5 ms·

VPN Extensions are not for privacy

94 points by EdOverflow 8y ago

superkuh 8y ago
They protect against ISPs. My ISP, Comcast, regularly and as part of it's policy performs man in the middle attacks on subscriber connections in order to insert malicious javascript into user requests from 3rd party websites. If hiding from your ISP is your threat model then a VPN is fine. It'd be better to use individual per-application tunnels though so you can still host servers with your ports locally and participate in the internet as an equal. Using a full VPN you rent prevents that.
- Wowfunhappy 8y ago
  > Comcast regularly and as part of it's policy performs man in the middle attacks on subscriber connections in order to insert malicious javascript into user requests from 3rd party websites. Wait what? This is the first I'm hearing about this!
  - pietroglyph 8y ago
    I think GP is referring to this: https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s... Comcast's behavior isn't exactly malicious right now, but it could be pretty easily.
    - superkuh 8y ago
      When it happened it broke websites' functionality (ie, it'd pop up in the Steam store browser and I'd be unable to close the pop-up within and have to start over). I even had it pop up between me and my bank website's non-HTTPS front page. They may have desired to notify me of things but it's obvious what would happen. Those who implemented this system were not ignorant. They were malicious. Those above them telling them to do so may have been just ignorant or stupid. These days I tunnel everything through one of my remote VPS.
  - elliekelly 8y ago
    It's nuts. And it's true. Link to previous thread on the topic: https://news.ycombinator.com/item?id=15890551 https://news.ycombinator.com/item?id=15890551 I found a github repo with the code once but I don't seem to have saved it. I'm sure it's on here somewhere though.
andreareina 8y ago
Getting a 503, here's an archive from a month ago: https://archive.is/pkeUI https://archive.is/pkeUI
- pcr0 8y ago
  That gives me an SSL error on both chrome and firefox.
  - chmod775 8y ago
    Please see my response here: https://news.ycombinator.com/item?id=18526184 https://news.ycombinator.com/item?id=18526184
- pmontra 8y ago
  > An error occurred during a connection to archive.is. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP
  - chmod775 8y ago
    A peer encountered that once too. Cloudflare DNS resolves archive.is to no-ecs.archive.is. If you have non-ECS ciphers disabled, you won't be able to access it while using CF DNS. Google DNS works correctly though.
    - pmontra 8y ago
      You're right. I can see the site from my laptop, which uses a different DNS. Anyway, this is Google's webcache of the original server https://webcache.googleusercontent.com/search?q=cache:CfxN6OtVlawJ:https://blog.innerht.ml/vpn-extensions-are-not-for-privacy/+&cd=1&hl=en&ct=clnk&gl=it https://webcache.googleusercontent.com/search?q=cache:CfxN6O...
    - arm 8y ago
      Also this: https://community.cloudflare.com/t/archive-is-error-1001/18227 https://community.cloudflare.com/t/archive-is-error-1001/182...
Jonnax 8y ago
I imagine the majority of people using web extensions for VPN are likely using them for watching blocked videos rather to hide. That's why I pay for a VPN service, to watch geo restricted YouTube videos. So to me it's as secure as a WiFi hotspot and that's alright.
- satysin 8y ago
  I bought a two year subscription to NordVPN a while back simply to use for - 1) Slightly better security/privacy using airport, cafe, etc. wifi 2) So I can watch iPlayer, YouTube etc. in different countries. Do Nord keep logs? Are they based in a five eyes country? I don't care to be honest. I don't use it to protect myself from that. I use it to get around stupid geo-retrictions and to make it hard for an attacker to intercept my data when I have to send an email at the airport. While on the subject I haven't had any issues with Nord, they are not the cheapest but no way near the most expensive either. Their iOS, Android, macOS and Windows apps are all very nice to use as well or you can do it manually with OpenVPN or whatever but that is more hassle that it is worth for me personally.
lazerwalker 8y ago
I can't read the original article, but I'd hope it has a rational discussion of threat models? I don't necessarily assume my VPN is 100% secure; I do trust a company that I pay money to more than I trust that nobody's sniffing my traffic at a rando coffee shop.
- jstanley 8y ago
  Why do you trust the VPN more than you trust Tor?
  - lazerwalker 8y ago
    Honestly? My VPN setup works for me, so I haven't particularly bothered to spend time investigating alternatives. It's not that I do or don't trust it more than Tor. That said, the few times in the far past I've tried to use Tor as a VPN, it's been slower and less reliable than the VPN I pay for (especially on my phone). Using a regular VPN also makes it easier for me to do things like spoof my country for region-locked services. (If I was going to bother making a change, it'd probably be to hosting my own VPN server on a VPS provider instead of specifically paying a VPN provider)
    - jstanley 8y ago
      Fair enough. For what it's worth, Tor does support choosing the country of your exit node, and is not as slow or unreliable as it has been in the past (although still not as fast as just using a VPS), but I watch YouTube over Tor without noticing anything unusual.
      - lazerwalker 8y ago
        To flip the question around: what benefits does Tor give me over my existing setup? I can see an ideological argument, and I can see the $5 or $10 a month savings, but — especially given my threat model is well enough served by a VPN — I'm curious if there are other practical benefits of Tor that might help overcome the obvious downsides (more complicated setup, slower)
choot 8y ago
Why not tor? Because it's slow and many website are block when i use tor.
- SlowRobotAhead 8y ago
  I’ve encountered some sites that block some VPNs, an obvious link with the number sites blocking to popularity increase. Odd sites you might not think of immediately, mouser.com for electronic components for example.
- goatsi 8y ago
  Depending on how popular (and cheap) your VPN is, you may find that many of it's IPs have just as nasty a reputation as Tor exit nodes do when you try and access services.
kibwen 8y ago
Note that you don't need an extension to proxy in Firefox, which has built-in support for SOCKS proxies (go to "Options" and search for "proxy"); all you need is an SSH client and a server that you can SSH into (`ssh -D 1234 foo@example.com`). I don't use it for privacy (rather, to prevent MITM on public networks), but it seems to avoid the pitfalls discussed in the article (e.g. does not allow split tunneling and DNS is resolved over the proxy). However, I suspect that if you were running a Flash or Java plugin then that could make network requests that bypass this proxy.
- badrabbit 8y ago
  Firefox has a checkbox to force DNS through the tunnel. Also,turn on dns over https in firefox and it won't do DNS lookups. I don't know if plugins are allowed to interface with host system's network stack,but if they're not then even plugins may not be able to bypass.
  - dylz 8y ago
    Plugins run through the host network stack. Ensure you disable java/flash/etc.
Mister_Snuggles 8y ago
If you want privacy, why not use a real VPN like IPSec or OpenVPN? Both work on every operating system and both are fairly easy, from the client perspective, to set up. If you want a VPN and are willing to pay a service provider for it, why would you not go this route? On the client side, configuring an IKEv1 VPN (IKEv2 doesn't support Split DNS yet) in MacOS, iOS, and Android is a piece of cake. You specify the server, username, password, and pre-shared key. Done. If you want to use a certificate instead of a pre-shared key it's a bit more work, but still do-able. With iOS devices you can provide a profile file that has all of the settings already baked in so it's even easier. OpenVPN is similar, though you need to install an OpenVPN client first.
- j88439h84 8y ago
  Where do you run the server?
  - Mister_Snuggles 8y ago
    I don't understand the question. With a use-case of "I'm paying a 3rd-party to secure my traffic", which matches what these "VPN" extensions claim to provide, then the answer is simply "Wherever the 3rd-party runs it".
kbuck 8y ago
I deal with a lot of abuse originating from "VPN" browser extensions. I've spent a lot of time looking at how they operate. A surprising number of these are implemented as open HTTPS proxies. You don't even need the extension installed to use the proxy, nor any kind of authentication. The extension just fetches a list of proxies that the company has configured and picks one. The free ones are rather questionable. For example, Hola makes your computer part of an expensive VPN service (sold under a different name) aimed at bypassing IP bans[0]. On some the free tier is made so inconvenient that you will almost have to subscribe to the paid tier if you're using it legitimately (but it's usually usable if you just want to get around some ban). There used to be some ad-supported VPN providers, which would ironically trade away all of the privacy you'd normally otherwise get by using a VPN, making them only useful for ban/block evasion. These have mostly died out now that ads == tracking is common knowledge[1], but I'm still very suspicious of "free" providers that offer generous access without payment. It's difficult to prove that logs aren't collected, and they could just as easily be collecting and selling user logs. If you're in the market for a VPN, pick a reputable provider that has no free tier (you should make sure that you are the customer and not the product), and ideally one that also provides actual VPN servers and not just a browser extension that connects to proxies. Another good option is to set one up yourself using a cheap VPS. [0]: http://adios-hola.org/ http://adios-hola.org/ [1]: https://blog.cyberghostvpn.com/en/ending-free-version-cyberghost-vpn/ https://blog.cyberghostvpn.com/en/ending-free-version-cyberg...
- ikeboy 8y ago
  Using your own VPS isn't helpful for privacy because it can be traced back to you after the fact, while a paid VPN that doesn't log cannot
- dgzl 8y ago
  I wonder if there's a system we could create that features guaranteed transparency of host's actions during your VPN session.
  - brokenmachine 8y ago
    I don't know how that would work but it's interesting to think about. I don't think it would be possible if you're depending on a single entity? I don't see a way a provider would be able to prove they are not logging connections, for example.

94 points by EdOverflow 8y ago

They protect against ISPs. My ISP, Comcast, regularly and as part of it's policy performs man in the middle attacks on subscriber connections in order to insert malicious javascript into user requests from 3rd party websites. If hiding from your ISP is your threat model then a VPN is fine. It'd be better to use individual per-application tunnels though so you can still host servers with your ports locally and participate in the internet as an equal. Using a full VPN you rent prevents that.

Wowfunhappy 8y ago
> Comcast regularly and as part of it's policy performs man in the middle attacks on subscriber connections in order to insert malicious javascript into user requests from 3rd party websites. Wait what? This is the first I'm hearing about this!
- pietroglyph 8y ago
  I think GP is referring to this: https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s... Comcast's behavior isn't exactly malicious right now, but it could be pretty easily.
  - superkuh 8y ago
    When it happened it broke websites' functionality (ie, it'd pop up in the Steam store browser and I'd be unable to close the pop-up within and have to start over). I even had it pop up between me and my bank website's non-HTTPS front page. They may have desired to notify me of things but it's obvious what would happen. Those who implemented this system were not ignorant. They were malicious. Those above them telling them to do so may have been just ignorant or stupid. These days I tunnel everything through one of my remote VPS.
- elliekelly 8y ago
  It's nuts. And it's true. Link to previous thread on the topic: https://news.ycombinator.com/item?id=15890551 https://news.ycombinator.com/item?id=15890551 I found a github repo with the code once but I don't seem to have saved it. I'm sure it's on here somewhere though.

andreareina 8y ago

Getting a 503, here's an archive from a month ago: https://archive.is/pkeUI https://archive.is/pkeUI

pcr0 8y ago
That gives me an SSL error on both chrome and firefox.
- chmod775 8y ago
  Please see my response here: https://news.ycombinator.com/item?id=18526184 https://news.ycombinator.com/item?id=18526184
pmontra 8y ago
> An error occurred during a connection to archive.is. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP
- chmod775 8y ago
  A peer encountered that once too. Cloudflare DNS resolves archive.is to no-ecs.archive.is. If you have non-ECS ciphers disabled, you won't be able to access it while using CF DNS. Google DNS works correctly though.
  - pmontra 8y ago
    You're right. I can see the site from my laptop, which uses a different DNS. Anyway, this is Google's webcache of the original server https://webcache.googleusercontent.com/search?q=cache:CfxN6OtVlawJ:https://blog.innerht.ml/vpn-extensions-are-not-for-privacy/+&cd=1&hl=en&ct=clnk&gl=it https://webcache.googleusercontent.com/search?q=cache:CfxN6O...
  - arm 8y ago
    Also this: https://community.cloudflare.com/t/archive-is-error-1001/18227 https://community.cloudflare.com/t/archive-is-error-1001/182...

Jonnax 8y ago

I imagine the majority of people using web extensions for VPN are likely using them for watching blocked videos rather to hide. That's why I pay for a VPN service, to watch geo restricted YouTube videos. So to me it's as secure as a WiFi hotspot and that's alright.

satysin 8y ago
I bought a two year subscription to NordVPN a while back simply to use for - 1) Slightly better security/privacy using airport, cafe, etc. wifi 2) So I can watch iPlayer, YouTube etc. in different countries. Do Nord keep logs? Are they based in a five eyes country? I don't care to be honest. I don't use it to protect myself from that. I use it to get around stupid geo-retrictions and to make it hard for an attacker to intercept my data when I have to send an email at the airport. While on the subject I haven't had any issues with Nord, they are not the cheapest but no way near the most expensive either. Their iOS, Android, macOS and Windows apps are all very nice to use as well or you can do it manually with OpenVPN or whatever but that is more hassle that it is worth for me personally.

lazerwalker 8y ago

I can't read the original article, but I'd hope it has a rational discussion of threat models? I don't necessarily assume my VPN is 100% secure; I do trust a company that I pay money to more than I trust that nobody's sniffing my traffic at a rando coffee shop.

jstanley 8y ago
Why do you trust the VPN more than you trust Tor?
- lazerwalker 8y ago
  Honestly? My VPN setup works for me, so I haven't particularly bothered to spend time investigating alternatives. It's not that I do or don't trust it more than Tor. That said, the few times in the far past I've tried to use Tor as a VPN, it's been slower and less reliable than the VPN I pay for (especially on my phone). Using a regular VPN also makes it easier for me to do things like spoof my country for region-locked services. (If I was going to bother making a change, it'd probably be to hosting my own VPN server on a VPS provider instead of specifically paying a VPN provider)
  - jstanley 8y ago
    Fair enough. For what it's worth, Tor does support choosing the country of your exit node, and is not as slow or unreliable as it has been in the past (although still not as fast as just using a VPS), but I watch YouTube over Tor without noticing anything unusual.
    - lazerwalker 8y ago
      To flip the question around: what benefits does Tor give me over my existing setup? I can see an ideological argument, and I can see the $5 or $10 a month savings, but — especially given my threat model is well enough served by a VPN — I'm curious if there are other practical benefits of Tor that might help overcome the obvious downsides (more complicated setup, slower)

choot 8y ago

Why not tor? Because it's slow and many website are block when i use tor.

SlowRobotAhead 8y ago
I’ve encountered some sites that block some VPNs, an obvious link with the number sites blocking to popularity increase. Odd sites you might not think of immediately, mouser.com for electronic components for example.
goatsi 8y ago
Depending on how popular (and cheap) your VPN is, you may find that many of it's IPs have just as nasty a reputation as Tor exit nodes do when you try and access services.

kibwen 8y ago

Note that you don't need an extension to proxy in Firefox, which has built-in support for SOCKS proxies (go to "Options" and search for "proxy"); all you need is an SSH client and a server that you can SSH into (`ssh -D 1234 foo@example.com`). I don't use it for privacy (rather, to prevent MITM on public networks), but it seems to avoid the pitfalls discussed in the article (e.g. does not allow split tunneling and DNS is resolved over the proxy). However, I suspect that if you were running a Flash or Java plugin then that could make network requests that bypass this proxy.

badrabbit 8y ago
Firefox has a checkbox to force DNS through the tunnel. Also,turn on dns over https in firefox and it won't do DNS lookups. I don't know if plugins are allowed to interface with host system's network stack,but if they're not then even plugins may not be able to bypass.
- dylz 8y ago
  Plugins run through the host network stack. Ensure you disable java/flash/etc.

Mister_Snuggles 8y ago

If you want privacy, why not use a real VPN like IPSec or OpenVPN? Both work on every operating system and both are fairly easy, from the client perspective, to set up. If you want a VPN and are willing to pay a service provider for it, why would you not go this route? On the client side, configuring an IKEv1 VPN (IKEv2 doesn't support Split DNS yet) in MacOS, iOS, and Android is a piece of cake. You specify the server, username, password, and pre-shared key. Done. If you want to use a certificate instead of a pre-shared key it's a bit more work, but still do-able. With iOS devices you can provide a profile file that has all of the settings already baked in so it's even easier. OpenVPN is similar, though you need to install an OpenVPN client first.

j88439h84 8y ago
Where do you run the server?
- Mister_Snuggles 8y ago
  I don't understand the question. With a use-case of "I'm paying a 3rd-party to secure my traffic", which matches what these "VPN" extensions claim to provide, then the answer is simply "Wherever the 3rd-party runs it".

kbuck 8y ago

I deal with a lot of abuse originating from "VPN" browser extensions. I've spent a lot of time looking at how they operate. A surprising number of these are implemented as open HTTPS proxies. You don't even need the extension installed to use the proxy, nor any kind of authentication. The extension just fetches a list of proxies that the company has configured and picks one. The free ones are rather questionable. For example, Hola makes your computer part of an expensive VPN service (sold under a different name) aimed at bypassing IP bans[0]. On some the free tier is made so inconvenient that you will almost have to subscribe to the paid tier if you're using it legitimately (but it's usually usable if you just want to get around some ban). There used to be some ad-supported VPN providers, which would ironically trade away all of the privacy you'd normally otherwise get by using a VPN, making them only useful for ban/block evasion. These have mostly died out now that ads == tracking is common knowledge[1], but I'm still very suspicious of "free" providers that offer generous access without payment. It's difficult to prove that logs aren't collected, and they could just as easily be collecting and selling user logs. If you're in the market for a VPN, pick a reputable provider that has no free tier (you should make sure that you are the customer and not the product), and ideally one that also provides actual VPN servers and not just a browser extension that connects to proxies. Another good option is to set one up yourself using a cheap VPS. [0]: http://adios-hola.org/ http://adios-hola.org/ [1]: https://blog.cyberghostvpn.com/en/ending-free-version-cyberghost-vpn/ https://blog.cyberghostvpn.com/en/ending-free-version-cyberg...

ikeboy 8y ago
Using your own VPS isn't helpful for privacy because it can be traced back to you after the fact, while a paid VPN that doesn't log cannot
dgzl 8y ago
I wonder if there's a system we could create that features guaranteed transparency of host's actions during your VPN session.
- brokenmachine 8y ago
  I don't know how that would work but it's interesting to think about. I don't think it would be possible if you're depending on a single entity? I don't see a way a provider would be able to prove they are not logging connections, for example.