8 ms·

How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, an

• dboat 6y ago
  Won't amazon cancel them when they keep getting copyright letters? Or do vpns have some other use I am not aware of.
  • dave5104 6y ago
    Is your comment implying that VPNs are only used for copyright infringement? Primary use of VPNs I see is to get onto my workplace's network.
    • gpm 6y ago
      Surely your company is not using a consumer provider like NordVPN or this UFO VPN company though?
      • flywheel 6y ago
        I don't know of any company that would be using a public VPN service for anything related to work. Typically "work VPNs" are running on systems that the employer controls, set up by someone employed by the company, and meant solely for employees to connect to - there is no reason any company would want or need to use a public VPN provider for their corporate network VPN. It just doesn't make any sense to me why you would suggest it.
  • gpm 6y ago
    VPNs do have some legitimate uses. Encrypting traffic over malicious networks (e.g. your average airport wifi) is probably the most common one for the average legal user. Getting an IP address in a given country is another sometimes legal use. I honestly don't know if you can do this with your average commercial vpn, but the technology is also good for many things like setting up virtual networks (hence the name) so you can do things like access your home computer from anywhere without exposing it to the internet.
    • dmurray 6y ago
      Just how insecure is airport WiFi these days with SSL and HSTS? I don't normally worry about it, and suspect people who still counsel against it of lazy FUD. I'd notice pretty quickly if someone was MITMing all of my traffic. I guess they could MITM a third-party Javascript site that wasn't being served with HSTS. Normally that would just give them all the information I already give to Google or Facebook and the hundred other shitbags that run JS on the sites I browse, but if they got really lucky they could pretend to be some third-party payment provider that didn't use HSTS or I hadn't used before.
      • gpm 6y ago
        Personally I don't worry about it, but I wouldn't blame other people for doing so. A browser is a very complex tech stack and it wouldn't surprise me in the slightest if there were vulnerabilities exploitable with a MITM. An airport would be a natural place to try and attack computers, lots of people with lots of money many of whom are doing things like moving that money around and many of whom won't think twice about connecting to an unsecured public hotspot. There's also all the other apps on your computer, how frequently do you think electron-app-foo-bar updates it's chrome version and what are the chances it's using one outdated enough that there are known openssl vulnerabilities against it? I don't think third party non-HSTS traffic is that much of a concern these days, both firefox and chrome block http traffic from https pages by default.
      • Bnshsysjab 6y ago
        I’d be more concerned about other stuff, which a vpn doesn’t solve. Look up SMB relay attacks, netbios, and Responder. An average win10 laptop will disclose creds to anyone
  • solarkraft 6y ago
    Are you implying VPN services are only good for piracy? I personally use mine for privacy (sounds similar, is a little different).
  • olyjohn 6y ago
    I use a VPN to keep Comcast from logging and selling my data to third parties. The client is always on and running on my PC.
    • llsf 6y ago
      I do the same, but again using remote AWS (free) servers. Which is funny sometimes, I realize that some website are suddenly in german because I am using my Berlin server, instead of my US one.
      • rootkea 6y ago
        Why not use Tor instead? Frees from the worry of going over free AWS server bandwidth limits.
• pixxel 6y ago
  > I never understood why people working in tech would ever trust a VPN service? It’s not that I trust them but I’d rather some random company across the world has my jerk off logs rather than my ISP who hands my habits to my government and all its favoured cohorts.
  • alfiedotwtf 6y ago
    For all you know, your government is running that VPN you’re using
    • peteretep 6y ago
      > For all you know, your government is running that VPN you’re using The NSA is simply not most people's threat model, and if they _are_ running it, it probably means that someone shadier is not. I'm using a VPN because I don't want my ISP to see what I'm browsing, don't want end sites to know who I am, want to watch American Netflix, and because the country I'm in tries to block all adult sites. The NSA is welcome to all of this traffic _shrug_
    • eternalban 6y ago
      I believe they have a cute name for it. It's called 5-Eyes.
    • pixxel 6y ago
      Yes maybe. I got to go with the maybe.
    • ajzinsbwbs 6y ago
      My government, along with any other entity with lawyers, can obtain my browsing history from my ISP as evidence that is admissible in civil or criminal court by submitting some paperwork. They can’t do that with my VPN traffic, even if some government spooks are secretly running the VPN. The NSA is not going to burn their operation to help the MPAA fine me.
• Causality1 6y ago
  The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.
  • bitxbitxbitcoin 6y ago
    Piggybacking off of this, Private Internet Access (PIA) has actually had their no logging policy "proven in court" via this method multiple times. [1][2] Full disclosure: I work at PIA. [1]https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2]https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...
    • pbhjpbhj 6y ago
      Is there any way to prove that is not NSA, say, and set up to only catch the biggest fish, or to always present parallel construction for criminals caught this way?
      • bdcravens 6y ago
        Of course you can't prove that, any more than you can't prove that YCombinator or FastMail aren't similar NSA operatives.
      • bitxbitxbitcoin 6y ago
        That's an interesting philosophical question.[1][2] [1]https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)#Proving_a_negative https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)#P... [2] https://en.wikipedia.org/wiki/Evidence_of_absence https://en.wikipedia.org/wiki/Evidence_of_absence
        • pbhjpbhj 6y ago
          I like you. I tend towards pyrhonism (or maybe I don't!) so I appreciate that response. Degree of proof is a relative: Maybe a terror organisation use PIA, NSA go fishing for evidence PIA has nothing. Terror org assassinate NSA head. PIA could be a front, but NSA head had to be willing to lose his life to hide the fakery, and terror org wasn't a big enough fish ... more likely you're currently in a coma. Lots of places for false premises to creep in. Dial it back, is there a point where there'd ever be enough evidence?
• solarkraft 6y ago
  > how do you measure VPN services? It's pretty difficult. You can't say anything for sure, it's all trust. That's why you should be so strict. When you host your own end point you still have to trustits provider of course, but of course the incentive (concentrated, specific user traffic data) for abuse is much reduced. But how anonymous are you actually? Are you sure your traffic can't be connected to you? Certain you set everything up correctly? With my provider of choice, because I trust them reasonably much (sure feels like jinxing it), I don't have these worries.
  • llsf 6y ago
    If you VPN service, only provide VPN, then a (free tier) AWS server in a foreign country + wireguard would do the same. Sure, AWS could log the outbound traffic for that account, but AWS only has an email address from me, not a credit card like a VPN service. Feels like the exposure is far less.
• fivre 6y ago
  I trust VPN services for the one thing they're good and useful for: hopping over geo-fences for content. You should not have any expectation of privacy or security from consumer VPN services (if you want that, obtain Tor Browser or Tails as your needs require). They provide a means to choose roughly where your client traffic comes from, and that's it. The rest is marketing bullshit. They're probably sufficient for low-key deflection of DMCA notices if you're torrenting shit--rightsholder enforcement companies aren't exactly able to undertake nation-state level investigations for what they do.
  • ramraj07 6y ago
    Why would I assure myself that Tor is safe either? Do we know for a fact that government agencies don't control the majority of the egress points?
    • _jal 6y ago
      > Do we know for a fact This always has been and always will be the security rabbit hole. (Well, one of them.) How do you define "know for a fact"? Even if you personally know a person managing an egress node, how do you know they aren't operating on behalf of someone else?
      • jakear 6y ago
        Saw an article a while back (years) saying NSA/FBI is able to track TOR connections and won’t say how even if it means they’d forfeit some cases.. anyone remember this? Edit to add: Also, it’s public knowledge that TOR is funded by the DoD, it seems extremely feasible that they privately control a sizable chunk of nodes. Based on what I know of American 3 letter agencies, I don’t think one could resist designing a “secure” system only they can listen in on. I consider TOR a very secure messaging channel between you, the other party, and the American government (metadata only, but that’s really not too big of a limitation in this case).
        • hkt 6y ago
• p1esk 6y ago
  You can chain several unrelated VPN providers.
  • banana_giraffe 6y ago
    Wouldn't that just put all the trust in the last one in the chain?
    • p1esk 6y ago
      How would they know where I am?
      • llsf 6y ago
        Don't you have to pay for those VPN ? How do you pay them ?
        • ta17711771 6y ago
          Cryptocurrency
          • sqldba 6y ago
            Most crypto places force you to provide ID now and governments force you to declare how much you have. Both for tax reasons.
            • Rebelgecko 6y ago
              You could mine the crypto yourself, or buy it from someone in person. Bitcoin ATMs verify phone numbers, but if you have a burner phone you could also get BTC from them— they're surprisingly common at gas stations near me
        • solarkraft 6y ago
          Mullvad allows you to mail them cash.
• bowmessage 6y ago
  all of your traffic? Or just insecure DNS/HTTP requests?
  • llsf 6y ago
    All the traffic... but not all the time. At home, if I work, then I use the corporate VPN. Otherwise, no VPN, except when I need to appear like my traffic comes from another country. For instance, I just have (AWS) tiny server in Europe with wireguard. So, easy to switch. I share the servers with my family as we are all scattered around the globe and still like to watch our European shows/replay.
• bilekas 6y ago
  > I mean how do you measure VPN services? - Credit only Word of mouth, but it depends what type of VPN you're looking for. So again, word of mouth these days. > I never understood why people working in tech would ever trust a VPN service? -I do, quite a bit actually, I need to connect to another network but region specific.. They are a tool for as you say 'in tech' to work. > A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? - At least in Europe that doesn't fly. It does depend on your provider though. Thats why you shop around. - On this point, I will argue that running your own VPN is better, but so is running your own web hosting. It depends on your priorities. > I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service. - Good for you. Enjoy.
• mirimir 6y ago
  Sure. But those statements are also true if you replace "VPN services" with "ISPs". The point of VPN services is obfuscating your ISP-assigned IP address. And hiding your traffic from your ISP, which both knows who you are, and is generally vulnerable to your government. With VPN services, conversely, you can pick ones that are less vulnerable to your government. And if you use nested VPN chains, you can fully obfuscate the relationship between your meatspace identity and your site traffic. So as long as you don't reveal your meatspace identity through your online activity, you can be at least somewhat anonymous online. And if you add Tor to the mix, you can be even more anonymous. And by hitting Tor through nested VPN chains, you're less vulnerable to deanonymization through Tor compromise. Such as the relay early vulnerability that CMU researchers exploited to deanonymize Tor users and onion sites.
• elcomet 6y ago
  Do you have big bills for traffic?