10 ms·

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically back to you.

mirimir 9y ago
Yes, this! Whether or not that's important depends on your risk model.
cyruscm 9y ago
Exactly. The author says because hosting companies are big they would never give information but this is a complete flaw. Google and Reddit are both known to hand information to law enforcement. Companies like digital ocean don't put as high as emphasis on customer privacy as companies likes PIA. On 90% of the service portals for servers I've purchased have had a message showing my IP was logged for safety reasons. So by making your own vpn you're just turning a direct link to you into link to a link pointing right back at you instead of thousands of people.
- jankotek 9y ago
  Put your consideration in Germany, privacy is pretty enforced here.
  - mahyarm 9y ago
    GEMA is pretty aggressive in Germany. Talking jane random and they don't do file sharing because they are in fear of GEMA.
    - germanier 9y ago
      People are afraid to file share but not because of GEMA which for once has nothing to do with this. Right holders (especially of popular music, movies, and TV shows) connect to torrents and log who is also in the swarm (i.e. uploading and downloading). They then go to court quickly with your IP which orders your ISP to give up your name and address.
      - mahyarm 9y ago
        They tell you about GEMA although as the cause of their fear, at least to me. The details, as you say, are probably different.
        germanier 9y ago
        Yes, for some reason GEMA has become the scapegoat for all music-related inconveniences in life.
  - pg_is_a_butt 9y ago
    where your soldiers don't have to do anything that they don't feel like doing....
deleted 9y ago
[deleted]
aphextron 9y ago
>The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. Yes, but what good is a VPN where you cannot trust your own network? I would have zero trust in any closed source private VPN. There are ways to gain anonymity from your host that wont require setting up a MITM attack vector for your traffic.
- greglindahl 9y ago
  I get a lot of value from a VPN that prevents my ISP from spying on my traffic. I see from looking around this conversation that two other people cited this same reason. I could totally see that many people wouldn't care about this particular thing.
  - deleted 9y ago
    [deleted]
  - cam_l 9y ago
    Not just spying either, but if you are in oz at least, keeping all that metadata in a big, juicy, government mandated, and poorly secured bundle for 2 years!
- daxorid 9y ago
  VPN is one layer. Filtering all port 80, only permitting TLS, and aggressively paring down your trusted root cert list can effectively mitigate the MITM threat.
andy_ppp 9y ago
Would it be possible to run a commercial vpn inside a hosted vpn? Still seems traceable to me...
masmullin 9y ago
> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them. Unless you are a MAJOR pirate distributor, the extra effort(money) to track you down isn't worth it. Is your enemy the NSA or the FBI? If that's the case, then yes, it's trivially easy for them to Subpoena digital ocean or amazon to get your data, but similarly they can use techniques on PIA to get your data too. In the end, it comes down to whom you trust with your data. And whether you want a managed VPN service, or are willing to put up with the inherent problems of maintaining your own system. will PIA sell your surfing habits to advertisers, will DO sell your surfing habits to advertisers? Who gives faster speeds?
- closeparen 9y ago
  The MPAA will serve an automated DMCA notice to your VPS provider, who will terminate your account at the very least.
  - loader 9y ago
    Amazon's not in the business of terminating accounts the second a copyright request comes in. They want to build trust with their customers that they won't just turn you off on a whim.
    - energybar 9y ago
      https://forums.aws.amazon.com/thread.jspa?messageID=399950 https://forums.aws.amazon.com/thread.jspa?messageID=399950
      - loader 9y ago
        That's their official response, and rightly so it should be. Talking from experience, I've had many requests for different websites I run and almost all were frivolous. Some content I took down anyways, and some I explained to Amazon why it was frivolous. They've never cancelled any of my services or even threatened to.
LinuxBender 9y ago
There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause. At a minimum, my ISP can not see or tamper with DNS requests. My VPS nodes are multi-purpose so it isn't really extra cost. This also gives me the capability to intercept some of my traffic and route it over my VPN using a combination of haproxy and squid. I can do this by source PC, or by destination, or protocol, or any combination thereof. For me, this has worked great for years and gives me a lot more flexibility, options and control over my data flows. If I want more privacy, I can use my existing tc cbq QoS and rate limited rsync's of random noise to hide some traffic patterns.
- ghotli 9y ago
  That's really cool. Do you have links to share about that setup?
  - LinuxBender 9y ago
    Sorry, I do not. I set it up manually. While I do have some scripts, they are custom tailored to my network setup. That said, it's really easy to do. You could use the other github scripts that folks have linked for setting up the VPN. Then you would want to set up recursive DNS servers on your home router and VPS nodes. Then look into iptables mangle to intercept DNS, NTP, etc. HAProxy L4 vip on the router is an easy way to forward some web traffic to Squid running on multiple VPS nodes. Squid has an intercept mode you can use for any traffic you want to throw at it. Unbound DNS can override min-ttl and allows overriding partial or complete DNS zones for block some shenanigans. Calomel.org has some articles on some of these things. It's probably even better if you research each step yourself so that adversaries have to work harder to generalize attacks around your configuration.
    - kfrzcode 9y ago
      Really easy to do :) I love HN
benevol 9y ago
> plausible deniability that's gained from a shared VPN Browser and device fingerprinting have become very powerful making VPNs not a very solid solution.
- DavideNL 9y ago
  yep :'( and the only solution seems to use Tor-browser with javascript disabled, which makes browsing the web a pain-in-the-ass.
andresgottlieb 9y ago
Vultr (http://www.vultr.com/?ref=6979836 http://www.vultr.com/?ref=6979836) allows you to pay with bitcoin, making it more difficult to trace you
- vbezhenar 9y ago
  But they are likely to provide IP addresses used to connect to your server. So now you're facing the same problem, if you wanted to hide your IP address.
  - andresgottlieb 9y ago
    Are they so likely? Do you mean they keep logs of every attempted connection to every vps? Even in countries like Netherlands? I'd bet that's less likely than keeping a log of their paying customers' names
- deleted 9y ago
  [deleted]
- 5_minutes 9y ago
  With referral link?
  - andresgottlieb 9y ago
    Why shouldn't I?
- gruez 9y ago
  >allows you to pay with bitcoin, making it more difficult to trace you ...but they require a valid credit card/paypal deposit beforehand, which kills the whole point.
  - andresgottlieb 9y ago
    I had no idea of that requirement, kills the whole point indeed :( edit: there's a list of providers allowing only bitcoin as payment method: http://cryto.net/~joepie91/bitcoinvps.html http://cryto.net/~joepie91/bitcoinvps.html

mirimir 9y ago

Yes, this! Whether or not that's important depends on your risk model.

cyruscm 9y ago

Exactly. The author says because hosting companies are big they would never give information but this is a complete flaw. Google and Reddit are both known to hand information to law enforcement. Companies like digital ocean don't put as high as emphasis on customer privacy as companies likes PIA. On 90% of the service portals for servers I've purchased have had a message showing my IP was logged for safety reasons. So by making your own vpn you're just turning a direct link to you into link to a link pointing right back at you instead of thousands of people.

jankotek 9y ago
Put your consideration in Germany, privacy is pretty enforced here.
- mahyarm 9y ago
  GEMA is pretty aggressive in Germany. Talking jane random and they don't do file sharing because they are in fear of GEMA.
  - germanier 9y ago
    People are afraid to file share but not because of GEMA which for once has nothing to do with this. Right holders (especially of popular music, movies, and TV shows) connect to torrents and log who is also in the swarm (i.e. uploading and downloading). They then go to court quickly with your IP which orders your ISP to give up your name and address.
    - mahyarm 9y ago
      They tell you about GEMA although as the cause of their fear, at least to me. The details, as you say, are probably different.
      - germanier 9y ago
        Yes, for some reason GEMA has become the scapegoat for all music-related inconveniences in life.
- pg_is_a_butt 9y ago
  where your soldiers don't have to do anything that they don't feel like doing....

deleted 9y ago

[deleted]

aphextron 9y ago

>The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. Yes, but what good is a VPN where you cannot trust your own network? I would have zero trust in any closed source private VPN. There are ways to gain anonymity from your host that wont require setting up a MITM attack vector for your traffic.

greglindahl 9y ago
I get a lot of value from a VPN that prevents my ISP from spying on my traffic. I see from looking around this conversation that two other people cited this same reason. I could totally see that many people wouldn't care about this particular thing.
- deleted 9y ago
  [deleted]
- cam_l 9y ago
  Not just spying either, but if you are in oz at least, keeping all that metadata in a big, juicy, government mandated, and poorly secured bundle for 2 years!
daxorid 9y ago
VPN is one layer. Filtering all port 80, only permitting TLS, and aggressively paring down your trusted root cert list can effectively mitigate the MITM threat.

andy_ppp 9y ago

Would it be possible to run a commercial vpn inside a hosted vpn? Still seems traceable to me...

masmullin 9y ago

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them. Unless you are a MAJOR pirate distributor, the extra effort(money) to track you down isn't worth it. Is your enemy the NSA or the FBI? If that's the case, then yes, it's trivially easy for them to Subpoena digital ocean or amazon to get your data, but similarly they can use techniques on PIA to get your data too. In the end, it comes down to whom you trust with your data. And whether you want a managed VPN service, or are willing to put up with the inherent problems of maintaining your own system. will PIA sell your surfing habits to advertisers, will DO sell your surfing habits to advertisers? Who gives faster speeds?

closeparen 9y ago
The MPAA will serve an automated DMCA notice to your VPS provider, who will terminate your account at the very least.
- loader 9y ago
  Amazon's not in the business of terminating accounts the second a copyright request comes in. They want to build trust with their customers that they won't just turn you off on a whim.
  - energybar 9y ago
    https://forums.aws.amazon.com/thread.jspa?messageID=399950 https://forums.aws.amazon.com/thread.jspa?messageID=399950
    - loader 9y ago
      That's their official response, and rightly so it should be. Talking from experience, I've had many requests for different websites I run and almost all were frivolous. Some content I took down anyways, and some I explained to Amazon why it was frivolous. They've never cancelled any of my services or even threatened to.

LinuxBender 9y ago

There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause. At a minimum, my ISP can not see or tamper with DNS requests. My VPS nodes are multi-purpose so it isn't really extra cost. This also gives me the capability to intercept some of my traffic and route it over my VPN using a combination of haproxy and squid. I can do this by source PC, or by destination, or protocol, or any combination thereof. For me, this has worked great for years and gives me a lot more flexibility, options and control over my data flows. If I want more privacy, I can use my existing tc cbq QoS and rate limited rsync's of random noise to hide some traffic patterns.

ghotli 9y ago
That's really cool. Do you have links to share about that setup?
- LinuxBender 9y ago
  Sorry, I do not. I set it up manually. While I do have some scripts, they are custom tailored to my network setup. That said, it's really easy to do. You could use the other github scripts that folks have linked for setting up the VPN. Then you would want to set up recursive DNS servers on your home router and VPS nodes. Then look into iptables mangle to intercept DNS, NTP, etc. HAProxy L4 vip on the router is an easy way to forward some web traffic to Squid running on multiple VPS nodes. Squid has an intercept mode you can use for any traffic you want to throw at it. Unbound DNS can override min-ttl and allows overriding partial or complete DNS zones for block some shenanigans. Calomel.org has some articles on some of these things. It's probably even better if you research each step yourself so that adversaries have to work harder to generalize attacks around your configuration.
  - kfrzcode 9y ago
    Really easy to do :) I love HN

benevol 9y ago

> plausible deniability that's gained from a shared VPN Browser and device fingerprinting have become very powerful making VPNs not a very solid solution.

DavideNL 9y ago
yep :'( and the only solution seems to use Tor-browser with javascript disabled, which makes browsing the web a pain-in-the-ass.

andresgottlieb 9y ago

Vultr (http://www.vultr.com/?ref=6979836 http://www.vultr.com/?ref=6979836) allows you to pay with bitcoin, making it more difficult to trace you

vbezhenar 9y ago
But they are likely to provide IP addresses used to connect to your server. So now you're facing the same problem, if you wanted to hide your IP address.
- andresgottlieb 9y ago
  Are they so likely? Do you mean they keep logs of every attempted connection to every vps? Even in countries like Netherlands? I'd bet that's less likely than keeping a log of their paying customers' names
deleted 9y ago
[deleted]
5_minutes 9y ago
With referral link?
- andresgottlieb 9y ago
  Why shouldn't I?
gruez 9y ago
>allows you to pay with bitcoin, making it more difficult to trace you ...but they require a valid credit card/paypal deposit beforehand, which kills the whole point.
- andresgottlieb 9y ago
  I had no idea of that requirement, kills the whole point indeed :( edit: there's a list of providers allowing only bitcoin as payment method: http://cryto.net/~joepie91/bitcoinvps.html http://cryto.net/~joepie91/bitcoinvps.html