5 ms·

It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care les

It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local network or ISP.

dguido 8y ago
Hello, I am the original author of Algo. This is 100% correct and I am glad that people understand the goals of the project. Please use Algo to keep communications secure.
auslander 8y ago
Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.
- JshWright 8y ago
  That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
  - auslander 8y ago
    > That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will, because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thousands, and not from my personal ISP IP.
    - harshreality 8y ago
      Where would your VPN be? What makes you think the government doesn't monitor traffic flows there? They don't even need to monitor traffic flows at your home's ISP, since they can see both legs of the connection just by watching the network your VPN server is on. If you're in a FVEY country, you can't count on any real network metadata privacy protection (against your own country's government) for near-realtime communication. Multiple hops (e.g. tor) makes it more difficult for them, but also makes your internet connection slow and unreliable, and your traffic becomes even higher priority for them to investigate; if they happen to have flow data on each of the nodes you use, you're probably unmasked.
      - auslander 8y ago
        > your traffic becomes even higher priority for them to investigate You use tor, your ISP marks it, it triggers priority for them to investigate you. You use VPN to access tor, it triggers nothing.
        azinman2 8y ago
        Evidence?
mindslight 8y ago
Let's not make a false dichotomy between privacy and security. Privacy is an integral part of security - https://news.ycombinator.com/item?id=17763324 https://news.ycombinator.com/item?id=17763324 The real quality to discuss is threat models. Even using a public-mix VPN is not going to protect against Klein-style wholesale tapping (due to packet correlation). Using your own VPN to exit will not protect against legal attacks (subscriber info will still be subpoenaed). But either will protect against revealing (to every service you connect to) your roaming between access networks - eg the discovery of who is friends from their connecting to the same WiFi. (Also, distinguishing between "government" and "commercial" surveillance is a bit of a red herring as well. Much government surveillance is done by the "private" sector, which the government at least then buys fulls access to, if it doesn't constitute a de facto government on its own - eg credit bureaus in the US)

dguido 8y ago

Hello, I am the original author of Algo. This is 100% correct and I am glad that people understand the goals of the project. Please use Algo to keep communications secure.

auslander 8y ago

Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.

JshWright 8y ago
That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
- auslander 8y ago
  > That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will, because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thousands, and not from my personal ISP IP.
  - harshreality 8y ago
    Where would your VPN be? What makes you think the government doesn't monitor traffic flows there? They don't even need to monitor traffic flows at your home's ISP, since they can see both legs of the connection just by watching the network your VPN server is on. If you're in a FVEY country, you can't count on any real network metadata privacy protection (against your own country's government) for near-realtime communication. Multiple hops (e.g. tor) makes it more difficult for them, but also makes your internet connection slow and unreliable, and your traffic becomes even higher priority for them to investigate; if they happen to have flow data on each of the nodes you use, you're probably unmasked.
    - auslander 8y ago
      > your traffic becomes even higher priority for them to investigate You use tor, your ISP marks it, it triggers priority for them to investigate you. You use VPN to access tor, it triggers nothing.
      - azinman2 8y ago
        Evidence?

mindslight 8y ago

Let's not make a false dichotomy between privacy and security. Privacy is an integral part of security - https://news.ycombinator.com/item?id=17763324 https://news.ycombinator.com/item?id=17763324 The real quality to discuss is threat models. Even using a public-mix VPN is not going to protect against Klein-style wholesale tapping (due to packet correlation). Using your own VPN to exit will not protect against legal attacks (subscriber info will still be subpoenaed). But either will protect against revealing (to every service you connect to) your roaming between access networks - eg the discovery of who is friends from their connecting to the same WiFi. (Also, distinguishing between "government" and "commercial" surveillance is a bit of a red herring as well. Much government surveillance is done by the "private" sector, which the government at least then buys fulls access to, if it doesn't constitute a de facto government on its own - eg credit bureaus in the US)