6 ms·

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government), specifically because they seek out traffic from people trying to hide - You get to pick the port/protocol/software you use, rather than being forced to accept the provider's ones - You can run other small servers you may need on the VPS as well

lijogdfljk 7y ago
But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?
- jen_h 7y ago
  Some thoughts: 1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer. 2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time. 3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in). 4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them? 5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
  - yread 7y ago
    > You have to keep two ports locked down That's what NordVPN thought as well
    - jen_h 7y ago
      I would hope that isn't what they thought and I'm sure it's not what they thought. Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP is absolutely nowhere the same as running a paid VPN service for millions of users across the world.
- rocqua 7y ago
  Using this for scary public WiFi makes some sense. Beyond that, the real question is ISP vs VPN. ISP advantage over VPN: - More regulated - Bigger, thus could have better focus on security - Less of a tasty target, because ISP customers do not specifically seek out to hide themselves, whereas VPN customers do. Advantages of VPN over ISP - Choice of jurisdiction (i.e. who can force the company to do stuff) - Company claims a focus on security - Choice of point where plaintext becomes available (for if you don't trust the beginning of your pipe) I think this is a wash in general, but the jurisdiction point could matter if you don't like your local jurisdiction. Similarly, if you do like your local regulator, probably better to go with the ISP.
- thenewnewguy 7y ago
  It's not like you're running a website on there - all you have to keep secure is SSH and your VPN. Keeping up to date with security updates and using a strong password (or better yet, private key) is essentially all you need to do. I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.
  - jen_h 7y ago
    I've seen "infosec professionals" say they don't trust themselves to secure their own VPN server. It blows my mind...if you can't do that, why are you even in this business? How do you even use a personal computer?
    - RankingMember 7y ago
      I've heard the same thing from cryptography authorities in regard to rolling your own encryption and it makes sense to me. Having specialized knowledge opens your eyes to all the gotchas and gottahaves that most people wouldn't think about. While you certainly can take the time to set everything up exactly the way it should be and keep it updated, I'd rather spend my time doing/thinking about other stuff and am happy to pay the $120/year or whatever to let someone (vetted) else deal with it.
      - jen_h 7y ago
        Rolling your own encryption is an entirely different animal. I agree with that sentiment for encryption. When you use a VPN service, though, you really don’t have any real insight into what’s going on on their servers. Run your own and you can be sure you’re running the most recent, audited version of OpenVPN on an updated operating system.
        RankingMember 7y ago
        You're right and I don't disagree with your core thinking, except to say that everyone draws a line beyond which they'll be happy to trade some risk for some time. I understand why someone would run their own VPN, but I also understand why someone wouldn't.
clinta 7y ago
But this buys you nothing in anonymity to the sites you visit. The IP you use to access the internet is still a single IP tied to you via a billing account with your cloud provider. A commercial VPN service NATs your connection out with thousands of other customers. So it all depends on what you want to use the VPN for.
gzer0 7y ago
Good way to deploy your own personal vpn on DigitalOcean, google cloud, or any cloud server of your choice really. Took me 5 minutes. https://news.ycombinator.com/item?id=21313902 https://news.ycombinator.com/item?id=21313902

lijogdfljk 7y ago

But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?

jen_h 7y ago
Some thoughts: 1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer. 2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time. 3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in). 4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them? 5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
- yread 7y ago
  > You have to keep two ports locked down That's what NordVPN thought as well
  - jen_h 7y ago
    I would hope that isn't what they thought and I'm sure it's not what they thought. Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP is absolutely nowhere the same as running a paid VPN service for millions of users across the world.
rocqua 7y ago
Using this for scary public WiFi makes some sense. Beyond that, the real question is ISP vs VPN. ISP advantage over VPN: - More regulated - Bigger, thus could have better focus on security - Less of a tasty target, because ISP customers do not specifically seek out to hide themselves, whereas VPN customers do. Advantages of VPN over ISP - Choice of jurisdiction (i.e. who can force the company to do stuff) - Company claims a focus on security - Choice of point where plaintext becomes available (for if you don't trust the beginning of your pipe) I think this is a wash in general, but the jurisdiction point could matter if you don't like your local jurisdiction. Similarly, if you do like your local regulator, probably better to go with the ISP.
thenewnewguy 7y ago
It's not like you're running a website on there - all you have to keep secure is SSH and your VPN. Keeping up to date with security updates and using a strong password (or better yet, private key) is essentially all you need to do. I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.
- jen_h 7y ago
  I've seen "infosec professionals" say they don't trust themselves to secure their own VPN server. It blows my mind...if you can't do that, why are you even in this business? How do you even use a personal computer?
  - RankingMember 7y ago
    I've heard the same thing from cryptography authorities in regard to rolling your own encryption and it makes sense to me. Having specialized knowledge opens your eyes to all the gotchas and gottahaves that most people wouldn't think about. While you certainly can take the time to set everything up exactly the way it should be and keep it updated, I'd rather spend my time doing/thinking about other stuff and am happy to pay the $120/year or whatever to let someone (vetted) else deal with it.
    - jen_h 7y ago
      Rolling your own encryption is an entirely different animal. I agree with that sentiment for encryption. When you use a VPN service, though, you really don’t have any real insight into what’s going on on their servers. Run your own and you can be sure you’re running the most recent, audited version of OpenVPN on an updated operating system.
      - RankingMember 7y ago
        You're right and I don't disagree with your core thinking, except to say that everyone draws a line beyond which they'll be happy to trade some risk for some time. I understand why someone would run their own VPN, but I also understand why someone wouldn't.

clinta 7y ago

But this buys you nothing in anonymity to the sites you visit. The IP you use to access the internet is still a single IP tied to you via a billing account with your cloud provider. A commercial VPN service NATs your connection out with thousands of other customers. So it all depends on what you want to use the VPN for.

gzer0 7y ago

Good way to deploy your own personal vpn on DigitalOcean, google cloud, or any cloud server of your choice really. Took me 5 minutes. https://news.ycombinator.com/item?id=21313902 https://news.ycombinator.com/item?id=21313902