing more aggressive surveillance than the NSA.