7 ms·

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend

by apecat 7y ago

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

sushid 7y ago
They’re also not based in a Nordic country, which I find misleading.
- jen_h 7y ago
  For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
- krn 7y ago
  > They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...
dehrmann 7y ago
> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks all the time. Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone.
- apecat 7y ago
  > Much of the web is moving over to https Yes, but US consumer ISPs, to the best of my understanding, still have this nasty habit of tracking and injecting code whenever they feel like it. HTTP is still a thing. Also, if the point is to avoid an ISP snooping on metadata for profiling, HTTPS adoption is good, because it encrypts real session data, but it does not stop data collection. Remember that DNS goes in the clear, until browser and OS vendors decide to turn on DNS over HTTPS by default on consumer devices. The ISP industry, being assholes, have already started to make DoH appear somehow controversial, and they're probably going after google on antitrust grounds. [1] [2] But even with DoH, we're still going to be stuck with SNI, which spells out the target domain of every HTTPS connection in the connection metadata. And whenever encrypted SNI is in place, services on the internet that aren't behind a CDN are still going to have identifiable IP addresses. That's user data perfect for profiling and reselling. So, to really give ISPs the finger, the user must use a VPN. > VPNs are hit-or-miss on whether they route DNS requests Major consumer VPNs, even clowns like NordVPN, have gotten pretty good at ensuring sane confs in their provided clients. I wouldn't rely on their kill switches etc for serious opsec, but it's enough to give the finger to an ISP. On the other hand, the point of a VPN router is precisely to have everything go over a tunnel, including DNS. It's not ideal to tunnel everything, but it's up to US consumers to make that choice. My suggestion would be to campaign to drive up VPN use on consumer broadband connections, just to fuck with the ISPs. > That, and you're trusting the VPN to not sell your data. This is an important point, and also why one would choose a VPN that relies on a reputation of not selling data. > Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone. Yes, it's an arms race, and the point is to make life as hard as possible for the tracking industry. Nothing is perfect. Tracking cookies don't go anywhere in a convenient to use browser setup, despite the shoddy claims from clowncar VPN companies. While Tor is great, it's slow and not advisable as a daily driver browser connected to the user's normal online identities. For most users, sane use of Tor Browser would be special purposes, like researching medical concerns you don't want tracking companies to connect to you, and similar. 1 - https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new-chrome-feature-will-stop-them-from-spying-on-you/ https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new... 2 - https://crsreports.congress.gov/product/pdf/IN/IN11182 https://crsreports.congress.gov/product/pdf/IN/IN11182
kevindong 7y ago
> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.
- nprateem 7y ago
  Apparently not [1] (paywall) / [2] (Google referrer to avoid paywall). There's a scam where email invoices are modified: > Somewhere along the line the email was intercepted and altered. I didn’t know then, but I know now, that I should have transferred a small amount first to see if it went through, or just phoned the builder to check his details [1] https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537acab https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537a... [2] https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an+online+scam+ft.com&s=g https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an...
- slivanes 7y ago
  I want to read my own email.
- rosybox 7y ago
  > No one was ever going to be able to read your emails. Except for Google, Yahoo, Microsoft, and Apple of course, and whoever they have to answer to depending on where you live.
  - UncleMeat 7y ago
    A VPN won't change that
- apecat 7y ago
  I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

by apecat 7y ago

sushid 7y ago

They’re also not based in a Nordic country, which I find misleading.

jen_h 7y ago
For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
krn 7y ago
> They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...

dehrmann 7y ago

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks all the time. Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone.

apecat 7y ago
> Much of the web is moving over to https Yes, but US consumer ISPs, to the best of my understanding, still have this nasty habit of tracking and injecting code whenever they feel like it. HTTP is still a thing. Also, if the point is to avoid an ISP snooping on metadata for profiling, HTTPS adoption is good, because it encrypts real session data, but it does not stop data collection. Remember that DNS goes in the clear, until browser and OS vendors decide to turn on DNS over HTTPS by default on consumer devices. The ISP industry, being assholes, have already started to make DoH appear somehow controversial, and they're probably going after google on antitrust grounds. [1] [2] But even with DoH, we're still going to be stuck with SNI, which spells out the target domain of every HTTPS connection in the connection metadata. And whenever encrypted SNI is in place, services on the internet that aren't behind a CDN are still going to have identifiable IP addresses. That's user data perfect for profiling and reselling. So, to really give ISPs the finger, the user must use a VPN. > VPNs are hit-or-miss on whether they route DNS requests Major consumer VPNs, even clowns like NordVPN, have gotten pretty good at ensuring sane confs in their provided clients. I wouldn't rely on their kill switches etc for serious opsec, but it's enough to give the finger to an ISP. On the other hand, the point of a VPN router is precisely to have everything go over a tunnel, including DNS. It's not ideal to tunnel everything, but it's up to US consumers to make that choice. My suggestion would be to campaign to drive up VPN use on consumer broadband connections, just to fuck with the ISPs. > That, and you're trusting the VPN to not sell your data. This is an important point, and also why one would choose a VPN that relies on a reputation of not selling data. > Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone. Yes, it's an arms race, and the point is to make life as hard as possible for the tracking industry. Nothing is perfect. Tracking cookies don't go anywhere in a convenient to use browser setup, despite the shoddy claims from clowncar VPN companies. While Tor is great, it's slow and not advisable as a daily driver browser connected to the user's normal online identities. For most users, sane use of Tor Browser would be special purposes, like researching medical concerns you don't want tracking companies to connect to you, and similar. 1 - https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new-chrome-feature-will-stop-them-from-spying-on-you/ https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new... 2 - https://crsreports.congress.gov/product/pdf/IN/IN11182 https://crsreports.congress.gov/product/pdf/IN/IN11182

kevindong 7y ago

> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

nprateem 7y ago
Apparently not [1] (paywall) / [2] (Google referrer to avoid paywall). There's a scam where email invoices are modified: > Somewhere along the line the email was intercepted and altered. I didn’t know then, but I know now, that I should have transferred a small amount first to see if it went through, or just phoned the builder to check his details [1] https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537acab https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537a... [2] https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an+online+scam+ft.com&s=g https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an...
slivanes 7y ago
I want to read my own email.
rosybox 7y ago
> No one was ever going to be able to read your emails. Except for Google, Yahoo, Microsoft, and Apple of course, and whoever they have to answer to depending on where you live.
- UncleMeat 7y ago
  A VPN won't change that
apecat 7y ago
I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.