5 ms·

> At Mozilla, we are working hard to build products to help you control of your privacy and stay safe online. > We know that we are on the right path to buildi

> At Mozilla, we are working hard to build products to help you control of your privacy and stay safe online. > We know that we are on the right path to building a VPN that makes your online experience safer Commercial VPNs are good for censorship circumvention or location spoofing. It is irresponsible to market VPNs as something which “protects” you online. In reality, they do nothing to improve security, and very little to improve privacy. You do not need a VPN. https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://schub.io/blog/2019/04/08/very-precarious-narrative.html https://schub.io/blog/2019/04/08/very-precarious-narrative.h...

ryantgtg 6y ago
The "Don't use VPN services" argument is weak because it doesn't acknowledge one of the most common reasons for using a VPN: avoiding DMCA notices.
- surround 6y ago
  That’s what I said. VPNs are good for “location spoofing,” i.e. changing your web-facing IP address to a different region. VPNs are great for this purpose. The issue is, VPN companies (Mozilla included) are marketing their service as one that improves your safety when it doesn’t.
  - ryantgtg 6y ago
    The value of location spoofing is to access geographically-restricted content (like a netflix show that is available through their service in Europe but not the US), not to avoid DMCA notices. VPNs are valuable for avoiding DMCA because it hides from your ISP (the entity serving you the notice) what you are torrenting.
    - Dahoon 6y ago
      If you live in a place where the ISP actually looks at what you torrent and does something about it then you clearly need a VPN. Luckily that mostly happens in places where a DMCA is the least of your worries, like eastern europe and the middle east.
      - ryantgtg 6y ago
        I don't know anything about how frequently Eastern European and Middle East countries act on DMCA. But I do know that this frequently occurs with US ISPs.
r3trohack3r 6y ago
I see this take a lot. Serious question: doesn't the U.S. government surveillance program focus on collecting communication metadata for U.S. citizens? While it isn't clear what that metadata includes, we do have examples of past programs that have leaked (and the legal theory used to justify them) to guide us. Given what we publicly know about these surveillance programs I could see FISC approving bulk metadata collection for the IPv4 header content, insecure HTTP header content, and DNS queries. Wouldn't using a VPN, DNS over HTTPS, and HTTPS everywhere shield you from these bulk metadata collection programs? I run https://everytwoyears.org https://everytwoyears.org, a political non-profit focused on ending these programs, and I view VPNs as a key technical piece of preventing these metadata collection programs from functioning; if the security community doesn't believe they are effective, I would really like to know! Another way of saying this: collecting _content_ of a communication requires a warrant (and our mass surveillance programs respect that from what we publicly know). Most people that I know aren't trying to avoid active (we have a warrant to search you) monitoring with a VPN, but trying to avoid passive warrantless monitoring. Obscuring communication metadata through encryption and tunneling seems to be an effective way of doing this.
- surround 6y ago
  This is a good question and I would like to discuss it. If the government is able to passively collect metadata from your ISP, couldn’t they do the same thing with a VPN company?
  - r3trohack3r 6y ago
    The original form of the Presidential Surveillance Program didn't compel service providers to share this metadata. The providers willingly shared it. There is a reference to a service provider backing out of the agreement several years after it started stating they would feel more comfortable continuing to share their data if the government compelled them. This may have changed since 2013.
- PureParadigm 6y ago
  If I were a government trying to gather metadata about web usage, the first thing I'd do is set up or acquire my own VPN company (and make it look convincing, of course).
deleted 6y ago
[deleted]
danShumway 6y ago
> In reality, they do nothing to improve security This is a bad take. I don't have the energy/time to go too in depth at the moment, but I've commented in more detail in the past. The short version: - HTTPS isn't perfect, sites sometimes support old encryption protocols that can leak resource information. Most users aren't checking packets from native apps to ensure they're being sent over HTTPS, and browsers don't mark sites that are configured for old SSL/TLS versions as insecure. - Most people aren't currently using encrypted DNS, and even as browsers like Firefox and Chrome move to turn it on by default, there will still be tons of older devices and native applications that lag behind. - VPNs only encrypt your connection from you to the provider, but the space between you and the provider is the part that's most likely to be targeted by attackers. You are far more likely to accidentally send a plaintext POST request to an infected router than you are to be targeted by a nation-state actor on the open web. - VPNs aren't just for hiding what sites you visit from your ISP, they're also for hiding your IP address. The linked claim that IP addresses are irrelevant is just outright wrong, IP addresses are extremely helpful for doxing, and sites like forums don't always secure them[0]. If you know my IP address, you'll be able to get surprisingly close to my real address. A VPN on its own will not protect you or provide you with a noticeable privacy increase. And a VPN should not be the first thing you reach for if you're trying to improve your privacy. But if you're already using an adblocker, if you're already taking steps to mitigate tracking in Firefox, if you're already disabling Javascript on most sites, if you're already avoiding native apps that break the browser sandbox or engage in hardware tracking, you do eventually reach a point where your IP address is a concern you will want to address. Ask yourself a few questions: - If IP addresses don't actually matter for tracking, then why is TOR wasting so much time and energy trying to mask them? - If masking an IP address doesn't provide any extra privacy, why do some services like Google Captcha penalize shared IP addresses? - If IP addresses don't matter for tracking, why are so many sites using IP bans at all? The answer is that IP addresses do matter, they're just not the only thing that matters. ---- [0]: https://danshumway.com/blog/gamasutra-vulnerabilities/ https://danshumway.com/blog/gamasutra-vulnerabilities/
crazygringo 6y ago
Agreed -- they provide some tiny specific benefits for security (e.g. against Wi-Fi hacking if accessing a site over HTTP, rare these days) and privacy (no geolocating), but the Mozilla copy says: > feel empowered, safe, and independent while being online Huh? This is doing nothing to protect me from any of the common attacks. It's not wiping my cookies. It's not anonymizing my browser fingerprinting. It's not blocking analytics or tracking. It's certainly not protecting my credit card details or password from being hacked from a website's server. Am I more "empowered"? "Safe"? "Independent"? What is this nonsense marketing fluff? To market this as being able to control my privacy or stay safe online is just completely disingenuous. Mozilla should be ashamed for trying to imply such strong claims that are just false.

ryantgtg 6y ago

The "Don't use VPN services" argument is weak because it doesn't acknowledge one of the most common reasons for using a VPN: avoiding DMCA notices.

surround 6y ago
That’s what I said. VPNs are good for “location spoofing,” i.e. changing your web-facing IP address to a different region. VPNs are great for this purpose. The issue is, VPN companies (Mozilla included) are marketing their service as one that improves your safety when it doesn’t.
- ryantgtg 6y ago
  The value of location spoofing is to access geographically-restricted content (like a netflix show that is available through their service in Europe but not the US), not to avoid DMCA notices. VPNs are valuable for avoiding DMCA because it hides from your ISP (the entity serving you the notice) what you are torrenting.
  - Dahoon 6y ago
    If you live in a place where the ISP actually looks at what you torrent and does something about it then you clearly need a VPN. Luckily that mostly happens in places where a DMCA is the least of your worries, like eastern europe and the middle east.
    - ryantgtg 6y ago
      I don't know anything about how frequently Eastern European and Middle East countries act on DMCA. But I do know that this frequently occurs with US ISPs.

r3trohack3r 6y ago

I see this take a lot. Serious question: doesn't the U.S. government surveillance program focus on collecting communication metadata for U.S. citizens? While it isn't clear what that metadata includes, we do have examples of past programs that have leaked (and the legal theory used to justify them) to guide us. Given what we publicly know about these surveillance programs I could see FISC approving bulk metadata collection for the IPv4 header content, insecure HTTP header content, and DNS queries. Wouldn't using a VPN, DNS over HTTPS, and HTTPS everywhere shield you from these bulk metadata collection programs? I run https://everytwoyears.org https://everytwoyears.org, a political non-profit focused on ending these programs, and I view VPNs as a key technical piece of preventing these metadata collection programs from functioning; if the security community doesn't believe they are effective, I would really like to know! Another way of saying this: collecting _content_ of a communication requires a warrant (and our mass surveillance programs respect that from what we publicly know). Most people that I know aren't trying to avoid active (we have a warrant to search you) monitoring with a VPN, but trying to avoid passive warrantless monitoring. Obscuring communication metadata through encryption and tunneling seems to be an effective way of doing this.

surround 6y ago
This is a good question and I would like to discuss it. If the government is able to passively collect metadata from your ISP, couldn’t they do the same thing with a VPN company?
- r3trohack3r 6y ago
  The original form of the Presidential Surveillance Program didn't compel service providers to share this metadata. The providers willingly shared it. There is a reference to a service provider backing out of the agreement several years after it started stating they would feel more comfortable continuing to share their data if the government compelled them. This may have changed since 2013.
PureParadigm 6y ago
If I were a government trying to gather metadata about web usage, the first thing I'd do is set up or acquire my own VPN company (and make it look convincing, of course).

deleted 6y ago

[deleted]

danShumway 6y ago

> In reality, they do nothing to improve security This is a bad take. I don't have the energy/time to go too in depth at the moment, but I've commented in more detail in the past. The short version: - HTTPS isn't perfect, sites sometimes support old encryption protocols that can leak resource information. Most users aren't checking packets from native apps to ensure they're being sent over HTTPS, and browsers don't mark sites that are configured for old SSL/TLS versions as insecure. - Most people aren't currently using encrypted DNS, and even as browsers like Firefox and Chrome move to turn it on by default, there will still be tons of older devices and native applications that lag behind. - VPNs only encrypt your connection from you to the provider, but the space between you and the provider is the part that's most likely to be targeted by attackers. You are far more likely to accidentally send a plaintext POST request to an infected router than you are to be targeted by a nation-state actor on the open web. - VPNs aren't just for hiding what sites you visit from your ISP, they're also for hiding your IP address. The linked claim that IP addresses are irrelevant is just outright wrong, IP addresses are extremely helpful for doxing, and sites like forums don't always secure them[0]. If you know my IP address, you'll be able to get surprisingly close to my real address. A VPN on its own will not protect you or provide you with a noticeable privacy increase. And a VPN should not be the first thing you reach for if you're trying to improve your privacy. But if you're already using an adblocker, if you're already taking steps to mitigate tracking in Firefox, if you're already disabling Javascript on most sites, if you're already avoiding native apps that break the browser sandbox or engage in hardware tracking, you do eventually reach a point where your IP address is a concern you will want to address. Ask yourself a few questions: - If IP addresses don't actually matter for tracking, then why is TOR wasting so much time and energy trying to mask them? - If masking an IP address doesn't provide any extra privacy, why do some services like Google Captcha penalize shared IP addresses? - If IP addresses don't matter for tracking, why are so many sites using IP bans at all? The answer is that IP addresses do matter, they're just not the only thing that matters. ---- [0]: https://danshumway.com/blog/gamasutra-vulnerabilities/ https://danshumway.com/blog/gamasutra-vulnerabilities/

crazygringo 6y ago

Agreed -- they provide some tiny specific benefits for security (e.g. against Wi-Fi hacking if accessing a site over HTTP, rare these days) and privacy (no geolocating), but the Mozilla copy says: > feel empowered, safe, and independent while being online Huh? This is doing nothing to protect me from any of the common attacks. It's not wiping my cookies. It's not anonymizing my browser fingerprinting. It's not blocking analytics or tracking. It's certainly not protecting my credit card details or password from being hacked from a website's server. Am I more "empowered"? "Safe"? "Independent"? What is this nonsense marketing fluff? To market this as being able to control my privacy or stay safe online is just completely disingenuous. Mozilla should be ashamed for trying to imply such strong claims that are just false.