3 ms·

Exactly what you say. Maybe the solution is to use two VPNs. That way the second doesn't know your home IP and the first has no info on the content. Like a home

Exactly what you say. Maybe the solution is to use two VPNs. That way the second doesn't know your home IP and the first has no info on the content. Like a home baked Tor.

jsjohnst 9y ago
You don’t thing a legal authority wouldn’t subpoena both?
- yjftsjthsd-h 9y ago
  First, they can be in different jurisdictions. Second, it depends on what threat model you use; I for one am hiding from my ISP, not the government.
- cm2187 9y ago
  I think that’s not his point. There is a probability p that vpn providers are not providing the service they advertise (ie lemon). But the probability that both are lemons become p^2 which is much lower (subpoena-ing a provider that maintains no log is useless). Where it breaks I think is that you can chain as many VPNs as you want, only the last one sees what you are downloading, the others only see traffic to another VPN. So the authority just needs to subpoena that one.
Thriptic 9y ago
The performance hit would be enormous
- yjftsjthsd-h 9y ago
  Why? Obviously latency would spike, but bandwidth should be fine.
  - jsjohnst 9y ago
    Generally speaking, tunneling TCP inside TCP is a bad idea. Yes, it’ll “mostly” work with the added latency you mentioned, but it can go very poorly if the network starts having packet congestion or dropped packets. If the “outer” VPN is UDP or IPsec, then not as much an issue, but many of the VPN providers commonly used are TCP based (of the ones I spot checked from a google search anyway). And remember, since they are TCPinTCP already, you are just making the situation even more likely to occur. Further reading: http://sites.inka.de/bigred/devel/tcp-tcp.html http://sites.inka.de/bigred/devel/tcp-tcp.html
    - slrz 9y ago
      Most VPN systems use UDP, with TCP possibly being supported as a fallback solution for when UDP connectivity is broken. The exception are things like SSH tunnels using sshuttle but they call themselves a "poor man's VPN" for a reason.
      - yjftsjthsd-h 9y ago
        Though ironically sshuttle claims to fix this problem.

Exactly what you say. Maybe the solution is to use two VPNs. That way the second doesn't know your home IP and the first has no info on the content. Like a home baked Tor.

jsjohnst 9y ago

You don’t thing a legal authority wouldn’t subpoena both?

yjftsjthsd-h 9y ago
First, they can be in different jurisdictions. Second, it depends on what threat model you use; I for one am hiding from my ISP, not the government.
cm2187 9y ago
I think that’s not his point. There is a probability p that vpn providers are not providing the service they advertise (ie lemon). But the probability that both are lemons become p^2 which is much lower (subpoena-ing a provider that maintains no log is useless). Where it breaks I think is that you can chain as many VPNs as you want, only the last one sees what you are downloading, the others only see traffic to another VPN. So the authority just needs to subpoena that one.

Thriptic 9y ago

The performance hit would be enormous

yjftsjthsd-h 9y ago
Why? Obviously latency would spike, but bandwidth should be fine.
- jsjohnst 9y ago
  Generally speaking, tunneling TCP inside TCP is a bad idea. Yes, it’ll “mostly” work with the added latency you mentioned, but it can go very poorly if the network starts having packet congestion or dropped packets. If the “outer” VPN is UDP or IPsec, then not as much an issue, but many of the VPN providers commonly used are TCP based (of the ones I spot checked from a google search anyway). And remember, since they are TCPinTCP already, you are just making the situation even more likely to occur. Further reading: http://sites.inka.de/bigred/devel/tcp-tcp.html http://sites.inka.de/bigred/devel/tcp-tcp.html
  - slrz 9y ago
    Most VPN systems use UDP, with TCP possibly being supported as a fallback solution for when UDP connectivity is broken. The exception are things like SSH tunnels using sshuttle but they call themselves a "poor man's VPN" for a reason.
    - yjftsjthsd-h 9y ago
      Though ironically sshuttle claims to fix this problem.