4 ms·

> You're also leaking your IP address to any website you visit. As opposed to leaking your VPN's IP address, which is about as meaningful. > You're also trust

> You're also leaking your IP address to any website you visit. As opposed to leaking your VPN's IP address, which is about as meaningful. > You're also trusting any other networks that you connect to when you open up your laptop in a coffee shop or hotel room not to have a sniffer sitting on them. True. Which is why a personal VPN to your home network is useful. > You're trusting tons of faceless organizations across the entire chain of you to the website you visit to be safe with your data. The connection from the VPN provider still goes through a similar chain. It's true that the chain will be substantially different if you, say, connect to a service in the US from the UK via an Australian VPN service. On the other hand, the chain will be way longer if you use that Australian VPN to look up your local pizza place's menu.

danShumway 8y ago
> As opposed to leaking your VPN's IP address, which is about as meaningful. Unless you're very lucky with providers, your local IP address is good enough for me to get at least your zip code, and if you're particularly unlucky with your provider/network setup there are theoretical attacks that can be used to get even closer to your physical location[0]. By comparison, the closest VPN address to my physical location is in a different state. That really matters if you care about privacy -- without a VPN you are broadcasting your current town to literally every single site you visit. > The connection from the VPN provider still goes through a similar chain. But when it goes through that chain, the request is sent from the VPN provider, not from your own IP address, which is significantly more unique and easier to track, even if you've taken steps to block browser fingerprinting. Request aggregation is by no means a perfect defense against tracking, but it is significantly better than not aggregating requests. > Which is why a personal VPN to your home network is useful. Granted. If you've set up a personal VPN to your home network and you're maintaining your own server to make that work, that'll protect you when you browse at a coffee shop. It's also a lot more work for the average user (it's certainly not a viable substitute for what Firefox is doing here), and if done incorrectly a home VPN can make your network vulnerable to attacks because it forces you to open ports. So my suggestion if you're going down that route would be to buy a 3rd-party server on something like Linode and set up your VPN there. That way a poorly configured server won't make your home network vulnerable. That will also protect you from at least the geolocation attacks I mentioned above. You won't have the advantage of sharing an IP with other people, but I can see that being an acceptable tradeoff for people who want more control. At that point though, you've basically just rolled your own private VPN provider. You can debate whether or not it's better to roll your own provider or use an existing provider, but in either case, you're still using a VPN. Because VPNs are strict upgrade to network security for most people. [0]: https://arstechnica.com/tech-policy/2011/04/getting-warmer-an-ip-address-can-map-you-within-half-a-mile/ https://arstechnica.com/tech-policy/2011/04/getting-warmer-a...

danShumway 8y ago

> As opposed to leaking your VPN's IP address, which is about as meaningful. Unless you're very lucky with providers, your local IP address is good enough for me to get at least your zip code, and if you're particularly unlucky with your provider/network setup there are theoretical attacks that can be used to get even closer to your physical location[0]. By comparison, the closest VPN address to my physical location is in a different state. That really matters if you care about privacy -- without a VPN you are broadcasting your current town to literally every single site you visit. > The connection from the VPN provider still goes through a similar chain. But when it goes through that chain, the request is sent from the VPN provider, not from your own IP address, which is significantly more unique and easier to track, even if you've taken steps to block browser fingerprinting. Request aggregation is by no means a perfect defense against tracking, but it is significantly better than not aggregating requests. > Which is why a personal VPN to your home network is useful. Granted. If you've set up a personal VPN to your home network and you're maintaining your own server to make that work, that'll protect you when you browse at a coffee shop. It's also a lot more work for the average user (it's certainly not a viable substitute for what Firefox is doing here), and if done incorrectly a home VPN can make your network vulnerable to attacks because it forces you to open ports. So my suggestion if you're going down that route would be to buy a 3rd-party server on something like Linode and set up your VPN there. That way a poorly configured server won't make your home network vulnerable. That will also protect you from at least the geolocation attacks I mentioned above. You won't have the advantage of sharing an IP with other people, but I can see that being an acceptable tradeoff for people who want more control. At that point though, you've basically just rolled your own private VPN provider. You can debate whether or not it's better to roll your own provider or use an existing provider, but in either case, you're still using a VPN. Because VPNs are strict upgrade to network security for most people. [0]: https://arstechnica.com/tech-policy/2011/04/getting-warmer-an-ip-address-can-map-you-within-half-a-mile/ https://arstechnica.com/tech-policy/2011/04/getting-warmer-a...