5 ms·

"That may be the case, but that’s an easily solvable problem." So, how is that problem solved? I can't see what VPN companies are really doing inside their sta

by nawitus 10y ago

"That may be the case, but that’s an easily solvable problem." So, how is that problem solved? I can't see what VPN companies are really doing inside their stack. They might very well be logging everything and I have no way to find out other than to "trust them" - so there's no real market mechanism to choose a VPN provider which doesn't log anything. I suppose it could be in the contract.. so does VPN contracts have a clause like that, and how is it enforced?

juliangoldsmith 10y ago
>I can't see what VPN companies are really doing inside their stack. You can always run your own VPN. Buy a cheap VPS, and set up OpenVPN to route traffic through it.
- rz2k 10y ago
  Couldn't your VPS provider sell information about what you're accessing? I ask because, I use a cheap VPS for a VPN, but wonder if it actually accomplishes anything.
  - juliangoldsmith 10y ago
    A VPS provider would be very unlikely to sell that sort of information. If they were caught capturing traffic, I doubt many businesses would want to use their services.
    - rz2k 10y ago
      Some of the tiny VPS providers accept $12-20 up front for a year of service and might disappear before the year is out, but it isn't a big deal because they are so cheap. I imagine they wouldn't know how to monetize the data, but if the market matures, there could easily be the same people behind buying data from Comcast-sized ISPs, creating tiny VPS and VPN providers that don't get any meaningful scrutiny in practice.
      - juliangoldsmith 10y ago
        If you're serious about your privacy, the first thing you'd want to do would be to use a reputable VPS provider. $60/yr for a DigitalOcean droplet isn't terribly expensive.
M_Grey 10y ago
The counter-arguments: A VPN that sells your information and eventually, inevitably is caught, will lose their entire business. Meanwhile they can make a perfectly good profit just... providing the desired service. There are also people who take the time to investigate these various services, and you can do some work to find one that meets standards you deem to be acceptable. There isn't going to be a perfect solution here, but the issues with VPN's are really not the issues you raise. My concerns are: Google and other major sites endlessly pestering VPN users with CAPTCHA requests, or the government actually making them illegal. Your concerns are largely answered by researching which product you're willing to buy, not unlike all other similar decisions in life.
- and0 10y ago
  This argument, applied to any industry, is so tired by now. Yes, a VPN company caught selling info would crash and burn. The invisible hand would ensure this, etc etc. But only if they got caught, and even then it's not like there would be any actual legal punishment (outside of a lawsuit if they were contractually obligated to not sell the info, I guess). And if selling that info meant double the profits, I doubt the owners who were willing to lie to their customers would feel all that bad or embarrassed. They'd probably also be shameless enough to re-brand. And all that is ignoring the fact that with VPNs privacy becomes a privilege only to people who can a.) afford it and b.) understand how to use it. And finding a VPN that won't sell your info on the side requires the time and know-how to research it, not to mention even considering that a VPN might sell your info requires interacting with news orgs or people who might bring this concept up. Chalk this up as another "HN readers don't realize most people don't read HN", color me surprised.
  - M_Grey 10y ago
    Except that those "most people" are the ones who are directly responsible for electing the current crop of leaders who have put us in this position, so I'm running a bit low on universal love and compassion, sue me. Moreover this is, as others have pointed out, not a new loss of privacy, just a new monetization of the existing loss of privacy. So yes, there are better solutions involving the law, but unfortunately the innocent lambs you're defending are the ones calling us nerds and buying IoT junk!
asimpletune 10y ago
Someone could make a program that inspects the packets on your local network. If they're encrypted then the connection is safe. They could then start a register of VPNs and rate them. This is just the start though, you'd also have to guard against common keys and other various gotchas. Also, another idea is VPN providers might start seeing it as a business opportunity to provide robust, secure connections and advertise how they work. These claims could easily be verified. Just a start, I'm not an expert in networking, but it seems fairly doable. Obviously MITM is always possible if you're not connecting via ssl. Also, this could be the impetus for further decentralizing the internet, although who knows how far that's out. The centralization of the internet might have taken things too far and killed the golden goose by abusing their position, incentivizing an acceleration of full decentralization, like with IPFS and their ilk.
- Operyl 10y ago
  Furthermore, SNI will leak domains. Which is just as valuable to data miners. And also DNS.
- nawitus 10y ago
  I don't understand. The VPN connection is decrypted at some point when it goes to public internet, and that server is in control of the VPN provider (or so I've thought). They could log the requests at that point. Even if you only use HTTPS, the VPN provider can at least log what servers you're making requests to, and DNS requests too I suppose, even if they can't figure out what HTTP route you're requesting.

by nawitus 10y ago

juliangoldsmith 10y ago

>I can't see what VPN companies are really doing inside their stack. You can always run your own VPN. Buy a cheap VPS, and set up OpenVPN to route traffic through it.

rz2k 10y ago
Couldn't your VPS provider sell information about what you're accessing? I ask because, I use a cheap VPS for a VPN, but wonder if it actually accomplishes anything.
- juliangoldsmith 10y ago
  A VPS provider would be very unlikely to sell that sort of information. If they were caught capturing traffic, I doubt many businesses would want to use their services.
  - rz2k 10y ago
    Some of the tiny VPS providers accept $12-20 up front for a year of service and might disappear before the year is out, but it isn't a big deal because they are so cheap. I imagine they wouldn't know how to monetize the data, but if the market matures, there could easily be the same people behind buying data from Comcast-sized ISPs, creating tiny VPS and VPN providers that don't get any meaningful scrutiny in practice.
    - juliangoldsmith 10y ago
      If you're serious about your privacy, the first thing you'd want to do would be to use a reputable VPS provider. $60/yr for a DigitalOcean droplet isn't terribly expensive.

M_Grey 10y ago

The counter-arguments: A VPN that sells your information and eventually, inevitably is caught, will lose their entire business. Meanwhile they can make a perfectly good profit just... providing the desired service. There are also people who take the time to investigate these various services, and you can do some work to find one that meets standards you deem to be acceptable. There isn't going to be a perfect solution here, but the issues with VPN's are really not the issues you raise. My concerns are: Google and other major sites endlessly pestering VPN users with CAPTCHA requests, or the government actually making them illegal. Your concerns are largely answered by researching which product you're willing to buy, not unlike all other similar decisions in life.

and0 10y ago
This argument, applied to any industry, is so tired by now. Yes, a VPN company caught selling info would crash and burn. The invisible hand would ensure this, etc etc. But only if they got caught, and even then it's not like there would be any actual legal punishment (outside of a lawsuit if they were contractually obligated to not sell the info, I guess). And if selling that info meant double the profits, I doubt the owners who were willing to lie to their customers would feel all that bad or embarrassed. They'd probably also be shameless enough to re-brand. And all that is ignoring the fact that with VPNs privacy becomes a privilege only to people who can a.) afford it and b.) understand how to use it. And finding a VPN that won't sell your info on the side requires the time and know-how to research it, not to mention even considering that a VPN might sell your info requires interacting with news orgs or people who might bring this concept up. Chalk this up as another "HN readers don't realize most people don't read HN", color me surprised.
- M_Grey 10y ago
  Except that those "most people" are the ones who are directly responsible for electing the current crop of leaders who have put us in this position, so I'm running a bit low on universal love and compassion, sue me. Moreover this is, as others have pointed out, not a new loss of privacy, just a new monetization of the existing loss of privacy. So yes, there are better solutions involving the law, but unfortunately the innocent lambs you're defending are the ones calling us nerds and buying IoT junk!

asimpletune 10y ago

Someone could make a program that inspects the packets on your local network. If they're encrypted then the connection is safe. They could then start a register of VPNs and rate them. This is just the start though, you'd also have to guard against common keys and other various gotchas. Also, another idea is VPN providers might start seeing it as a business opportunity to provide robust, secure connections and advertise how they work. These claims could easily be verified. Just a start, I'm not an expert in networking, but it seems fairly doable. Obviously MITM is always possible if you're not connecting via ssl. Also, this could be the impetus for further decentralizing the internet, although who knows how far that's out. The centralization of the internet might have taken things too far and killed the golden goose by abusing their position, incentivizing an acceleration of full decentralization, like with IPFS and their ilk.

Operyl 10y ago
Furthermore, SNI will leak domains. Which is just as valuable to data miners. And also DNS.
nawitus 10y ago
I don't understand. The VPN connection is decrypted at some point when it goes to public internet, and that server is in control of the VPN provider (or so I've thought). They could log the requests at that point. Even if you only use HTTPS, the VPN provider can at least log what servers you're making requests to, and DNS requests too I suppose, even if they can't figure out what HTTP route you're requesting.