5 ms·

>All [vpn] providers listed here are outside the US, use encryption, accept Bitcoin, support OpenVPN and have a no logging policy. Yes but how does the average

by jasode 8y ago

>All [vpn] providers listed here are outside the US, use encryption, accept Bitcoin, support OpenVPN and have a no logging policy. Yes but how does the average person really know if those suggested foreign VPNs are not CIA or other government coordinated honeypots? In terms of cyberspace cat & mouse games, I think VPNs can be useful to evade Netflix streaming restrictions to particular countries or to hide your DNS queries from your ISP. You don't need a lot of trust in VPN entities to evade commercial businesses. However, using VPNs to evade government surveillance is a whole different ballgame. Because of the far reaching tentacles of government agencies, there's no reliable method to determine which VPN to trust.

DyslexicAtheist 8y ago
exactly. it just shifts the trust from your ISP to the VPN (who ironically even has your credit card info in many cases ...). even Verizon now peddles VPN services to take their slice of the privacy snake-oil market https://www.verizonwireless.com/biz/security/wireless-private-network-vpn/ https://www.verizonwireless.com/biz/security/wireless-privat...
- reshie 8y ago
  many accept bitcoin. as you say though it all comes to trust.
  - IggleSniggle 8y ago
    Bitcoin is not private. It is, in fact, a PUBLIC LEDGER, and at some point, most folks want to either convert to or from bitcoin to a government backed currency. Sure, you could argue that the transaction could be laundered, but no more than any other transaction could be laundered, so then you need to compare whether it is more or less private than other transactions internally. I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger.
    - spurgu 8y ago
      Still less transparent and offers _some_ plausible deniability, unless you're tumbling the coins. Monero or some other privacy focused coin would be better. Disclaimer: Not an expert.
    - reshie 8y ago
      its just a number. its not necissary tied to you and no attached name unless you advertise. there are ways of tracking it and asserting identity but their are counter measures as well. you could of course buy prepaid credit cards to a simmilar effect and that transaction could of course be tracked but as long as it was cash(though there may be video footage of the teller and time) though this goes more into posible crime than just privacy minded if they investigate that far.
      - DyslexicAtheist 8y ago
        yeah taking it out is a major obstacle unless you're prepared to wear a crash helmet or some other type of face concealment. When serious crime is involved you'd have to worry about CCTV on your way to the dispenser too. But set-up and transactions an be fully concealed with hardware compartmentalization, anonymous sims etc
    - LMYahooTFY 8y ago
      "I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger." You don't have to provide personally identifiable data to transact. As far as I can tell, this is not achievable digitally with any traditional currencies. Yes it requires connectivity that might yield personally identifiable data, just like every other method of connectivity via the internet.
      - freeflight 8y ago
        > As far as I can tell, this is not achievable digitally with any traditional currencies. Paysafecard [0] does exactly that with traditional currencies. I can buy those with cash, even at gas stations, and use them to pay online without ever sharing my personal details with anybody. [0] https://en.wikipedia.org/wiki/Paysafecard https://en.wikipedia.org/wiki/Paysafecard
  - ionised 8y ago
    A few accept cash in the post.
- LeftTurnSignal 8y ago
  The argument I use when someone asks me about paying and trusting non-US based VPN providers is this: I trust the VPN providers much more than any ISP I have available to me. That is all. I still don't trust the VPNs for super sensitive stuff. For that I'll setup my own somewhere.
jstanley 8y ago
I don't think there's any privacy advantage of using a VPN over Tor. Tor is basically a free VPN that's more anonymous.
- jstarfish 8y ago
  Using a VPN over Tor does the opposite of granting privacy. If that VPN provider is compromised, Tor gave you no additional protection, just a shittier internet connection while you sent all your traffic to a compromised endpoint over an encrypted channel. Using Tor over a VPN, it doesn't matter as much if the VPN provider is compromised-- your traffic is still scattered and encrypted by means of Tor itself. Based on traffic analysis you can be identified either way so I can't speak to how well this holds up to hostile governments but in such cases the former is an amateur mistake likely to lead to your disappearance. The latter gives you more of a fighting chance.
  - BostonEnginerd 8y ago
    I believe that Jstanley was saying exactly that — I read that as he doesn’t see any advantage for the use of a VPN ‘instead’ of just using Tor. John
nabla9 8y ago
Privacy is not one dimensional issue. Improving privacy towards some goal may reduce privacy against some other goal. For example: Mass surveillance and targeted surveillance are different privacy scenarios. Mass surveillance becomes ineffective when it becomes too expensive to identify people in the large scale even if they are not secure against targeted surveillance. If CIA mass surveillance is your concern, good VPN, Tor and other privacy tools puts you into their radar faster than buying second laptop to do your private stuff without any privacy tools. Targeting and deanonymizing just just few million privacy conscious people using Tor justifies more work per user than large scale mass surveillance of billion people. Anyone using Tor or good VPN will be be in the much smaller pool of users who CIA/NSA may not be able to identify quickly but who they are interested in knowing better. If you want to avoid Facebook and other commercial trackers, VPN combined with good tools goes a long way.
rsync 8y ago
"there's no reliable method to determine which VPN to trust. " I would suggest there is no inexpensive and reliable method to determine which VPN to trust. I generally think that designing against state level adversaries is a fools errand but if one went down that road, placing a hardware device that you own into a non-shared rack that you pay for inside a United States datacenter would be a very good start. Now the complaints / warrants / letters come to you and it is your prerogative to respond as you see fit. Further, the uptime and tamper-resistance of your systems are under your own control.
- freeflight 8y ago
  > placing a hardware device that you own into a non-shared rack that you pay for inside a United States datacenter would be a very good start. Why even bother a non-shared rack when you can't even guarantee the physical security of your hardware in the first place, as you've outsourced all that responsibility to a third party, the datacenter?
  - rsync 8y ago
    Because when you have your own rack you can put arbitrary devices and safeguards into and on it. So you're right - the datacenter can open and close and tamper with the rack as they see fit - but I can notify myself of that and even video record it. Interruption of the physical monitoring would be itself a signal. I've never done this, but I have placed many strange and arbitrary devices within, and on top of, racks I have leased and nobody notices or cares unless you're a nuisance somehow.
  - aaron_m04 8y ago
    Since we are no longer ruling out expensive solutions, we'll just have our own chip foundry using open source IP cores and cameras everywhere.
dgzl 8y ago
> Yes but how does the average person really know if those suggested foreign VPNs are not CIA or other government coordinated honeypots? > there's no reliable method to determine which VPN to trust. I'll offer a method, people can agree or deny if they like... Why don't we just extend the transparency to the creators, developers and hosts? As in, the people central to the operation of the VPN give up a percentage of their privacy in order to gain public trust. For example, it's well known that developer Bob eats and drinks at this pub house on Fridays, and welcomes chat from his customers. It's also known that he takes MMA classes twice a week, and likes to attend the local ballgame. We know and trust Bob because he's part of our daily life. I'm sure an undercover operative can navigate this scenario (and that's true regardless of the subject), but the lives of an entire team of developers would be difficult to fake. > Inb4 remote work, difficult to arrange I'm wondering if this is actually a beneficial use of a "social score" type of system. If a person has the social "proof" that they are indeed Bob the software builder instead of Bøb, FBI#1337, then this question of authenticity might not be needed. Bonus thought: I would imagine the global superpowers are trying to hack China's social scoring system via undercover agents. I'm not sure about the program's details, but surely it has weaknesses.

by jasode 8y ago

DyslexicAtheist 8y ago

exactly. it just shifts the trust from your ISP to the VPN (who ironically even has your credit card info in many cases ...). even Verizon now peddles VPN services to take their slice of the privacy snake-oil market https://www.verizonwireless.com/biz/security/wireless-private-network-vpn/ https://www.verizonwireless.com/biz/security/wireless-privat...

reshie 8y ago
many accept bitcoin. as you say though it all comes to trust.
- IggleSniggle 8y ago
  Bitcoin is not private. It is, in fact, a PUBLIC LEDGER, and at some point, most folks want to either convert to or from bitcoin to a government backed currency. Sure, you could argue that the transaction could be laundered, but no more than any other transaction could be laundered, so then you need to compare whether it is more or less private than other transactions internally. I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger.
  - spurgu 8y ago
    Still less transparent and offers _some_ plausible deniability, unless you're tumbling the coins. Monero or some other privacy focused coin would be better. Disclaimer: Not an expert.
  - reshie 8y ago
    its just a number. its not necissary tied to you and no attached name unless you advertise. there are ways of tracking it and asserting identity but their are counter measures as well. you could of course buy prepaid credit cards to a simmilar effect and that transaction could of course be tracked but as long as it was cash(though there may be video footage of the teller and time) though this goes more into posible crime than just privacy minded if they investigate that far.
    - DyslexicAtheist 8y ago
      yeah taking it out is a major obstacle unless you're prepared to wear a crash helmet or some other type of face concealment. When serious crime is involved you'd have to worry about CCTV on your way to the dispenser too. But set-up and transactions an be fully concealed with hardware compartmentalization, anonymous sims etc
  - LMYahooTFY 8y ago
    "I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger." You don't have to provide personally identifiable data to transact. As far as I can tell, this is not achievable digitally with any traditional currencies. Yes it requires connectivity that might yield personally identifiable data, just like every other method of connectivity via the internet.
    - freeflight 8y ago
      > As far as I can tell, this is not achievable digitally with any traditional currencies. Paysafecard [0] does exactly that with traditional currencies. I can buy those with cash, even at gas stations, and use them to pay online without ever sharing my personal details with anybody. [0] https://en.wikipedia.org/wiki/Paysafecard https://en.wikipedia.org/wiki/Paysafecard
- ionised 8y ago
  A few accept cash in the post.
LeftTurnSignal 8y ago
The argument I use when someone asks me about paying and trusting non-US based VPN providers is this: I trust the VPN providers much more than any ISP I have available to me. That is all. I still don't trust the VPNs for super sensitive stuff. For that I'll setup my own somewhere.

jstanley 8y ago

I don't think there's any privacy advantage of using a VPN over Tor. Tor is basically a free VPN that's more anonymous.

jstarfish 8y ago
Using a VPN over Tor does the opposite of granting privacy. If that VPN provider is compromised, Tor gave you no additional protection, just a shittier internet connection while you sent all your traffic to a compromised endpoint over an encrypted channel. Using Tor over a VPN, it doesn't matter as much if the VPN provider is compromised-- your traffic is still scattered and encrypted by means of Tor itself. Based on traffic analysis you can be identified either way so I can't speak to how well this holds up to hostile governments but in such cases the former is an amateur mistake likely to lead to your disappearance. The latter gives you more of a fighting chance.
- BostonEnginerd 8y ago
  I believe that Jstanley was saying exactly that — I read that as he doesn’t see any advantage for the use of a VPN ‘instead’ of just using Tor. John

nabla9 8y ago

Privacy is not one dimensional issue. Improving privacy towards some goal may reduce privacy against some other goal. For example: Mass surveillance and targeted surveillance are different privacy scenarios. Mass surveillance becomes ineffective when it becomes too expensive to identify people in the large scale even if they are not secure against targeted surveillance. If CIA mass surveillance is your concern, good VPN, Tor and other privacy tools puts you into their radar faster than buying second laptop to do your private stuff without any privacy tools. Targeting and deanonymizing just just few million privacy conscious people using Tor justifies more work per user than large scale mass surveillance of billion people. Anyone using Tor or good VPN will be be in the much smaller pool of users who CIA/NSA may not be able to identify quickly but who they are interested in knowing better. If you want to avoid Facebook and other commercial trackers, VPN combined with good tools goes a long way.

rsync 8y ago

"there's no reliable method to determine which VPN to trust. " I would suggest there is no inexpensive and reliable method to determine which VPN to trust. I generally think that designing against state level adversaries is a fools errand but if one went down that road, placing a hardware device that you own into a non-shared rack that you pay for inside a United States datacenter would be a very good start. Now the complaints / warrants / letters come to you and it is your prerogative to respond as you see fit. Further, the uptime and tamper-resistance of your systems are under your own control.

freeflight 8y ago
> placing a hardware device that you own into a non-shared rack that you pay for inside a United States datacenter would be a very good start. Why even bother a non-shared rack when you can't even guarantee the physical security of your hardware in the first place, as you've outsourced all that responsibility to a third party, the datacenter?
- rsync 8y ago
  Because when you have your own rack you can put arbitrary devices and safeguards into and on it. So you're right - the datacenter can open and close and tamper with the rack as they see fit - but I can notify myself of that and even video record it. Interruption of the physical monitoring would be itself a signal. I've never done this, but I have placed many strange and arbitrary devices within, and on top of, racks I have leased and nobody notices or cares unless you're a nuisance somehow.
- aaron_m04 8y ago
  Since we are no longer ruling out expensive solutions, we'll just have our own chip foundry using open source IP cores and cameras everywhere.

dgzl 8y ago

> Yes but how does the average person really know if those suggested foreign VPNs are not CIA or other government coordinated honeypots? > there's no reliable method to determine which VPN to trust. I'll offer a method, people can agree or deny if they like... Why don't we just extend the transparency to the creators, developers and hosts? As in, the people central to the operation of the VPN give up a percentage of their privacy in order to gain public trust. For example, it's well known that developer Bob eats and drinks at this pub house on Fridays, and welcomes chat from his customers. It's also known that he takes MMA classes twice a week, and likes to attend the local ballgame. We know and trust Bob because he's part of our daily life. I'm sure an undercover operative can navigate this scenario (and that's true regardless of the subject), but the lives of an entire team of developers would be difficult to fake. > Inb4 remote work, difficult to arrange I'm wondering if this is actually a beneficial use of a "social score" type of system. If a person has the social "proof" that they are indeed Bob the software builder instead of Bøb, FBI#1337, then this question of authenticity might not be needed. Bonus thought: I would imagine the global superpowers are trying to hack China's social scoring system via undercover agents. I'm not sure about the program's details, but surely it has weaknesses.