4 ms·

His whole argument against VPN providers seems to depend on this statement: "Statistically speaking, it is more likely that a VPN provider will be malicious or

His whole argument against VPN providers seems to depend on this statement: "Statistically speaking, it is more likely that a VPN provider will be malicious or a honeypot, than that an arbitrary generic VPS provider will be." But is that really true - how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?

Barrin92 9y ago
It isn't and it is horrible advice. Networks of trust are a real thing. It's like saying "don't trust any code you haven't audited yourself because they might lie to you and insert malicious code, just assume a priori that everybody scams you" which is obviously nonsensical because nobody would ever get any work done this way. A sane way to think about it is to make a judgement whether the business you trust has a solid track record, has market incentive to not screw you over, is transparent, is open source and whether your security demand is proportionate to what you're doing. The only major hickup seems to be the mentioned "HideMyAss" case, where a UK citizen was arrested on hacking charges facing 15 years in prison. Yes if you're trying to break into corporations and want to commit serious crimes don't trust a five dollar vpn provider legally registered in the same country. If you're trying to circumvent censorship or torrent a movie I think a regular VPN might still be an adequate choice
morganvachon 9y ago
> "how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?" I would assume that it's because they have no financial interest in the content of your traffic, whereas a VPN-specific service might. Most big VPS providers know that the bulk of their customers are technically minded people who read their own logs and monitor their own traffic, so there's no technical interest for them either. That said, if you end up abusing their terms (higher than allocated traffic or sustained heavy CPU time, for example), you can expect them to investigate if only to see if it's malicious in nature (DoS, spam, etc) or just a bad configuration. But again, those are just assumptions on my part. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit.
- Johnny555 9y ago
  But again, those are just assumptions on my part. Well yeah, that was the point of my comment -- it sounds like unsubstantiated opinion. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit. How is that even possible? Assuming you want to connect to the internet, you have to hand off your traffic to some upstream provider than you can't trust.
yjftsjthsd-h 9y ago
A guess: If random VPN service is doing something malicious to traffic, they won't get caught and nothing would happen if they did. If AWS/DO/gcloud do something malicious, one of the many very technical shops using them will notice, and the fallout would be epic. Now, "arbitrary generic VPS provider", maybe less so, but there are big names that are probably trustworthy in hosting.

Barrin92 9y ago

It isn't and it is horrible advice. Networks of trust are a real thing. It's like saying "don't trust any code you haven't audited yourself because they might lie to you and insert malicious code, just assume a priori that everybody scams you" which is obviously nonsensical because nobody would ever get any work done this way. A sane way to think about it is to make a judgement whether the business you trust has a solid track record, has market incentive to not screw you over, is transparent, is open source and whether your security demand is proportionate to what you're doing. The only major hickup seems to be the mentioned "HideMyAss" case, where a UK citizen was arrested on hacking charges facing 15 years in prison. Yes if you're trying to break into corporations and want to commit serious crimes don't trust a five dollar vpn provider legally registered in the same country. If you're trying to circumvent censorship or torrent a movie I think a regular VPN might still be an adequate choice

morganvachon 9y ago

> "how do I know that Linode, Bluehost, and other VPS providers aren't looking at my traffic?" I would assume that it's because they have no financial interest in the content of your traffic, whereas a VPN-specific service might. Most big VPS providers know that the bulk of their customers are technically minded people who read their own logs and monitor their own traffic, so there's no technical interest for them either. That said, if you end up abusing their terms (higher than allocated traffic or sustained heavy CPU time, for example), you can expect them to investigate if only to see if it's malicious in nature (DoS, spam, etc) or just a bad configuration. But again, those are just assumptions on my part. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit.

Johnny555 9y ago
But again, those are just assumptions on my part. Well yeah, that was the point of my comment -- it sounds like unsubstantiated opinion. If you have any doubt about a particular service, it's probably best to move on to one you can vet/audit. How is that even possible? Assuming you want to connect to the internet, you have to hand off your traffic to some upstream provider than you can't trust.

yjftsjthsd-h 9y ago

A guess: If random VPN service is doing something malicious to traffic, they won't get caught and nothing would happen if they did. If AWS/DO/gcloud do something malicious, one of the many very technical shops using them will notice, and the fallout would be epic. Now, "arbitrary generic VPS provider", maybe less so, but there are big names that are probably trustworthy in hosting.