5 ms·

LinusTechTips did a video on anonymous browsing with VPNs and TOR yesterday and I wish they had been more serious on this bit. The top/pinned comment when I vie

LinusTechTips did a video on anonymous browsing with VPNs and TOR yesterday and I wish they had been more serious on this bit. The top/pinned comment when I viewed was along the lines of "What is a good free VPN, not a trial", and LTT themselves responded something like "None. Bandwidth costs money and you should be suspicious of a VPN that doesn't make money in a clear way." Still, I bet 99% of viewers won't see a comment response. But even then, and I realize this gets a bit tinfoily, but as a thought experiment, is there a really good, reasonably trustless, way to vet a VPN? For example I use PIA because of word of mouth and a few incidents in the past which show trustworthiness. But how can I really prove they're not secretly backed by China and I'm paying $5/mo for higher priority access to a Chinese VPN farm? Or at the very least that they are honest on any given day about not retaining log data.

lunchables 7y ago
I don't know if this is helpful, but I'll mention it because it works well for me. I use a Digital Ocean droplet and local forwarding. $ ssh -q -D [port] [droplet-hostname] Then setup my browser to use a proxy at localhost on [port]. Works great. You can get a "droplet", in Digital Ocean Parlance (i.e., "VPS") for as little as $5/mo, which includes 1TB/mo of data transfer. I assume other options like Linode, Vultr, etc would work as well.
- squeaky-clean 7y ago
  I actually did this for several years, with the added benefit that any number of my (trusted) friends could piggyback on it, given we weren't all using at once. There are dozens of great guides on this, DigitalOcean even hosts some of their own that you can practically copy paste blindly and be done. I'll be honest though, haha, 10% of my VPN usage is legitimate stuff and 90% is just so I can feel safe streaming things illegally that are otherwise hard to purchase. So I switched over to a third party for the simplicity. If I wanted to do more than avoid an email from my ISP I would definitely go back to rolling my own. (I'm also grandfathered into PIA's older cheaper price tier which makes it easier).
  - throwaway8941 7y ago
    >an email from my ISP That's pretty funny. I am from Kazakhstan myself and our largest (pretty much monopolist) internet provider has been encouraging ""piracy"" for as long as I can remember. About 10 years ago a bunch of local media companies (making money from selling badly translated Hollywood movies/video games/etc) lobbied a new law making operating all torrent trackers illegal, and banning access to everything they could find carpet bombing-style. Well, the ban lasted for less than a week, and was lifted after some heavy lobbying by said provider, who was beginning to lose a share of their most valuable customers. Here's another anecdote: in ~2012, when I was getting an FTTH connection, their representative used a popular torrent on my machine to measure the upload/download speeds through the freshly laid cable.
    - big_chungus 7y ago
      You're kidding; Kazakhstan has FTTH? I'm in America and still not even close...
      - throwaway8941 7y ago
        Yeah. I pay $10/month for 100 Mb/s with very stable upload and download speeds. You can get 1 Gb/s for $50/mo. I have been serving 10-20 TB each month with no complaints from my provider. But you have to remember that we make something like 5-10 times less than Americans. 100 Mb/s is still very affordable though.
      - lunchables 7y ago
        There is FTTH in more places than you might realize: https://broadbandnow.com/Fiber https://broadbandnow.com/Fiber I live in Nashville and we have FTTH from both AT&T and Google as well as gigabit service from Comcast. I think the problem is the US is really, really big and we widely deployed cable which has been "good enough" (DOCSIS 3.x at 300, 500Mb/s or more) that there historically hasn't been much incentive for people to deploy really expensive fiber networks. But it is certainly improving all the time. I think services like Starlink and fixed 5G are really driving carriers to start deploying more fiber to compete.
- aardshark 7y ago
  There is also sshuttle, which will forward all TCP traffic on your machine to anywhere you can ssh into and run a python script: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle It's very easy to use and setup, just do sshuttle -r username@12.34.56.789 0/0 That's it. All your TCP traffic is now going through your remote server. If you want DNS requests to go through as well, you can add the --dns option.
  - bayesianbot 7y ago
    I've been using sshuttle for a while and it works great. But I've always had to exclude (-x) the host address from trying to route through the sshuttle itself and ending up in a loop: sshuttle -r username@12.34.56.789 -x 12.34.56.789 0.0.0.0/0
- Fice 7y ago
  > for as little as $5/mo, which includes 1TB/mo of data transfer. There are even much cheaper virtual server offerings, as one probably doesn't need 1 GB of RAM and a dedicated IP for personal VPN or proxy.
- ViViDboarder 7y ago
  Vultr is a bit cheaper than DO I believe. An ssh proxy is great, but might as well just use OpenVPN if you’re hosting on DO or Vultr since I believe they both have prebuilt images you can deploy with a single click.
  - lunchables 7y ago
    I use my VPS for several other things and because it already runs ssh, this was easier for me, so I've never looked into openvpn. I keep telling myself once wireguard is merged into the kernel I will really invest some time into getting up to speed on it.
- sandos 7y ago
  Google cloud has a free tier giving you a very low spec VM for free. I dont know if it works for a http proxy, but it certainly could work.
rasengan 7y ago
We (PIA) are not backed by China. But you’re absolutely right - how do you vet trust in a VPN? The true answer isn’t one the industry or you want to hear - you don’t. Audits don’t do much as they only prove something is true at a certain moment in time. There is still trust involved. Instead, it’s a responsibility of the VPN industry to migrate towards architectures that require lesser or zero trust. We are working on it, and as always, I encourage anyone else in the industry (or outside of it) to reach out as this is something we should all work toward, because that’s what cypherpunks do!
- jopsen 7y ago
  You have to trust someone.. Mozilla is partnering with protonVPN. And if I recall correctly, Mozilla is vetting them: https://blog.mozilla.org/futurereleases/2018/10/22/testing-new-ways-to-keep-you-safe-online/ https://blog.mozilla.org/futurereleases/2018/10/22/testing-n...
  - rasengan 7y ago
    > You have to trust someone Our technology that we have before us today is a wonderful gift. We can in fact create trust-less systems.
    - fouc 7y ago
      You're referring to blockchain I assume, I guess a trustless VPN would be more akin to Tor than a centralized VPN service.
peteretep 7y ago
> But how can I really prove they're not secretly backed by China and I'm paying $5/mo for higher priority access to a Chinese VPN farm You can't. But you need to think of what your threat model is here. I tend to assume that FIVEYES is capable of intercepting all of my internet traffic going via a commercial VPN, but also ... that's kind of fine? My threat model is I don't want to fall victim to cyber-crime, and I want to remain relatively anonymous to large American corporations.

lunchables 7y ago

I don't know if this is helpful, but I'll mention it because it works well for me. I use a Digital Ocean droplet and local forwarding. $ ssh -q -D [port] [droplet-hostname] Then setup my browser to use a proxy at localhost on [port]. Works great. You can get a "droplet", in Digital Ocean Parlance (i.e., "VPS") for as little as $5/mo, which includes 1TB/mo of data transfer. I assume other options like Linode, Vultr, etc would work as well.

squeaky-clean 7y ago
I actually did this for several years, with the added benefit that any number of my (trusted) friends could piggyback on it, given we weren't all using at once. There are dozens of great guides on this, DigitalOcean even hosts some of their own that you can practically copy paste blindly and be done. I'll be honest though, haha, 10% of my VPN usage is legitimate stuff and 90% is just so I can feel safe streaming things illegally that are otherwise hard to purchase. So I switched over to a third party for the simplicity. If I wanted to do more than avoid an email from my ISP I would definitely go back to rolling my own. (I'm also grandfathered into PIA's older cheaper price tier which makes it easier).
- throwaway8941 7y ago
  >an email from my ISP That's pretty funny. I am from Kazakhstan myself and our largest (pretty much monopolist) internet provider has been encouraging ""piracy"" for as long as I can remember. About 10 years ago a bunch of local media companies (making money from selling badly translated Hollywood movies/video games/etc) lobbied a new law making operating all torrent trackers illegal, and banning access to everything they could find carpet bombing-style. Well, the ban lasted for less than a week, and was lifted after some heavy lobbying by said provider, who was beginning to lose a share of their most valuable customers. Here's another anecdote: in ~2012, when I was getting an FTTH connection, their representative used a popular torrent on my machine to measure the upload/download speeds through the freshly laid cable.
  - big_chungus 7y ago
    You're kidding; Kazakhstan has FTTH? I'm in America and still not even close...
    - throwaway8941 7y ago
      Yeah. I pay $10/month for 100 Mb/s with very stable upload and download speeds. You can get 1 Gb/s for $50/mo. I have been serving 10-20 TB each month with no complaints from my provider. But you have to remember that we make something like 5-10 times less than Americans. 100 Mb/s is still very affordable though.
    - lunchables 7y ago
      There is FTTH in more places than you might realize: https://broadbandnow.com/Fiber https://broadbandnow.com/Fiber I live in Nashville and we have FTTH from both AT&T and Google as well as gigabit service from Comcast. I think the problem is the US is really, really big and we widely deployed cable which has been "good enough" (DOCSIS 3.x at 300, 500Mb/s or more) that there historically hasn't been much incentive for people to deploy really expensive fiber networks. But it is certainly improving all the time. I think services like Starlink and fixed 5G are really driving carriers to start deploying more fiber to compete.
aardshark 7y ago
There is also sshuttle, which will forward all TCP traffic on your machine to anywhere you can ssh into and run a python script: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle It's very easy to use and setup, just do sshuttle -r username@12.34.56.789 0/0 That's it. All your TCP traffic is now going through your remote server. If you want DNS requests to go through as well, you can add the --dns option.
- bayesianbot 7y ago
  I've been using sshuttle for a while and it works great. But I've always had to exclude (-x) the host address from trying to route through the sshuttle itself and ending up in a loop: sshuttle -r username@12.34.56.789 -x 12.34.56.789 0.0.0.0/0
Fice 7y ago
> for as little as $5/mo, which includes 1TB/mo of data transfer. There are even much cheaper virtual server offerings, as one probably doesn't need 1 GB of RAM and a dedicated IP for personal VPN or proxy.
ViViDboarder 7y ago
Vultr is a bit cheaper than DO I believe. An ssh proxy is great, but might as well just use OpenVPN if you’re hosting on DO or Vultr since I believe they both have prebuilt images you can deploy with a single click.
- lunchables 7y ago
  I use my VPS for several other things and because it already runs ssh, this was easier for me, so I've never looked into openvpn. I keep telling myself once wireguard is merged into the kernel I will really invest some time into getting up to speed on it.
sandos 7y ago
Google cloud has a free tier giving you a very low spec VM for free. I dont know if it works for a http proxy, but it certainly could work.

rasengan 7y ago

We (PIA) are not backed by China. But you’re absolutely right - how do you vet trust in a VPN? The true answer isn’t one the industry or you want to hear - you don’t. Audits don’t do much as they only prove something is true at a certain moment in time. There is still trust involved. Instead, it’s a responsibility of the VPN industry to migrate towards architectures that require lesser or zero trust. We are working on it, and as always, I encourage anyone else in the industry (or outside of it) to reach out as this is something we should all work toward, because that’s what cypherpunks do!

jopsen 7y ago
You have to trust someone.. Mozilla is partnering with protonVPN. And if I recall correctly, Mozilla is vetting them: https://blog.mozilla.org/futurereleases/2018/10/22/testing-new-ways-to-keep-you-safe-online/ https://blog.mozilla.org/futurereleases/2018/10/22/testing-n...
- rasengan 7y ago
  > You have to trust someone Our technology that we have before us today is a wonderful gift. We can in fact create trust-less systems.
  - fouc 7y ago
    You're referring to blockchain I assume, I guess a trustless VPN would be more akin to Tor than a centralized VPN service.

peteretep 7y ago

> But how can I really prove they're not secretly backed by China and I'm paying $5/mo for higher priority access to a Chinese VPN farm You can't. But you need to think of what your threat model is here. I tend to assume that FIVEYES is capable of intercepting all of my internet traffic going via a commercial VPN, but also ... that's kind of fine? My threat model is I don't want to fall victim to cyber-crime, and I want to remain relatively anonymous to large American corporations.