6 ms·

A VPN is just a tunnel from one point to another. You'd have to establish why the remote end is more trustworthy than the local end. Being located in a hostile

A VPN is just a tunnel from one point to another. You'd have to establish why the remote end is more trustworthy than the local end. Being located in a hostile jurisdiction may be somewhat protective, but it would also seem likely that compromising foreign VPN services is within the NSA's wheelhouse.

deepbreath 6y ago
If nothing else, it significantly reduces the entropy of your IP when websites are fingerprinting you, especially if your ISP assigns you a static IP. Even if you don't have a static IP, I suspect the entropy of your /24 (IPv4) is also a lot smaller when over VPN.
- abofh 6y ago
  Do you understand the words you're using?
  - deepbreath 6y ago
    I thought I did? The condescending attitude is unnecessary. Happy to clarify my point if my initial comment was confusing: Websites such as http://panopticlick.eff.org/ http://panopticlick.eff.org/ showcase how fingerprinting works. They tell you how many bits of information they can extract from various datapoints they get out of you when visiting their site, such as User-Agent. Panopticlick does not use your IP address as a datapoint, but actual trackers most likely do. If not your IP directly, then a prefix thereof (such as your /24), to account for ISPs w/ dynamic IP allocation. If you have a static IP, there's a lot of bits of entropy in it, i.e. it's great for fingerprinting. It's basically sufficient, by itself, to uniquely identify your home. The handful of devices in your home can then likely be distinguished by the User-Agent. If you're part of your ISP's small dynamic IP pool (e.g. a /24), there's probably still a lot of entropy in there. How many people in your neighborhood are also on Linux and have the same set of fonts installed? Probably just you. Your VPN's dynamic IP subnets, OTOH, can be a lot larger, and the members of the pool are not geographically close to one another, so there's probably a lot less fingerprinting entropy in your IP in that case.
    - zrobotics 6y ago
      I think the negative reaction to your earlier comment comes from your mis-use of the term entropy. A static ip, for purposes of tracking you as an individual, has very, very little entropy (in fact, none) . High entropy would be a dynamic IP that is refreshed from a large pool very often. Additionally, very few ISPs assign static IPs anymore, not unless you pay 5x the price for a business account. Trackers, by and large, don't really pay much attention to IP, since much more reliable metrics have been implemented. Sure, it probably is used to a small extent, but there are much more effective steps that can be taken. https://en.wikipedia.org/wiki/Entropy_%28computing%29?wprov=sfla1 https://en.wikipedia.org/wiki/Entropy_%28computing%29?wprov=...
      - GoblinSlayer 6y ago
        VPN users get IPs from a small pool, so little entropy. The larger pool you select IP from, the more unique is your IP.
  - dang 6y ago
    Personal attacks aren't ok here. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting, we'd be grateful.
wongarsu 6y ago
Unless I set up my own VPN I'll share a VPN server and IP with other people. That makes my traffic inherently more anonymous once it has left the VPN server, since you can't correlate traffic to a single person anymore. So even if traffic in the data center is analyzed, that's better than my ISP analyzing traffic. Thus we only have to establish that the VPN provider is at least as trustworthy as my ISP. That's a pretty low bar to clear in many places. I have no doubt some VPNs are operated by nefarious actors (no better way to collect high quality data), but I don't think that's a concern with Mozilla.
- closeparen 6y ago
  You should expect that the government can compel a VPN provider to correlate traffic to subscriber information exactly the same way it does with a residential ISP.
  - wongarsu 6y ago
    Sure, but the set of governments that can compel my ISP might be different from the set of governments that can compel my VPN. I don't care about all governments equally, and my own government has a disproportional impact on me compared to most other governments.
  - r3trohack3r 6y ago
    If they have a warrant a VPN isn't going to protect you. If you think you are under active surveillance, you want more than a VPN. Write-ups of the 2013 leaks revealed they did not compel ISPs to correlate traffic to subscriber information. It doesn't seem like they had any subscriber information in their database, only enough metadata about the communications to later compel a ISP to provide the subscriber information _postmortem_ (i.e. who did this cellphone number belong to on this date?). ISPs weren't even compelled to share that metadata. It was a voluntary program. Some ISPs said no. Others said yes and then later backed out. In the end something like 80% of the traffic the NSA was after was able to be collected through the ISPs that voluntarily shared their data. But, again, this was 2013. 2013 was forever ago, things may have changed.
- 6y ago
r3trohack3r 6y ago
Agreed. I think the key for me is that, at least under the original Presidential Surveillance Program, the providers that participated were not compelled to share their user's metadata. They shared it willingly, regularly, and in bulk. There is reference to a service provider backing out of this agreement a few years later, telling the NSA they would feel more comfortable sharing the data if it were compelled. It's not clear if this has changed since 2013. But assuming Mozilla, or Mullvad, isn't compelled to share _all of their data_ it seems unlikely that they would willingly give that up to a government surveillance program. I think ISPs have demonstrated they aren't trustworthy. For most people in the U.S., it seems, finding someone more trustworthy than their ISP is literally anyone who isn't admitting that they collect and share their private data. I would be surprised if Mozilla doesn't clear this bar.
weavejester 6y ago
Even if you trust your ISP, and it's not required to keep logs due to local laws, a VPN is often a good idea anyway. Geolocation from IP address can be scarily accurate - mine identifies me to within a mile radius of where I live.
mike_d 6y ago
> compromising foreign VPN services is within the NSA's wheelhouse This is the explicit danger of VPN providers. Even if the provider is not complicit (which I believe applies to the likes of Mozilla), it still creates a centralized aggregation site for collection. I'm not even sure a US-based VPN provider is safe. GCHQ just conducts the interception and would share the data with NSA. At that point, you are at the mercy of the NSAs locators being good enough to flag your tunneled traffic as "reasonably a US person" so it gets excluded.
- toyg 6y ago
  > I'm not even sure a US-based VPN provider is safe. Oh, I am sure that it is not safe, thanks to the PATRIOT Act. Even if they were not storing any metadata, VPN providers can be compelled to 1) share all data about their subscribers, which will include you, then 2) silently wiretap and decrypt everything. US courts will rubber-stamp, as they've consistently done in the past, and "that's all, folks". Sadly it's not like you'll be much safer elsewhere: as soon as you step outside of the US, one of the strongest cybersec agencies on the planet (NSA) will have free reign on your traffic. But you can resist the legal attack (in some countries) and at least try to make it challenging on a technical level. I hope Mozilla want to bring some innovation to the table that will make VPNs somehow more resistant to legal attack (not just in the US) but I doubt it.
  - raxxorrax 6y ago
    That would still create protections for people outside the US but with US-friendly administrations. Using a VPN in less US-friendly nation could increase protection. Is it safe? Probably not. Is it safer? Most likely.
  - r3trohack3r 6y ago
    Again, from what I understand, this would be active surveillance targeting an individual and the bulk data would not be collected (even if technically feasible given the mechanism for collecting the individual's data). From write-ups of the 2013 leaks, we saw references to violations of the legal theory used to justify the Presidential Surveillance Program. One of those violations was them unintentionally collecting the wrong data, due to how the ISP was bundling packets or something like that, which constituted a warrantless search, and they supposedly took that very seriously because it jeopardized the whole program. My take on the surveillance program is that they try very hard to be law abiding, even if they have to stretch what the law means to justify the program. If you are worried they have a warrant for your communication, a VPN isn't going to help you. If they don't have a warrant, they will avoid U.S. citizen's content like the plague for fear of compromising the whole program.
bioipbiop 6y ago
Might reduce chances of prosecution if they’d have to reveal the compromised a particular VPN to convict.

deepbreath 6y ago

If nothing else, it significantly reduces the entropy of your IP when websites are fingerprinting you, especially if your ISP assigns you a static IP. Even if you don't have a static IP, I suspect the entropy of your /24 (IPv4) is also a lot smaller when over VPN.

abofh 6y ago
Do you understand the words you're using?
- deepbreath 6y ago
  I thought I did? The condescending attitude is unnecessary. Happy to clarify my point if my initial comment was confusing: Websites such as http://panopticlick.eff.org/ http://panopticlick.eff.org/ showcase how fingerprinting works. They tell you how many bits of information they can extract from various datapoints they get out of you when visiting their site, such as User-Agent. Panopticlick does not use your IP address as a datapoint, but actual trackers most likely do. If not your IP directly, then a prefix thereof (such as your /24), to account for ISPs w/ dynamic IP allocation. If you have a static IP, there's a lot of bits of entropy in it, i.e. it's great for fingerprinting. It's basically sufficient, by itself, to uniquely identify your home. The handful of devices in your home can then likely be distinguished by the User-Agent. If you're part of your ISP's small dynamic IP pool (e.g. a /24), there's probably still a lot of entropy in there. How many people in your neighborhood are also on Linux and have the same set of fonts installed? Probably just you. Your VPN's dynamic IP subnets, OTOH, can be a lot larger, and the members of the pool are not geographically close to one another, so there's probably a lot less fingerprinting entropy in your IP in that case.
  - zrobotics 6y ago
    I think the negative reaction to your earlier comment comes from your mis-use of the term entropy. A static ip, for purposes of tracking you as an individual, has very, very little entropy (in fact, none) . High entropy would be a dynamic IP that is refreshed from a large pool very often. Additionally, very few ISPs assign static IPs anymore, not unless you pay 5x the price for a business account. Trackers, by and large, don't really pay much attention to IP, since much more reliable metrics have been implemented. Sure, it probably is used to a small extent, but there are much more effective steps that can be taken. https://en.wikipedia.org/wiki/Entropy_%28computing%29?wprov=sfla1 https://en.wikipedia.org/wiki/Entropy_%28computing%29?wprov=...
    - GoblinSlayer 6y ago
      VPN users get IPs from a small pool, so little entropy. The larger pool you select IP from, the more unique is your IP.
- dang 6y ago
  Personal attacks aren't ok here. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting, we'd be grateful.

wongarsu 6y ago

Unless I set up my own VPN I'll share a VPN server and IP with other people. That makes my traffic inherently more anonymous once it has left the VPN server, since you can't correlate traffic to a single person anymore. So even if traffic in the data center is analyzed, that's better than my ISP analyzing traffic. Thus we only have to establish that the VPN provider is at least as trustworthy as my ISP. That's a pretty low bar to clear in many places. I have no doubt some VPNs are operated by nefarious actors (no better way to collect high quality data), but I don't think that's a concern with Mozilla.

closeparen 6y ago
You should expect that the government can compel a VPN provider to correlate traffic to subscriber information exactly the same way it does with a residential ISP.
- wongarsu 6y ago
  Sure, but the set of governments that can compel my ISP might be different from the set of governments that can compel my VPN. I don't care about all governments equally, and my own government has a disproportional impact on me compared to most other governments.
- r3trohack3r 6y ago
  If they have a warrant a VPN isn't going to protect you. If you think you are under active surveillance, you want more than a VPN. Write-ups of the 2013 leaks revealed they did not compel ISPs to correlate traffic to subscriber information. It doesn't seem like they had any subscriber information in their database, only enough metadata about the communications to later compel a ISP to provide the subscriber information _postmortem_ (i.e. who did this cellphone number belong to on this date?). ISPs weren't even compelled to share that metadata. It was a voluntary program. Some ISPs said no. Others said yes and then later backed out. In the end something like 80% of the traffic the NSA was after was able to be collected through the ISPs that voluntarily shared their data. But, again, this was 2013. 2013 was forever ago, things may have changed.
6y ago

r3trohack3r 6y ago

Agreed. I think the key for me is that, at least under the original Presidential Surveillance Program, the providers that participated were not compelled to share their user's metadata. They shared it willingly, regularly, and in bulk. There is reference to a service provider backing out of this agreement a few years later, telling the NSA they would feel more comfortable sharing the data if it were compelled. It's not clear if this has changed since 2013. But assuming Mozilla, or Mullvad, isn't compelled to share _all of their data_ it seems unlikely that they would willingly give that up to a government surveillance program. I think ISPs have demonstrated they aren't trustworthy. For most people in the U.S., it seems, finding someone more trustworthy than their ISP is literally anyone who isn't admitting that they collect and share their private data. I would be surprised if Mozilla doesn't clear this bar.

weavejester 6y ago

Even if you trust your ISP, and it's not required to keep logs due to local laws, a VPN is often a good idea anyway. Geolocation from IP address can be scarily accurate - mine identifies me to within a mile radius of where I live.

mike_d 6y ago

> compromising foreign VPN services is within the NSA's wheelhouse This is the explicit danger of VPN providers. Even if the provider is not complicit (which I believe applies to the likes of Mozilla), it still creates a centralized aggregation site for collection. I'm not even sure a US-based VPN provider is safe. GCHQ just conducts the interception and would share the data with NSA. At that point, you are at the mercy of the NSAs locators being good enough to flag your tunneled traffic as "reasonably a US person" so it gets excluded.

toyg 6y ago
> I'm not even sure a US-based VPN provider is safe. Oh, I am sure that it is not safe, thanks to the PATRIOT Act. Even if they were not storing any metadata, VPN providers can be compelled to 1) share all data about their subscribers, which will include you, then 2) silently wiretap and decrypt everything. US courts will rubber-stamp, as they've consistently done in the past, and "that's all, folks". Sadly it's not like you'll be much safer elsewhere: as soon as you step outside of the US, one of the strongest cybersec agencies on the planet (NSA) will have free reign on your traffic. But you can resist the legal attack (in some countries) and at least try to make it challenging on a technical level. I hope Mozilla want to bring some innovation to the table that will make VPNs somehow more resistant to legal attack (not just in the US) but I doubt it.
- raxxorrax 6y ago
  That would still create protections for people outside the US but with US-friendly administrations. Using a VPN in less US-friendly nation could increase protection. Is it safe? Probably not. Is it safer? Most likely.
- r3trohack3r 6y ago
  Again, from what I understand, this would be active surveillance targeting an individual and the bulk data would not be collected (even if technically feasible given the mechanism for collecting the individual's data). From write-ups of the 2013 leaks, we saw references to violations of the legal theory used to justify the Presidential Surveillance Program. One of those violations was them unintentionally collecting the wrong data, due to how the ISP was bundling packets or something like that, which constituted a warrantless search, and they supposedly took that very seriously because it jeopardized the whole program. My take on the surveillance program is that they try very hard to be law abiding, even if they have to stretch what the law means to justify the program. If you are worried they have a warrant for your communication, a VPN isn't going to help you. If they don't have a warrant, they will avoid U.S. citizen's content like the plague for fear of compromising the whole program.

bioipbiop 6y ago

Might reduce chances of prosecution if they’d have to reveal the compromised a particular VPN to convict.