25 ms·
The rationale stated for this work is preventing ISPs from being able to monitor and potentially sell information about Internet usage, which is reasonable and
by oil25 7y ago
The rationale stated for this work is preventing ISPs from being able to monitor and potentially sell information about Internet usage, which is reasonable and worthwhile. But by hosting a VPN with a third party, haven't we simply reassigned the same responsibility to someone else rather than absolve it? Is Digital Ocean more trustworthy than, say Cox Communications? How is this risk to be calculated, especially by a layperson?
I believe low-latency anonymizing networks like Tor might be a better more suited for accomplishing the task of obscuring one's own network traffic. In fact, I'm typing this comment from Firefox with uBlock Origin configured to use a Tor SOCKS proxy which is always running locally - eliminating ads and making little attributable netflow in my wake.
- miloignis 7y agoGenerally, I do trust the big VPS providers much more than my local ISP.
- yjftsjthsd-h 7y ago> Is Digital Ocean more trustworthy than, say Cox Communications? Dunno about Cox, but I promise you I trust Digital Ocean far more than I will ever trust Comcast or AT&T. Even if they didn't have a history of being bad actors (and they do), a lot of people have exactly one choice of ISP but dozens of choices for hosting in the cloud, so the incentives are much more favorable.
- leetbulb 7y agoMost of these residential ISPs that people hate are also major (T1/T2) upstream providers for companies like DO. If not already, at some point, these providers are going to just sniff VPN traffic straight off of their backbones. Say your ISP is Comcast... If Comcast knows your are connected to some VPS via VPN, it's likely that anything coming out of that VPN is yours. And if Comcast (or some subsidiary or partner) is also the upstream provider for that VPS, they could pretty easily make some correlations.
- davidu 7y agoThis isn't really true. The wholesale networks are operating at speeds that make this kind of sniffing impractical. I'm not saying they don't ever siphon traffic for LEO or other reasons, but not for privacy-violating/ad-targeting reasons. DO probably is running 40gbps alone with each transit provider, plus sending traffic over peering circuits, so it's just way less practical. So what you are suggesting isn't actually true, and it's hardly hypothetically even possible.
- leetbulb 7y agoTotally agree and I considered the shear throughput making it impractical. And while it's impractical, my point is that it's still possible, and maybe even practical in the future.
- kingosticks 7y agoMaybe I misunderstand by why is this considered impossible? Network processors read data from a packet, make decisions based on that, and then rewrite arbitrary parts of the packet. All on the fast path. This sounds doable if you had the custom firmware that did that. It'd just be a huge waste of money considering your very, very expensive network box.
- kingosticks 7y agoAhh so maybe it's because the packet, once out of the VPN and heading to it's destination, is (normally - it is 2019 after all!) TLS encrypted so you can't just modify the payload like I said. Fair enough.
- stjohnswarts 7y agoI'm counting on greed. We know their business model depends on money from people who at least think they're not selling their traffic info. One bad rumor and evidence that they're selling the info to google and their business is dead.
- jtbayly 7y agoIsn't the traffic into your virtual server at Digital Ocean encrypted? Would the concern be the outgoing traffic?
- Nextgrid 7y agoYep the concern would be the outgoing traffic.
- swebs 7y agoAnyone is more trustworthy than Comcast, who has been proven to abuse MitM attacks.
- chewz 7y agoYour private traffic via VPN is a drop in an ocean of server traffic so there is little incentive for VPS in attempt to identify it and monetize it. But it is significant revenue opportunity for ISPs serving households.
- rurp 7y agoBased on my own experience, having dealt with both companies a fair amount, I trust Digital Ocean to be vastly more competent than Cox. That doesn't stop DO from doing something nefarious, but negligence and incompetence probably account for more data breeches than any other cause.
- reshie 7y agoin many places isp's have a monopoly whereas with vpn's you can always move to another. im with you with tor but it is slow.
- Fnoord 7y agoI connect my mobile clients (smartphone, MBP, ...) via WireGuard through my router. You never know what WLAN or mobile network you're on. The router serves Pi-Hole and DNS over TLS. My ISP/ASP (LibertyGlobal) I can trust for now.