5 ms·

It might be that PIA is not going to start doing anything shady, and they'll still be a (relatively) well-respected VPN company after the merger. But if you're

It might be that PIA is not going to start doing anything shady, and they'll still be a (relatively) well-respected VPN company after the merger. But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back. There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens. I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing. I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards. In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).

AndrewKemendo 7y ago
I don't follow here. PIA is a paid third party VPN. So you're advocating to use one just like this, but not PIA?
- arkades 7y ago
  Yes. He advocates for third party VPNs, but PIA was acquired by a shady company, so not them anymore, because there’s now a reason to distrust them specifically. It seemed pretty clear to me.
  - AndrewKemendo 7y ago
    PIA meets 100% of the criteria outlined in that post however with no discussion of how to determine or measure additional criteria like future possible bad behavior based on corporate ownership, which was the genesis of the whole thread. Ostensibly the "paid" portion of the criteria is a proxy for incentive to not do shady things like show ads or distribute malware.
    - dvosar34 7y ago
      The lengthy commentary was done more to draw attention to himself rather than convey any real threat by PIA's corporate changes.
- deleted 7y ago
  [deleted]
arkades 7y ago
So what’re the recommendations for alternatives? It seems like quite a lot of VPNs play their cards close to the vest - and at the end of the day, all I want is a modicum of privacy and to safely torrent a movie for my PLEX server instead of having to dig up my Blu-ray reader and rip it myself once in a while.
- danShumway 7y ago
  I can't give you a checklist for how you should determine who you trust -- that's one of the reasons why I don't advocate for or endorse any particular VPN, and one of the reasons why I don't disclose which VPN providers I use. The difficulty of determining which VPNs to trust is why I call them a "least-bad solution" rather than a "good solution." There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start: - What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities? - Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic. - What's their privacy policy look like? Do they make public commitments to destroy logs? Are their claims on-their-face absurd? There's no such thing as a VPN that does zero logging at all, so if someone is claiming perfect anonymity, I distrust them from the get-go. - Have they had data breaches in the past (for example, NordVPN)? - Are there any high-profile cases of them refusing to provide logs to someone? - What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts. - Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims. - Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches? That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."
  - 7y ago
cmdshiftf4 7y ago
Fully agree with all of the above. I've been a happy customer of PIA's for years now and, as such, they've built up relatively solid trust with me (for a third-party VPN company). Even still, I only renewed only a yearly basis because a) things in tech, especially security, change quickly and b) companies also change quickly and like today, that change can be greatly for the worst. I can't personally understand buying in to such a service for a timespan measured in years.
- sokoloff 7y ago
  I paid $60 for 3 years of PIA access. From a convenience standpoint alone, I’m happy to think about it and update config every three years. If things sour over the course of that time, I’m probably only out a few bucks over the annual payment price.
sigstoat 7y ago
> But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back. how will they prove it in a year? and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?
- blotter_paper 7y ago
  Logging data costs money, but selling data earns money. Also, if the parent company is known for malware then getting mitm-attacked by your VPN sounds like an actual risk if you have any unencrypted traffic passing through it.
  - adamfisk 7y ago
    Or encrypted traffic for that matter -- a lot of VPNs install root certs on your OS.
- jasonzemos 7y ago
  Would you be alright if a VPN profiled and sold your browsing habits, engaging in very traditional, even benign business model similar to what everyone else is (e.g. credit cards, etc) doing -- but with the knack of keeping your real identity strictly anonymous and detached from these activities? In other words, would you be alright if the VPN built a profile of your VPN identity? The corollary, I think, asks if you're interested in a VPN to separate your activities, or to thoroughly diffuse them for actual information loss.
  - jammygit 7y ago
    No. You could associate the two profiles later on
LMYahooTFY 7y ago
>and unlike Tor, VPNs actually scale well for regular Internet browsing What is "regular internet browsing"?
- danShumway 7y ago
  Streaming, downloading multi-GB files like games or HD movies, playing games online while avoiding (at least some) latency, uploading content or hosting your own file-sharing servers. It's not just a speed problem. Within the Tor community I personally still see a lot of people saying that behaviors like these are selfish because they take up too many volunteer resources. Maybe it's a little unfair of me, maybe those people are misinformed -- but I interpret that as meaning that the community doesn't think Tor can scale to meet those demands. With either a 3rd-party or a self-hosted VPN, you can reroute literally all of your network traffic from all of your devices without giving it any thought, and the only time you'll really need to get off is if you're accessing a blocked website or doing something that demands very low latency.
  - blotter_paper 7y ago
    > playing games online while avoiding (at least some) latency Also at most some latency. /pedantism
  - LMYahooTFY 7y ago
    IMO defining all of those things as "regular usage" is problematic. In regards to your specific list, that's above average internet user, in which case I think a better solution is diversifying your network connection methods. Trying to use one tool for that entire range of traffic centralizes it needlessly, and you'll get more effective privacy by avoiding that. Furthermore, if you want more speed out of tor I'd argue step one is running a node and contributing and/or donating at least.
- cookiecaper 7y ago
  Unless this has changed in the last few years, anyone can set up an exit node on Tor and begin proxying your traffic. It's just a switch in the config. The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection -- then you at least know that it's $LOCAL_TELCO sniffing the packets. Tor is excellent and it has uses, but I've had to explain to many people over the years that day-to-day browsing like checking email, checking bank accounts, etc., is far less safe through Tor than through a direct connection (at least for people in the US -- if you're using Tor for its intended purpose of thwarting oppressive regimes, crossing your fingers on the exit node lottery is probably preferable).
bscphil 7y ago
> I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is. Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.
rdiddly 7y ago
If we're talking spending extra for switching flexibility, just abandoning PIA midway through your year-long subscription term and writing off whatever you paid, works too.

AndrewKemendo 7y ago

I don't follow here. PIA is a paid third party VPN. So you're advocating to use one just like this, but not PIA?

arkades 7y ago
Yes. He advocates for third party VPNs, but PIA was acquired by a shady company, so not them anymore, because there’s now a reason to distrust them specifically. It seemed pretty clear to me.
- AndrewKemendo 7y ago
  PIA meets 100% of the criteria outlined in that post however with no discussion of how to determine or measure additional criteria like future possible bad behavior based on corporate ownership, which was the genesis of the whole thread. Ostensibly the "paid" portion of the criteria is a proxy for incentive to not do shady things like show ads or distribute malware.
  - dvosar34 7y ago
    The lengthy commentary was done more to draw attention to himself rather than convey any real threat by PIA's corporate changes.
deleted 7y ago
[deleted]

arkades 7y ago

So what’re the recommendations for alternatives? It seems like quite a lot of VPNs play their cards close to the vest - and at the end of the day, all I want is a modicum of privacy and to safely torrent a movie for my PLEX server instead of having to dig up my Blu-ray reader and rip it myself once in a while.

danShumway 7y ago
I can't give you a checklist for how you should determine who you trust -- that's one of the reasons why I don't advocate for or endorse any particular VPN, and one of the reasons why I don't disclose which VPN providers I use. The difficulty of determining which VPNs to trust is why I call them a "least-bad solution" rather than a "good solution." There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start: - What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities? - Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic. - What's their privacy policy look like? Do they make public commitments to destroy logs? Are their claims on-their-face absurd? There's no such thing as a VPN that does zero logging at all, so if someone is claiming perfect anonymity, I distrust them from the get-go. - Have they had data breaches in the past (for example, NordVPN)? - Are there any high-profile cases of them refusing to provide logs to someone? - What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts. - Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims. - Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches? That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."
- 7y ago

cmdshiftf4 7y ago

Fully agree with all of the above. I've been a happy customer of PIA's for years now and, as such, they've built up relatively solid trust with me (for a third-party VPN company). Even still, I only renewed only a yearly basis because a) things in tech, especially security, change quickly and b) companies also change quickly and like today, that change can be greatly for the worst. I can't personally understand buying in to such a service for a timespan measured in years.

sokoloff 7y ago
I paid $60 for 3 years of PIA access. From a convenience standpoint alone, I’m happy to think about it and update config every three years. If things sour over the course of that time, I’m probably only out a few bucks over the annual payment price.

sigstoat 7y ago

> But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back. how will they prove it in a year? and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?

blotter_paper 7y ago
Logging data costs money, but selling data earns money. Also, if the parent company is known for malware then getting mitm-attacked by your VPN sounds like an actual risk if you have any unencrypted traffic passing through it.
- adamfisk 7y ago
  Or encrypted traffic for that matter -- a lot of VPNs install root certs on your OS.
jasonzemos 7y ago
Would you be alright if a VPN profiled and sold your browsing habits, engaging in very traditional, even benign business model similar to what everyone else is (e.g. credit cards, etc) doing -- but with the knack of keeping your real identity strictly anonymous and detached from these activities? In other words, would you be alright if the VPN built a profile of your VPN identity? The corollary, I think, asks if you're interested in a VPN to separate your activities, or to thoroughly diffuse them for actual information loss.
- jammygit 7y ago
  No. You could associate the two profiles later on

LMYahooTFY 7y ago

>and unlike Tor, VPNs actually scale well for regular Internet browsing What is "regular internet browsing"?

danShumway 7y ago
Streaming, downloading multi-GB files like games or HD movies, playing games online while avoiding (at least some) latency, uploading content or hosting your own file-sharing servers. It's not just a speed problem. Within the Tor community I personally still see a lot of people saying that behaviors like these are selfish because they take up too many volunteer resources. Maybe it's a little unfair of me, maybe those people are misinformed -- but I interpret that as meaning that the community doesn't think Tor can scale to meet those demands. With either a 3rd-party or a self-hosted VPN, you can reroute literally all of your network traffic from all of your devices without giving it any thought, and the only time you'll really need to get off is if you're accessing a blocked website or doing something that demands very low latency.
- blotter_paper 7y ago
  > playing games online while avoiding (at least some) latency Also at most some latency. /pedantism
- LMYahooTFY 7y ago
  IMO defining all of those things as "regular usage" is problematic. In regards to your specific list, that's above average internet user, in which case I think a better solution is diversifying your network connection methods. Trying to use one tool for that entire range of traffic centralizes it needlessly, and you'll get more effective privacy by avoiding that. Furthermore, if you want more speed out of tor I'd argue step one is running a node and contributing and/or donating at least.
cookiecaper 7y ago
Unless this has changed in the last few years, anyone can set up an exit node on Tor and begin proxying your traffic. It's just a switch in the config. The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection -- then you at least know that it's $LOCAL_TELCO sniffing the packets. Tor is excellent and it has uses, but I've had to explain to many people over the years that day-to-day browsing like checking email, checking bank accounts, etc., is far less safe through Tor than through a direct connection (at least for people in the US -- if you're using Tor for its intended purpose of thwarting oppressive regimes, crossing your fingers on the exit node lottery is probably preferable).

bscphil 7y ago

> I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is. Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.

rdiddly 7y ago

If we're talking spending extra for switching flexibility, just abandoning PIA midway through your year-long subscription term and writing off whatever you paid, works too.