4 ms·

I watch a bunch of tech related YouTube channels and the amount of NordVPN shilling is outrageous. Some fine folks making good content telling their audience th

I watch a bunch of tech related YouTube channels and the amount of NordVPN shilling is outrageous. Some fine folks making good content telling their audience that "your ISP is seeing everything you do but if you use a VPN you are safe, it's totally not like the VPN provider is then able to do exactly what the ISP could before!" Even worse the VPN provider is usually operating from some country with much less regulation regarding privacy. If it were revealed that some ISP here in Germany is sniffing traffic and selling your data, shit would hit the fan, but if your trusty VPN provider from whoknowswhere does this, good luck going after them.

Kaveren 7y ago
don't forget the "military grade encryption" NordVPN makes the youtubers include sometimes.
- Avamander 7y ago
  But if you take a closer look at many of them, they actually do TLSv1.1 with weak primitives, have weak CA certs or other problems in their system.
- mushufasa 7y ago
  eh. I wouldn't take that as a strike against them. It's pretty impossible to communicate crypto to laypeople using technical language, like AES or even SSL. You have to use analogies, to banks or militaries. For better or worse, that's just how it goes.
  - CiPHPerCoder 7y ago
    > For better or worse, that's just how it goes. No, it isn't. You don't have to use "bank-grade", "military-grade", etc. in your marketing. They don't actually mean anything, and only serve as a red flag for "we don't know what the fuck we're doing". You can use almost-equally meaningless phrases like "state of the art", "industry standard", etc. You can sell on a "proven track record" of not selling out to data brokers or yielding to government search warrants (although that mostly hinges on "never been subpoenaed" rather than "resisted a subpoena" in practical terms). There's lots of other paths to take besides using "${DUMB}-grade" in your marketing copy. Saying "that's just how it goes" is yielding to a lazy cop-out with another lazier cop-out. It absolutely isn't just how it goes.
    - mushufasa 7y ago
      I fail to see how using "equally-meaningless phrases" is worse than using other "equally-meaningless phrases." Nord also says they never hold logs, and locate in Panama to avoid gov't subpoenas. It's not either/or. You can (should) put the technical information on a 'security' page for the people who know enough to find it and read it.
derefr 7y ago
I mean, there’s something left unsaid in all of those VPN advertisements, that goes something like this: > You live in the US, right? And you pirate stuff, right? Or maybe you Google things that would get you put on the TSA no-fly list? Well, with a VPN, it won’t be your US ISP that has access to your traffic—and then has to give it over to the MPAA and the NSA—but rather a VPN company from some foreign country, who has no such obligations. Sure, they can sell your data to anyone they like... but it’s not like the USGOV or the various media cartels are buying data. If they can’t compel it for free, they don’t bother (and they certainly couldn’t fully trust data sourced from a company headquartered in a non-allied country anyway, so why would they bother?) Someone somewhere might know about your VPN traffic, but it probably won’t be someone out to get you. Just someone out to sell you stuff. Or, if you prefer: > You live in Hong Kong, right? And you have some vocal opinions about Chinese sovereignty, right? Well, with a VPN, it’s not the Chinese government that sees your traffic, but rather....
typenil 7y ago
In the US, we know that ISPs and government agencies are harvesting data for their own proposes. So using a VPN comes down to the fair gamble that someone who promises not to log and use your data is possibly better than the guys who definitely log and use it.

Kaveren 7y ago

don't forget the "military grade encryption" NordVPN makes the youtubers include sometimes.

Avamander 7y ago
But if you take a closer look at many of them, they actually do TLSv1.1 with weak primitives, have weak CA certs or other problems in their system.
mushufasa 7y ago
eh. I wouldn't take that as a strike against them. It's pretty impossible to communicate crypto to laypeople using technical language, like AES or even SSL. You have to use analogies, to banks or militaries. For better or worse, that's just how it goes.
- CiPHPerCoder 7y ago
  > For better or worse, that's just how it goes. No, it isn't. You don't have to use "bank-grade", "military-grade", etc. in your marketing. They don't actually mean anything, and only serve as a red flag for "we don't know what the fuck we're doing". You can use almost-equally meaningless phrases like "state of the art", "industry standard", etc. You can sell on a "proven track record" of not selling out to data brokers or yielding to government search warrants (although that mostly hinges on "never been subpoenaed" rather than "resisted a subpoena" in practical terms). There's lots of other paths to take besides using "${DUMB}-grade" in your marketing copy. Saying "that's just how it goes" is yielding to a lazy cop-out with another lazier cop-out. It absolutely isn't just how it goes.
  - mushufasa 7y ago
    I fail to see how using "equally-meaningless phrases" is worse than using other "equally-meaningless phrases." Nord also says they never hold logs, and locate in Panama to avoid gov't subpoenas. It's not either/or. You can (should) put the technical information on a 'security' page for the people who know enough to find it and read it.

derefr 7y ago

I mean, there’s something left unsaid in all of those VPN advertisements, that goes something like this: > You live in the US, right? And you pirate stuff, right? Or maybe you Google things that would get you put on the TSA no-fly list? Well, with a VPN, it won’t be your US ISP that has access to your traffic—and then has to give it over to the MPAA and the NSA—but rather a VPN company from some foreign country, who has no such obligations. Sure, they can sell your data to anyone they like... but it’s not like the USGOV or the various media cartels are buying data. If they can’t compel it for free, they don’t bother (and they certainly couldn’t fully trust data sourced from a company headquartered in a non-allied country anyway, so why would they bother?) Someone somewhere might know about your VPN traffic, but it probably won’t be someone out to get you. Just someone out to sell you stuff. Or, if you prefer: > You live in Hong Kong, right? And you have some vocal opinions about Chinese sovereignty, right? Well, with a VPN, it’s not the Chinese government that sees your traffic, but rather....

typenil 7y ago

In the US, we know that ISPs and government agencies are harvesting data for their own proposes. So using a VPN comes down to the fair gamble that someone who promises not to log and use your data is possibly better than the guys who definitely log and use it.