4 ms·

If you use a VPN, it's absolutely safe. The solution is to raise more public awareness of VPNs, and their benefits. Also, automating the setup of self-hosted

If you use a VPN, it's absolutely safe. The solution is to raise more public awareness of VPNs, and their benefits. Also, automating the setup of self-hosted VPNs (like OpenVPN) on a home machine (like a Raspberry Pi plugged into the router) would go a long way. I personally prefer not to use third-party VPN providers, as I don't really know whether I can trust them.

NickBusey 7y ago
Just a note that there are many solutions for automated installation of VPN on home machines. HomelabOS (https://gitlab.com/NickBusey/HomelabOS https://gitlab.com/NickBusey/HomelabOS) is one of them, Algo (https://github.com/trailofbits/algo https://github.com/trailofbits/algo) is another.
- pushpop 7y ago
  This then just pushes the layer of trust to the developers of the installers. The OPs point is, at some point in the chain you have to trust someone and in his opinion coffee shops are less likely to want to do bad things with your WiFi connection than VPN providers et al. Which I think is a fair point when you look at the costs of scale. ie it’s easier and cheaper to set up a rogue VPN provider or boobytrapped installer than it is a coffee shop. Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties.
  - Endy 7y ago
    >Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties. This is why I have a few spare email addresses that I don't log into. They have no personal information about me (most of these mailboxes were last accessed on computers I don't have anymore or via the public library).
    - pushpop 7y ago
      That’s one option and it does make a lot of sense. Sadly free WiFi in the UK has largely been pretty awful. I’ve lost count of the number of times I’ve had a faster mobile connection than (for example) hotel WiFi. So I’ve just given up trying. That said, things may have improved in the last couple of years...
jrockway 7y ago
A VPN just pushes link-layer security off to someone else. Now instead of trusting your coffee shop, you're trusting your VPN vendor. Why a VPN vendor deserves any more trust than your coffee shop is beyond me. Trusting the link layer is an unnecessary band-aid. It doesn't need to be trusted, and you should always operate with the assumption that it's not trusted. Only trust end-to-end encryption and authentication.
- ygjb 7y ago
  I agree with the first line - with the proviso that there are (IMO) trustworthy third parties that have vetted some VPNs (for example, Mozilla's partnership). I also agree that E2E could resolve a number of issues, but I don't think it's practical or useful advice. Your second line steps toward security absolutism, since it just pushes out the trust boundary one step further and requires even more technical expertise to be actionable, especially in contrast to using a VPN provider. The advice to only trust E2E encryption is only useful if you trust both the E2E service provider and the implementation, especially where the service provider owns the only compatible implementations, and the implementation is closed source. The recent observations that FB could, either willfully, or under coercion, completely undermine their E2E implementation illustrates that, in general, solutions that are user friendly, readily accessible, and operating at scale, are subject to manipulation for economic, law enforcement, or political reasons.
  - jrockway 7y ago
    If you can't trust the other end of the E2E implementation, there is nothing a VPN can do to get you closer to trusting them. Of course Facebook has all the requests you sent to them. You sent them! Using a VPN doesn't prevent Facebook from misusing the data they collect on you. Perhaps using a VPN prevents them from logging your IP address. But they still have your username that you logged in with, your phone's device ID, your session cookies (which were created when you were at home on WiFi), your browser's signature, etc. Again, using a VPN isn't going to stop any of that. The likely outcome of using a VPN is that Facebook's analytics will know exactly who you are, but their global rate limiter will cut off your access because your IP address is now shared with a thousand other people, some of whom are using a VPN to spam them.
groestl 7y ago
> If you use a VPN, it's absolutely safe There is still the rest of the internet, like the part between Cloudflare terminating SSL, and the backend on shared hosting, running bare HTTP. Point being that if you're using sites that are lazy about transport security, no VPN will help you.

NickBusey 7y ago

Just a note that there are many solutions for automated installation of VPN on home machines. HomelabOS (https://gitlab.com/NickBusey/HomelabOS https://gitlab.com/NickBusey/HomelabOS) is one of them, Algo (https://github.com/trailofbits/algo https://github.com/trailofbits/algo) is another.

pushpop 7y ago
This then just pushes the layer of trust to the developers of the installers. The OPs point is, at some point in the chain you have to trust someone and in his opinion coffee shops are less likely to want to do bad things with your WiFi connection than VPN providers et al. Which I think is a fair point when you look at the costs of scale. ie it’s easier and cheaper to set up a rogue VPN provider or boobytrapped installer than it is a coffee shop. Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties.
- Endy 7y ago
  >Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties. This is why I have a few spare email addresses that I don't log into. They have no personal information about me (most of these mailboxes were last accessed on computers I don't have anymore or via the public library).
  - pushpop 7y ago
    That’s one option and it does make a lot of sense. Sadly free WiFi in the UK has largely been pretty awful. I’ve lost count of the number of times I’ve had a faster mobile connection than (for example) hotel WiFi. So I’ve just given up trying. That said, things may have improved in the last couple of years...

jrockway 7y ago

A VPN just pushes link-layer security off to someone else. Now instead of trusting your coffee shop, you're trusting your VPN vendor. Why a VPN vendor deserves any more trust than your coffee shop is beyond me. Trusting the link layer is an unnecessary band-aid. It doesn't need to be trusted, and you should always operate with the assumption that it's not trusted. Only trust end-to-end encryption and authentication.

ygjb 7y ago
I agree with the first line - with the proviso that there are (IMO) trustworthy third parties that have vetted some VPNs (for example, Mozilla's partnership). I also agree that E2E could resolve a number of issues, but I don't think it's practical or useful advice. Your second line steps toward security absolutism, since it just pushes out the trust boundary one step further and requires even more technical expertise to be actionable, especially in contrast to using a VPN provider. The advice to only trust E2E encryption is only useful if you trust both the E2E service provider and the implementation, especially where the service provider owns the only compatible implementations, and the implementation is closed source. The recent observations that FB could, either willfully, or under coercion, completely undermine their E2E implementation illustrates that, in general, solutions that are user friendly, readily accessible, and operating at scale, are subject to manipulation for economic, law enforcement, or political reasons.
- jrockway 7y ago
  If you can't trust the other end of the E2E implementation, there is nothing a VPN can do to get you closer to trusting them. Of course Facebook has all the requests you sent to them. You sent them! Using a VPN doesn't prevent Facebook from misusing the data they collect on you. Perhaps using a VPN prevents them from logging your IP address. But they still have your username that you logged in with, your phone's device ID, your session cookies (which were created when you were at home on WiFi), your browser's signature, etc. Again, using a VPN isn't going to stop any of that. The likely outcome of using a VPN is that Facebook's analytics will know exactly who you are, but their global rate limiter will cut off your access because your IP address is now shared with a thousand other people, some of whom are using a VPN to spam them.

groestl 7y ago

> If you use a VPN, it's absolutely safe There is still the rest of the internet, like the part between Cloudflare terminating SSL, and the backend on shared hosting, running bare HTTP. Point being that if you're using sites that are lazy about transport security, no VPN will help you.