23 ms·

Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement. It’s just using a different middleman. One middleman

by mikl 7y ago

Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement. It’s just using a different middleman. One middleman might be better than another, but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home. It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic. DNS is still not encrypted in most browsers, so this traffic is still a goldmine of marketable info. Sure, they can’t see what you post on snapstagram.com or what pages you visit on news.ycombinator.com, but they can infer a lot about your browsing habits from DNS queries.

gambiting 7y ago
Friendly reminder that in the UK all ISPs are required by law to keep your entire browsing history for a year, and that history can be accessed by few dozen agencies, warrant free. That's why I use a VPN personally.
- stjohnswarts 7y ago
  Exactly, they're generally more trustworthy than most governments. Security is about probability and is never 100%.
- ludjer 7y ago
  If you only use HTTPS they can track your DNS queries but they cant track anything other then that. When you do a google for something so let us say google.com?search=searchTerm they see a dns lookup for google.com. They will not see ?search=searchTerm or anything else. They will see a connection open between your computer and another IP after that. In the future that will stop becoming a problem because there will be DNS over TLS or DNS over HTTPS which will even hide your DNS lookups. Which means all the ISP will see is you made a TCP connection to X. Theoretically they could just do a reverse lookup for that IP but that is not always easy.
- My1 7y ago
  Except that they cant really get your browsing history. Just the domains you used. At least on the 90% of https sites most ppl visit
derefr 7y ago
A VPN provider is basically a choice to trade one country’s passive adversary for another. I.e., if you’re in the US and using a VPN with German corporate headquarters, then your Internet transactions are able to be wiretapped by the German government, but not by the US government. Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market—but not usually in a form that will result in legal problems for you, since ad-targeting data tends to be semi-anonymized (in the sense that it isn’t in a form where a court would accept it as evidence of who you are; not in the sense that it couldn’t be used to deanonymize you by a sufficiently-motivated private researcher.)
- toyg 7y ago
  Actually, legally speaking, by using a German VPN you are effectively allowing the NSA to spy on you, since the traffic is now “overseas” — which is always fair game for any US agency. Conversely, you might be protected from German surveillance (depending on German law). (This said, obviously no agency is going to come after you for the occasional lootin’ of moving pictures, and if you are doing anything more serious, then you should have your own VPN infrastructure.)
  - robcohen 7y ago
    This is correct, however in theory the NSA is not allowed to spy (let's not argue about "wittingly" here, I get it) on American citizens without FISA or 702 approval: https://www.newamerica.org/oti/blog/scope-standards-and-protections-compared/ https://www.newamerica.org/oti/blog/scope-standards-and-prot... So if they did not know you were an American through your identifiers, they could intercept foreign traffic. However, once they identified you they would need to stop unless the above exceptions were met. IN THEORY. Exceptions have occurred, the most egregious that I can think of is that the FBI has NO ACCOUNTING WHATSOEVER of how many agents accessed the 702 database: https://www.justsecurity.org/66622/how-to-address-newly-revealed-abuses-of-section-702-surveillance/ https://www.justsecurity.org/66622/how-to-address-newly-reve...
    - tobias3 7y ago
Mirioron 7y ago
The VPN providers pay the bills for them. Why would they not shill them?
- mikl 7y ago
  Yeah, why would someone ever consider their moral responsibilities and credibility before endorsing a product they do not understand the technical details of?
  - Mirioron 7y ago
    I get what you're saying, but that would then mean that you couldn't advertise essentially anything. Chances are very high that you will never get an endorsement/advertisement deal for a product that you do understand well.
    - mikl 7y ago
      There is lots of advertisement you can do without making misleading (or even downright false) claims. Not that advertising mobile games or g-fuel is great, but you’re at least not pushing (dangerously) false claims on people and imperiling their privacy and security.
SmellyGeekBoy 7y ago
Besides the security implications, if there's no way to legally stream Disney content in my country and I desperately want to watch it for some reason I'll pirate it. Why should I jump through hoops to give them (and an unconnected third party) my money if they don't want me as a customer? I'm making a genuine effort to keep all my entertainment above board by being a paying customer to Netflix, Amazon, Spotify, Google Play, YouTube Premium, Steam and a few others, but I have to say that my patience is wearing very thin with TV/movie studios and their idiotic licensing shenanigans.
- alwayseasy 7y ago
  What's worse, is that they can't snap a finger and distribute worldwide. They lobbied themselves into legal corners with all these licensing shenanigans.
  - burnte 7y ago
    They absolutely can if they choose to. They own the rights, they don't need nations' permission to do things with it. However, their lawyers need lots of time to create all sorts of artificially restrictive terms of service and silly contracts with partners rather than just opening the service worldwide.
    - shaklee3 7y ago
      That's absolutely not true. It's the reason movies like Coco are still on Netflix and not Disney plus. You can't just renege on a previous contract because you started your own streaming service. These things take time.
      - burnte 7y ago
        I was unclear, I meant that the restrictions are artificial; based on contracts and in-company reasoning, not that the law prevents them from letting users in other nations buy subscriptions. Yes, they can't reneg on contracts, but the only reason Disney+ isn't available in other nations is entirely of their own making, and they could let Ukranians or Vietnamese into Disney+ whenever they choose (aside from existing agreed upon obligations), there is no national-legal restriction.
scarface74 7y ago
If you’re using “sketchy WiFi”, you’re still more than likely using https so your traffic is encrypted.
throw0101a 7y ago
> * Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.* You may enjoy Tom Scott's video: > I tried to write a more honest VPN commercial. The sponsor wasn't happy about it. • Get ■■■ days of ■■■ VPN free at ■■■■.com/honest * https://www.youtube.com/watch?v=WVDQEoe6ZWY https://www.youtube.com/watch?v=WVDQEoe6ZWY
- mikl 7y ago
  I already did ;)
rsync 7y ago
"It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic." I never understand this false dichotomy - especially in a forum which is named ... let me check ... "hacker news". Just set up your own. It costs almost nothing to run a EC2 instance in the region of your choice (or at some other provider like GCS or whatever). There are keystroke-by-keystroke instructions everywhere on setting this up. Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether. Some more extra points for multiplying the almost-zero-cost by 3 or 4 or 5 and spinning up extra copies of your endpoint in multiple regions (or even providers) and manually (or automatically) switching between them. You don't need to trust anyone - adjust your threat model all the way up to "near nation state" (in the case of Amazon or GCS) and assume these actors could already discern all of your Internet traffic even if you weren't doing business with them. Christ.
- Ruthalas 7y ago
  Could you provide a good reference for the process you describe, or maybe just a good set of search terms? I'd like to pursue this, but have just little enough experience with ec2 to not be composing effective search terms.
  - kizashi 7y ago
    I think one of the interesting option out there is: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand Waiting for https://github.com/StreisandEffect/streisand/pull/1668 https://github.com/StreisandEffect/streisand/pull/1668 to be fixed though.
    - nitzle 7y ago
      Hey, I wrote the PR you just linked (#1668). Was there an issue with the code changes you ran into? Just asking since you said you were waiting for it to be fixed. If so, I'd love to know what the error was so I can test/fix it. Or did you just mean the underlying issue (ACMEv1 protocol being deprecated)?
StanislavPetrov 7y ago
One middleman might be better than another, but 10 middleman are better than 1 if you are truly interested in mitigating the invasion of your privacy. There's nothing preventing you from using multiple VPNs to make it harder for any one middleman to build a profile of your internet activity.
- obenn 7y ago
  Which is basically TOR
  - lsofzz 7y ago
    > Which is basically TOR Last time I checked Tor's technical paper (probably been 10 or so years), it stated the fact that a relay? node in between can only decrypt the information required to route to next hop and not the actual packet's payload. Is that correct or am I dreaming? Also, I recall that if someone malicious flooded the tor network with malicious exit nodes, then all traffic details can be `inferred' right? i.e., the assumption was that exit nodes need to route the packet to destination thus it needed to look at every packet but couldn't infer the originating IP address (based on my dated knowledge :)) If a malicious person now floods the tor network with bazillion exit + relay nodes - then essentially all contents (payload + IP src/dst) can be aggregated. Is this still problem in tor network?
jdormit 7y ago
Why can't your VPN see what pages you visit on sites? They can see every URL you request, can't they?
- berbec 7y ago
  For https, the only thing sent in plaintext (and this is only if you don't use DoH or similar), is your DNS query (google.com). The rest of the page (search.php?=goat+snuff+videos) is encrypted.
  - jdormit 7y ago
    Ah, I see. Thanks!
  - lsofzz 7y ago
    Yes. To add, any number of middle boxes during egress from the VPN provider can also sniff the SNI in TLS packet (SNI stands for Server Name Indication and stands on its own as a plain text traffic) before a TLS sessions is established (assuming DoT/DoH DNS scheme is in use) Effort and RFCs are underway to establish what would become part of TLS protocol stack. One of which is eSNI (encrypted SNI).
hawaiian 7y ago
> if you have a good ISP already That's a big IF. Not all of us share the luxury of being able to get internet service from companies like Sonic.net.
foopdoopfoop 7y ago
> but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home. This is just not true. You cannot sign up for an ISP without disclosing at least your name and address. Many VPNs support complete anonymity. It's a different middle man that--if you choose the right one--will absolutely know less about you.
- jachee 7y ago
  How are you going to access a completely anonymous VPN provider without a non-anonymous internet connection? If your traffic is interesting enough, the money trail will eventually lead back to you.
  - lokedhs 7y ago
    Micah Lee did a talk about how he does it. In essence he uses Tor to connect to the VPN. He also explains how to pay for the VPN anonymously. I think it was part of his Qubes OS talk: https://youtu.be/f4U8YbXKwog https://youtu.be/f4U8YbXKwog
secfirstmd 7y ago
I disagree. The comments here are based on a specific threat model. There are many other threat models where a good VPN dramatically increases a users security.
alasdair_ 7y ago
>But remember that you’re trusting the VPN provider with all your traffic. May I suggest hosting youe own VPN using Streisand (https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand)? It's an absolutely fantastic VPN that runs on just about any cloud system out of the box (or your own hardware of course). Right now I use Linode for hosting ($5/month) but there are lots and lots of other ways to set it up. Importantly, setup is easy for all kinds of clients, including mobile devices.
- Spy520 7y ago
  Making your own VPN sure seems like the safest option but something as popular as Linode won’t be of a use to someone who wants to stream geoblocked services as they most likely are already blacklisted from many.
raxxorrax 7y ago
There is currently a difference in business interest for VPNs and ISPs. ISPs sell your data, since people mostly don't have much choice here anyway. A VPN service who becomes known to share data can probably close their business soon, new ones will quickly fill the void. They have less infrastructure requirements than ISPs and a subset of users with different expectations to privacy. So yes, I do think there is quite a difference, although you should still be critical of your VPN provider.
morpheuskafka 7y ago
Also worth noting that while VPN providers don't care what DNS servers you use, the geo-blocking protection features usually require that you use their DNS servers.

by mikl 7y ago

gambiting 7y ago

Friendly reminder that in the UK all ISPs are required by law to keep your entire browsing history for a year, and that history can be accessed by few dozen agencies, warrant free. That's why I use a VPN personally.

stjohnswarts 7y ago
Exactly, they're generally more trustworthy than most governments. Security is about probability and is never 100%.
ludjer 7y ago
If you only use HTTPS they can track your DNS queries but they cant track anything other then that. When you do a google for something so let us say google.com?search=searchTerm they see a dns lookup for google.com. They will not see ?search=searchTerm or anything else. They will see a connection open between your computer and another IP after that. In the future that will stop becoming a problem because there will be DNS over TLS or DNS over HTTPS which will even hide your DNS lookups. Which means all the ISP will see is you made a TCP connection to X. Theoretically they could just do a reverse lookup for that IP but that is not always easy.
My1 7y ago
Except that they cant really get your browsing history. Just the domains you used. At least on the 90% of https sites most ppl visit

derefr 7y ago

A VPN provider is basically a choice to trade one country’s passive adversary for another. I.e., if you’re in the US and using a VPN with German corporate headquarters, then your Internet transactions are able to be wiretapped by the German government, but not by the US government. Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market—but not usually in a form that will result in legal problems for you, since ad-targeting data tends to be semi-anonymized (in the sense that it isn’t in a form where a court would accept it as evidence of who you are; not in the sense that it couldn’t be used to deanonymize you by a sufficiently-motivated private researcher.)

toyg 7y ago
Actually, legally speaking, by using a German VPN you are effectively allowing the NSA to spy on you, since the traffic is now “overseas” — which is always fair game for any US agency. Conversely, you might be protected from German surveillance (depending on German law). (This said, obviously no agency is going to come after you for the occasional lootin’ of moving pictures, and if you are doing anything more serious, then you should have your own VPN infrastructure.)
- robcohen 7y ago
  This is correct, however in theory the NSA is not allowed to spy (let's not argue about "wittingly" here, I get it) on American citizens without FISA or 702 approval: https://www.newamerica.org/oti/blog/scope-standards-and-protections-compared/ https://www.newamerica.org/oti/blog/scope-standards-and-prot... So if they did not know you were an American through your identifiers, they could intercept foreign traffic. However, once they identified you they would need to stop unless the above exceptions were met. IN THEORY. Exceptions have occurred, the most egregious that I can think of is that the FBI has NO ACCOUNTING WHATSOEVER of how many agents accessed the 702 database: https://www.justsecurity.org/66622/how-to-address-newly-revealed-abuses-of-section-702-surveillance/ https://www.justsecurity.org/66622/how-to-address-newly-reve...
  - tobias3 7y ago

Mirioron 7y ago

The VPN providers pay the bills for them. Why would they not shill them?

mikl 7y ago
Yeah, why would someone ever consider their moral responsibilities and credibility before endorsing a product they do not understand the technical details of?
- Mirioron 7y ago
  I get what you're saying, but that would then mean that you couldn't advertise essentially anything. Chances are very high that you will never get an endorsement/advertisement deal for a product that you do understand well.
  - mikl 7y ago
    There is lots of advertisement you can do without making misleading (or even downright false) claims. Not that advertising mobile games or g-fuel is great, but you’re at least not pushing (dangerously) false claims on people and imperiling their privacy and security.

SmellyGeekBoy 7y ago

Besides the security implications, if there's no way to legally stream Disney content in my country and I desperately want to watch it for some reason I'll pirate it. Why should I jump through hoops to give them (and an unconnected third party) my money if they don't want me as a customer? I'm making a genuine effort to keep all my entertainment above board by being a paying customer to Netflix, Amazon, Spotify, Google Play, YouTube Premium, Steam and a few others, but I have to say that my patience is wearing very thin with TV/movie studios and their idiotic licensing shenanigans.

alwayseasy 7y ago
What's worse, is that they can't snap a finger and distribute worldwide. They lobbied themselves into legal corners with all these licensing shenanigans.
- burnte 7y ago
  They absolutely can if they choose to. They own the rights, they don't need nations' permission to do things with it. However, their lawyers need lots of time to create all sorts of artificially restrictive terms of service and silly contracts with partners rather than just opening the service worldwide.
  - shaklee3 7y ago
    That's absolutely not true. It's the reason movies like Coco are still on Netflix and not Disney plus. You can't just renege on a previous contract because you started your own streaming service. These things take time.
    - burnte 7y ago
      I was unclear, I meant that the restrictions are artificial; based on contracts and in-company reasoning, not that the law prevents them from letting users in other nations buy subscriptions. Yes, they can't reneg on contracts, but the only reason Disney+ isn't available in other nations is entirely of their own making, and they could let Ukranians or Vietnamese into Disney+ whenever they choose (aside from existing agreed upon obligations), there is no national-legal restriction.

scarface74 7y ago

If you’re using “sketchy WiFi”, you’re still more than likely using https so your traffic is encrypted.

throw0101a 7y ago

> * Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.* You may enjoy Tom Scott's video: > I tried to write a more honest VPN commercial. The sponsor wasn't happy about it. • Get ■■■ days of ■■■ VPN free at ■■■■.com/honest * https://www.youtube.com/watch?v=WVDQEoe6ZWY https://www.youtube.com/watch?v=WVDQEoe6ZWY

mikl 7y ago
I already did ;)

rsync 7y ago

"It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic." I never understand this false dichotomy - especially in a forum which is named ... let me check ... "hacker news". Just set up your own. It costs almost nothing to run a EC2 instance in the region of your choice (or at some other provider like GCS or whatever). There are keystroke-by-keystroke instructions everywhere on setting this up. Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether. Some more extra points for multiplying the almost-zero-cost by 3 or 4 or 5 and spinning up extra copies of your endpoint in multiple regions (or even providers) and manually (or automatically) switching between them. You don't need to trust anyone - adjust your threat model all the way up to "near nation state" (in the case of Amazon or GCS) and assume these actors could already discern all of your Internet traffic even if you weren't doing business with them. Christ.

Ruthalas 7y ago
Could you provide a good reference for the process you describe, or maybe just a good set of search terms? I'd like to pursue this, but have just little enough experience with ec2 to not be composing effective search terms.
- kizashi 7y ago
  I think one of the interesting option out there is: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand Waiting for https://github.com/StreisandEffect/streisand/pull/1668 https://github.com/StreisandEffect/streisand/pull/1668 to be fixed though.
  - nitzle 7y ago
    Hey, I wrote the PR you just linked (#1668). Was there an issue with the code changes you ran into? Just asking since you said you were waiting for it to be fixed. If so, I'd love to know what the error was so I can test/fix it. Or did you just mean the underlying issue (ACMEv1 protocol being deprecated)?

StanislavPetrov 7y ago

One middleman might be better than another, but 10 middleman are better than 1 if you are truly interested in mitigating the invasion of your privacy. There's nothing preventing you from using multiple VPNs to make it harder for any one middleman to build a profile of your internet activity.

obenn 7y ago
Which is basically TOR
- lsofzz 7y ago
  > Which is basically TOR Last time I checked Tor's technical paper (probably been 10 or so years), it stated the fact that a relay? node in between can only decrypt the information required to route to next hop and not the actual packet's payload. Is that correct or am I dreaming? Also, I recall that if someone malicious flooded the tor network with malicious exit nodes, then all traffic details can be `inferred' right? i.e., the assumption was that exit nodes need to route the packet to destination thus it needed to look at every packet but couldn't infer the originating IP address (based on my dated knowledge :)) If a malicious person now floods the tor network with bazillion exit + relay nodes - then essentially all contents (payload + IP src/dst) can be aggregated. Is this still problem in tor network?

jdormit 7y ago

Why can't your VPN see what pages you visit on sites? They can see every URL you request, can't they?

berbec 7y ago
For https, the only thing sent in plaintext (and this is only if you don't use DoH or similar), is your DNS query (google.com). The rest of the page (search.php?=goat+snuff+videos) is encrypted.
- jdormit 7y ago
  Ah, I see. Thanks!
- lsofzz 7y ago
  Yes. To add, any number of middle boxes during egress from the VPN provider can also sniff the SNI in TLS packet (SNI stands for Server Name Indication and stands on its own as a plain text traffic) before a TLS sessions is established (assuming DoT/DoH DNS scheme is in use) Effort and RFCs are underway to establish what would become part of TLS protocol stack. One of which is eSNI (encrypted SNI).

hawaiian 7y ago

> if you have a good ISP already That's a big IF. Not all of us share the luxury of being able to get internet service from companies like Sonic.net.

foopdoopfoop 7y ago

> but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home. This is just not true. You cannot sign up for an ISP without disclosing at least your name and address. Many VPNs support complete anonymity. It's a different middle man that--if you choose the right one--will absolutely know less about you.

jachee 7y ago
How are you going to access a completely anonymous VPN provider without a non-anonymous internet connection? If your traffic is interesting enough, the money trail will eventually lead back to you.
- lokedhs 7y ago
  Micah Lee did a talk about how he does it. In essence he uses Tor to connect to the VPN. He also explains how to pay for the VPN anonymously. I think it was part of his Qubes OS talk: https://youtu.be/f4U8YbXKwog https://youtu.be/f4U8YbXKwog

secfirstmd 7y ago

I disagree. The comments here are based on a specific threat model. There are many other threat models where a good VPN dramatically increases a users security.

alasdair_ 7y ago

>But remember that you’re trusting the VPN provider with all your traffic. May I suggest hosting youe own VPN using Streisand (https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand)? It's an absolutely fantastic VPN that runs on just about any cloud system out of the box (or your own hardware of course). Right now I use Linode for hosting ($5/month) but there are lots and lots of other ways to set it up. Importantly, setup is easy for all kinds of clients, including mobile devices.

Spy520 7y ago
Making your own VPN sure seems like the safest option but something as popular as Linode won’t be of a use to someone who wants to stream geoblocked services as they most likely are already blacklisted from many.

raxxorrax 7y ago

There is currently a difference in business interest for VPNs and ISPs. ISPs sell your data, since people mostly don't have much choice here anyway. A VPN service who becomes known to share data can probably close their business soon, new ones will quickly fill the void. They have less infrastructure requirements than ISPs and a subset of users with different expectations to privacy. So yes, I do think there is quite a difference, although you should still be critical of your VPN provider.

morpheuskafka 7y ago

Also worth noting that while VPN providers don't care what DNS servers you use, the geo-blocking protection features usually require that you use their DNS servers.