15 ms·

Don't use VPN services

384 points by miles 9y ago

delbel 9y ago
Well then why is it if you actually try and sue a VPN provider for the logs, you won't be able to get them. this is the case for one scenario I know of where a subject got hacked and it was traced to a VPN service. Article is just FUD -- which this conversation could be warranted in some cases, but realistically I've found that it isn't the case. This doesn't mean that their outbound service isn't being logged by a third or unknown party like a government entity (which we know all traffic is logged), but hey it is what it is.
- ocdtrekkie 9y ago
  They have logs, they just don't keep them very long. (Allegedly.) So in theory, while they might not have logs for a past incident if it's been long enough, they most certainly have logs in very short term and/or can tell who's connected to what at the present time. So while many copyright actors will be too slow to get a hold of said logs, a government actor with significant interest will. The biggest issue for me is that VPN providers have given me no particular reason to trust them. If I already have reasons to distrust large international corporations that say they care about my privacy, why would I go trust one I've never heard of on the Internet that says it cares about my privacy?
  - jopsen 9y ago
    Under EU privacy regulations you could probably demand that your VPN provider gives you a copy of all information they have on you, including logs. In the EU I've seen this successfully done with ISPs, ie. customers request logs and get a CD by mail. You'll have to insist and it might involve a small service fee.
    - SaturateDK 9y ago
      I did this and the fee was 200 DKK, and that is around 33 USD.
      - sumedh 9y ago
        So what exactly was in the logs?
        jopsen 9y ago
        Probably what is required under Danish "law", which would be every 20th TCP session or so... Note: I write "law" because afaik the current logging directives have been found in violation of the European Human Rights declaration, I hear a legal battle is pending: https://ulovliglogning.dk/en/ https://ulovliglogning.dk/en/
  - bigiain 9y ago
    To be fair - I'd never rely on a VPN provider to protect me from government actors with significant interest. "YOU’RE STILL GONNA BE MOSSAD’ED UPON" (from https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf ) Whether or not your VPN provider gives you any particular reason to trust them - for some of us, the government has passed laws to require our ISPs to be "untrustworthy".
- cgb223 9y ago
  Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible
  - godelski 9y ago
    A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...
    - kuschku 9y ago
      Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
      - tonyztan 9y ago
        I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
      - reaperducer 9y ago
- pasbesoin 9y ago
  The way I see it (guessing, not knowing anything specific), the better commercial VPN services -- at least in or ensared into U.S. law -- may not keep logs, in general. But when a three letter agency with relevant authority (being more generous WRT some VPN services, maybe only unavoidable authority), asks for logging for specific users or perhaps some other narrow logging profile, then such logging starts and is made available.
- Godel_unicode 9y ago
  That's hardly the only concern. What if they have an arrangement to sell your traffic data to ad networks? Inject ads via dns poisoning? Inject Bitcoin mining JavaScript into http? Throttle traffic unless e.g. Netflix pays for bandwidth? VPN just substitutes an unregulated ISP for a somewhat regulated ISP.
  - jessaustin 9y ago
    Someone would notice a VPN firm fucking with their only service in those ways (well, maybe not the first way), and then they wouldn't have any more customers. That's the difference between these firms and ISPs: they face actual competition!
    - Godel_unicode 9y ago
      Someone technical enough to notice would notice, I think that’s a small portion of people who are being preyed on by Big Privacy.
- emmanuel_1234 9y ago
  The VPN I used is based in a country where the US can't come and subpoena / sue people, which is the main protection I can think of. Worst that can happen is their servers being shutdown in countries that can, and it happens on a daily basis. Using a US-based VPN seems like a bad idea either way. Additionally, why would a VPN keep logs at all? With no traces, they have "plausible deniability" that some of their users are doing horrible, horrible things online. This is the main reason I trust my VPN provider to not have logs. IIRC, the only thing they look for is email spam (which is fairly easy to detect with very minimal / time restricted logging), as it spoils their IP addresses too quickly.
  - dredmorbius 9y ago
    Debugging and assessing abusive behaviour is far easier with some level of history. That might be a few minutes, hours, or days. Weeks, months, years, not so much.
- SmirkingRevenge 9y ago
  There is a point to be made in there somewhere, that your VPN needs to be an entity you trust (at least more than the alternatives), if you pay for its services, expecting privacy for the price. A more helpful rant than the OP provided, would be one that informs you of ways to evaluate the trustworthiness of various VPN providers.
AdmiralAsshat 9y ago
So we've seen several VPN services that have proven to be malicious, insofar as selling your browsing history to advertisers (see Hola Better Internet[0]), but have we actually seen a VPN provider being a 'honeypot' yet? I guess we should qualify the term. In my mind, that would be a hostile government who sets up a VPN service for the purpose of attracting citizens who wish to avoid their censorship, and then arresting the users. [0]https://lifehacker.com/hola-better-internet-sells-your-bandwidth-turning-its-1707496872 https://lifehacker.com/hola-better-internet-sells-your-bandw...
- ikeboy 9y ago
  Some Tor relays are absolutely honeypots
endorphone 9y ago
As always the title is a bit of an overreach. If you are going to attract the attention of governments (PSN and Sony hacks, etc), yes, don't expect a VPN to shield you. If you're pirating a show that isn't available in your region, or checking up on an old workplace website, etc, a VPN is likely perfectly fine and will save you from legal scare letters, an old employer seeing your visit, etc.
- smogcutter 9y ago
  Wait, we're supposed to worry about an old employer seeing a visit to a public company website? How would that even happen, and why would anyone care?
  - lighttower 9y ago
    I want to know the same thing
  - jsmthrowaway 9y ago
    Only justification I could think of is a strict reading of CFAA, where in your exit paperwork the employer commands you not to access any company systems, and the Web site is technically a company system. Though “protected” would be quite arguable there. I occasionally have crons from my personal infrastructure running into an employer for operational purposes (offsite monitoring or whatever), so I’ve blackholed outgoing traffic to former employers to be on the safe side in case I miss one. So I can see where that sentiment is coming from, though I think it’s a legal stretch.
    - fred_is_fred 9y ago
      So for the 99.999999% of the rest of us who don't use personal systems to provide monitoring services this argument doesn't apply. Seems like it would be easier to just use outside monitoring or setup some monitoring instances in the cloud that your employer owns than going through this effort.
  - endorphone 9y ago
thieving_magpie 9y ago
I'm sure the intended audience for enemies of the state are googling "should i use a vpn?" right now. What a silly article. Understand vpn's, understand public VPN providers, evaluate the risk for whatever you're trying to do.
zokier 9y ago
> If somebody wants to tap your connection, they can still do so - they just have to do so at a different point (ie. when your traffic leaves the VPN server). I feel like this sets up false equivalency. Tapping VPN provider and tapping individuals last mile are very different things. Of course it is debatable which one is more secure etc, but the fact remains that they have very different characteristics. I'd say that for almost any single attacker moving the hypothetical tap will not be happening at a push of a button, more likely it will not happen at all.
- nukeop 9y ago
  Furthermore, what is even meant by this "tap"? For most attackers breaking OpenVPN + HTTPS is just plain impossible, even if they somehow intercept the connection and position themselves between the VPN end point and the target server.
whorleater 9y ago
This is throwing the baby out with the bathwater, yes you should assume that your VPN provider is 100% logging your IP, traffic, referrer, etc, but you should also assume that any public wifi is being sniffed. A VPN won't magically hide your traffic, you're shifting the attacker in the threat model. But all this is also means that a VPN provider is less dangerous than public wifi is, which is really the reason you should be using VPN's.
- kibwen 9y ago
  If you already have an SSH client (which implies that you have somewhere to SSH to) and Firefox installed on your machine (not sure about Chrome) then you can prevent public wi-fi snooping right this very instant with a SOCKS proxy. This requires no new software on your machine, no money to change hands, and takes literally 30 seconds to set up. VPNs are overkill for that use case.
  - coherentpony 9y ago
    Only for firefox's traffic. There's almost certainly other software on your machine using the network and thus not going through the proxy unless you explicitly tell it to.
    - fibers 9y ago
      environment variables
    - jffry 9y ago
      I'm pretty sure you could use https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle though I haven't looked into it (does it proxy DNS? UDP? DHCP? I'm not sure)
      - GordonS 9y ago
        Just a note, it doesn't work with Windows, only Linux and OSX.
    - 9y ago
nukeop 9y ago
We've seen this little bit of FUD several times in the past and it's as inaccurate as it has always been. VPNs cover some scenarios but the author makes unreasonable, extreme demands and wants them to provide security no entity lower than major government-level can provide. A VPN is just one of many steps in hardening your machine and connection, it's not a silver bullet. A setup that's truly hardened against internet surveillance directed towards the average user _should_ also include a VPN as one of its components, that much is sure. A VPN will not protect you against Mossad, because as Mickens said, if Mossad is after you, you are going to die and there's nothing you can do to stop it. But a VPN will provide a very effective layer protecting you against location and IP based tracking and fingerprinting.
slg 9y ago
I suggest people lookup "The Market For Lemons"[1] as it is a good warning for what can happen to markets with extreme information asymmetry. VPN providers like many tech companies have a huge information asymmetry over their customers. There is no way to really verify many of the claims that a provider is making, especially when it comes to something like logging. The result is that the consumer can't actually distinguish a low quality product from a high quality product. This creates a disincentive for companies to actually provide a high quality product when they can provide a product that is lower quality and cheaper to produce and still pull in the same revenue from users. If this is allowed to go on without any form of third party intervention, the end result is a market filled of products with dubious quality. [1] - https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofMarketforLemons.pdf https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofM...
- lighttower 9y ago
  Exactly what you say. Maybe the solution is to use two VPNs. That way the second doesn't know your home IP and the first has no info on the content. Like a home baked Tor.
  - jsjohnst 9y ago
    You don’t thing a legal authority wouldn’t subpoena both?
    - yjftsjthsd-h 9y ago
      First, they can be in different jurisdictions. Second, it depends on what threat model you use; I for one am hiding from my ISP, not the government.
    - cm2187 9y ago
      I think that’s not his point. There is a probability p that vpn providers are not providing the service they advertise (ie lemon). But the probability that both are lemons become p^2 which is much lower (subpoena-ing a provider that maintains no log is useless). Where it breaks I think is that you can chain as many VPNs as you want, only the last one sees what you are downloading, the others only see traffic to another VPN. So the authority just needs to subpoena that one.
0x7f800000 9y ago
Steve Gibson specifically recommends TunnelBear because they submitted themselves to a public security audit. https://www.tunnelbear.com/blog/tunnelbear_public_security_audit/ https://www.tunnelbear.com/blog/tunnelbear_public_security_a... Other than TunnelBear, ProtonVPN is run by the ProtonMail folks and is based out of Switzerland, so they would respond to any foreign subpoena with a polite "fuck off."
- daxorid 9y ago
  > based out of Switzerland Switzerland is no longer the bastion of privacy it once was. In fact, it's been nine years since every single Swiss Bank rolled over on their customers to placate the IRS. And it's only been downhill from there since.
  - XorNot 9y ago
    I'm really okay with this. Taxes are the price we pay for civilisation and people dodging them are stealing from you.
    - confounded 9y ago
      Surveillance of money, and surveillance of speech, association, location, etc. are not the same, and one does not justify the other.
      - s73v3r_ 9y ago
        I believe they were saying that they were OK with the Swiss banks giving info to the IRS about tax dodgers. Which I'm ok with too. I'm not ok with random web traffic being disclosed to authorities.
    - cookiecaper 9y ago
      Switzerland and the United States are not the same country. That the United States can steamroll the sovereignty of independent nations like this is not very good. Diversity and competition among jurisdictions is important.
j0hnml 9y ago
If anything, a better title would be “Use VPN services for security, not privacy”. I don’t know about others, but whenever I’m using a VPN, I pretty much only have security in mind for when I’m using public WiFi’s.
0culus 9y ago
As always, you have to do what is right for your threat model. I personally run my own VPN mainly for peace of mind when I'm on untrusted LANs. It's actually not that hard to do, and I can easily serve both my phone and my computers. And as always, if you have an APT after you...you have bigger problems than what VPN provider you should use. This gist is at best a straw man.
cyberpip 9y ago
Great site for going into the differences between VPN providers and all that goes with the ratings: https://thatoneprivacysite.net/ https://thatoneprivacysite.net/
drcode 9y ago
I view VPN services more as "Kabuki Theater": The major governments need to keep up the pretense that they aren't reading our traffic via arrangements with the VPN providers, and in return they promise to keep our actions secret BUT ONLY if we aren't engaging in a national crime such as terrorism or espionage.
infodroid 9y ago
This seems like bad advice because it doesn't address the legitimate need for keeping your browsing history private from overzealous, data-mining ISP's [1]. And even in the case of a known-hostile ISP that engages in invasive practices like supercookies or ad injection, it's unrealistic to ask users to set up and maintain their own VPS servers. For the average internet user, a "glorified proxy" service that is hassle-free to set up is a simple and effective means of protection against such a menace. [1] https://techcrunch.com/2017/03/29/everything-you-need-to-know-about-congress-decision-to-expose-your-data-to-internet-providers/ https://techcrunch.com/2017/03/29/everything-you-need-to-kno...
- rsync 9y ago
  "it's unrealistic to ask users to set up and maintain their own VPS servers." I think that sshuttle[1] changes that calculus. sshuttle allows you to make any ssh server a VPN endpoint. So you don't need to configure IPSEC or make an SSH tunnel or anything like that - you just need a login on an ssh server somewhere. [1] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
  - GordonS 9y ago
    AFAIR, it doesn't work for Windows clients, which are a rather large user segment. Still, it is impressively simple to use for Linux and OSX users.
    - rsync 9y ago
      ... and it works for FreeBSD and as of our (rsync.net) sponsorship of work done last year, has DNS support in FreeBSD with ipfw as the backend.
- __jal 9y ago
  It was addressed, indirectly, at the end - "You are on a known-hostile network". In my case, one of my links is Comcast, a known-hostile network. I agree it should have been much more prominent, because this is exactly why I use one, and why many folks I know use one.
nrjames 9y ago
I use a VPN for one reason only: to watch Olympics coverage that is good. I'm not ashamed of that.
vr46 9y ago
I use a VPN to (a) prevent my employer from recording my visits to anywhere and (b) my government from doing the same. I use ProtonVPN. This seems like a good use case. And Proton seem like a good bunch. Anyone have any feedback?
- yorby 9y ago
  your employer doesn't have access to your computer? if they do, they more than likely can see the traffic before it reaches the VPN...
  - vr46 9y ago
    It’s my own machine but of course I’m using their WiFi network.
sxates 9y ago
So we can't absolutely trust a VPN provider - but do we have more trust in Comcast/AT&T/Verizon/etc?
lr4444lr 9y ago
So what's the alternative? Trust my ISP not to do the same? No thanks, I'll take my chances that my well-regarded and relatively cheap VPN service has both less resources to handle massive data storage for as long term, and is no less incentivized to turn huge profits or protect themselves by spilling everything to the government, even if both would under extreme duress. For what I pay, the VPN is a worthwhile little extra protection, not to mention the extra portable security when I have no choice but to use public wifi.
- yjftsjthsd-h 9y ago
  If you're reading HN, one alternative is spin up your own VPN on AWS/Gcloud/DigitalOcean/etc. It's not hard, and there are some scripts / ansible playbooks to automate the process.
  - lr4444lr 9y ago
    Yes, but with all due respect, this misses the point: If my concern is privacy, consider the business incentives to each party for divulging info about me to a government agency or marketer. The cloud services you describe receive revenue from thousands of different companies with various business needs and concerns. Little ol' me won't be a blip on the radar revenue-wise, even if it's a big news story in the internet privacy world. For the VPN on the other hand, a sizable - maybe the lion's share - of their customer base has the same priority as me. If it gets out in public that the VPN caved either to pressures of the state or corporate greed on my data, they'd just as easily do so to anyone else, and customers would flee en masse.
  - cm2187 9y ago
    The movie studio will send a DMCA to AWS who will pass it on to you, then what? Helps with ISP snooping yes, though I expect it to be more expensive (VM and bandwidth in clouds isn’t cheap).
    - hyperpower 9y ago
      What do you consider expensive? You can easily get a VM with 1TB bandwidth for $5 a month.
adzicg 9y ago
It’s reasonably easy to set up a l2tp VPN on AWS, using cloudformation. Running an EC2 instance for a full month for this costs roughly $5 USD. I don’t really get why someone with a bit of tech skills (=using github) would use a third party VPN service from an unverified provider. Sure enough, if Five Eyes want to get your logs from AWS they will, but for avoiding airport or hotel WiFi’s snooping a simple l2tp VPN over AWS serves quite fine, and it works with mobile phones and laptops without requiring any additional software.
- notacoward 9y ago
  Do you suppose that Amazon, which actively sells cloud services to the US intelligence community, is less able or willing to spy on your setup than a VPN provider would be? I have some bad news for you.
  - sterlind 9y ago
    AWS would lose lots of business if their complicity became public. Foreign customers have lost confident in the security/data compliance of public cloud in the wake of the NSA revelations. It'd be bad for the NSA, too. I assume they are spying but only rarely act on the data they're slurping. If Amazon loses customers, and the NSA has eyes inside, the NSA loses their eyes.
    - notacoward 9y ago
      > AWS would lose lots of business if their complicity became public. So would any VPN provider. The incentives are no different, and neither are the opportunities, so recommending one over the other is a bit suspect.
  - floatboth 9y ago
    > US intelligence community If you're not from the US, you might care about your country's spying way more than about US spying.
sesutton 9y ago
I have much higher trust in my VPN than my ISP, which used to make you pay more if you didn't want to be spied on (AT&T). It also stops them from sending me copyright notices which is a verifiable service.
HorizonXP 9y ago
I'm not overly concerned with traffic being traced back to me via my ISP, so I just run OpenVPN on my pfSense router. Whenever I'm on remote WiFi that isn't run by me, I hop on the VPN and route all traffic through it. Minimizes my exposure on public hotspots, which is what concerns me most. It's irritating that I have to worry about my ISP, but not irritating enough for me to care. If that changes, I'll spin up a machine on some hosting provider and route traffic through there. It'll suck to have reduced speeds in that case though.
hprotagonist 9y ago
The bayesian guess that customers of a VPN service, specifically, are going to have more interesting traffic, is an interesting thing i hadn't really thought about. I would think that setting up https://github.com/trailofbits/algo https://github.com/trailofbits/algo and getting good at moving around from cloud-provider-of-your-choice VMs wouldn't be a horrible idea.
- loopbit 9y ago
  A while ago I saw a link to https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand (probably here in HN) and I have it in the list of things-to-do to try it. In the meantime I have a OpenVPN server at home just so I can log into my internal network from everywhere and use it when on public wifi... For the moment it's more than enough for me.
nextstep 9y ago
There’s a third, valid reason you should use a VPN: accessing geo-restricted content. This use case doesn’t require any privacy guarantees above a normal user-ISP relationship.
- pasbesoin 9y ago
  This has been locked down -- presumably including using targeting services provided by some businesses that apparently don't get reported on, much -- to the point where I've started talking about the "curated" Web/Internet. There are already large, shadowy forces increasingly differentiating traffic. This also includes access at all via a VPN; more and more, I run into web sites that refuse to serve you at all if you hit them with an IP address associated with a VPN. Or, they put you through rounds of Recaptcha. At first, it was just the big commercial streamers. Now, it's a lot more.
  - mythrwy 9y ago
    Yes. And this applies much of the time even if you run your own VPN from a data center.
    - pasbesoin 9y ago
      That, I wasn't aware of. It's been on my mind to set one up. I principally use a VPN to keep Comcast and Verizon out of my business (there's no need I endorse for them to sniff -- much less inject into -- my traffic). As archive.is and others and now increasingly even Google block me and make me jump through hoops, I'd been thinking rolling my own was the next step. I suppose I can switch to business class Internet at home and run a local server, but... Curated Internet. One not of our choosing...
- erikb 9y ago
  Is that still possible? Around a year ago services like Netflix started to block VPNs to avoid exactly this usecase.
  - 9y ago
clpwn 9y ago
Obviously, this guy has never been to China (or any other censored country for that matter).
aviv 9y ago
My guess is US authorities already own, operate, or have otherwise infiltrated some of the major VPN providers out there.
terrywang 9y ago
The title is very misleading. One should always use VPN to encrypt traffic when connecting to untrusted network (wired or wireless). Just use your DIY VPN (IPsec - strongSwan is very good option, or OpenVPN), don't use any free or untrusted VPN services
smsm42 9y ago
The argument seems to be "since VPN does not provide perfect security and privacy, you should not use it". This is obviously a fallacious argument - you need to evaluate "using VPN" vs. "not using VPN", not "using VPN" vs. "using some perfect theoretic unicorn privacy system that nobody has". Yes, VPN providers can track - but they make it harder to track you to third parties, unless they are in collusion with those parties, but for average user the chance this is happening - unless they are on the FBI/NSA radar already - is pretty low. Yes, third parties can fingerprint and use other techniques to track people. That's not the reason to offer them the most easy and readily available means of tracking on a silver plate.
braindongle 9y ago
Wha? Isn't the VPN market about accessing geo-restricted content? My non-geek friends often ask me "Can I stream X for free?" Moral and legal questions not-withstanding, the answer is often yes, using a VPN service. Could restriction-avoidance come back to bite you someday via logged behavior? Perhaps, but it sure wouldn't be in the interest of a VPN provider to allow that to happen. Should one lose sleep over appearing to be in the UK in order to stream Eurosport? Tough sell. "Send all of your traffic through us so that we can keep it private and secure" is absurd on the face of it. I'd like to think many non-technical people can see this, yet want to watch the Olympics on CBC because, more curling!
sandov 9y ago
Yeah, but it's easier to coerce a local ISP into giving my logs than it is to force a VPN settled in god knows what country to do so.
Johnny555 9y ago
His whole argument against VPN providers seems to depend on this statement: "Statistically speaking, it is more likely that a VPN provider will be malicious or a honeypot, than that an arbitrary generic VPS provider will be." But is that really true - how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?
- Barrin92 9y ago
  It isn't and it is horrible advice. Networks of trust are a real thing. It's like saying "don't trust any code you haven't audited yourself because they might lie to you and insert malicious code, just assume a priori that everybody scams you" which is obviously nonsensical because nobody would ever get any work done this way. A sane way to think about it is to make a judgement whether the business you trust has a solid track record, has market incentive to not screw you over, is transparent, is open source and whether your security demand is proportionate to what you're doing. The only major hickup seems to be the mentioned "HideMyAss" case, where a UK citizen was arrested on hacking charges facing 15 years in prison. Yes if you're trying to break into corporations and want to commit serious crimes don't trust a five dollar vpn provider legally registered in the same country. If you're trying to circumvent censorship or torrent a movie I think a regular VPN might still be an adequate choice
- morganvachon 9y ago
  > "how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?" I would assume that it's because they have no financial interest in the content of your traffic, whereas a VPN-specific service might. Most big VPS providers know that the bulk of their customers are technically minded people who read their own logs and monitor their own traffic, so there's no technical interest for them either. That said, if you end up abusing their terms (higher than allocated traffic or sustained heavy CPU time, for example), you can expect them to investigate if only to see if it's malicious in nature (DoS, spam, etc) or just a bad configuration. But again, those are just assumptions on my part. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit.
  - 9y ago
cookiecaper 9y ago
VPNs are very useful in lots of situations. My wife was in the hospital after delivering a baby, and whatever QoS they had going on in the router was making it painfully slow. Fired up PIA and off to the races, a normally functioning internet connection. There are a lot of networks where this is a legitimate use case. With cell phones such as they are today, people connect to public wifi frequently. There's another benefit of VPN that people don't discuss much: your traffic can be compressed with LZO. This can make an unusably slow connection usable. The applicability to web browsing may be somewhat limited if the sites you use all set up their gzip headers properly, but I think that's a stretch when you're going off major properties, and it will compress all the traffic at the network level regardless of protocol-specific options, so it should help some.
raides 9y ago
I've made this argument several times. I'm a psybouncer sort of guy. #shellz It is super easy to get a 2 dollar a month shell account and run psybouncer with a list of hosts you can hide behind. At least then I can double proxy cheaper.
krick 9y ago
> But I want more encryption! > Use SSL/TLS and blah-blah Uh, DNS?
statueq 9y ago
Any level of obfuscation between you and a resource is valuable when every bit of web traffic is sniffed and stored.
overgard 9y ago
I use a VPN all the time on my laptop because I'm frequently on public wifi at coffee shops. That alone makes a VPN worthwhile. The logic of "you can't 100% trust them so its useless" seems really extreme and detrimental. Yeah it won't stop a determined government agency... but unless you're Edward Snowden what you probably should be more worried about is some sketchy hacker listening in on wifi traffic, which VPNs are super useful for.
gerdesj 9y ago
Slightly tangential: Today, one of my staff (we're an IT company, I'm CREST accredited etc etc) connected up a NextCloud client to our NextCloud instance on a laptop and noted that the SSL cert was untrusted. The cert. on our NextCloud is a Let's Encrypt job. He was using a laptop provided by a customer (he works there a lot) and they deploy a MitM web proxy that he was perhaps only dimly aware of. I haven't look too deeply into the laptop config but it looks like either the MitM CA wasn't installed as trusted or the NC client is a bit clever. Now, I'll plump for: screw up in other corp. IT. So we have a techie ignoring warnings from an app that is designed to share data safely. OK, the customer's IT dept have their policies but I would have hoped that the default from my employee would have been to quietly walk away and uninstall NC from that laptop (he did after a few words.)
themanual 9y ago
BTW, I use a private VPN server which can be setup on aws in a few minutes https://github.com/webdigi/AWS-VPN-Server-Setup https://github.com/webdigi/AWS-VPN-Server-Setup No logging on server side guaranteed. AWS could monitor but I do not thinking of that as an issue for my use cases.
jfrankamp 9y ago
Just run your own, its two clicks. Load this into cloudformation and stop it when you're done. https://github.com/webdigi/AWS-VPN-Server-Setup/blob/master/src/output/Unified-Cloud-Formation.json https://github.com/webdigi/AWS-VPN-Server-Setup/blob/master/...
- ripdog 9y ago
  What problems does this solve? It ensures you still have a unique IP on the internet which can be traced by governments trivially, while a VPN service which actually doesn't log will keep you safe from simple attacks like that by sharing your IP. If you assume the service provider is malicious and DOES log, then why is a VPS provider any better than a VPN provider?
m3mnoch 9y ago
personally, i always side with greed/effort on this one. "wait -- we don't have to pay to keep/store/rotate/maintain logfiles? and that's a value proposition? yes! pipe them badboys to dev null!"
badrabbit 9y ago
The author makes good points but forgets to key considerations: 1) Reputation. A well known,well reputed provider (Fsecure or protonvpn for example) for most users would not be less trustworthy than their ISP. ISPs can easily get away with injecting malware into your http traffic or selling your data. A security company or VPN provider based in a jurisdiction with strict privacy laws and with well known business owners however has a lot more to lose and a lot less legal fighting power. 2) Threat model - you are already trusting someone (ISP) with not only monitoring your traffic but manipulating it. That should already be part of your threat model.when comparing a vpn provider with your ISP, which potential attacker poses a greater risk? For many users,sadly,it is their ISP. Last note,most vpn users just want to bypass IP restrictions,they don't care all that much about privacy(although that seems to be changing)
- irundebian 9y ago
  I don't know where you live, but in my country ISPs are not well known for injecting malware into the traffic.
darawk 9y ago
...Or any network where it is not known whether it is hostile or not. I.e. any network that isn't known-non-hostile. Which is most networks, possibly up to and including your own home WiFi. But if you want VPN service, why not simply setup your own server? They're cheap. There are hosting services that accept cryptocurrencies if you're into anonymity, and then you can be certain there are no logs (unless the hosting provider logs you, of course).
Dangeranger 9y ago
If you want to setup your own VPN for personal use or for friends the StreisandEffect project[0] on Github has made it dead simple for anyone with basic Linux experience. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- Exuma 9y ago
  If I'm doing that on OS X, what actual app/service do I use to connect to the VPN i set up? For example with NordVPN it uses a mac app... so if I create my own what do I use instead? Please dont say tunnelblick
  - subliminalpanda 9y ago
    You could try Viscosity[0], it's a great client but has a price tag, which I feel is worth it. [0] https://www.sparklabs.com/viscosity/ https://www.sparklabs.com/viscosity/
_Chief 9y ago
As someone from an African country with govt affiliated ISPs, even if my vpn service logged almost everything, I'd still use it as compared to the alternative
deleted 9y ago
[deleted]
bb88 9y ago
There is a good question about whether or not a national security letter holds any weight with a VPN, especially an endpoint outside the United States. I believe if supplied an NSL, I would expect the VPN provider to grant the request. But that would be only for those operating in the US.
karmakaze 9y ago
> And remember that it is in a VPN provider's best interest to log their users - it lets them deflect blame to the customer... Data is a liability. Keeping it is assuming responsibility. It is in the provider's best interest to keep the minimum information. If any agency were to ask for data, you can honestly say there is none and be free to continue running your business. And if you must keep data, keep it encrypted and only decryptable by the customer wherever possible.
newscracker 9y ago
If you're going to use a VPN, please read about its policies and try to understand them. I was horrified to learn about this VPN service from Facebook that is now being promoted in its iOS app (I don't use the app, but anything to do with Facebook generally worries me). The Onavo VPN service from Facebook is disguised as a protection mechanism but tracks the user for the benefit of Facebook. Quoting from this recent news: [1] "But Facebook didn’t buy Onavo for its security protections. Instead, Onavo’s VPN allow Facebook to monitor user activity across apps, giving Facebook a big advantage in terms of spotting new trends across the larger mobile ecosystem. For example, Facebook gets an early heads up about apps that are becoming breakout hits; it can tell which are seeing slowing user growth; it sees which apps’ new features appear to be resonating with their users, and much more. This data has already helped Facebook in a number of ways, most notably in its battle with Snapchat. At The WSJ reported last August, Facebook could tell that Instagram’s launch of Stories – a Snapchat-like feature – was working to slow Snapchat’s user growth, before the company itself even publicly disclosed this fact." [1]: https://techcrunch.com/2018/02/12/facebook-starts-pushing-its-data-tracking-onavo-vpn-within-its-main-mobile-app/ https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...
jachee 9y ago
Can we get a '(2015)' appended to this article title, please?
tribby 9y ago
awful advice. use a threat model, which may or may not include commercial VPN services. I can think of many situations in which I'd prefer a commercial VPN provider to a private one, or even to running meek on a tor bridge. there are also many situations in which someone else keeping logs is extremely useful :)
leethargo 9y ago
There are also multi-hop VPN services (similar to onion routing) that offer privacy beyond a "glorified proxy" [1], [2]. [1] https://restoreprivacy.com/multi-hop-vpn-chains/ https://restoreprivacy.com/multi-hop-vpn-chains/ [2] https://secure.cryptohippie.com/resources.php https://secure.cryptohippie.com/resources.php
gambiting 9y ago
In UK, all ISPs have to log your browsing history for a year now. And from April, all adult websites have to verify your identity(proposals as to how include giving them your passport scan and credit card details). And British government has just announced a tool that will automatically flag extremist content on the internet using AI. I'd much much much rather take my chances with a VPN provider and still route all of my traffic through any other country other than UK, thank you very much.
werid 9y ago
I only use a VPN when I need to get around geo-restrictions.
eloisant 9y ago
It depends what you want to do with the proxy. If you're doing serious crimes like child porn, terrorism or mass hacking the government will probably ask the VPN for logs. But if you're just doing stuff like P2P to download content illegally, at least in France they only track IPs for the consumer ISPs. Any other IP, especially out of the country, they'll ignore. So it doesn't matter if they have the logs, for minor things the government agencies or copyright holders will just give up and focus on the easy targets.
- laurent123456 9y ago
  Also in some countries some torrent websites are blocked and a VPN gives access to these too. It's also useful to watch TV channels in other countries since they are often geo-blocked. In other countries like China there's no question that a VPN is useful. Actually whoever wrote this article seems a bit clueless about why a VPN is useful. They suggest setting up your own on a VPS but doing this in China will get your server blocked right away. That's why a third party is useful since they can offer various IPs in many countries and quickly setup new servers when they get blocked.
skywhopper 9y ago
Plenty of good points here. I'm disappointed the author did not know about Streisand, a tool to help set up a number of VPN and related services on cloud hardware you control: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand When the setup is complete, you end up with some incredibly well-written instructions that make setting up the tools with any OS dead-simple. It's a really fantastic project.
- DavideNL 9y ago
  or Algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
emmelaich 9y ago
My analogy for non-IT people for a VPN is that it's a tunnel between houses so you don't have use the road or footpath. Then I point out that if it's easy for you to get out, it's easy for others (in the other house) to get in. And by extension anyone who visits their house. That usually makes them think. Managed/service VPN makes the hole wider or tighter depending on how trustworthy the manager is.
kemonocode 9y ago
Sometimes, a glorified proxy is just the thing you need. You have to weigh in the risk in having some random schmuck knowing where you've been and maybe getting subpoenaed against your Wifi hotspot provider, your ISP and your government easily knowing where you've been.
vectorEQ 9y ago
just dont use the internet, it's all untrusted network. every option u take is shitty. enjoy our glorious internet!
agumonkey 9y ago
so encrypted dns and https ?
Pokepokalypse 9y ago
My direct ISP is a local monopoly. My direct ISP is also a vertically integrated global media conglomerate which lobbies for abusive copyright practices, and maintains a large catalog of entertainment IP, which it walls-off from other providers, for the purpose of limiting competition. My VPN provider may collect data. But they're not fucking evil monopolists. And the other not-too-delicate point: MOST of the harm that comes from data collection is not Gillette learning that you have sensitive skin and might benefit from a 7-blade razor. MOST of the harm comes from LARGE corporate entities aggregating huge datasets from large quantities of people, such that they can draw statistical inferences. There can be a small subset of weirdos - who adblock and vpn. Doesn't matter, because all their neighbors share their data openly. The weirdos who protect themselves are still statistically outed - and even if they aren't the idiot neighbors are exposed to fake news, shitty campaign ads, and they vote, and that affects policy and law which applies to all of us, and that's why we should ALL be using VPN, but that's certainly not going to happen, and if it did, the VPN companies would just sell our data to aggregators anyway.
deleted 9y ago
[deleted]
husamia 9y ago
facepalm, your doing it wrong

384 points by miles 9y ago

Well then why is it if you actually try and sue a VPN provider for the logs, you won't be able to get them. this is the case for one scenario I know of where a subject got hacked and it was traced to a VPN service. Article is just FUD -- which this conversation could be warranted in some cases, but realistically I've found that it isn't the case. This doesn't mean that their outbound service isn't being logged by a third or unknown party like a government entity (which we know all traffic is logged), but hey it is what it is.

ocdtrekkie 9y ago
They have logs, they just don't keep them very long. (Allegedly.) So in theory, while they might not have logs for a past incident if it's been long enough, they most certainly have logs in very short term and/or can tell who's connected to what at the present time. So while many copyright actors will be too slow to get a hold of said logs, a government actor with significant interest will. The biggest issue for me is that VPN providers have given me no particular reason to trust them. If I already have reasons to distrust large international corporations that say they care about my privacy, why would I go trust one I've never heard of on the Internet that says it cares about my privacy?
- jopsen 9y ago
  Under EU privacy regulations you could probably demand that your VPN provider gives you a copy of all information they have on you, including logs. In the EU I've seen this successfully done with ISPs, ie. customers request logs and get a CD by mail. You'll have to insist and it might involve a small service fee.
  - SaturateDK 9y ago
    I did this and the fee was 200 DKK, and that is around 33 USD.
    - sumedh 9y ago
      So what exactly was in the logs?
      - jopsen 9y ago
        Probably what is required under Danish "law", which would be every 20th TCP session or so... Note: I write "law" because afaik the current logging directives have been found in violation of the European Human Rights declaration, I hear a legal battle is pending: https://ulovliglogning.dk/en/ https://ulovliglogning.dk/en/
- bigiain 9y ago
  To be fair - I'd never rely on a VPN provider to protect me from government actors with significant interest. "YOU’RE STILL GONNA BE MOSSAD’ED UPON" (from https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf ) Whether or not your VPN provider gives you any particular reason to trust them - for some of us, the government has passed laws to require our ISPs to be "untrustworthy".
cgb223 9y ago
Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible
- godelski 9y ago
  A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...
  - kuschku 9y ago
    Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
    - tonyztan 9y ago
      I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
    - reaperducer 9y ago
pasbesoin 9y ago
The way I see it (guessing, not knowing anything specific), the better commercial VPN services -- at least in or ensared into U.S. law -- may not keep logs, in general. But when a three letter agency with relevant authority (being more generous WRT some VPN services, maybe only unavoidable authority), asks for logging for specific users or perhaps some other narrow logging profile, then such logging starts and is made available.
Godel_unicode 9y ago
That's hardly the only concern. What if they have an arrangement to sell your traffic data to ad networks? Inject ads via dns poisoning? Inject Bitcoin mining JavaScript into http? Throttle traffic unless e.g. Netflix pays for bandwidth? VPN just substitutes an unregulated ISP for a somewhat regulated ISP.
- jessaustin 9y ago
  Someone would notice a VPN firm fucking with their only service in those ways (well, maybe not the first way), and then they wouldn't have any more customers. That's the difference between these firms and ISPs: they face actual competition!
  - Godel_unicode 9y ago
    Someone technical enough to notice would notice, I think that’s a small portion of people who are being preyed on by Big Privacy.
emmanuel_1234 9y ago
The VPN I used is based in a country where the US can't come and subpoena / sue people, which is the main protection I can think of. Worst that can happen is their servers being shutdown in countries that can, and it happens on a daily basis. Using a US-based VPN seems like a bad idea either way. Additionally, why would a VPN keep logs at all? With no traces, they have "plausible deniability" that some of their users are doing horrible, horrible things online. This is the main reason I trust my VPN provider to not have logs. IIRC, the only thing they look for is email spam (which is fairly easy to detect with very minimal / time restricted logging), as it spoils their IP addresses too quickly.
- dredmorbius 9y ago
  Debugging and assessing abusive behaviour is far easier with some level of history. That might be a few minutes, hours, or days. Weeks, months, years, not so much.
SmirkingRevenge 9y ago
There is a point to be made in there somewhere, that your VPN needs to be an entity you trust (at least more than the alternatives), if you pay for its services, expecting privacy for the price. A more helpful rant than the OP provided, would be one that informs you of ways to evaluate the trustworthiness of various VPN providers.

AdmiralAsshat 9y ago

So we've seen several VPN services that have proven to be malicious, insofar as selling your browsing history to advertisers (see Hola Better Internet[0]), but have we actually seen a VPN provider being a 'honeypot' yet? I guess we should qualify the term. In my mind, that would be a hostile government who sets up a VPN service for the purpose of attracting citizens who wish to avoid their censorship, and then arresting the users. [0]https://lifehacker.com/hola-better-internet-sells-your-bandwidth-turning-its-1707496872 https://lifehacker.com/hola-better-internet-sells-your-bandw...

ikeboy 9y ago
Some Tor relays are absolutely honeypots

endorphone 9y ago

As always the title is a bit of an overreach. If you are going to attract the attention of governments (PSN and Sony hacks, etc), yes, don't expect a VPN to shield you. If you're pirating a show that isn't available in your region, or checking up on an old workplace website, etc, a VPN is likely perfectly fine and will save you from legal scare letters, an old employer seeing your visit, etc.

smogcutter 9y ago
Wait, we're supposed to worry about an old employer seeing a visit to a public company website? How would that even happen, and why would anyone care?
- lighttower 9y ago
  I want to know the same thing
- jsmthrowaway 9y ago
  Only justification I could think of is a strict reading of CFAA, where in your exit paperwork the employer commands you not to access any company systems, and the Web site is technically a company system. Though “protected” would be quite arguable there. I occasionally have crons from my personal infrastructure running into an employer for operational purposes (offsite monitoring or whatever), so I’ve blackholed outgoing traffic to former employers to be on the safe side in case I miss one. So I can see where that sentiment is coming from, though I think it’s a legal stretch.
  - fred_is_fred 9y ago
    So for the 99.999999% of the rest of us who don't use personal systems to provide monitoring services this argument doesn't apply. Seems like it would be easier to just use outside monitoring or setup some monitoring instances in the cloud that your employer owns than going through this effort.
- endorphone 9y ago

thieving_magpie 9y ago

I'm sure the intended audience for enemies of the state are googling "should i use a vpn?" right now. What a silly article. Understand vpn's, understand public VPN providers, evaluate the risk for whatever you're trying to do.

zokier 9y ago

> If somebody wants to tap your connection, they can still do so - they just have to do so at a different point (ie. when your traffic leaves the VPN server). I feel like this sets up false equivalency. Tapping VPN provider and tapping individuals last mile are very different things. Of course it is debatable which one is more secure etc, but the fact remains that they have very different characteristics. I'd say that for almost any single attacker moving the hypothetical tap will not be happening at a push of a button, more likely it will not happen at all.

nukeop 9y ago
Furthermore, what is even meant by this "tap"? For most attackers breaking OpenVPN + HTTPS is just plain impossible, even if they somehow intercept the connection and position themselves between the VPN end point and the target server.

whorleater 9y ago

This is throwing the baby out with the bathwater, yes you should assume that your VPN provider is 100% logging your IP, traffic, referrer, etc, but you should also assume that any public wifi is being sniffed. A VPN won't magically hide your traffic, you're shifting the attacker in the threat model. But all this is also means that a VPN provider is less dangerous than public wifi is, which is really the reason you should be using VPN's.

kibwen 9y ago
If you already have an SSH client (which implies that you have somewhere to SSH to) and Firefox installed on your machine (not sure about Chrome) then you can prevent public wi-fi snooping right this very instant with a SOCKS proxy. This requires no new software on your machine, no money to change hands, and takes literally 30 seconds to set up. VPNs are overkill for that use case.
- coherentpony 9y ago
  Only for firefox's traffic. There's almost certainly other software on your machine using the network and thus not going through the proxy unless you explicitly tell it to.
  - fibers 9y ago
    environment variables
  - jffry 9y ago
    I'm pretty sure you could use https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle though I haven't looked into it (does it proxy DNS? UDP? DHCP? I'm not sure)
    - GordonS 9y ago
      Just a note, it doesn't work with Windows, only Linux and OSX.
  - 9y ago

nukeop 9y ago

We've seen this little bit of FUD several times in the past and it's as inaccurate as it has always been. VPNs cover some scenarios but the author makes unreasonable, extreme demands and wants them to provide security no entity lower than major government-level can provide. A VPN is just one of many steps in hardening your machine and connection, it's not a silver bullet. A setup that's truly hardened against internet surveillance directed towards the average user _should_ also include a VPN as one of its components, that much is sure. A VPN will not protect you against Mossad, because as Mickens said, if Mossad is after you, you are going to die and there's nothing you can do to stop it. But a VPN will provide a very effective layer protecting you against location and IP based tracking and fingerprinting.

slg 9y ago

I suggest people lookup "The Market For Lemons"[1] as it is a good warning for what can happen to markets with extreme information asymmetry. VPN providers like many tech companies have a huge information asymmetry over their customers. There is no way to really verify many of the claims that a provider is making, especially when it comes to something like logging. The result is that the consumer can't actually distinguish a low quality product from a high quality product. This creates a disincentive for companies to actually provide a high quality product when they can provide a product that is lower quality and cheaper to produce and still pull in the same revenue from users. If this is allowed to go on without any form of third party intervention, the end result is a market filled of products with dubious quality. [1] - https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofMarketforLemons.pdf https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofM...

lighttower 9y ago
Exactly what you say. Maybe the solution is to use two VPNs. That way the second doesn't know your home IP and the first has no info on the content. Like a home baked Tor.
- jsjohnst 9y ago
  You don’t thing a legal authority wouldn’t subpoena both?
  - yjftsjthsd-h 9y ago
    First, they can be in different jurisdictions. Second, it depends on what threat model you use; I for one am hiding from my ISP, not the government.
  - cm2187 9y ago
    I think that’s not his point. There is a probability p that vpn providers are not providing the service they advertise (ie lemon). But the probability that both are lemons become p^2 which is much lower (subpoena-ing a provider that maintains no log is useless). Where it breaks I think is that you can chain as many VPNs as you want, only the last one sees what you are downloading, the others only see traffic to another VPN. So the authority just needs to subpoena that one.

0x7f800000 9y ago

Steve Gibson specifically recommends TunnelBear because they submitted themselves to a public security audit. https://www.tunnelbear.com/blog/tunnelbear_public_security_audit/ https://www.tunnelbear.com/blog/tunnelbear_public_security_a... Other than TunnelBear, ProtonVPN is run by the ProtonMail folks and is based out of Switzerland, so they would respond to any foreign subpoena with a polite "fuck off."

daxorid 9y ago
> based out of Switzerland Switzerland is no longer the bastion of privacy it once was. In fact, it's been nine years since every single Swiss Bank rolled over on their customers to placate the IRS. And it's only been downhill from there since.
- XorNot 9y ago
  I'm really okay with this. Taxes are the price we pay for civilisation and people dodging them are stealing from you.
  - confounded 9y ago
    Surveillance of money, and surveillance of speech, association, location, etc. are not the same, and one does not justify the other.
    - s73v3r_ 9y ago
      I believe they were saying that they were OK with the Swiss banks giving info to the IRS about tax dodgers. Which I'm ok with too. I'm not ok with random web traffic being disclosed to authorities.
  - cookiecaper 9y ago
    Switzerland and the United States are not the same country. That the United States can steamroll the sovereignty of independent nations like this is not very good. Diversity and competition among jurisdictions is important.

j0hnml 9y ago

If anything, a better title would be “Use VPN services for security, not privacy”. I don’t know about others, but whenever I’m using a VPN, I pretty much only have security in mind for when I’m using public WiFi’s.

0culus 9y ago

As always, you have to do what is right for your threat model. I personally run my own VPN mainly for peace of mind when I'm on untrusted LANs. It's actually not that hard to do, and I can easily serve both my phone and my computers. And as always, if you have an APT after you...you have bigger problems than what VPN provider you should use. This gist is at best a straw man.

cyberpip 9y ago

Great site for going into the differences between VPN providers and all that goes with the ratings: https://thatoneprivacysite.net/ https://thatoneprivacysite.net/

drcode 9y ago

I view VPN services more as "Kabuki Theater": The major governments need to keep up the pretense that they aren't reading our traffic via arrangements with the VPN providers, and in return they promise to keep our actions secret BUT ONLY if we aren't engaging in a national crime such as terrorism or espionage.

infodroid 9y ago

This seems like bad advice because it doesn't address the legitimate need for keeping your browsing history private from overzealous, data-mining ISP's [1]. And even in the case of a known-hostile ISP that engages in invasive practices like supercookies or ad injection, it's unrealistic to ask users to set up and maintain their own VPS servers. For the average internet user, a "glorified proxy" service that is hassle-free to set up is a simple and effective means of protection against such a menace. [1] https://techcrunch.com/2017/03/29/everything-you-need-to-know-about-congress-decision-to-expose-your-data-to-internet-providers/ https://techcrunch.com/2017/03/29/everything-you-need-to-kno...

rsync 9y ago
"it's unrealistic to ask users to set up and maintain their own VPS servers." I think that sshuttle[1] changes that calculus. sshuttle allows you to make any ssh server a VPN endpoint. So you don't need to configure IPSEC or make an SSH tunnel or anything like that - you just need a login on an ssh server somewhere. [1] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
- GordonS 9y ago
  AFAIR, it doesn't work for Windows clients, which are a rather large user segment. Still, it is impressively simple to use for Linux and OSX users.
  - rsync 9y ago
    ... and it works for FreeBSD and as of our (rsync.net) sponsorship of work done last year, has DNS support in FreeBSD with ipfw as the backend.
__jal 9y ago
It was addressed, indirectly, at the end - "You are on a known-hostile network". In my case, one of my links is Comcast, a known-hostile network. I agree it should have been much more prominent, because this is exactly why I use one, and why many folks I know use one.

nrjames 9y ago

I use a VPN for one reason only: to watch Olympics coverage that is good. I'm not ashamed of that.

vr46 9y ago

I use a VPN to (a) prevent my employer from recording my visits to anywhere and (b) my government from doing the same. I use ProtonVPN. This seems like a good use case. And Proton seem like a good bunch. Anyone have any feedback?

yorby 9y ago
your employer doesn't have access to your computer? if they do, they more than likely can see the traffic before it reaches the VPN...
- vr46 9y ago
  It’s my own machine but of course I’m using their WiFi network.

sxates 9y ago

So we can't absolutely trust a VPN provider - but do we have more trust in Comcast/AT&T/Verizon/etc?

lr4444lr 9y ago

So what's the alternative? Trust my ISP not to do the same? No thanks, I'll take my chances that my well-regarded and relatively cheap VPN service has both less resources to handle massive data storage for as long term, and is no less incentivized to turn huge profits or protect themselves by spilling everything to the government, even if both would under extreme duress. For what I pay, the VPN is a worthwhile little extra protection, not to mention the extra portable security when I have no choice but to use public wifi.

yjftsjthsd-h 9y ago
If you're reading HN, one alternative is spin up your own VPN on AWS/Gcloud/DigitalOcean/etc. It's not hard, and there are some scripts / ansible playbooks to automate the process.
- lr4444lr 9y ago
  Yes, but with all due respect, this misses the point: If my concern is privacy, consider the business incentives to each party for divulging info about me to a government agency or marketer. The cloud services you describe receive revenue from thousands of different companies with various business needs and concerns. Little ol' me won't be a blip on the radar revenue-wise, even if it's a big news story in the internet privacy world. For the VPN on the other hand, a sizable - maybe the lion's share - of their customer base has the same priority as me. If it gets out in public that the VPN caved either to pressures of the state or corporate greed on my data, they'd just as easily do so to anyone else, and customers would flee en masse.
- cm2187 9y ago
  The movie studio will send a DMCA to AWS who will pass it on to you, then what? Helps with ISP snooping yes, though I expect it to be more expensive (VM and bandwidth in clouds isn’t cheap).
  - hyperpower 9y ago
    What do you consider expensive? You can easily get a VM with 1TB bandwidth for $5 a month.

adzicg 9y ago

It’s reasonably easy to set up a l2tp VPN on AWS, using cloudformation. Running an EC2 instance for a full month for this costs roughly $5 USD. I don’t really get why someone with a bit of tech skills (=using github) would use a third party VPN service from an unverified provider. Sure enough, if Five Eyes want to get your logs from AWS they will, but for avoiding airport or hotel WiFi’s snooping a simple l2tp VPN over AWS serves quite fine, and it works with mobile phones and laptops without requiring any additional software.

notacoward 9y ago
Do you suppose that Amazon, which actively sells cloud services to the US intelligence community, is less able or willing to spy on your setup than a VPN provider would be? I have some bad news for you.
- sterlind 9y ago
  AWS would lose lots of business if their complicity became public. Foreign customers have lost confident in the security/data compliance of public cloud in the wake of the NSA revelations. It'd be bad for the NSA, too. I assume they are spying but only rarely act on the data they're slurping. If Amazon loses customers, and the NSA has eyes inside, the NSA loses their eyes.
  - notacoward 9y ago
    > AWS would lose lots of business if their complicity became public. So would any VPN provider. The incentives are no different, and neither are the opportunities, so recommending one over the other is a bit suspect.
- floatboth 9y ago
  > US intelligence community If you're not from the US, you might care about your country's spying way more than about US spying.

sesutton 9y ago

I have much higher trust in my VPN than my ISP, which used to make you pay more if you didn't want to be spied on (AT&T). It also stops them from sending me copyright notices which is a verifiable service.

HorizonXP 9y ago

I'm not overly concerned with traffic being traced back to me via my ISP, so I just run OpenVPN on my pfSense router. Whenever I'm on remote WiFi that isn't run by me, I hop on the VPN and route all traffic through it. Minimizes my exposure on public hotspots, which is what concerns me most. It's irritating that I have to worry about my ISP, but not irritating enough for me to care. If that changes, I'll spin up a machine on some hosting provider and route traffic through there. It'll suck to have reduced speeds in that case though.

hprotagonist 9y ago

The bayesian guess that customers of a VPN service, specifically, are going to have more interesting traffic, is an interesting thing i hadn't really thought about. I would think that setting up https://github.com/trailofbits/algo https://github.com/trailofbits/algo and getting good at moving around from cloud-provider-of-your-choice VMs wouldn't be a horrible idea.

loopbit 9y ago
A while ago I saw a link to https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand (probably here in HN) and I have it in the list of things-to-do to try it. In the meantime I have a OpenVPN server at home just so I can log into my internal network from everywhere and use it when on public wifi... For the moment it's more than enough for me.

nextstep 9y ago

There’s a third, valid reason you should use a VPN: accessing geo-restricted content. This use case doesn’t require any privacy guarantees above a normal user-ISP relationship.

pasbesoin 9y ago
This has been locked down -- presumably including using targeting services provided by some businesses that apparently don't get reported on, much -- to the point where I've started talking about the "curated" Web/Internet. There are already large, shadowy forces increasingly differentiating traffic. This also includes access at all via a VPN; more and more, I run into web sites that refuse to serve you at all if you hit them with an IP address associated with a VPN. Or, they put you through rounds of Recaptcha. At first, it was just the big commercial streamers. Now, it's a lot more.
- mythrwy 9y ago
  Yes. And this applies much of the time even if you run your own VPN from a data center.
  - pasbesoin 9y ago
    That, I wasn't aware of. It's been on my mind to set one up. I principally use a VPN to keep Comcast and Verizon out of my business (there's no need I endorse for them to sniff -- much less inject into -- my traffic). As archive.is and others and now increasingly even Google block me and make me jump through hoops, I'd been thinking rolling my own was the next step. I suppose I can switch to business class Internet at home and run a local server, but... Curated Internet. One not of our choosing...
erikb 9y ago
Is that still possible? Around a year ago services like Netflix started to block VPNs to avoid exactly this usecase.
- 9y ago

clpwn 9y ago

Obviously, this guy has never been to China (or any other censored country for that matter).

aviv 9y ago

My guess is US authorities already own, operate, or have otherwise infiltrated some of the major VPN providers out there.

terrywang 9y ago

The title is very misleading. One should always use VPN to encrypt traffic when connecting to untrusted network (wired or wireless). Just use your DIY VPN (IPsec - strongSwan is very good option, or OpenVPN), don't use any free or untrusted VPN services

smsm42 9y ago

The argument seems to be "since VPN does not provide perfect security and privacy, you should not use it". This is obviously a fallacious argument - you need to evaluate "using VPN" vs. "not using VPN", not "using VPN" vs. "using some perfect theoretic unicorn privacy system that nobody has". Yes, VPN providers can track - but they make it harder to track you to third parties, unless they are in collusion with those parties, but for average user the chance this is happening - unless they are on the FBI/NSA radar already - is pretty low. Yes, third parties can fingerprint and use other techniques to track people. That's not the reason to offer them the most easy and readily available means of tracking on a silver plate.

braindongle 9y ago

Wha? Isn't the VPN market about accessing geo-restricted content? My non-geek friends often ask me "Can I stream X for free?" Moral and legal questions not-withstanding, the answer is often yes, using a VPN service. Could restriction-avoidance come back to bite you someday via logged behavior? Perhaps, but it sure wouldn't be in the interest of a VPN provider to allow that to happen. Should one lose sleep over appearing to be in the UK in order to stream Eurosport? Tough sell. "Send all of your traffic through us so that we can keep it private and secure" is absurd on the face of it. I'd like to think many non-technical people can see this, yet want to watch the Olympics on CBC because, more curling!

sandov 9y ago

Yeah, but it's easier to coerce a local ISP into giving my logs than it is to force a VPN settled in god knows what country to do so.

Johnny555 9y ago

His whole argument against VPN providers seems to depend on this statement: "Statistically speaking, it is more likely that a VPN provider will be malicious or a honeypot, than that an arbitrary generic VPS provider will be." But is that really true - how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?

Barrin92 9y ago
It isn't and it is horrible advice. Networks of trust are a real thing. It's like saying "don't trust any code you haven't audited yourself because they might lie to you and insert malicious code, just assume a priori that everybody scams you" which is obviously nonsensical because nobody would ever get any work done this way. A sane way to think about it is to make a judgement whether the business you trust has a solid track record, has market incentive to not screw you over, is transparent, is open source and whether your security demand is proportionate to what you're doing. The only major hickup seems to be the mentioned "HideMyAss" case, where a UK citizen was arrested on hacking charges facing 15 years in prison. Yes if you're trying to break into corporations and want to commit serious crimes don't trust a five dollar vpn provider legally registered in the same country. If you're trying to circumvent censorship or torrent a movie I think a regular VPN might still be an adequate choice
morganvachon 9y ago
> "how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?" I would assume that it's because they have no financial interest in the content of your traffic, whereas a VPN-specific service might. Most big VPS providers know that the bulk of their customers are technically minded people who read their own logs and monitor their own traffic, so there's no technical interest for them either. That said, if you end up abusing their terms (higher than allocated traffic or sustained heavy CPU time, for example), you can expect them to investigate if only to see if it's malicious in nature (DoS, spam, etc) or just a bad configuration. But again, those are just assumptions on my part. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit.
- 9y ago

cookiecaper 9y ago

VPNs are very useful in lots of situations. My wife was in the hospital after delivering a baby, and whatever QoS they had going on in the router was making it painfully slow. Fired up PIA and off to the races, a normally functioning internet connection. There are a lot of networks where this is a legitimate use case. With cell phones such as they are today, people connect to public wifi frequently. There's another benefit of VPN that people don't discuss much: your traffic can be compressed with LZO. This can make an unusably slow connection usable. The applicability to web browsing may be somewhat limited if the sites you use all set up their gzip headers properly, but I think that's a stretch when you're going off major properties, and it will compress all the traffic at the network level regardless of protocol-specific options, so it should help some.

raides 9y ago

I've made this argument several times. I'm a psybouncer sort of guy. #shellz It is super easy to get a 2 dollar a month shell account and run psybouncer with a list of hosts you can hide behind. At least then I can double proxy cheaper.

krick 9y ago

> But I want more encryption! > Use SSL/TLS and blah-blah Uh, DNS?

statueq 9y ago

Any level of obfuscation between you and a resource is valuable when every bit of web traffic is sniffed and stored.

overgard 9y ago

I use a VPN all the time on my laptop because I'm frequently on public wifi at coffee shops. That alone makes a VPN worthwhile. The logic of "you can't 100% trust them so its useless" seems really extreme and detrimental. Yeah it won't stop a determined government agency... but unless you're Edward Snowden what you probably should be more worried about is some sketchy hacker listening in on wifi traffic, which VPNs are super useful for.

gerdesj 9y ago

Slightly tangential: Today, one of my staff (we're an IT company, I'm CREST accredited etc etc) connected up a NextCloud client to our NextCloud instance on a laptop and noted that the SSL cert was untrusted. The cert. on our NextCloud is a Let's Encrypt job. He was using a laptop provided by a customer (he works there a lot) and they deploy a MitM web proxy that he was perhaps only dimly aware of. I haven't look too deeply into the laptop config but it looks like either the MitM CA wasn't installed as trusted or the NC client is a bit clever. Now, I'll plump for: screw up in other corp. IT. So we have a techie ignoring warnings from an app that is designed to share data safely. OK, the customer's IT dept have their policies but I would have hoped that the default from my employee would have been to quietly walk away and uninstall NC from that laptop (he did after a few words.)

themanual 9y ago

BTW, I use a private VPN server which can be setup on aws in a few minutes https://github.com/webdigi/AWS-VPN-Server-Setup https://github.com/webdigi/AWS-VPN-Server-Setup No logging on server side guaranteed. AWS could monitor but I do not thinking of that as an issue for my use cases.

jfrankamp 9y ago

Just run your own, its two clicks. Load this into cloudformation and stop it when you're done. https://github.com/webdigi/AWS-VPN-Server-Setup/blob/master/src/output/Unified-Cloud-Formation.json https://github.com/webdigi/AWS-VPN-Server-Setup/blob/master/...

ripdog 9y ago
What problems does this solve? It ensures you still have a unique IP on the internet which can be traced by governments trivially, while a VPN service which actually doesn't log will keep you safe from simple attacks like that by sharing your IP. If you assume the service provider is malicious and DOES log, then why is a VPS provider any better than a VPN provider?

m3mnoch 9y ago

personally, i always side with greed/effort on this one. "wait -- we don't have to pay to keep/store/rotate/maintain logfiles? and that's a value proposition? yes! pipe them badboys to dev null!"

badrabbit 9y ago

The author makes good points but forgets to key considerations: 1) Reputation. A well known,well reputed provider (Fsecure or protonvpn for example) for most users would not be less trustworthy than their ISP. ISPs can easily get away with injecting malware into your http traffic or selling your data. A security company or VPN provider based in a jurisdiction with strict privacy laws and with well known business owners however has a lot more to lose and a lot less legal fighting power. 2) Threat model - you are already trusting someone (ISP) with not only monitoring your traffic but manipulating it. That should already be part of your threat model.when comparing a vpn provider with your ISP, which potential attacker poses a greater risk? For many users,sadly,it is their ISP. Last note,most vpn users just want to bypass IP restrictions,they don't care all that much about privacy(although that seems to be changing)

irundebian 9y ago
I don't know where you live, but in my country ISPs are not well known for injecting malware into the traffic.

darawk 9y ago

...Or any network where it is not known whether it is hostile or not. I.e. any network that isn't known-non-hostile. Which is most networks, possibly up to and including your own home WiFi. But if you want VPN service, why not simply setup your own server? They're cheap. There are hosting services that accept cryptocurrencies if you're into anonymity, and then you can be certain there are no logs (unless the hosting provider logs you, of course).

Dangeranger 9y ago

If you want to setup your own VPN for personal use or for friends the StreisandEffect project[0] on Github has made it dead simple for anyone with basic Linux experience. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand

Exuma 9y ago
If I'm doing that on OS X, what actual app/service do I use to connect to the VPN i set up? For example with NordVPN it uses a mac app... so if I create my own what do I use instead? Please dont say tunnelblick
- subliminalpanda 9y ago
  You could try Viscosity[0], it's a great client but has a price tag, which I feel is worth it. [0] https://www.sparklabs.com/viscosity/ https://www.sparklabs.com/viscosity/

_Chief 9y ago

As someone from an African country with govt affiliated ISPs, even if my vpn service logged almost everything, I'd still use it as compared to the alternative

deleted 9y ago

[deleted]

bb88 9y ago

There is a good question about whether or not a national security letter holds any weight with a VPN, especially an endpoint outside the United States. I believe if supplied an NSL, I would expect the VPN provider to grant the request. But that would be only for those operating in the US.

karmakaze 9y ago

> And remember that it is in a VPN provider's best interest to log their users - it lets them deflect blame to the customer... Data is a liability. Keeping it is assuming responsibility. It is in the provider's best interest to keep the minimum information. If any agency were to ask for data, you can honestly say there is none and be free to continue running your business. And if you must keep data, keep it encrypted and only decryptable by the customer wherever possible.

newscracker 9y ago

If you're going to use a VPN, please read about its policies and try to understand them. I was horrified to learn about this VPN service from Facebook that is now being promoted in its iOS app (I don't use the app, but anything to do with Facebook generally worries me). The Onavo VPN service from Facebook is disguised as a protection mechanism but tracks the user for the benefit of Facebook. Quoting from this recent news: [1] "But Facebook didn’t buy Onavo for its security protections. Instead, Onavo’s VPN allow Facebook to monitor user activity across apps, giving Facebook a big advantage in terms of spotting new trends across the larger mobile ecosystem. For example, Facebook gets an early heads up about apps that are becoming breakout hits; it can tell which are seeing slowing user growth; it sees which apps’ new features appear to be resonating with their users, and much more. This data has already helped Facebook in a number of ways, most notably in its battle with Snapchat. At The WSJ reported last August, Facebook could tell that Instagram’s launch of Stories – a Snapchat-like feature – was working to slow Snapchat’s user growth, before the company itself even publicly disclosed this fact." [1]: https://techcrunch.com/2018/02/12/facebook-starts-pushing-its-data-tracking-onavo-vpn-within-its-main-mobile-app/ https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...

jachee 9y ago

Can we get a '(2015)' appended to this article title, please?

tribby 9y ago

awful advice. use a threat model, which may or may not include commercial VPN services. I can think of many situations in which I'd prefer a commercial VPN provider to a private one, or even to running meek on a tor bridge. there are also many situations in which someone else keeping logs is extremely useful :)

leethargo 9y ago

There are also multi-hop VPN services (similar to onion routing) that offer privacy beyond a "glorified proxy" [1], [2]. [1] https://restoreprivacy.com/multi-hop-vpn-chains/ https://restoreprivacy.com/multi-hop-vpn-chains/ [2] https://secure.cryptohippie.com/resources.php https://secure.cryptohippie.com/resources.php

gambiting 9y ago

In UK, all ISPs have to log your browsing history for a year now. And from April, all adult websites have to verify your identity(proposals as to how include giving them your passport scan and credit card details). And British government has just announced a tool that will automatically flag extremist content on the internet using AI. I'd much much much rather take my chances with a VPN provider and still route all of my traffic through any other country other than UK, thank you very much.

werid 9y ago

I only use a VPN when I need to get around geo-restrictions.

eloisant 9y ago

It depends what you want to do with the proxy. If you're doing serious crimes like child porn, terrorism or mass hacking the government will probably ask the VPN for logs. But if you're just doing stuff like P2P to download content illegally, at least in France they only track IPs for the consumer ISPs. Any other IP, especially out of the country, they'll ignore. So it doesn't matter if they have the logs, for minor things the government agencies or copyright holders will just give up and focus on the easy targets.

laurent123456 9y ago
Also in some countries some torrent websites are blocked and a VPN gives access to these too. It's also useful to watch TV channels in other countries since they are often geo-blocked. In other countries like China there's no question that a VPN is useful. Actually whoever wrote this article seems a bit clueless about why a VPN is useful. They suggest setting up your own on a VPS but doing this in China will get your server blocked right away. That's why a third party is useful since they can offer various IPs in many countries and quickly setup new servers when they get blocked.

skywhopper 9y ago

Plenty of good points here. I'm disappointed the author did not know about Streisand, a tool to help set up a number of VPN and related services on cloud hardware you control: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand When the setup is complete, you end up with some incredibly well-written instructions that make setting up the tools with any OS dead-simple. It's a really fantastic project.

DavideNL 9y ago
or Algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

emmelaich 9y ago

My analogy for non-IT people for a VPN is that it's a tunnel between houses so you don't have use the road or footpath. Then I point out that if it's easy for you to get out, it's easy for others (in the other house) to get in. And by extension anyone who visits their house. That usually makes them think. Managed/service VPN makes the hole wider or tighter depending on how trustworthy the manager is.

kemonocode 9y ago

Sometimes, a glorified proxy is just the thing you need. You have to weigh in the risk in having some random schmuck knowing where you've been and maybe getting subpoenaed against your Wifi hotspot provider, your ISP and your government easily knowing where you've been.

vectorEQ 9y ago

just dont use the internet, it's all untrusted network. every option u take is shitty. enjoy our glorious internet!

agumonkey 9y ago

so encrypted dns and https ?

Pokepokalypse 9y ago

My direct ISP is a local monopoly. My direct ISP is also a vertically integrated global media conglomerate which lobbies for abusive copyright practices, and maintains a large catalog of entertainment IP, which it walls-off from other providers, for the purpose of limiting competition. My VPN provider may collect data. But they're not fucking evil monopolists. And the other not-too-delicate point: MOST of the harm that comes from data collection is not Gillette learning that you have sensitive skin and might benefit from a 7-blade razor. MOST of the harm comes from LARGE corporate entities aggregating huge datasets from large quantities of people, such that they can draw statistical inferences. There can be a small subset of weirdos - who adblock and vpn. Doesn't matter, because all their neighbors share their data openly. The weirdos who protect themselves are still statistically outed - and even if they aren't the idiot neighbors are exposed to fake news, shitty campaign ads, and they vote, and that affects policy and law which applies to all of us, and that's why we should ALL be using VPN, but that's certainly not going to happen, and if it did, the VPN companies would just sell our data to aggregators anyway.

deleted 9y ago

[deleted]

husamia 9y ago

facepalm, your doing it wrong