6 ms·

When evaluating a VPN service for trustworthiness, I always look at what their webpage loads in terms of tracking scripts. Basically, if you offer me the servi

by Sylos 9y ago

When evaluating a VPN service for trustworthiness, I always look at what their webpage loads in terms of tracking scripts. Basically, if you offer me the service to protect my IP address and don't even have the decency to let me inform myself about your offering without handing over my IP address to Google et al., then I'm not using your service. Unfortunately, VPN providers collectively don't seem to be aware of this presentation layer, so it's neigh impossible to find one which doesn't violate privacy here. So far, I've found exactly two: azirevpn.com and airvpn.org They load in Piwik, which I'm okay with. These two providers also check a lot of other boxes for me, but yeah, it's still just two providers after hours of research, so if anyone knows any other VPN providers with privacy-respecting webpages, please do tell.

grooling 9y ago
Loyal customer of AIRvpn here. No complaints here
- Insanity 9y ago
  Been using it for about a year now and I am quite happy with it! Recommended it to a few friends, works great on Linux.
stanlarroque 9y ago
It is the first time I have ever encounter a philosophy close to mine about this subject. Check out my VPN service, DataBuster[0]. I made the VPN only for myself at the beginning but my friends requested the features and it became a viable product. The only "tracking" I do on the main page is a passive analysis of Apache logs made with Piwik, so there is no visible JS tracking code or third-party tracker. [0] https://databuster.net https://databuster.net
- arm 9y ago
  That’s fantastic! My only suggestion would be to not require JavaScript for the page to load any text at all.
- needcaffeine 9y ago
  I’m interested in the technology behind the service; any details you can provide?
  - stanlarroque 9y ago
    Yes, I provide some details in a blog article: https://stan.sh/posts/building-a-distributed-vpn-service https://stan.sh/posts/building-a-distributed-vpn-service The underlying technology used is from Algo VPN, a well-acclaimed open source VPN solution. https://github.com/trailofbits/algo https://github.com/trailofbits/algo
kbyatnal 9y ago
windscribe.com is another one.
- Fice 9y ago
  Windscribe.com appears to be behind Cloudflare, which means that they allow a third party to MITM https connections to their site. I would not trust their service.
iDemonix 9y ago
I'm itching to set one up as a side project...
- Someone1234 9y ago
  Be cautious of the potential legal headaches, register it as a limited liability company, and host away from your place of residence (so police don't raid your home). Even if you're entirely above board your users may not. Child porn, illegal substances, gambling, stalking/bullying, fake emergency calls, bomb threats, and so on. Your users are just waiting in the wings to place you into law enforcement's crosshairs. If I opened a VPN I'd spend 10% on equipment and the other 90% on lawyers, fraud prevention, and liability insurance.
  - needcaffeine 9y ago
    This is good advice. I had to deal with crap like this just from running a high traffic message board. Not OP, but I want to do this as a side project just for myself though.
DavideNL 9y ago
> I always look at what their webpage loads in terms of tracking scripts. Note that this is also one of the criteria in the Vpn comparison chart: https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg/export?format=xlsx https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-N... by https://thatoneprivacysite.net/ https://thatoneprivacysite.net/
- Ajedi32 9y ago
  Non-download link: https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-N...
- Sylos 9y ago
  Which itself is hosted on Google Docs. Does not compute, does it? I mean, sorry if I sound rude and thanks for trying to help, but yeah, I'm not clicking on that link.
  - hnarn 9y ago
    You need to get your threat vectors sorted out because you sound like a bit of a dick.
    - Sylos 9y ago
      Fully aware that I sounded like a dick there. I even apologized for it. As for sorting out my threat vectors, I think you should sort out your threat vectors, if you don't consider the biggest data broker on the planet to be part of that. But even if you yourself are entirely unaware of Google being a threat vector, I do think I made it abundantly clear in my initial comment that I don't want my IP address shared with Google, so then linking me to a Google webpage has got to either be a bad joke or so incredibly oblivious that I very much do think, it warrants a dick response.
      - hnarn 9y ago
        First of all, your apology still made you sound like a dick. Secondly, enlighten me, what is the threat in reading an open spreadsheet on Google detailing pros and cons of different VPN vendors?
mirimir 9y ago
IVPN loads only typekit.net in Linux/Firefox.
tonyztan 9y ago
ProtonVPN (same team as ProtonMail) appears to load no external trackers.
xbkingx 9y ago
Why does this matter for anyone not doing something that would attract the attention of a government agency? If you're running illegal weapons, sure. But if you're just trying to connect to your company's server or prevent Comcast from seeing your search history, this shouldn't matter. It reminds me of the recent uproar over Facebook supposedly listening though the mic at all times. It sounds like a severe lack of appreciation for how much data we leak at any given moment. What I mean is that just by reading this thread, we've all been added to whatever VPN user list the (insert bad guy name here) has set up. From there it's just simple data mining. One of the easiest ways to link user to VPN service might be through tracking scripts, but that's not specific to the VPN sites. Presumably your're researching which VPN and then reading more on specific VPNs as you narrow down your choice. Then you want to be "anonymous" so you search for bitcoin info. Then you suddenly stop searching for bitcoin and VPN info. So, you have the data from all those searches (specific breadcrumbs), the length of time searched (length of time correlated to how serious and educated you are about the topic), the time the searches stopped (correlated to VPN subscription start), your previous un-anonymized topics of interest that led to the search for VPNs, the exit nodes of the VPN you probably chose, etc. That's on top of all the physical variables - when you're likely to be awake, schedule of connections, location, etc. I would argue that just having a tracking script on the VPN provider's website is a drop in the bucket, even from a legal perspective - it's better to have a preponderance of evidence. You're not giving 'them' any more information than they'd already need for a search warrant, which is the real danger threshold for this conversation. It's conflating an annoyance with a threat.

by Sylos 9y ago

grooling 9y ago

Loyal customer of AIRvpn here. No complaints here

Insanity 9y ago
Been using it for about a year now and I am quite happy with it! Recommended it to a few friends, works great on Linux.

stanlarroque 9y ago

It is the first time I have ever encounter a philosophy close to mine about this subject. Check out my VPN service, DataBuster[0]. I made the VPN only for myself at the beginning but my friends requested the features and it became a viable product. The only "tracking" I do on the main page is a passive analysis of Apache logs made with Piwik, so there is no visible JS tracking code or third-party tracker. [0] https://databuster.net https://databuster.net

arm 9y ago
That’s fantastic! My only suggestion would be to not require JavaScript for the page to load any text at all.
needcaffeine 9y ago
I’m interested in the technology behind the service; any details you can provide?
- stanlarroque 9y ago
  Yes, I provide some details in a blog article: https://stan.sh/posts/building-a-distributed-vpn-service https://stan.sh/posts/building-a-distributed-vpn-service The underlying technology used is from Algo VPN, a well-acclaimed open source VPN solution. https://github.com/trailofbits/algo https://github.com/trailofbits/algo

kbyatnal 9y ago

windscribe.com is another one.

Fice 9y ago
Windscribe.com appears to be behind Cloudflare, which means that they allow a third party to MITM https connections to their site. I would not trust their service.

iDemonix 9y ago

I'm itching to set one up as a side project...

Someone1234 9y ago
Be cautious of the potential legal headaches, register it as a limited liability company, and host away from your place of residence (so police don't raid your home). Even if you're entirely above board your users may not. Child porn, illegal substances, gambling, stalking/bullying, fake emergency calls, bomb threats, and so on. Your users are just waiting in the wings to place you into law enforcement's crosshairs. If I opened a VPN I'd spend 10% on equipment and the other 90% on lawyers, fraud prevention, and liability insurance.
- needcaffeine 9y ago
  This is good advice. I had to deal with crap like this just from running a high traffic message board. Not OP, but I want to do this as a side project just for myself though.

DavideNL 9y ago

> I always look at what their webpage loads in terms of tracking scripts. Note that this is also one of the criteria in the Vpn comparison chart: https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg/export?format=xlsx https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-N... by https://thatoneprivacysite.net/ https://thatoneprivacysite.net/

Ajedi32 9y ago
Non-download link: https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-N...
Sylos 9y ago
Which itself is hosted on Google Docs. Does not compute, does it? I mean, sorry if I sound rude and thanks for trying to help, but yeah, I'm not clicking on that link.
- hnarn 9y ago
  You need to get your threat vectors sorted out because you sound like a bit of a dick.
  - Sylos 9y ago
    Fully aware that I sounded like a dick there. I even apologized for it. As for sorting out my threat vectors, I think you should sort out your threat vectors, if you don't consider the biggest data broker on the planet to be part of that. But even if you yourself are entirely unaware of Google being a threat vector, I do think I made it abundantly clear in my initial comment that I don't want my IP address shared with Google, so then linking me to a Google webpage has got to either be a bad joke or so incredibly oblivious that I very much do think, it warrants a dick response.
    - hnarn 9y ago
      First of all, your apology still made you sound like a dick. Secondly, enlighten me, what is the threat in reading an open spreadsheet on Google detailing pros and cons of different VPN vendors?

mirimir 9y ago

IVPN loads only typekit.net in Linux/Firefox.

tonyztan 9y ago

ProtonVPN (same team as ProtonMail) appears to load no external trackers.

xbkingx 9y ago

Why does this matter for anyone not doing something that would attract the attention of a government agency? If you're running illegal weapons, sure. But if you're just trying to connect to your company's server or prevent Comcast from seeing your search history, this shouldn't matter. It reminds me of the recent uproar over Facebook supposedly listening though the mic at all times. It sounds like a severe lack of appreciation for how much data we leak at any given moment. What I mean is that just by reading this thread, we've all been added to whatever VPN user list the (insert bad guy name here) has set up. From there it's just simple data mining. One of the easiest ways to link user to VPN service might be through tracking scripts, but that's not specific to the VPN sites. Presumably your're researching which VPN and then reading more on specific VPNs as you narrow down your choice. Then you want to be "anonymous" so you search for bitcoin info. Then you suddenly stop searching for bitcoin and VPN info. So, you have the data from all those searches (specific breadcrumbs), the length of time searched (length of time correlated to how serious and educated you are about the topic), the time the searches stopped (correlated to VPN subscription start), your previous un-anonymized topics of interest that led to the search for VPNs, the exit nodes of the VPN you probably chose, etc. That's on top of all the physical variables - when you're likely to be awake, schedule of connections, location, etc. I would argue that just having a tracking script on the VPN provider's website is a drop in the bucket, even from a legal perspective - it's better to have a preponderance of evidence. You're not giving 'them' any more information than they'd already need for a search warrant, which is the real danger threshold for this conversation. It's conflating an annoyance with a threat.