4 ms·

Oh trust me, I'm well aware of "VPN providers". Just checkout luminati.io . See how they offer an SDK so "You can offer the user a choice between advertisements

Oh trust me, I'm well aware of "VPN providers". Just checkout luminati.io . See how they offer an SDK so "You can offer the user a choice between advertisements or a bit of background data usage"? I asked, and they are only interested in partners with 100k active users a month. Right, like a legitimate company with that many users is going to use luminati. Or oxylabs.io who I think owns luminati? I'm also aware that many of the VPNs are owned by the same parent companies. And also that VPNs are ridiculously over marketed. They don't "add security" for most people, they just move who you're trusting from your ISP to the VPN company. Right, like I want to trust a company registered in Panama with no other existence outside of this year not to sell my data. --- tl;dr - I don't trust any of them. If I want a "VPN" I just ssh-tunnel into a VPS from an established company that I purchase with a different account. Could the VPS provider do fishy stuff? Sure, but I trust them a lot more then these "VPN" providers.

pnutjam 7y ago
Stick with the big players, PIA, airvpn. I trust those two.
- penagwin 7y ago
  At the end of the day they're mostly just fancy OpenVPN profiles. The entire space is fishy AF IMO. I'm thankful that linustechtips seems to evaluate their VPN sponsors at least. I believe they dropped tunnelbear in favor of PIA because of similar concerns.
  - ganoushoreilly 7y ago
    Tunnelbear was acquired and all sponsorship dropped, he actually mentioned it on one of the derbauer overclocking posts from Computex this past week. PIA has cross pollination with IP blocks owned by Micfo subsidiaries as well. They're all like 2 degrees away from each other.
preinheimer 7y ago
More on how luminati and other "residential ip" providers work here: https://medium.com/@xianghangmi/resident-evil-understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29 https://medium.com/@xianghangmi/resident-evil-understanding-...
- sjnair96 7y ago
  Wow, very interesting read. Thanks for bringing this to light.
- farisjarrah 7y ago
  Looks like Luminati is also explicitly getting developers to put a luminati proxy client into their apps and have users opt into using that instead of getting fed advertisements. https://luminati.io/faq https://luminati.io/faq Between your link, and the luminati faq's, I definitely have more questions then when I started looking at these articles.
  - penagwin 7y ago
    Luminati didn't start off like that. They started by burying what they were doing in a "free" vpn. I asked, and they are only interested in partners with 100k active users a month. They REALLY REALLY wanted to talk to me over skype. Right, like a legitimate company with that many users is going to use luminati. The use case of luminati is almost entirely grey/black hat. Their history is laughably sketchy. Unless anybody knows of any apps that use the SDK and ask for permission, I suspect that FAQ page is just for show. Again you have to be a big player to even use it, it's not a stretch to believe they don't "enforce" the consent rule.
- jrs72s 7y ago
  Wow, that's a good read.
LinuxBender 7y ago
+1 on ssh + vps. People will say it isn't as anonymous as the shared vpn's and while that is somewhat true, it is still more than sufficient to remove your home IP from logs. Short of scary letters and warrants to the VPS provider, people won't really know who you are. You can also automate the rebuilding of proxy nodes to get new IP's, as most VPS providers have an API for automated rebuilds.
- penagwin 7y ago
  Exactly this. For non-state actors my "data" is gone. You'd need a warrant to get data from my VPS provider, so for most of the common threats I'm pretty anonymous to non-state actors. Maybe you don't want your employer to see everything you search? Interestingly for programmers the ssh-tunnel is perfectly explainable, especially if you do most of your browsing in the clearnet, and only some over your ssh-tunnel. If your threat model includes state actors (doing something illegal hmmmm?) then I would recommend doing something a bit different, but for what most people are using services like Nord for ssh + vps should be fine. EDIT: If yall are torrenting then just get a 10$/mo seedbox, you'll thank me later.
- anderspitman 7y ago
  Are there any high quality VPS providers that have a way to sign up and pay anonymously with Monero (or similar), manage via tor browser, etc?
  - penagwin 7y ago
    This here is assuming you don't have a nation state actively trying to track you down. Otherwise see [0] One option is to use basically any provider + prepaid visa cards. Just access the website over tor or a VPN you semi trust. Sure it's technically traceable but not without a lot of trouble. Keep in mind that once the VPS provider is issued a subpoena they still have access to your connecting computer's IP. They then have to issue a subpoena to your ISP for your account information. The only way to hide your IP is to use a proxy or a vpn... Oh wait, yeah that's the issue. See [0] I personally just recommend using whatever you'd like, Vultr, DO, scaleway, etc. Feralhosting isn't anonymous but they uh... don't care what you really use it for cough torrents cough. [0] If you're REALLY trying to be fully anonymous then you'll need to put on your blackhat. I would start with planting a raspberry pi in a business, library, coffeeshop, etc. You can use that IP as a starting point. You won't want to use only that one IP most likely, so you're going to need more proxies/servers, most common method is botnets. This really isn't worth the trouble to 99.9999% of people. Edit: I guess I'm estimating there are ~7,000 people in the world who it's worth the trouble to do.... Actually that might be accurate, cool! :D
dontbenebby 7y ago
IIRC can't an SSH tunnel leak your browsing through DNS leaks, or am I misunderstanding? I thought you usually want to use an actual VPN protocol like Wireguard.
- RL_Quine 7y ago
  socks4 leaks DNS requests, socks5 can tunnel them as well.
dewey 7y ago
Oxylabs and Luminati are competitors. They don’t own them.

pnutjam 7y ago

Stick with the big players, PIA, airvpn. I trust those two.

penagwin 7y ago
At the end of the day they're mostly just fancy OpenVPN profiles. The entire space is fishy AF IMO. I'm thankful that linustechtips seems to evaluate their VPN sponsors at least. I believe they dropped tunnelbear in favor of PIA because of similar concerns.
- ganoushoreilly 7y ago
  Tunnelbear was acquired and all sponsorship dropped, he actually mentioned it on one of the derbauer overclocking posts from Computex this past week. PIA has cross pollination with IP blocks owned by Micfo subsidiaries as well. They're all like 2 degrees away from each other.

preinheimer 7y ago

More on how luminati and other "residential ip" providers work here: https://medium.com/@xianghangmi/resident-evil-understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29 https://medium.com/@xianghangmi/resident-evil-understanding-...

sjnair96 7y ago
Wow, very interesting read. Thanks for bringing this to light.
farisjarrah 7y ago
Looks like Luminati is also explicitly getting developers to put a luminati proxy client into their apps and have users opt into using that instead of getting fed advertisements. https://luminati.io/faq https://luminati.io/faq Between your link, and the luminati faq's, I definitely have more questions then when I started looking at these articles.
- penagwin 7y ago
  Luminati didn't start off like that. They started by burying what they were doing in a "free" vpn. I asked, and they are only interested in partners with 100k active users a month. They REALLY REALLY wanted to talk to me over skype. Right, like a legitimate company with that many users is going to use luminati. The use case of luminati is almost entirely grey/black hat. Their history is laughably sketchy. Unless anybody knows of any apps that use the SDK and ask for permission, I suspect that FAQ page is just for show. Again you have to be a big player to even use it, it's not a stretch to believe they don't "enforce" the consent rule.
jrs72s 7y ago
Wow, that's a good read.

LinuxBender 7y ago

+1 on ssh + vps. People will say it isn't as anonymous as the shared vpn's and while that is somewhat true, it is still more than sufficient to remove your home IP from logs. Short of scary letters and warrants to the VPS provider, people won't really know who you are. You can also automate the rebuilding of proxy nodes to get new IP's, as most VPS providers have an API for automated rebuilds.

penagwin 7y ago
Exactly this. For non-state actors my "data" is gone. You'd need a warrant to get data from my VPS provider, so for most of the common threats I'm pretty anonymous to non-state actors. Maybe you don't want your employer to see everything you search? Interestingly for programmers the ssh-tunnel is perfectly explainable, especially if you do most of your browsing in the clearnet, and only some over your ssh-tunnel. If your threat model includes state actors (doing something illegal hmmmm?) then I would recommend doing something a bit different, but for what most people are using services like Nord for ssh + vps should be fine. EDIT: If yall are torrenting then just get a 10$/mo seedbox, you'll thank me later.
anderspitman 7y ago
Are there any high quality VPS providers that have a way to sign up and pay anonymously with Monero (or similar), manage via tor browser, etc?
- penagwin 7y ago
  This here is assuming you don't have a nation state actively trying to track you down. Otherwise see [0] One option is to use basically any provider + prepaid visa cards. Just access the website over tor or a VPN you semi trust. Sure it's technically traceable but not without a lot of trouble. Keep in mind that once the VPS provider is issued a subpoena they still have access to your connecting computer's IP. They then have to issue a subpoena to your ISP for your account information. The only way to hide your IP is to use a proxy or a vpn... Oh wait, yeah that's the issue. See [0] I personally just recommend using whatever you'd like, Vultr, DO, scaleway, etc. Feralhosting isn't anonymous but they uh... don't care what you really use it for cough torrents cough. [0] If you're REALLY trying to be fully anonymous then you'll need to put on your blackhat. I would start with planting a raspberry pi in a business, library, coffeeshop, etc. You can use that IP as a starting point. You won't want to use only that one IP most likely, so you're going to need more proxies/servers, most common method is botnets. This really isn't worth the trouble to 99.9999% of people. Edit: I guess I'm estimating there are ~7,000 people in the world who it's worth the trouble to do.... Actually that might be accurate, cool! :D

dontbenebby 7y ago

IIRC can't an SSH tunnel leak your browsing through DNS leaks, or am I misunderstanding? I thought you usually want to use an actual VPN protocol like Wireguard.

RL_Quine 7y ago
socks4 leaks DNS requests, socks5 can tunnel them as well.

dewey 7y ago

Oxylabs and Luminati are competitors. They don’t own them.