7 ms·

Ask yourself why you want a VPN. Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might b

by Jonnax 6y ago

Ask yourself why you want a VPN. Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough. Is it to watch geo region blocked videos? Then pretty much any service will work for you. Except that video streaming sites have caught on and blocked hosting provider IP blocks. So that might require you to shop around. Do you want the most privacy or want to get around blocking? Then get a VM from a provider and configure a VPN to it. Wireguard works fine. Want to do something illegal? Don't expect a VPN to save you.

Maximus9000 6y ago
> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough. Wouldn't your ISP still see what IP's you are visiting? Then, your ISP could just reverse DNS that IP to get the domain name, right?
- vocatus_gate 6y ago
  Not necessarily, many sites are hosted on the same VPS, or the IP could just be one of 5000 CloudFlare servers serving up the page you requested.
- offmycloud 6y ago
  Maybe, but most ISPs are lazy/cheap and can't do a full-take packet capture of all customers data at the same time. The ones that I have seen usually have a custom or logging DNS server that associates each domain request with a customer account. So yes, in many cases, changing your DNS server is enough to avoid the larger DNS sniffing operations. You should also use an IP check query to make sure that you are really using the DNS server you think, and that you're not being DNATed back to your ISP's DNS server.
  - Skunkleton 6y ago
    DNS is super trivial to redirect. I've been on ISPs that redirect _all_ DNS traffic to their servers regardless of where it was sent. The best solution here is to switch to DoH. Of course then your DoH provider gets to log all of that sweet info instead.
    - Spivak 6y ago
      Not if you run your own DoH endpoint on a VPS!
      - Skunkleton 6y ago
        I have my own unbound running on a VPS. My network intercepts all port 53 traffic, filters out ad servers, and then forwards over wireguard to my VPS. I should probably enable DoH as well. I'm feeling kind of lazy about it though.
        n1try 6y ago
        I think ceasing to use your ISP provider's unencrypted DNS services will already bring quite some boost in privacy for the average internet user. That's why I recently switched to using DNSCrypt (https://github.com/DNSCrypt/dnscrypt-proxy https://github.com/DNSCrypt/dnscrypt-proxy) with one of the public providers listed here: https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers (pick one run by some university or internet activism organization).
        Skunkleton 6y ago
        It also brings an increase in recaptcha puzzles lol
- sigio 6y ago
  Most ISP's wouldn't care... and they shouldn't
- sriram_sun 6y ago
  This time when I changed internet service providers from Cox to AT&t fiber, I was shocked to find that I could not change my DNS to point to the OpenDNS servers!
  - ahnick 6y ago
    AT&T requires you to use their DNS? Did you try doing DoH to bypass?
badRNG 6y ago
>Want to do something illegal? Don't expect a VPN to save you. I'm not condoning piracy, but VPNs are generally a foolproof way to avoid DMCA letters from your ISP. Privacy means something different to every individual, everyone's threat model is different. And many models can benefit from a VPN; journalists, activists, and many others might find benefit from using a VPN.
- Jonnax 6y ago
  Are DMCA letters still a thing? It seems like Torrenting died out significantly over the last 5 years.
  - TulliusCicero 6y ago
    I moved to Germany and apparently they're still very much a thing here. Torrenting popular shows sans VPN is -- at least according to Germans on reddit -- an easy way to get sued, and forced to pay hundreds of euros. Obviously, I have no interest in testing this out myself, so I take their word for it.
    - laingc 6y ago
      I lived in Germany for years, and this is absolutely the case. Don’t mess with torrents in Germany without a VPN. Except for those Linux ISOs, of course.
    - Eremotherium 6y ago
      I got C&D from Daedalic Entertainment. They demanded 1.1k or something along the lines. I was on welfare at the time, so a lawyer was not within my means,so I objected. I'm not sure what happened next because I probably didn't open the letter from the court (getting a manila envelope is fucking scary in addition to the stress of already being broke) but they seemed to have got a verdict against me and suddenly I owed over 2k. That being said I got a few letters from lawyers and replied with a legal note promising not to do it again (with any clause concerning automatic fines removed) and beat them by simply ignoring their demands afterwards. So it's entirely possible that I simply fucked myself with Daedalic by not opening their first letter and replying with a note. I haven't pirated in years but have gotten a VPN and will start back up because the fragmentation in the streaming space pisses me off too much especially since there's stuff I can't legally get here.
cgb223 6y ago
> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough. 8.8.8.8 is Google’s DNS so you’re really just trading being tracked by an ISP to a giant advertising company...
- jefftk 6y ago
  The privacy policy for 8.8.8.8 is actually really good: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy I wish more google products were so explicit in what they log and for what purposes. (Disclosure: I work for Google)
  - johnklos 6y ago
    Not related to this thread: Do you have any way to communicate with actual humans inside of Google who can do anything? There are demonstrable issues with 8.8.8.8, yet I cannot get anything but the occasional form response from every address I've tried.
    - deepbreath 6y ago
      Could you point what you believe to be the issues in the thread?
    - jefftk 6y ago
      If you wanted to describe what was wrong, in a way that I can reproduce it, I could file a bug, yeah
    - frei 6y ago
      Complaining about a reproducible issue on a public forum works. Even if you don't get direct feedback, there's a good chance it will get quickly forwarded to an teams' internal mailing list. A lot of google engineers read hacker news comments, reddit threads, etc. all the time, and generally try and route good feedback where it belongs.
- jwilk 6y ago
jcul 6y ago
Though the last option doesn't give you anonymity. It just gives you privacy from your ISP. Any services you connect to can tie you to the IP of your VM. Sometimes the shared IP of a VPN provider might be desirable.
kd913 6y ago
Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests to their own DNS. If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS. Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.
- eli 6y ago
  T-Mobile US was definitely doing this at one point: silently rerouting popular third-party DNS services back to their servers
- __turbobrew__ 6y ago
  Unless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc.... At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.
  - xrisk 6y ago
    Doesn’t work with a large number of sites because of Cloudflare. Edit: it _is_ easy to read the destination address from TCP packets though.
    - __turbobrew__ 6y ago
      Yea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.
rakoo 6y ago
Additional use case: you want to self host at home ? A VPN will give you a public, stable IP address without having to fiddle with your router and opening ports and NAT-punching and friends
deleted 6y ago
[deleted]
29athrowaway 6y ago
Your ISP can sniff your DNS traffic as it is just a plaintext protocol.
beagle3 6y ago
As long as you don’t use encrypted DNS (e.g. DoH) it doesn’t matter which DNS server you use - the ISP sees your requests and the replies, and the sees you accessing the returned IP within 10 seconds. Also, unless it’s behind Cloudflare. Most nontrivial sites today have a unique IP so even with DoH there’s a good probability any specific site will be identified. If you want your ISP to stay ignorant of where you surf, you MUsT have a VPN.

by Jonnax 6y ago

Maximus9000 6y ago

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough. Wouldn't your ISP still see what IP's you are visiting? Then, your ISP could just reverse DNS that IP to get the domain name, right?

vocatus_gate 6y ago
Not necessarily, many sites are hosted on the same VPS, or the IP could just be one of 5000 CloudFlare servers serving up the page you requested.
offmycloud 6y ago
Maybe, but most ISPs are lazy/cheap and can't do a full-take packet capture of all customers data at the same time. The ones that I have seen usually have a custom or logging DNS server that associates each domain request with a customer account. So yes, in many cases, changing your DNS server is enough to avoid the larger DNS sniffing operations. You should also use an IP check query to make sure that you are really using the DNS server you think, and that you're not being DNATed back to your ISP's DNS server.
- Skunkleton 6y ago
  DNS is super trivial to redirect. I've been on ISPs that redirect _all_ DNS traffic to their servers regardless of where it was sent. The best solution here is to switch to DoH. Of course then your DoH provider gets to log all of that sweet info instead.
  - Spivak 6y ago
    Not if you run your own DoH endpoint on a VPS!
    - Skunkleton 6y ago
      I have my own unbound running on a VPS. My network intercepts all port 53 traffic, filters out ad servers, and then forwards over wireguard to my VPS. I should probably enable DoH as well. I'm feeling kind of lazy about it though.
      - n1try 6y ago
        I think ceasing to use your ISP provider's unencrypted DNS services will already bring quite some boost in privacy for the average internet user. That's why I recently switched to using DNSCrypt (https://github.com/DNSCrypt/dnscrypt-proxy https://github.com/DNSCrypt/dnscrypt-proxy) with one of the public providers listed here: https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers (pick one run by some university or internet activism organization).
        Skunkleton 6y ago
        It also brings an increase in recaptcha puzzles lol
sigio 6y ago
Most ISP's wouldn't care... and they shouldn't
sriram_sun 6y ago
This time when I changed internet service providers from Cox to AT&t fiber, I was shocked to find that I could not change my DNS to point to the OpenDNS servers!
- ahnick 6y ago
  AT&T requires you to use their DNS? Did you try doing DoH to bypass?

badRNG 6y ago

>Want to do something illegal? Don't expect a VPN to save you. I'm not condoning piracy, but VPNs are generally a foolproof way to avoid DMCA letters from your ISP. Privacy means something different to every individual, everyone's threat model is different. And many models can benefit from a VPN; journalists, activists, and many others might find benefit from using a VPN.

Jonnax 6y ago
Are DMCA letters still a thing? It seems like Torrenting died out significantly over the last 5 years.
- TulliusCicero 6y ago
  I moved to Germany and apparently they're still very much a thing here. Torrenting popular shows sans VPN is -- at least according to Germans on reddit -- an easy way to get sued, and forced to pay hundreds of euros. Obviously, I have no interest in testing this out myself, so I take their word for it.
  - laingc 6y ago
    I lived in Germany for years, and this is absolutely the case. Don’t mess with torrents in Germany without a VPN. Except for those Linux ISOs, of course.
  - Eremotherium 6y ago
    I got C&D from Daedalic Entertainment. They demanded 1.1k or something along the lines. I was on welfare at the time, so a lawyer was not within my means,so I objected. I'm not sure what happened next because I probably didn't open the letter from the court (getting a manila envelope is fucking scary in addition to the stress of already being broke) but they seemed to have got a verdict against me and suddenly I owed over 2k. That being said I got a few letters from lawyers and replied with a legal note promising not to do it again (with any clause concerning automatic fines removed) and beat them by simply ignoring their demands afterwards. So it's entirely possible that I simply fucked myself with Daedalic by not opening their first letter and replying with a note. I haven't pirated in years but have gotten a VPN and will start back up because the fragmentation in the streaming space pisses me off too much especially since there's stuff I can't legally get here.

cgb223 6y ago

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough. 8.8.8.8 is Google’s DNS so you’re really just trading being tracked by an ISP to a giant advertising company...

jefftk 6y ago
The privacy policy for 8.8.8.8 is actually really good: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy I wish more google products were so explicit in what they log and for what purposes. (Disclosure: I work for Google)
- johnklos 6y ago
  Not related to this thread: Do you have any way to communicate with actual humans inside of Google who can do anything? There are demonstrable issues with 8.8.8.8, yet I cannot get anything but the occasional form response from every address I've tried.
  - deepbreath 6y ago
    Could you point what you believe to be the issues in the thread?
  - jefftk 6y ago
    If you wanted to describe what was wrong, in a way that I can reproduce it, I could file a bug, yeah
  - frei 6y ago
    Complaining about a reproducible issue on a public forum works. Even if you don't get direct feedback, there's a good chance it will get quickly forwarded to an teams' internal mailing list. A lot of google engineers read hacker news comments, reddit threads, etc. all the time, and generally try and route good feedback where it belongs.
jwilk 6y ago

jcul 6y ago

Though the last option doesn't give you anonymity. It just gives you privacy from your ISP. Any services you connect to can tie you to the IP of your VM. Sometimes the shared IP of a VPN provider might be desirable.

kd913 6y ago

Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests to their own DNS. If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS. Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.

eli 6y ago
T-Mobile US was definitely doing this at one point: silently rerouting popular third-party DNS services back to their servers
__turbobrew__ 6y ago
Unless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc.... At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.
- xrisk 6y ago
  Doesn’t work with a large number of sites because of Cloudflare. Edit: it _is_ easy to read the destination address from TCP packets though.
  - __turbobrew__ 6y ago
    Yea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.

rakoo 6y ago

Additional use case: you want to self host at home ? A VPN will give you a public, stable IP address without having to fiddle with your router and opening ports and NAT-punching and friends

deleted 6y ago

[deleted]

29athrowaway 6y ago

Your ISP can sniff your DNS traffic as it is just a plaintext protocol.

beagle3 6y ago

As long as you don’t use encrypted DNS (e.g. DoH) it doesn’t matter which DNS server you use - the ISP sees your requests and the replies, and the sees you accessing the returned IP within 10 seconds. Also, unless it’s behind Cloudflare. Most nontrivial sites today have a unique IP so even with DoH there’s a good probability any specific site will be identified. If you want your ISP to stay ignorant of where you surf, you MUsT have a VPN.