4 ms·

I agree with the first line - with the proviso that there are (IMO) trustworthy third parties that have vetted some VPNs (for example, Mozilla's partnership). I

by ygjb 7y ago

I agree with the first line - with the proviso that there are (IMO) trustworthy third parties that have vetted some VPNs (for example, Mozilla's partnership). I also agree that E2E could resolve a number of issues, but I don't think it's practical or useful advice. Your second line steps toward security absolutism, since it just pushes out the trust boundary one step further and requires even more technical expertise to be actionable, especially in contrast to using a VPN provider. The advice to only trust E2E encryption is only useful if you trust both the E2E service provider and the implementation, especially where the service provider owns the only compatible implementations, and the implementation is closed source. The recent observations that FB could, either willfully, or under coercion, completely undermine their E2E implementation illustrates that, in general, solutions that are user friendly, readily accessible, and operating at scale, are subject to manipulation for economic, law enforcement, or political reasons.

jrockway 7y ago
If you can't trust the other end of the E2E implementation, there is nothing a VPN can do to get you closer to trusting them. Of course Facebook has all the requests you sent to them. You sent them! Using a VPN doesn't prevent Facebook from misusing the data they collect on you. Perhaps using a VPN prevents them from logging your IP address. But they still have your username that you logged in with, your phone's device ID, your session cookies (which were created when you were at home on WiFi), your browser's signature, etc. Again, using a VPN isn't going to stop any of that. The likely outcome of using a VPN is that Facebook's analytics will know exactly who you are, but their global rate limiter will cut off your access because your IP address is now shared with a thousand other people, some of whom are using a VPN to spam them.

by ygjb 7y ago

jrockway 7y ago

If you can't trust the other end of the E2E implementation, there is nothing a VPN can do to get you closer to trusting them. Of course Facebook has all the requests you sent to them. You sent them! Using a VPN doesn't prevent Facebook from misusing the data they collect on you. Perhaps using a VPN prevents them from logging your IP address. But they still have your username that you logged in with, your phone's device ID, your session cookies (which were created when you were at home on WiFi), your browser's signature, etc. Again, using a VPN isn't going to stop any of that. The likely outcome of using a VPN is that Facebook's analytics will know exactly who you are, but their global rate limiter will cut off your access because your IP address is now shared with a thousand other people, some of whom are using a VPN to spam them.