3 ms·

The whole idea of VPNs (or extra hops in general[0]) providing security is very context specific. For the vast majority of people they seemingly chose to trust

The whole idea of VPNs (or extra hops in general[0]) providing security is very context specific. For the vast majority of people they seemingly chose to trust a VPN provider over their ISP which is hard to justify. If you don't have a reason to be afraid of surveillance the best thing to do is nothing. [0] usually even worse if not VPNs used by many

tw04 6y ago
>The whole idea of VPNs (or extra hops in general[0]) providing security is very context specific. For the vast majority of people they seemingly chose to trust a VPN provider over their ISP which is hard to justify. The whole idea of VPNs and why I encourage people to use them is so that when they're sitting on public wifi at a coffee shop, their traffic is going out encrypted. It has almost nothing to do with hiding from authorities or authorities surveilling you. It has everything to do with the kiddiot in the corner hoping to steal a login because your mom re-used the same one 400 times and her favorite cross-stitch site doesn't use SSL.
- auganov 6y ago
  Well, using public WiFi is a good example of a situation where there is a reasonable expectation of tampering. Point is there's no easy win if you don't adequately understand your threat model. If you then end up using the VPN even when you're not on an untrusted network then it's questionable. The concern with VPNs isn't state level players either. Much more likely to have a rouge admin or hackers at a VPN provider than a big ISP. They get to see your clear text connections too. Not even talking about minor concerns like the fact that some VPNs won't put you behind a NAT like most networks would. Had an http proxy running and was sending tons of spam traffic to Russian and Ukrainian (I hope that's all they were doing!) websites for weeks before I realized I had to lock down ingress traffic myself.

tw04 6y ago

>The whole idea of VPNs (or extra hops in general[0]) providing security is very context specific. For the vast majority of people they seemingly chose to trust a VPN provider over their ISP which is hard to justify. The whole idea of VPNs and why I encourage people to use them is so that when they're sitting on public wifi at a coffee shop, their traffic is going out encrypted. It has almost nothing to do with hiding from authorities or authorities surveilling you. It has everything to do with the kiddiot in the corner hoping to steal a login because your mom re-used the same one 400 times and her favorite cross-stitch site doesn't use SSL.

auganov 6y ago
Well, using public WiFi is a good example of a situation where there is a reasonable expectation of tampering. Point is there's no easy win if you don't adequately understand your threat model. If you then end up using the VPN even when you're not on an untrusted network then it's questionable. The concern with VPNs isn't state level players either. Much more likely to have a rouge admin or hackers at a VPN provider than a big ISP. They get to see your clear text connections too. Not even talking about minor concerns like the fact that some VPNs won't put you behind a NAT like most networks would. Had an http proxy running and was sending tons of spam traffic to Russian and Ukrainian (I hope that's all they were doing!) websites for weeks before I realized I had to lock down ingress traffic myself.