9 ms·
So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all? The downside in a nutshell: "Researchers recently
by gvb 9y ago
So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all?
The downside in a nutshell:
"Researchers recently tested 300 free VPN apps on Google Play and found that nearly 40 percent installed malware or malvertising on users’ machines."
"Bob" very likely doesn't know you even exist and doesn't care. The downside of VPNs is that many VPN hosting companies are even less trustworthy than "Bob" and do care who you are. An unscrupulous VPN provider can MitM your connections, harvest anything you give the VPN's app privilege to see (probably a lot), etc.
Step one of security is to understand the threat you want to defend against and make sure your defense against that is (a) adequate, (b) appropriate, and (c) not compromising you in other ways.
- baldfat 9y agoAnother downside: Recently the Federal Government sent out a malware to certain persona of interest. That malware played a higher pitch sound than can be heard by the human ear. They were able to track that person and identify them because they heard the sound on the computer's microphone. TOR or VPN can stop this.
- koolba 9y ago> That malware played a higher pitch sound than can be heard by the human ear. That should be "... can not be heard ..." right? Also, do you have a link with more details.
- wccrawford 9y agoNo, it's right as-is.
- Tushon 9y ago"a higher sound than can be heard" or "played a sound, which cannot be heard due to its pitch" would both work, but your interpretation isn't correct.
- pubg 9y agoWithout a source to corroborate, the tinfoil hat factor is extremely high with this one
- drawnwren 9y agoI slightly agree. However, these days it seems more and more that "thing elite spy agency does to track terrorist" is on about a 6 months to 1 year lead on "thing startup does to target ads."
- jamiek88 9y agoWouldn’t even surprise me if it was the other way around either. Some of the brightest minds of this generation are working on ad tech. Sadly.
- im3w1l 9y agoAbility and motive... Are they able to do this? Yes, for sure. Are they willing to this? For terrorists or maffia bosses, no doubt. For smaller fish? Maybe they can't be bothered. Or maybe they can.
- Florin_Andrei 9y agoOnce it's productized, it's probably easy to reuse.
- 9y ago
- 0XAFFE 9y agoHere is a source, but no „malware“ but ads, the line gets more and more blurry https://arstechnica.com/tech-policy/2015/11/beware-of-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/ https://arstechnica.com/tech-policy/2015/11/beware-of-ads-th...
- gozur88 9y agoI'm surprised a computer speaker has the frequency response to play an inaudible tone.
- jm547ster 9y agoMost wouldn’t, I’d imagine OP is referring to a mobile device, look at Androids dev docs they recommend sticking to 44.1khz, which we know does fail into the range of human hearing with its 22khz reproduction, albeit fewer people. I’d suspect the person being spied on would become suspicious upon many children they encounter and even more dogs fleeing from their direction.
- isostatic 9y agoTested my kids - they could hear an alleged 21khz tone out of laptop speakers. The actual level of the tone doesn't matter - it was above my level of hearing. Wasn't a double blind, but they told me when it started and stopped based on a bash script with random intervals.
- BenjiWiebe 9y agoI'm 20 but I can still hear 20 khz, albeit not very well.
- isostatic 9y agoI could when I was 20, did a proper hearing test when I joined my company. 15.625khz was very noticeable - I scoffed at the old timers who couldn't hear it. I can no longer hear it. Still I can hear 1khz, so that's what's important.
- schoen 9y ago> TOR or VPN can stop this. You're saying that the persons of interest in this case were identified and targeted only based on an IP address and not based on some other aspect of their online activity?
- thinkloop 9y agoIf they were able to gain access to a person's microphone doesn't that mean they are already compromised?
- nathancahill 9y agoWasn't this how they caught the Silk Road guy? Ross Ulbricht? They played a loud noise from his computer in a public area, as I recall.
- jstanley 9y agoDo you have a source for that? I've never heard it before.
- nathancahill 9y agoNevermind, they chatted with him, but that was to ensure that he was logged in to SR before grabbing his laptop in an unencrypted state, not to identify him: https://www.wired.co/2015/01/silk-road-trial-undercover-dhs-fbi-trap-ross-ulbricht/ https://www.wired.co/2015/01/silk-road-trial-undercover-dhs-...
- marme 9y agothat is not how they caught him. They used a correlation attack. He was stupid and posted something using his personal email on stackoverflow about setting up tor website and processing bitcoin transactions. He then used a linked account to advertise silk road a few times. This made him a prime suspect. They followed him for weeks and watched that every time dread pirate roberts logged in and posted on silk road he was sitting in a cafe or library on his computer connected to a vpn. This was enough for them to get a search warrant and they found all the other evidence they needed to convict him on his laptop
- earenndil 9y agoWhy not just use a trusted solution like openvpn and only use providers who provide openvpn servers? That immediately gets rid of one half of your problem; and as for the other half, vpn services that allow for connections via openvpn are likely to be more trustworthy. In addition, the vpn company can't MitM connections which are already on an encrypted channel outside of the vpn conneciton.
- hultner 9y agoIsn't openvpn kind of a hack and a IKEv2/IPSEC based strongswan solution to prefer?
- joecool1029 9y agoDon't see why you're getting downvoted. From a user standpoint, IKEv2 doesn't require a secondary client and integrates with most major OS better. For example: It's way easier for a client to install a mobileconfig to ios that supports on demand VPN than it is to have them download and configure openvpn. Fairly set and forget.
- JetSpiegel 9y agoIKE is a nightmare to admin, only for Cisco level bureaucracies.
- MichaelGG 9y agoOpenVPN protocol is sorta weird (I wrote a clean room client and server impl). But IPSec stuff is such a pain to deal with that it is not worth it despite it having better OS integration.
- mirimir 9y agoIt's arguably no more a "hack" than TLS is one. Right? Re OpenVPN vs IKEv2/IPSec, this IVPN FAQ seems accurate.[0] But then, I helped edit it, so I'm biased. Still, if anyone can point to inaccuracies, I'll recommend fixing them :) The major weakness is pre-shared IKE keys. On the other hand, I get from IVPN that the IPSEC implementation in iOS is very secure. 0) https://www.ivpn.net/knowledgebase/160/Is-using-L2TPorIPSec-with-a-public-pre-shared-key-secure.html https://www.ivpn.net/knowledgebase/160/Is-using-L2TPorIPSec-...
- mirimir 9y agoWell, never use free VPNs! Also, don't choose a VPN based on some online review. Most of those are basically paid advertising. Either "pay if you want a good review" or "pay more for highter rank", or stuff by independent affiliates, who get paid for referrals. Better, choose VPNs that have been recommended by consensus in relevant communities. Torrent users. Wilders. Me ;) And by the way, I do consult for IVPN, but my opinions are otherwise unbiased.
- leadingthenet 9y agoWould you recommend IVPN?
- mirimir 9y agoWell, of course I would! They're one of the oldest. Except for the the first generation, anyway, such as Anonymizer (now basically owned by the CIA) and Cryptohippie (still very cool, but very expensive). And they have great clients for Windows, OS X and iOS. I've found a few others that are just as leak-free.[0] However, the data there are old, and just about all VPN services have improved their clients. What's most relevant about the site is the testing protocol. There's more about that in an IVPN guide.[1] I also recommend AirVPN, Mullvad and PIA. But not necessarily for their clients. I mean, IVPN doesn't have a custom Linux client. So in many cases, you need firewall rules. And you need to make sure that you're not using an ISP-assigned DNS server with the VPN. 0) https://vpntesting.info/ https://vpntesting.info/ 1) https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-leak-test https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...
- patcheudor 9y ago>So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all? Rarely addressed: VPN CLIENT ISOLATION. The majority of us sit behind a NAT'd address range provided by our physical router, thus isolating our machines via a hardware router / firewall from our ISP. When you connect via a VPN, you are not automatically isolated from other client-peers on that VPN and must implicitly trust the VPN provider has properly configured client isolation. You can do testing, like firing up Wireshark and listening for broadcast traffic or simply by trying to nmap other hosts on the network, however, whatever you find could change with a configuration setting at any time.
- DavideNL 9y agoExactly my thoughts; One way to further "secure" this would be to run the VPN client on a hardware router like pfSense (instead of directly on your laptop) and block all incoming connections on the vpn client tunnel interface? A disadvantage of this method would be that the WIFI signal from your Laptop to the router is no longer secured by the Vpn...
- patcheudor 9y agoThat's how I do VPN. I have my ISP connected router, then a DMZ network with my test servers & three routers: 1) guest, 2) main, 3) VPN. I then use a virtual LAN from (2) to (3) over a virtual interface on (2) to connect to (3) which is NAT'd. Honestly though, the whole advice of "get a VPN to be secure" is ridiculous because it can end up exposing you far more than what you were previously, especially if you are running a VPN client on a host that is running a media client / server like Plex, Kodi, WinAmp, iTunes (Bonjour), etc. If you are a developer and using The Fiddler, Charles Proxy, or the Burp Suite, then there's an easy route to the rest of your internal network. I know the first time I was on a VPN and saw someone on the VPN come through my interception proxy it freaked me out enough to instantly understand the dangers of VPN services.
- fulafel 9y agoIt's more effective to block what you want on your host firewall and not rely on the the network to keep you safe. "Processing in hardware", meaning application specific hardware acceleration, is a not a plus in security related things: it's not safer, and it doesn't exist in most boxes, and it's often impossible to field upgrade when bugs are found. It's done to speed things up/lower cost at large scale, but that's irrelevant for consumer/small office gear.