8 ms·

Every time someone mentions a VPN provider in my techie social circles, the "A VPN doesn't protect you" crowd piles in, usually with links to something like: ht

Every time someone mentions a VPN provider in my techie social circles, the "A VPN doesn't protect you" crowd piles in, usually with links to something like: https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29 I don't understand this argument, but would like to. I run https://everytwoyears.org https://everytwoyears.org, a political non-profit focused on ending the warrantless metadata collection of U.S. citizens' communications. From everything I know about these programs, they are _explicitly_ not collecting content of communications. These programs only collect the metadata about a communication. As citizens, we don't get to have a clear definition of "metadata" (that is classified!) but we can assume anything that isn't the message itself is at risk of being considered metadata, especially if it was shared with a service provider in the normal course of conducting business (i.e. routing a request). For HTTP requests, I assume the body of the request would require a warrant before it can be persisted on a government server. The HTTP headers, if unencrypted, _might_ be considered metadata but I would be surprised. The IPV4 headers are more than likely metadata. DNS queries are more than likely metadata. If you are trying to avoid _active_ surveillance, where your government has a warrant, a VPN isn't going to help you. If you are trying to avoid _active_ surveillance where your adversary doesn't need/want a warrant to search you, a VPN isn't going to help you. But if you are trying to avoid having your internet activity ending up, de-anonymized, in a metadata database that your government does bulk analysis on, a VPN does seem like it would help. It seems like it would help a lot.

koheripbal 6y ago
I think you are correct that VPNs are a sort of half-solution. There are a lot of people that think anything less than 100% isn't worth your time, so they suggest TOR - but TOR has all sorts of annoying limitations that preclude daily usage. Absolute solutions are seldom worth the 10x extra effort they frequently require. Another set of half-solutions can be seen here which will make you more secure... https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/ ESNI, DoH, DNSSEC, and TLS1.3 are fairly easy to setup - and worth your time . Using Firefox with uBlock Origin & PrivacyBadger plus the above gets me to a good enough place. Illegal stuff on the other hand -> TOR. The problem with doing illegal stuff with only half-protections is that the authorities don't need to use the metadata to prove your guilt. After they raid your house they'll have all the parallel construction they need to make it stick. ...then again if you're just buying personal use amounts of drugs - no one at the FBI cares.
- r3trohack3r 6y ago
  I think you cut right to the core of where I get lost in the VPN argument. Tunneling (even through TOR) isn't sufficient if you have someone well funded, highly skilled, and very motivated to watch you. I would posit that purely technical solutions will never solve human problems. Perfect, unbreakable, encryption can be trivially passed with a set of cleverly placed jumper cables. The key, in my opinion, is trying to align technology with the laws that (mostly) already successfully protect us from jumper cable wielding adversaries. From my understanding, The U.S. government interprets "metadata" as having no societal expectation of privacy and therefor they don't need a warrant to collect it. These questionable metadata collection programs seem like they can be effectively thwarted through half measures, like E2E encryption of the metadata (use HTTPS and DNS over HTTPS), obfuscation of the metadata through tunneling (use VPNs), etc. Some metadata I don't have a good answer for, like location data when my cellphone pings the local towers. I can chose to share my location data w/ the tower so it can route calls to me, and submit to that possibly ending up in a government database, or I can keep my phone from talking to the cell tower being unable to send/receive calls. I don't see a half measure...
- fataliss 6y ago
  Do you have a good write up on how to get all that setup by any chance? Also, any body has a comparison of Brave vs Firefox when it comes to privacy?
  - julesallen 6y ago
    https://www.androidpolice.com/2020/06/07/brave-browser-caught-adding-its-own-referral-codes-to-some-cryptcurrency-trading-sites/ https://www.androidpolice.com/2020/06/07/brave-browser-caugh... I was using Brave until this story came out and switched over to Vivaldi for the stuff that absolutely demands the Blink engine. Point one, if they _repeatedly_ continue to do this kind of thing, what kind of stuff are they also getting away with? Or what's the next big surprise around the corner? The second point is I really no prefer Vivaldi as things like sync work (it's been broken for a long time in Brave) and there's more exposed in the prefs for techie types who like to tinker with that kind of thing. Firefox continues to be the every day browser and it keeps getting better as time goes on (another +1 for take my money for email, calendar, file storage, etc.).
Spooky23 6y ago
I doubt it, unless you run the VPN. Governments have the same ability to leverage things like trackers, etc. A public VPN service is good for localized privacy. Even a cheap Ubiquity setup will be able to tell about your habits. It's probably good enough to avoid the attention of a civil or informal inquiry (DMCA, employer, etc).
- r3trohack3r 6y ago
  > Governments have the same ability to leverage things like trackers It's not clear to me whether the methods trackers use to de-anonymize you are considered "content" or "metadata", and whether the U.S. government would need a warrant to access tracker information. Do you have thoughts?
  - Spooky23 6y ago
    You can buy the data on the market without a warrant. VPNs seems like a really obvious bypass of controls and surveillance capability. I’m sure the folks at NSA, et al thought of it too.
    - r3trohack3r 6y ago
      They can think of it, sure. But when you read their testimonies, and read the summaries of leaked documents, you can see they are attempting to be law abiding even if they _really_ stretch to interpret the law. Just because they know its a way to thwart their system doesn't mean they have another "legal" way to collect the same data.
tafl 6y ago
Yeah I've heard this one before. I use Mullvad, paid using BTC that came straight from a tumbler. I don't use it for any nefarious reasons, just wanted to see how such a setup would work. It was surprisingly painless. I think it took 15 minutes in total from moving my btc to the tumbler and having the tumbler move the btc to my Mullvad account. Am I 100% secure? No, they know what IP I'm connecting from. Is my name attached to the VPN? No, not even close. I suppose if I wanted to further improve my security I wouldn't use my own home network, but public wifi's nearby. But again, I didn't do it to stay "safe" or anonymous. Just wanted to see how the process would actually be.
- Shank 6y ago
  > I use Mullvad, paid using BTC that came straight from a tumbler. I don't use it for any nefarious reasons, just wanted to see how such a setup would work. > But again, I didn't do it to stay "safe" or anonymous. I sincerely hope that you're trying to stay safe if you're admitting to money laundering on a public forum.
  - cyberpunk 6y ago
    Tumbling coins has nothing to do with money laundering, it's just a way to anonymize them....
    - ryanlol 6y ago
      Tumbling coins has everything to do with money laundering. Of course, the source of the funds isn’t necessarily illicit.
      - crazygringo 6y ago
        Money laundering is turning dirty money into clean, that appears legitimate, taxable etc. If the source isn't illicit, it isn't laundering because there's nothing to clean. Tumbling coins is just obscuring their origin. The two don't inherently have anything to do with each other. Even if you tumble "dirty" coins, you've got to explain to the IRS the source of income behind the new coins. Tumbling, in and of itself, doesn't achieve that.
closeparen 6y ago
A VPN is just a tunnel from one point to another. You'd have to establish why the remote end is more trustworthy than the local end. Being located in a hostile jurisdiction may be somewhat protective, but it would also seem likely that compromising foreign VPN services is within the NSA's wheelhouse.
- deepbreath 6y ago
  If nothing else, it significantly reduces the entropy of your IP when websites are fingerprinting you, especially if your ISP assigns you a static IP. Even if you don't have a static IP, I suspect the entropy of your /24 (IPv4) is also a lot smaller when over VPN.
  - abofh 6y ago
    Do you understand the words you're using?
    - deepbreath 6y ago
      I thought I did? The condescending attitude is unnecessary. Happy to clarify my point if my initial comment was confusing: Websites such as http://panopticlick.eff.org/ http://panopticlick.eff.org/ showcase how fingerprinting works. They tell you how many bits of information they can extract from various datapoints they get out of you when visiting their site, such as User-Agent. Panopticlick does not use your IP address as a datapoint, but actual trackers most likely do. If not your IP directly, then a prefix thereof (such as your /24), to account for ISPs w/ dynamic IP allocation. If you have a static IP, there's a lot of bits of entropy in it, i.e. it's great for fingerprinting. It's basically sufficient, by itself, to uniquely identify your home. The handful of devices in your home can then likely be distinguished by the User-Agent. If you're part of your ISP's small dynamic IP pool (e.g. a /24), there's probably still a lot of entropy in there. How many people in your neighborhood are also on Linux and have the same set of fonts installed? Probably just you. Your VPN's dynamic IP subnets, OTOH, can be a lot larger, and the members of the pool are not geographically close to one another, so there's probably a lot less fingerprinting entropy in your IP in that case.
miniyarov 6y ago
This is very totally legit that public VPN services are complete trash. Online anonymity is very hard. However, you can still create your own VPN server on cloud providers for at least have some privacy while you are on an untrusted network. Because of this reason, I created zudvpn.com - It is a free and open-source mobile application that's used to deploy a private VPN server on major Cloud Providers! Github repo: https://github.com/zudvpn/ZudVPN https://github.com/zudvpn/ZudVPN
- RealStickman_ 6y ago
  Why would a VPS server be any more secure than a VPN provider? They have the same ability to view outgoing traffic and can very easily log the source ip address.
  - miniyarov 6y ago
    http://zudvpn.com http://zudvpn.com does not provide complete anonymity. The idea is that you control your own server and you make sure that nobody is logging your every move. Even though public VPNs claim that they don't log, you should not blindly trust them. Check GH repo to see how https://ZudVPN.com https://ZudVPN.com generates SSH key on your phone and locks the VPN server with the key that is only available for you.
ccktlmazeltov 6y ago
Most people use a VPN because it lets them have a different geolocation (to watch Netflix in a different country, access thepiratebay, etc.) If you do use a VPN to mask your traffic, there are two questions to ask yourself: 1. who are you masking your traffic from? 2. can you trust the VPN network more? In general, you cannot trust a VPN network more, and HTTPS is the solution as it provides end-to-end encryption with some important caveats (web PKI) Running your own VPN is not a good solution either, because who owns the servers where your VPN is running?
- r3trohack3r 6y ago
  HTTPS protects content. Content requires a warrant in the united states. The bulk metadata programs, as far as we know, only collect metadata. Which two IP addresses communicated, the routes they took, the size of the payloads, etc. are all "metadata". HTTPS, AFAIK, does not solve this.
  - ccktlmazeltov 6y ago
    Using a VPN adds indirection but can give you a sense of false security as well. Metadata is obviously the least important data to analyze, but for example a VPN does not hide the size of payloads. TLS 1.3 do addresses that and let's you randomly pad messages but I don't think anybody use that.
- dannyw 6y ago
  You can use HTTPS with a VPN. With HSTS and certificate transparency, a modern browser will not let you get compromised by a HTTPS MITM. I also trust many VPN providers more than my ISP, which actively engages in MITM like compressing images to be a lower resolution on HTTP pages on 4G networks.
edw 6y ago
There’s a lot of gross stuff that your ISPs (which includes your mobile phone provider) do to further monetize your relationship with them, and having a VPN can negate that. ISPs can observe your DNS lookups to their servers and assemble a profile on you based on the domain names you look up, and put you into a series of audiences that marketers can then use (for a fee) for ad targeting. ISPs can also observer your DNS lookups to Google’s or anyone else’s public DNS servers. ISPs can snoop on your unencrypted traffic, proxy it, and inject headers into HTTP responses to facilitate (you guessed it) the creation and sale of audience data to advertisers. ISPs can transcode (and downsample) multimedia content to decongest their pipes or airwaves. If you are a spy or a member of a disfavored political group, you should almost appreciate the scummy practices of ISPs, as it drives a bunch of non-spies and people not associated with disfavored political groups to adopt privacy-enhancing technologies. If I worked at the NSA or CIA or FSB or Mossad or wherever, I would highly encourage lawmakers to enact laws to protect consumer privacy in order to drastically reduce the perceived need for people not in the above groups (et alia) to adopt VPNs and other technologies; there would be fewer “boring” people using such technologies, giving the needles a lot less haystack to get lost in.
- Kelamir 6y ago
  > ISPs can also observer your DNS lookups to Google’s or anyone else’s public DNS servers. edw, could you elaborate on that, please? I thought changing to public DNS servers like OpenDNS provides some security from ISP tracking.
  - stuuuuuuuuu 6y ago
    Traffic between you and the public DNS servers isn't encrypted, so your ISP can still read it. (I suppose this is one of the problems that DNS-over-HTTPS is designed to fix.)
    - Kelamir 6y ago
      Thank you for the answer, stuuuuuuuuu! I'll look into it. ... DNS-over-HTTPS can be enabled in Firefox via Network settings, turns out.
yurlungur 6y ago
I'm not qualified to analyze the technical details but I have some more practical grievances with VPNs. I paid for ExpressVPN for 1yr on going and found it disappointing despite being advertised as the expensive but good option. First, geo blocking often catches it or provider has moved to other means to verify address. I don't use Netflix but for certain streaming sites in Japan that I use and BBC express does nothing. Second, it doesn't get pass GFW whereas shadowsocks based solution does. Overall it seems the only benefits are getting better speed sometimes and theoretical privacy benefits.
zaptheimpaler 6y ago
If you assume VPNs don't keep logs forever, then a VPN is very strong protection. Seems like all the anti VPN arguments are predicated on the VPN keeping exhaustive logs of every request. Given the volume of data and the incentives of businesses, i feel like thats probably not true for many VPNs. I generally believe them when they say they don't log, because its just more $$$ on storage that provide 0 value to the company unless they are required by law.
WealthVsSurvive 6y ago
They are explicitly collecting both the metadata and the content of all communications they are able to. They have burned their own when someone raises a complaint about their methods or dares to introduce crypto that respects constitutionality(https://en.wikipedia.org/wiki/Thomas_Andrews_Drake https://en.wikipedia.org/wiki/Thomas_Andrews_Drake).
- r3trohack3r 6y ago
  I'm not able to see anything here that references the content being collected. Maybe I'm not looking closely enough?
peterwwillis 6y ago
A VPN is a crappy hack around a bigger problem. Protocols are not designed for what we use them for, and buggy legacy applications that won't change their protocols or implement them correctly. The more people use VPNs, the more the problem gets buried behind a wall of abstraction. The proliferation of VPNs is really the burying of a problem, not the solution. I don't care about being tracked, because I live my life in the open. I'm not a vulnerable minority, so I don't fear for my safety. I don't care what a random corporation (or anyone, really) knows about me. You could log into every digital account I have, and the only thing I'd be worried about you finding is an active session to my bank's website if I was still logged in at the time. I don't care if my ISP "monetizes me". I also know how to browse the web as securely as possible, and that there are plenty of ways I can be hacked regardless of my network connection. The biggest risk I face is not from a VPN, but from my local network: if my internet modem or router gets compromised (either remotely or through my machine), I'm subject to local attacks a VPN won't protect me from. And if the government wants to hack me, they'll just guess what websites I'm viewing (either by conventional means or statistical traffic analysis), hack the server, and drop a payload through a browser 0-day. I could see using a VPN if I was an activist, or of a class of citizen that's oppressed by my society or government. But even then, they'd figure out I was using a VPN, and realize I'm hiding something. So you could argue everyone should be on a VPN to make this less noticeable. But then we go back to the beginning: we're not solving the root problem.
egd 6y ago
I'm a fan of James Mickens' "Mossad or Not-Mossad" internet threat models ~essay: https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- teddyh 6y ago
  Despite his somewhat annoying style, that article has many good points about the aloofness of security researchers. However, I will disagree on two points which the article contains: 1. Tor is (rightly) used by anyone who has a good reason for remaining anonymous. (See [REALNAMES] for who this can be.) Anyone trying to smear Tor as only used by drug dealers and other unsavory types are themselves suspect of having an agenda of discouraging Tor use for anyone lest they be suspected. This can only lead to an installation of Tor being viewed as a suspicious thing in itself; who would want that? 2. His threat model of Mossad or not-Mossad leaves out one important actor, which we can call the NSA. They, and others like them, unlike Mossad, are not after you personally in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. He seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger. [REALNAMES] Who is harmed by a "Real Names" policy? https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Real_Names%22_policy%3F https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Re...
bluedays 6y ago
Browser fingerprinting means you can more or less be identified regardless of your IP address. Since tracking is more or less tied to the browser should you not use the VPN in some instance the browser fingerprint remains the same. So all the Facebook/Google tracking will be able to determine who you are after you change your IP.
- r3trohack3r 6y ago
  Yup. But it isn't clear to me whether that tracking information would be considered "content" (and require a warrant) or "metadata" and be subject to mass warrantless data collection. Do you have thoughts?
  - bluedays 6y ago
    I don't know. Probably better to ask a lawyer something like this.

koheripbal 6y ago

I think you are correct that VPNs are a sort of half-solution. There are a lot of people that think anything less than 100% isn't worth your time, so they suggest TOR - but TOR has all sorts of annoying limitations that preclude daily usage. Absolute solutions are seldom worth the 10x extra effort they frequently require. Another set of half-solutions can be seen here which will make you more secure... https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/ ESNI, DoH, DNSSEC, and TLS1.3 are fairly easy to setup - and worth your time . Using Firefox with uBlock Origin & PrivacyBadger plus the above gets me to a good enough place. Illegal stuff on the other hand -> TOR. The problem with doing illegal stuff with only half-protections is that the authorities don't need to use the metadata to prove your guilt. After they raid your house they'll have all the parallel construction they need to make it stick. ...then again if you're just buying personal use amounts of drugs - no one at the FBI cares.

r3trohack3r 6y ago
I think you cut right to the core of where I get lost in the VPN argument. Tunneling (even through TOR) isn't sufficient if you have someone well funded, highly skilled, and very motivated to watch you. I would posit that purely technical solutions will never solve human problems. Perfect, unbreakable, encryption can be trivially passed with a set of cleverly placed jumper cables. The key, in my opinion, is trying to align technology with the laws that (mostly) already successfully protect us from jumper cable wielding adversaries. From my understanding, The U.S. government interprets "metadata" as having no societal expectation of privacy and therefor they don't need a warrant to collect it. These questionable metadata collection programs seem like they can be effectively thwarted through half measures, like E2E encryption of the metadata (use HTTPS and DNS over HTTPS), obfuscation of the metadata through tunneling (use VPNs), etc. Some metadata I don't have a good answer for, like location data when my cellphone pings the local towers. I can chose to share my location data w/ the tower so it can route calls to me, and submit to that possibly ending up in a government database, or I can keep my phone from talking to the cell tower being unable to send/receive calls. I don't see a half measure...
fataliss 6y ago
Do you have a good write up on how to get all that setup by any chance? Also, any body has a comparison of Brave vs Firefox when it comes to privacy?
- julesallen 6y ago
  https://www.androidpolice.com/2020/06/07/brave-browser-caught-adding-its-own-referral-codes-to-some-cryptcurrency-trading-sites/ https://www.androidpolice.com/2020/06/07/brave-browser-caugh... I was using Brave until this story came out and switched over to Vivaldi for the stuff that absolutely demands the Blink engine. Point one, if they _repeatedly_ continue to do this kind of thing, what kind of stuff are they also getting away with? Or what's the next big surprise around the corner? The second point is I really no prefer Vivaldi as things like sync work (it's been broken for a long time in Brave) and there's more exposed in the prefs for techie types who like to tinker with that kind of thing. Firefox continues to be the every day browser and it keeps getting better as time goes on (another +1 for take my money for email, calendar, file storage, etc.).

Spooky23 6y ago

I doubt it, unless you run the VPN. Governments have the same ability to leverage things like trackers, etc. A public VPN service is good for localized privacy. Even a cheap Ubiquity setup will be able to tell about your habits. It's probably good enough to avoid the attention of a civil or informal inquiry (DMCA, employer, etc).

r3trohack3r 6y ago
> Governments have the same ability to leverage things like trackers It's not clear to me whether the methods trackers use to de-anonymize you are considered "content" or "metadata", and whether the U.S. government would need a warrant to access tracker information. Do you have thoughts?
- Spooky23 6y ago
  You can buy the data on the market without a warrant. VPNs seems like a really obvious bypass of controls and surveillance capability. I’m sure the folks at NSA, et al thought of it too.
  - r3trohack3r 6y ago
    They can think of it, sure. But when you read their testimonies, and read the summaries of leaked documents, you can see they are attempting to be law abiding even if they _really_ stretch to interpret the law. Just because they know its a way to thwart their system doesn't mean they have another "legal" way to collect the same data.

tafl 6y ago

Yeah I've heard this one before. I use Mullvad, paid using BTC that came straight from a tumbler. I don't use it for any nefarious reasons, just wanted to see how such a setup would work. It was surprisingly painless. I think it took 15 minutes in total from moving my btc to the tumbler and having the tumbler move the btc to my Mullvad account. Am I 100% secure? No, they know what IP I'm connecting from. Is my name attached to the VPN? No, not even close. I suppose if I wanted to further improve my security I wouldn't use my own home network, but public wifi's nearby. But again, I didn't do it to stay "safe" or anonymous. Just wanted to see how the process would actually be.

Shank 6y ago
> I use Mullvad, paid using BTC that came straight from a tumbler. I don't use it for any nefarious reasons, just wanted to see how such a setup would work. > But again, I didn't do it to stay "safe" or anonymous. I sincerely hope that you're trying to stay safe if you're admitting to money laundering on a public forum.
- cyberpunk 6y ago
  Tumbling coins has nothing to do with money laundering, it's just a way to anonymize them....
  - ryanlol 6y ago
    Tumbling coins has everything to do with money laundering. Of course, the source of the funds isn’t necessarily illicit.
    - crazygringo 6y ago
      Money laundering is turning dirty money into clean, that appears legitimate, taxable etc. If the source isn't illicit, it isn't laundering because there's nothing to clean. Tumbling coins is just obscuring their origin. The two don't inherently have anything to do with each other. Even if you tumble "dirty" coins, you've got to explain to the IRS the source of income behind the new coins. Tumbling, in and of itself, doesn't achieve that.

closeparen 6y ago

A VPN is just a tunnel from one point to another. You'd have to establish why the remote end is more trustworthy than the local end. Being located in a hostile jurisdiction may be somewhat protective, but it would also seem likely that compromising foreign VPN services is within the NSA's wheelhouse.

deepbreath 6y ago
If nothing else, it significantly reduces the entropy of your IP when websites are fingerprinting you, especially if your ISP assigns you a static IP. Even if you don't have a static IP, I suspect the entropy of your /24 (IPv4) is also a lot smaller when over VPN.
- abofh 6y ago
  Do you understand the words you're using?
  - deepbreath 6y ago
    I thought I did? The condescending attitude is unnecessary. Happy to clarify my point if my initial comment was confusing: Websites such as http://panopticlick.eff.org/ http://panopticlick.eff.org/ showcase how fingerprinting works. They tell you how many bits of information they can extract from various datapoints they get out of you when visiting their site, such as User-Agent. Panopticlick does not use your IP address as a datapoint, but actual trackers most likely do. If not your IP directly, then a prefix thereof (such as your /24), to account for ISPs w/ dynamic IP allocation. If you have a static IP, there's a lot of bits of entropy in it, i.e. it's great for fingerprinting. It's basically sufficient, by itself, to uniquely identify your home. The handful of devices in your home can then likely be distinguished by the User-Agent. If you're part of your ISP's small dynamic IP pool (e.g. a /24), there's probably still a lot of entropy in there. How many people in your neighborhood are also on Linux and have the same set of fonts installed? Probably just you. Your VPN's dynamic IP subnets, OTOH, can be a lot larger, and the members of the pool are not geographically close to one another, so there's probably a lot less fingerprinting entropy in your IP in that case.

miniyarov 6y ago

This is very totally legit that public VPN services are complete trash. Online anonymity is very hard. However, you can still create your own VPN server on cloud providers for at least have some privacy while you are on an untrusted network. Because of this reason, I created zudvpn.com - It is a free and open-source mobile application that's used to deploy a private VPN server on major Cloud Providers! Github repo: https://github.com/zudvpn/ZudVPN https://github.com/zudvpn/ZudVPN

RealStickman_ 6y ago
Why would a VPS server be any more secure than a VPN provider? They have the same ability to view outgoing traffic and can very easily log the source ip address.
- miniyarov 6y ago
  http://zudvpn.com http://zudvpn.com does not provide complete anonymity. The idea is that you control your own server and you make sure that nobody is logging your every move. Even though public VPNs claim that they don't log, you should not blindly trust them. Check GH repo to see how https://ZudVPN.com https://ZudVPN.com generates SSH key on your phone and locks the VPN server with the key that is only available for you.

ccktlmazeltov 6y ago

Most people use a VPN because it lets them have a different geolocation (to watch Netflix in a different country, access thepiratebay, etc.) If you do use a VPN to mask your traffic, there are two questions to ask yourself: 1. who are you masking your traffic from? 2. can you trust the VPN network more? In general, you cannot trust a VPN network more, and HTTPS is the solution as it provides end-to-end encryption with some important caveats (web PKI) Running your own VPN is not a good solution either, because who owns the servers where your VPN is running?

r3trohack3r 6y ago
HTTPS protects content. Content requires a warrant in the united states. The bulk metadata programs, as far as we know, only collect metadata. Which two IP addresses communicated, the routes they took, the size of the payloads, etc. are all "metadata". HTTPS, AFAIK, does not solve this.
- ccktlmazeltov 6y ago
  Using a VPN adds indirection but can give you a sense of false security as well. Metadata is obviously the least important data to analyze, but for example a VPN does not hide the size of payloads. TLS 1.3 do addresses that and let's you randomly pad messages but I don't think anybody use that.
dannyw 6y ago
You can use HTTPS with a VPN. With HSTS and certificate transparency, a modern browser will not let you get compromised by a HTTPS MITM. I also trust many VPN providers more than my ISP, which actively engages in MITM like compressing images to be a lower resolution on HTTP pages on 4G networks.

edw 6y ago

There’s a lot of gross stuff that your ISPs (which includes your mobile phone provider) do to further monetize your relationship with them, and having a VPN can negate that. ISPs can observe your DNS lookups to their servers and assemble a profile on you based on the domain names you look up, and put you into a series of audiences that marketers can then use (for a fee) for ad targeting. ISPs can also observer your DNS lookups to Google’s or anyone else’s public DNS servers. ISPs can snoop on your unencrypted traffic, proxy it, and inject headers into HTTP responses to facilitate (you guessed it) the creation and sale of audience data to advertisers. ISPs can transcode (and downsample) multimedia content to decongest their pipes or airwaves. If you are a spy or a member of a disfavored political group, you should almost appreciate the scummy practices of ISPs, as it drives a bunch of non-spies and people not associated with disfavored political groups to adopt privacy-enhancing technologies. If I worked at the NSA or CIA or FSB or Mossad or wherever, I would highly encourage lawmakers to enact laws to protect consumer privacy in order to drastically reduce the perceived need for people not in the above groups (et alia) to adopt VPNs and other technologies; there would be fewer “boring” people using such technologies, giving the needles a lot less haystack to get lost in.

Kelamir 6y ago
> ISPs can also observer your DNS lookups to Google’s or anyone else’s public DNS servers. edw, could you elaborate on that, please? I thought changing to public DNS servers like OpenDNS provides some security from ISP tracking.
- stuuuuuuuuu 6y ago
  Traffic between you and the public DNS servers isn't encrypted, so your ISP can still read it. (I suppose this is one of the problems that DNS-over-HTTPS is designed to fix.)
  - Kelamir 6y ago
    Thank you for the answer, stuuuuuuuuu! I'll look into it. ... DNS-over-HTTPS can be enabled in Firefox via Network settings, turns out.

yurlungur 6y ago

I'm not qualified to analyze the technical details but I have some more practical grievances with VPNs. I paid for ExpressVPN for 1yr on going and found it disappointing despite being advertised as the expensive but good option. First, geo blocking often catches it or provider has moved to other means to verify address. I don't use Netflix but for certain streaming sites in Japan that I use and BBC express does nothing. Second, it doesn't get pass GFW whereas shadowsocks based solution does. Overall it seems the only benefits are getting better speed sometimes and theoretical privacy benefits.

zaptheimpaler 6y ago

If you assume VPNs don't keep logs forever, then a VPN is very strong protection. Seems like all the anti VPN arguments are predicated on the VPN keeping exhaustive logs of every request. Given the volume of data and the incentives of businesses, i feel like thats probably not true for many VPNs. I generally believe them when they say they don't log, because its just more $$$ on storage that provide 0 value to the company unless they are required by law.

WealthVsSurvive 6y ago

They are explicitly collecting both the metadata and the content of all communications they are able to. They have burned their own when someone raises a complaint about their methods or dares to introduce crypto that respects constitutionality(https://en.wikipedia.org/wiki/Thomas_Andrews_Drake https://en.wikipedia.org/wiki/Thomas_Andrews_Drake).

r3trohack3r 6y ago
I'm not able to see anything here that references the content being collected. Maybe I'm not looking closely enough?

peterwwillis 6y ago

A VPN is a crappy hack around a bigger problem. Protocols are not designed for what we use them for, and buggy legacy applications that won't change their protocols or implement them correctly. The more people use VPNs, the more the problem gets buried behind a wall of abstraction. The proliferation of VPNs is really the burying of a problem, not the solution. I don't care about being tracked, because I live my life in the open. I'm not a vulnerable minority, so I don't fear for my safety. I don't care what a random corporation (or anyone, really) knows about me. You could log into every digital account I have, and the only thing I'd be worried about you finding is an active session to my bank's website if I was still logged in at the time. I don't care if my ISP "monetizes me". I also know how to browse the web as securely as possible, and that there are plenty of ways I can be hacked regardless of my network connection. The biggest risk I face is not from a VPN, but from my local network: if my internet modem or router gets compromised (either remotely or through my machine), I'm subject to local attacks a VPN won't protect me from. And if the government wants to hack me, they'll just guess what websites I'm viewing (either by conventional means or statistical traffic analysis), hack the server, and drop a payload through a browser 0-day. I could see using a VPN if I was an activist, or of a class of citizen that's oppressed by my society or government. But even then, they'd figure out I was using a VPN, and realize I'm hiding something. So you could argue everyone should be on a VPN to make this less noticeable. But then we go back to the beginning: we're not solving the root problem.

egd 6y ago

I'm a fan of James Mickens' "Mossad or Not-Mossad" internet threat models ~essay: https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf

teddyh 6y ago
Despite his somewhat annoying style, that article has many good points about the aloofness of security researchers. However, I will disagree on two points which the article contains: 1. Tor is (rightly) used by anyone who has a good reason for remaining anonymous. (See [REALNAMES] for who this can be.) Anyone trying to smear Tor as only used by drug dealers and other unsavory types are themselves suspect of having an agenda of discouraging Tor use for anyone lest they be suspected. This can only lead to an installation of Tor being viewed as a suspicious thing in itself; who would want that? 2. His threat model of Mossad or not-Mossad leaves out one important actor, which we can call the NSA. They, and others like them, unlike Mossad, are not after you personally in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. He seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger. [REALNAMES] Who is harmed by a "Real Names" policy? https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Real_Names%22_policy%3F https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Re...

bluedays 6y ago

Browser fingerprinting means you can more or less be identified regardless of your IP address. Since tracking is more or less tied to the browser should you not use the VPN in some instance the browser fingerprint remains the same. So all the Facebook/Google tracking will be able to determine who you are after you change your IP.

r3trohack3r 6y ago
Yup. But it isn't clear to me whether that tracking information would be considered "content" (and require a warrant) or "metadata" and be subject to mass warrantless data collection. Do you have thoughts?
- bluedays 6y ago
  I don't know. Probably better to ask a lawyer something like this.