5 ms·
This is throwing the baby out with the bathwater, yes you should assume that your VPN provider is 100% logging your IP, traffic, referrer, etc, but you should a
by whorleater 9y ago
This is throwing the baby out with the bathwater, yes you should assume that your VPN provider is 100% logging your IP, traffic, referrer, etc, but you should also assume that any public wifi is being sniffed. A VPN won't magically hide your traffic, you're shifting the attacker in the threat model. But all this is also means that a VPN provider is less dangerous than public wifi is, which is really the reason you should be using VPN's.
- kibwen 9y agoIf you already have an SSH client (which implies that you have somewhere to SSH to) and Firefox installed on your machine (not sure about Chrome) then you can prevent public wi-fi snooping right this very instant with a SOCKS proxy. This requires no new software on your machine, no money to change hands, and takes literally 30 seconds to set up. VPNs are overkill for that use case.
- coherentpony 9y agoOnly for firefox's traffic. There's almost certainly other software on your machine using the network and thus not going through the proxy unless you explicitly tell it to.
- fibers 9y agoenvironment variables
- jffry 9y agoI'm pretty sure you could use https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle though I haven't looked into it (does it proxy DNS? UDP? DHCP? I'm not sure)
- GordonS 9y agoJust a note, it doesn't work with Windows, only Linux and OSX.
- kibwen 9y agoIndeed, I had tunnel vision and was thinking only of web traffic. But at the same time, what software other than web-browsers-connecting-to-HTTP-sites is attempting unencrypted network communcation? If there are any system updaters or package managers trying to do their job over plaintext, that's important for people to know!
- scbrg 9y agoDNS lookups are generally unencrypted, no? w/r to package managers, apt is usually unencrypted. Of course, there's signature validation that makes sure you don't get altered packages, but traffic can be snooped none the less.
- GordonS 9y agoYou can ask Firefox to do the DNS lookup at the proxy end, as long as it supports SOCKS5 (I tunnel from my Windows machine to a remote Linux VPS using PuTTY, and this setup works great)
- squiguy7 9y agoAnother good alternative is to use sshuttle [0] which can tunnel all traffic that you instruct it to. It's quite simple to run as well. [0]: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
- hug 9y agoVery useful for the ~12% of desktops on Mac OS or linux. Not at all useful for the single largest desktop OS, Windows. Even less sensible for the majority of Internet traffic, which is now on a mobile OS.
- yjftsjthsd-h 9y agoI have long wished for a port of sshuttle to Android; it should work fine, since Android has a native VPN API and working SSH clients.
- mythrwy 9y agoOr do it for everything with sshuttle and don't worry with changing settings in Firefox. https://sshuttle.readthedocs.io/en/stable/ https://sshuttle.readthedocs.io/en/stable/ <edit I guess should read other comments before posting>
- cookiecaper 9y agoYes, I agree that this is overly generic. But it's important to realize that most people don't have the technical knowledge to approach this from a nuanced perspective. For them, it is all or nothing. I wrote a post pretty similar to this about Tor several years ago. That's even worse than a VPN.
- josteink 9y ago> But all this is also means that a VPN provider is less dangerous than public wifi is Is it really? I guess it depends on what sort of threat you are trying to protect yourself from. Using public wifi lots of places leaves different traces at completely disconnected ISPs/service-points. For an attacker, obtaining and correlating all these is probably not a realistic option. Consistently using a third-party VPN service (as opposed to hosting your own) centralizes all your data in a single point which is much easier to target.