13 ms·

At risk of thread-jacking, may I ask: Why, when, and where should I be using a VPN to practice good, secure use of online content/resources? I learned a lot fr

At risk of thread-jacking, may I ask: Why, when, and where should I be using a VPN to practice good, secure use of online content/resources? I learned a lot from running through 2FA and security practices as explained at Tech Solidarity [1], but I'm still not clear on where VPNs should fit into my workflow on desktop, laptop, and mobile. [1] https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm

zcid 9y ago
I generally use a VPN 100% of the time on my laptop. It doesn't provide a ton of extra privacy by itself, but it combines my traffic with that of a large numbers of others. And by using browser extensions such as ublock, umatrix, and privacy badger, I can feel a little more peace of mind about being constantly watched. On mobile, it's a different story. I'm not sure about iOS, but on unrooted Android phones, I don't believe there is a way to route IPv6 traffic over a VPN so you are a bit more limited from information gathering via that route. Also, VPN clients eat a lot of battery so useability goes down. My solution for that is to limit my use of mobile devices. Edit: clarified a statement
- BatFastard 9y ago
  Could always use a burner too.
tptacek 9y ago
I would be careful about using VPNs ever. For the most part, the truism about VPN services is accurate: VPN services give you all the security of coffee shop wifi, but in the cloud. If you're going to use a VPN, you need to set up your own server. This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). You'll need to set up the serverside to whatever VPN you choose to use on that cloud server. For this problem, the gold standard is still Trail of Bits's Algo. Hopefully sometime this year we'll get to the point where Algo sets up WireGuard for people on Macbooks and Windows machines. In the meantime, if you don't know what you're doing or how to set up a VPN, I'd use Algo's strongSwan rather than a shared WireGuard provider.
- OrwellianChild 9y ago
  Great advice on technical implementation - thanks for this! I guess the takeaway I'm getting is that using this AWS-backed, encrypted tunnel will let me: Mask my traffic destination (via AWS routing) Hide my traffic content (via encryption to AWS) Minimize/eliminate tracking (assuming I don't accept cookies) Are those the benefits I'm looking for out of this? Or am I missing benefits here?
  - ktta 9y ago
    The important part is knowing what you're looking for. Using a VPN isn't inherently going to make you more secure. It is advised to do so when you are in networks where you don't trust someone to not monitor your traffic or inject stuff into unsecured traffic. If you trust your ISP, then you really don't need a VPN. Unfortunately, most can't be trusted if you're in the US, especially since there was a recent senate action[1] that lets them collect and sell your history. If you do use a VPN, then the trust problems with ISP will shift towards trust in AWS. There's nothing stopping AWS from doing the same things that your ISP does. It is just that most people trust AWS to not do that. So to be clear, AWS can still see all your traffic and inject things into unsecured webpages. The VPN will just won't let your local ISP see what you're doing. All they see is encrypted traffic going to your AWS instance. Also your traffic is not anymore tracking proof when you use a VPN since instead of people storing your home IP address, they can store your AWS VPN's address (which no one really does anymore. They just use cookies and tracking elements). PS: Note that AWS charges for bandwidth. There are 'lightsail' instances where first 1TB egress is free. [1]: https://arstechnica.com/information-technology/2017/03/how-isps-can-sell-your-web-history-and-how-to-stop-them/ https://arstechnica.com/information-technology/2017/03/how-i...
- bcook 9y ago
  > This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). This is the first I've heard of AWS's trustworthiness in this respect. Can someone share some details?
- fulafel 9y ago

zcid 9y ago

I generally use a VPN 100% of the time on my laptop. It doesn't provide a ton of extra privacy by itself, but it combines my traffic with that of a large numbers of others. And by using browser extensions such as ublock, umatrix, and privacy badger, I can feel a little more peace of mind about being constantly watched. On mobile, it's a different story. I'm not sure about iOS, but on unrooted Android phones, I don't believe there is a way to route IPv6 traffic over a VPN so you are a bit more limited from information gathering via that route. Also, VPN clients eat a lot of battery so useability goes down. My solution for that is to limit my use of mobile devices. Edit: clarified a statement

BatFastard 9y ago
Could always use a burner too.

tptacek 9y ago

I would be careful about using VPNs ever. For the most part, the truism about VPN services is accurate: VPN services give you all the security of coffee shop wifi, but in the cloud. If you're going to use a VPN, you need to set up your own server. This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). You'll need to set up the serverside to whatever VPN you choose to use on that cloud server. For this problem, the gold standard is still Trail of Bits's Algo. Hopefully sometime this year we'll get to the point where Algo sets up WireGuard for people on Macbooks and Windows machines. In the meantime, if you don't know what you're doing or how to set up a VPN, I'd use Algo's strongSwan rather than a shared WireGuard provider.

OrwellianChild 9y ago
Great advice on technical implementation - thanks for this! I guess the takeaway I'm getting is that using this AWS-backed, encrypted tunnel will let me: Mask my traffic destination (via AWS routing) Hide my traffic content (via encryption to AWS) Minimize/eliminate tracking (assuming I don't accept cookies) Are those the benefits I'm looking for out of this? Or am I missing benefits here?
- ktta 9y ago
  The important part is knowing what you're looking for. Using a VPN isn't inherently going to make you more secure. It is advised to do so when you are in networks where you don't trust someone to not monitor your traffic or inject stuff into unsecured traffic. If you trust your ISP, then you really don't need a VPN. Unfortunately, most can't be trusted if you're in the US, especially since there was a recent senate action[1] that lets them collect and sell your history. If you do use a VPN, then the trust problems with ISP will shift towards trust in AWS. There's nothing stopping AWS from doing the same things that your ISP does. It is just that most people trust AWS to not do that. So to be clear, AWS can still see all your traffic and inject things into unsecured webpages. The VPN will just won't let your local ISP see what you're doing. All they see is encrypted traffic going to your AWS instance. Also your traffic is not anymore tracking proof when you use a VPN since instead of people storing your home IP address, they can store your AWS VPN's address (which no one really does anymore. They just use cookies and tracking elements). PS: Note that AWS charges for bandwidth. There are 'lightsail' instances where first 1TB egress is free. [1]: https://arstechnica.com/information-technology/2017/03/how-isps-can-sell-your-web-history-and-how-to-stop-them/ https://arstechnica.com/information-technology/2017/03/how-i...
bcook 9y ago
> This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). This is the first I've heard of AWS's trustworthiness in this respect. Can someone share some details?
fulafel 9y ago