4 ms·

Because it's easy to change a VPN provider if you don't like their actions, but most of us are stuck with an ISP and have no control over what they do with our

by sauwan 7y ago

Because it's easy to change a VPN provider if you don't like their actions, but most of us are stuck with an ISP and have no control over what they do with our data?

_-___________-_ 7y ago
What exactly can they be doing with your data other than selling a list of which DNS queries you make and which IP addresses you connect to? (Which the VPN provider can also do.)
- sixothree 7y ago
  Send me your browsing history and your location history and we can continue this conversation.
- _-___________-_ 7y ago
  Where did location history come into this? (IP addresses are generally not correlated to location at much more than city level.) My point is simply that using a VPN provider doesn't change the fact that an actor has access to your DNS queries and which IPs you connect to (and where you connect from). It just changes that actor from your ISP to a VPN provider, and most VPN providers seem a hell of a lot more shady than any ISP I've dealt with.
- neom 7y ago
  I'm currently sitting on a plane. gogo wifi can read all my email if they so chose (and pass to a government). I'll use a VPN.
  - ceejayoz 7y ago
    Any major email provider at this point should have SSL enabled when you check your email.
    - neom 7y ago
      Shame they're (still) spoofing certs. https://slate.com/technology/2015/01/gogo-creates-fake-ssl-tls-certificates-so-it-can-block-video-streaming.html https://slate.com/technology/2015/01/gogo-creates-fake-ssl-t... https://www.zdnet.com/article/gogo-in-flight-wi-fi-serving-spoofed-ssl-certificates/ https://www.zdnet.com/article/gogo-in-flight-wi-fi-serving-s... https://arstechnica.com/tech-policy/2014/04/at-feds-request-gogo-in-flight-wi-fi-service-added-more-spying-capabilities/ https://arstechnica.com/tech-policy/2014/04/at-feds-request-...
      - ceejayoz 7y ago
        The browser (as should your email client) appears to have rejected those certs.
        voxic11 7y ago
        ok, so they have been rejected. Now what? I still would like to read my email... which is where VPN's come in handy.
        _-___________-_ 7y ago
        I have had this situation in-flight a few times. I just used wireguard to a server I have. If I didn't already have that set up, I would have used an SSH+SOCKS tunnel to route around the damage. No need to send all my traffic to some shady VPN provider.
        ceejayoz 7y ago
        If you're running your own VPN, fine. If you're using something like NordVPN, you're just swapping one shady outfit for another. Worse, in many cases. Might be better to just wait until you land.
- sixothree 7y ago
  FTC believes location data is being sold alongside browsing history.
- voxic11 7y ago
  On the cellphone side, most carriers will sell your identity and real time location to websites that your visit. https://news.ycombinator.com/item?id=15477286 https://news.ycombinator.com/item?id=15477286
  - _-___________-_ 7y ago
    I'd like to see some evidence for "most carriers" and for "to websites that you visit".
- threecheese 7y ago
  The ISP knows who you are and where you live; the VPN provider only knows your source IP address and information gleaned from your payment method (which in many cases can be "not much", as VPN providers support pseudo-anonymous payments).
- ramphastidae 7y ago
  Many of us live in countries where our ISP is owned by a hostile government that regularly blocks social media and other parts of the web on a whim.
- saurik 7y ago
  They can do active attacks on you, as most people don't actively attempt to ban and absolutely block unencrypted connections (and there are also sometimes attacks on SSL stacks anyway); and like... SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type". (Also, if I see you making requests to some websites I can correlate it to others, just on hostname, which I would get from SNI/TLS, not DNS: like, you go to news.ycombinator.com followed by some other websites that are currently on the front page of Hacker News, I can now guess with high likelihood you are clicking on specific website links you just saw.) As for "the VPN provider can also do that", that is like saying "what can a random stranger do with your secrets that someone you know well can't?", which is "true" sure, but not really interesting: being able to choose the company on whom you rely for security is extremely useful: I don't really have choice over my ISP, but I have choice over my VPN, and so you can't really say "these VPNs are shadier than my ISP" unless you can show the best of all VPNs is shadier than my ISP. Meanwhile, for many people, your "ISP" on a given day might be "the local coffee shop" or "an airport" or "your brother's friend Bob": people talk about "ISP" as if it always means "AT&T", but I see even extremely technical people who "should know better" happily using WiFi provided by conferences, which is just crazy to me... you are way more likely to get messed with in some scary way by people close enough to you for it to matter than by some random entity.
  - hannob 7y ago
    > SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type". A VPN won't protect you from these sidechannel attacks.
    - Dylan16807 7y ago

by sauwan 7y ago

Because it's easy to change a VPN provider if you don't like their actions, but most of us are stuck with an ISP and have no control over what they do with our data?

_-___________-_ 7y ago

What exactly can they be doing with your data other than selling a list of which DNS queries you make and which IP addresses you connect to? (Which the VPN provider can also do.)

sixothree 7y ago
Send me your browsing history and your location history and we can continue this conversation.
_-___________-_ 7y ago
Where did location history come into this? (IP addresses are generally not correlated to location at much more than city level.) My point is simply that using a VPN provider doesn't change the fact that an actor has access to your DNS queries and which IPs you connect to (and where you connect from). It just changes that actor from your ISP to a VPN provider, and most VPN providers seem a hell of a lot more shady than any ISP I've dealt with.
neom 7y ago
I'm currently sitting on a plane. gogo wifi can read all my email if they so chose (and pass to a government). I'll use a VPN.
- ceejayoz 7y ago
  Any major email provider at this point should have SSL enabled when you check your email.
  - neom 7y ago
    Shame they're (still) spoofing certs. https://slate.com/technology/2015/01/gogo-creates-fake-ssl-tls-certificates-so-it-can-block-video-streaming.html https://slate.com/technology/2015/01/gogo-creates-fake-ssl-t... https://www.zdnet.com/article/gogo-in-flight-wi-fi-serving-spoofed-ssl-certificates/ https://www.zdnet.com/article/gogo-in-flight-wi-fi-serving-s... https://arstechnica.com/tech-policy/2014/04/at-feds-request-gogo-in-flight-wi-fi-service-added-more-spying-capabilities/ https://arstechnica.com/tech-policy/2014/04/at-feds-request-...
    - ceejayoz 7y ago
      The browser (as should your email client) appears to have rejected those certs.
      - voxic11 7y ago
        ok, so they have been rejected. Now what? I still would like to read my email... which is where VPN's come in handy.
        _-___________-_ 7y ago
        I have had this situation in-flight a few times. I just used wireguard to a server I have. If I didn't already have that set up, I would have used an SSH+SOCKS tunnel to route around the damage. No need to send all my traffic to some shady VPN provider.
        ceejayoz 7y ago
        If you're running your own VPN, fine. If you're using something like NordVPN, you're just swapping one shady outfit for another. Worse, in many cases. Might be better to just wait until you land.
sixothree 7y ago
FTC believes location data is being sold alongside browsing history.
voxic11 7y ago
On the cellphone side, most carriers will sell your identity and real time location to websites that your visit. https://news.ycombinator.com/item?id=15477286 https://news.ycombinator.com/item?id=15477286
- _-___________-_ 7y ago
  I'd like to see some evidence for "most carriers" and for "to websites that you visit".
threecheese 7y ago
The ISP knows who you are and where you live; the VPN provider only knows your source IP address and information gleaned from your payment method (which in many cases can be "not much", as VPN providers support pseudo-anonymous payments).
ramphastidae 7y ago
Many of us live in countries where our ISP is owned by a hostile government that regularly blocks social media and other parts of the web on a whim.
saurik 7y ago
They can do active attacks on you, as most people don't actively attempt to ban and absolutely block unencrypted connections (and there are also sometimes attacks on SSL stacks anyway); and like... SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type". (Also, if I see you making requests to some websites I can correlate it to others, just on hostname, which I would get from SNI/TLS, not DNS: like, you go to news.ycombinator.com followed by some other websites that are currently on the front page of Hacker News, I can now guess with high likelihood you are clicking on specific website links you just saw.) As for "the VPN provider can also do that", that is like saying "what can a random stranger do with your secrets that someone you know well can't?", which is "true" sure, but not really interesting: being able to choose the company on whom you rely for security is extremely useful: I don't really have choice over my ISP, but I have choice over my VPN, and so you can't really say "these VPNs are shadier than my ISP" unless you can show the best of all VPNs is shadier than my ISP. Meanwhile, for many people, your "ISP" on a given day might be "the local coffee shop" or "an airport" or "your brother's friend Bob": people talk about "ISP" as if it always means "AT&T", but I see even extremely technical people who "should know better" happily using WiFi provided by conferences, which is just crazy to me... you are way more likely to get messed with in some scary way by people close enough to you for it to matter than by some random entity.
- hannob 7y ago
  > SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type". A VPN won't protect you from these sidechannel attacks.
  - Dylan16807 7y ago