3 ms·

The title should be renamed to "Don't Use 3rd Party VPN Services".[1] On-prem VPN deployments with solutions like AlgoVPN[2] from TrailOfBits is still very use

by devy 7y ago

The title should be renamed to "Don't Use 3rd Party VPN Services".[1] On-prem VPN deployments with solutions like AlgoVPN[2] from TrailOfBits is still very useful. Let alone mass majority of the the corporate IT's internal VPNs that is required for some workforces to perform their jobs remotely on public Internet. [1]: https://gist.github.com/joepie91/5a9909939e6ce7d09e29#gistcomment-2197521 https://gist.github.com/joepie91/5a9909939e6ce7d09e29#gistco... [2]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

tptacek 7y ago
The article specifically discussed that (using Streisand as the example rather than Algo, though Algo is what you should in fact use).
- hello_moto 7y ago
  why Algo instead of Streisand? out of curiosity.
  - tptacek 7y ago
    Algo is designed not to install risky VPN software, or to use risky configurations, by subject matter experts.
    - hello_moto 7y ago
      Thank you for the insight (esp coming from security expert :)).
jplayer01 7y ago
I’ve seen a complete lack of arguments for why anybody should use Algo or Streisand. I don’t see the point. If you don’t trust VPN's, why trust literally anybody you choose to host a VPN, especially if there is arguably even less anonymity to be had.
- devy 7y ago
  > If you don’t trust VPN's That's the exactly the misnomer that the title didn't do justice. Of course you MUST trust VPN in order to make sense of using it. The differentiation is whether that VPN is some 3rd party manage it or you manage it on your own. With 3rd Party VPNs you have no idea how they setup it and no transparency how they secure the VPN node. If you manage your VPN node on your own, you have full control what algorithms and configuration you are using and you pick the right node in an "secure" environment, all are risks factored into the big picture.
  - jplayer01 7y ago
    > If you manage your VPN node on your own, you have full control what algorithms and configuration you are using and you pick the right node in an "secure" environment, all are risks factored into the big picture. No, it's the exact same situation. Or do you happen to know exactly how whatever hosting provider manages the server you're using? They can be trusted exactly as much as VPN providers. There is no real security once you're using systems that you don't own, but there are benefits to using a VPN that can't be realized if your name is on the box.
    - devy 7y ago
      > No, it's the exact same situation. Or do you happen to know exactly how whatever hosting provider manages the server you're using? It's not exactly the same. In the case of cloud providers, you know what you are getting into and mostly having the freedom to setup your own VPC, your VM image, your firewall, even secure boot/TPM stuff, etc. As far as the data security goes, many Cloud vendor provide data encryption at rest with your own keys (Of course data security in transit for a VPN, that goes without saying). This is even MORE true for Corporate ITs since they own and operate their own data centers and hardwares too (even with popular trend cloud computing migration). Just think about it, if public cloud vendors can get government contracts (DoD/CIA/NSA), then they can ensure security at a high bar. But keep in mind that security is NEVER an absolute term, so your argument to me are moot.

by devy 7y ago

tptacek 7y ago

The article specifically discussed that (using Streisand as the example rather than Algo, though Algo is what you should in fact use).

hello_moto 7y ago
why Algo instead of Streisand? out of curiosity.
- tptacek 7y ago
  Algo is designed not to install risky VPN software, or to use risky configurations, by subject matter experts.
  - hello_moto 7y ago
    Thank you for the insight (esp coming from security expert :)).

jplayer01 7y ago

I’ve seen a complete lack of arguments for why anybody should use Algo or Streisand. I don’t see the point. If you don’t trust VPN's, why trust literally anybody you choose to host a VPN, especially if there is arguably even less anonymity to be had.

devy 7y ago
> If you don’t trust VPN's That's the exactly the misnomer that the title didn't do justice. Of course you MUST trust VPN in order to make sense of using it. The differentiation is whether that VPN is some 3rd party manage it or you manage it on your own. With 3rd Party VPNs you have no idea how they setup it and no transparency how they secure the VPN node. If you manage your VPN node on your own, you have full control what algorithms and configuration you are using and you pick the right node in an "secure" environment, all are risks factored into the big picture.
- jplayer01 7y ago
  > If you manage your VPN node on your own, you have full control what algorithms and configuration you are using and you pick the right node in an "secure" environment, all are risks factored into the big picture. No, it's the exact same situation. Or do you happen to know exactly how whatever hosting provider manages the server you're using? They can be trusted exactly as much as VPN providers. There is no real security once you're using systems that you don't own, but there are benefits to using a VPN that can't be realized if your name is on the box.
  - devy 7y ago
    > No, it's the exact same situation. Or do you happen to know exactly how whatever hosting provider manages the server you're using? It's not exactly the same. In the case of cloud providers, you know what you are getting into and mostly having the freedom to setup your own VPC, your VM image, your firewall, even secure boot/TPM stuff, etc. As far as the data security goes, many Cloud vendor provide data encryption at rest with your own keys (Of course data security in transit for a VPN, that goes without saying). This is even MORE true for Corporate ITs since they own and operate their own data centers and hardwares too (even with popular trend cloud computing migration). Just think about it, if public cloud vendors can get government contracts (DoD/CIA/NSA), then they can ensure security at a high bar. But keep in mind that security is NEVER an absolute term, so your argument to me are moot.