5 ms·

But why do you trust the VPN provider more than your ISP?

dcolkitt 6y ago
1) I trust the privacy laws and their level of enforcement in certain foreign jurisdictions more than the US. 2) I trust a company who’s entire value proposition is privacy more than one who’s value proposition is having a monopoly on the local fiber.
- pstrateman 6y ago
  Have you considered that their primary revenue stream is selling your data and not the fee you pay? Many of the VPN providers are suspiciously cheap.
  - danShumway 6y ago
    Well, don't buy from a VPN provider that is suspiciously cheap. If a no-name company starts selling suspiciously cheap smartphones, the odds of those smartphones being backdoored/stolen/broken goes up pretty dramatically. That doesn't mean that every company selling smartphones is equally untrustworthy. Of course it's a problem how hard it is to tell if a VPN company is trustworthy, but that's a problem that exists for almost every 3rd-party relationship I enter into.
- falcolas 6y ago
  > who’s entire value proposition is privacy I wouldn't believe any corporation who says this. A profile of a self-identified private person's traffic is likely worth a lot more than what a niche audience will pay for privacy. VPNs have a history of lying about their business models, about how private their service really is. International contract enforcement won't exactly leave you with a lot of leverage if (pragmatically, when) they lie to you. And merely being international certainly won't stop a state level actor who is intent on gaining access to your traffic.
LGNUITLZCJ 6y ago
If you know your ISP is bad [0][1] then a VPN which might be bad is better than definitely bad. [0] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A [1] https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now-collect-and-sell-your-data-what-know-internet-privacy/100015356/ https://www.usatoday.com/story/tech/news/2017/04/04/isps-can...
everdrive 6y ago
Something I seldom see listed here is simply the possibility of splitting the profile: - My ISP knows all my normal internet traffic, and all the caveats that apply (HTTPS, SNI, IPs, etc) - My VPN knows a much smaller subset of traffic used for a different purpose. Also, do this in a VM, or on a separate computer, or otherwise somehow containerize your cookies and browser and things. (no, I still don't think people are correlating between profiles using webgl in any large-scale way. If they were, I'd be getting fewer CAPTCHAs.) Yes, the VPN could presumably violate their privacy statements and sell your information, but that still avoids the primary concern: an ad domain that lives on the two websites you'd like to visit (ie, the normal vs the private site) With a new IP, and a different host (VM, physical computer, etc) there's nothing to correlate. The website in question doesn't know it's you -- only the VPN does. And it doesn't seem likely they're going to sell your information in such a way that the website can figure out which cookie to correlate with which identity. So, the primary tracking method of the internet should be defeated in this way.
- falcolas 6y ago
  IP tracking is pretty old-school, and unless you're perfectly scrupulous about your split profiles locally, there's probably a well known bridge between these profiles. And if IP obfuscation is that important, you'll likely be using TOR, not a VPN (which have proven to be a nearly transparent shield).
  - crtasm 6y ago
    Proven how exactly? I was reading this recently: https://torrentfreak.com/ovpn-wins-court-battle-after-pirate-bay-data-demands-rejected-200911/ https://torrentfreak.com/ovpn-wins-court-battle-after-pirate...
  - everdrive 6y ago
    >there's probably a well known bridge between these profiles. That's my plan -- that there is no bridge between the profiles. I'll admit, the likelihood that I'm doing this perfectly is definitely not 100%. But I'll bet it covers most cases.
aloisdg 6y ago
My VPN doesn't answer to my government. It is not how well do you hide, it is from who.

1) I trust the privacy laws and their level of enforcement in certain foreign jurisdictions more than the US. 2) I trust a company who’s entire value proposition is privacy more than one who’s value proposition is having a monopoly on the local fiber.

pstrateman 6y ago
Have you considered that their primary revenue stream is selling your data and not the fee you pay? Many of the VPN providers are suspiciously cheap.
- danShumway 6y ago
  Well, don't buy from a VPN provider that is suspiciously cheap. If a no-name company starts selling suspiciously cheap smartphones, the odds of those smartphones being backdoored/stolen/broken goes up pretty dramatically. That doesn't mean that every company selling smartphones is equally untrustworthy. Of course it's a problem how hard it is to tell if a VPN company is trustworthy, but that's a problem that exists for almost every 3rd-party relationship I enter into.
falcolas 6y ago
> who’s entire value proposition is privacy I wouldn't believe any corporation who says this. A profile of a self-identified private person's traffic is likely worth a lot more than what a niche audience will pay for privacy. VPNs have a history of lying about their business models, about how private their service really is. International contract enforcement won't exactly leave you with a lot of leverage if (pragmatically, when) they lie to you. And merely being international certainly won't stop a state level actor who is intent on gaining access to your traffic.

LGNUITLZCJ 6y ago

If you know your ISP is bad [0][1] then a VPN which might be bad is better than definitely bad. [0] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A [1] https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now-collect-and-sell-your-data-what-know-internet-privacy/100015356/ https://www.usatoday.com/story/tech/news/2017/04/04/isps-can...

everdrive 6y ago

Something I seldom see listed here is simply the possibility of splitting the profile: - My ISP knows all my normal internet traffic, and all the caveats that apply (HTTPS, SNI, IPs, etc) - My VPN knows a much smaller subset of traffic used for a different purpose. Also, do this in a VM, or on a separate computer, or otherwise somehow containerize your cookies and browser and things. (no, I still don't think people are correlating between profiles using webgl in any large-scale way. If they were, I'd be getting fewer CAPTCHAs.) Yes, the VPN could presumably violate their privacy statements and sell your information, but that still avoids the primary concern: an ad domain that lives on the two websites you'd like to visit (ie, the normal vs the private site) With a new IP, and a different host (VM, physical computer, etc) there's nothing to correlate. The website in question doesn't know it's you -- only the VPN does. And it doesn't seem likely they're going to sell your information in such a way that the website can figure out which cookie to correlate with which identity. So, the primary tracking method of the internet should be defeated in this way.

falcolas 6y ago
IP tracking is pretty old-school, and unless you're perfectly scrupulous about your split profiles locally, there's probably a well known bridge between these profiles. And if IP obfuscation is that important, you'll likely be using TOR, not a VPN (which have proven to be a nearly transparent shield).
- crtasm 6y ago
  Proven how exactly? I was reading this recently: https://torrentfreak.com/ovpn-wins-court-battle-after-pirate-bay-data-demands-rejected-200911/ https://torrentfreak.com/ovpn-wins-court-battle-after-pirate...
- everdrive 6y ago
  >there's probably a well known bridge between these profiles. That's my plan -- that there is no bridge between the profiles. I'll admit, the likelihood that I'm doing this perfectly is definitely not 100%. But I'll bet it covers most cases.

aloisdg 6y ago

My VPN doesn't answer to my government. It is not how well do you hide, it is from who.