4 ms·

What's the argument for VPNs in 2021? Can't ISP just use metadata patterns and DPI/analytics to tell what you're up to anyways? For example if I want to hide by

What's the argument for VPNs in 2021? Can't ISP just use metadata patterns and DPI/analytics to tell what you're up to anyways? For example if I want to hide by torrenting, it's not like VPN is going to really help that. ISP should be able to figure that out right? Or am I wrong here? edit: this is a serious question I am not trying to troll anyone here

AlexandrB 6y ago
Using DPI an ISP might be able to figure out that you're torrenting but not what you're torrenting. In some jurisdictions this is a big improvement.
ev1 6y ago
A correct VPN will make it look like you're just sending garbage traffic to/from one destination, the outside looking in traffic pattern is completely different than a torrent directly (which is many to one + one to many)
- pdimitar 6y ago
  What do you mean by a "correct VPN" here? The traffic analysis obfuscation angle is also interesting, do you have links?
- jorblumesea 6y ago
  Does it really look like garbage from the outside? My impression or understanding was that you could tease out those details (they are torrenting) but not inspect the packets directly (what are they torrenting?)
  - ev1 6y ago
    A proper VPN will completely encapsulate your layer 7 data, so you should not be able to tease out the fact that they are torrenting - it should more or less be an opaque stream. With some protocols you can identify that they are sending VPN traffic to and from a destination, but that should be it, otherwise something has gone horribly wrong in a dangerous way.
    - yjftsjthsd-h 6y ago
      Depending on the VPN protocol, you can still fingerprint by size - as I understand it, bandwidth use patterns are actually enough to distinguish things like "streaming video" from "BitTorrent traffic" from "web browsing". IIRC, ex. TOR does a bucket-filling approach to fight this (something along the lines of trying to wait until you've got X bytes to send together to smooth out the packet size, or even inserting garbage to pad out your use).
beermonster 6y ago
People use VPN services, as opposed to say why enterprises use site-to-site VPNs, for a variety of reasons: - Access geo-restricted content on say Netflix - Privacy - one encrypted pipe to hide what you're doing - Hide source IP address (perhaps for researching a competitors website etc) - Protect insecure services (though the services would need to exist on the VPN endpoint or they would be exposed at the VPN->insecure service termination). - Bypass ISP throttling (yup this works and is always funny as ISPs deny they do this but hey, easy to check!) - Avoid censorship even in places like the UK (https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_by_country https://en.wikipedia.org/wiki/Internet_censorship_and_survei...) And more. So there's plenty of use-cases for a VPN in 2021. But it's worth thinking about how the threat model changes as a result of using one especially if you're not hosting it yourself.

AlexandrB 6y ago

Using DPI an ISP might be able to figure out that you're torrenting but not what you're torrenting. In some jurisdictions this is a big improvement.

ev1 6y ago

A correct VPN will make it look like you're just sending garbage traffic to/from one destination, the outside looking in traffic pattern is completely different than a torrent directly (which is many to one + one to many)

pdimitar 6y ago
What do you mean by a "correct VPN" here? The traffic analysis obfuscation angle is also interesting, do you have links?
jorblumesea 6y ago
Does it really look like garbage from the outside? My impression or understanding was that you could tease out those details (they are torrenting) but not inspect the packets directly (what are they torrenting?)
- ev1 6y ago
  A proper VPN will completely encapsulate your layer 7 data, so you should not be able to tease out the fact that they are torrenting - it should more or less be an opaque stream. With some protocols you can identify that they are sending VPN traffic to and from a destination, but that should be it, otherwise something has gone horribly wrong in a dangerous way.
  - yjftsjthsd-h 6y ago
    Depending on the VPN protocol, you can still fingerprint by size - as I understand it, bandwidth use patterns are actually enough to distinguish things like "streaming video" from "BitTorrent traffic" from "web browsing". IIRC, ex. TOR does a bucket-filling approach to fight this (something along the lines of trying to wait until you've got X bytes to send together to smooth out the packet size, or even inserting garbage to pad out your use).

beermonster 6y ago

People use VPN services, as opposed to say why enterprises use site-to-site VPNs, for a variety of reasons: - Access geo-restricted content on say Netflix - Privacy - one encrypted pipe to hide what you're doing - Hide source IP address (perhaps for researching a competitors website etc) - Protect insecure services (though the services would need to exist on the VPN endpoint or they would be exposed at the VPN->insecure service termination). - Bypass ISP throttling (yup this works and is always funny as ISPs deny they do this but hey, easy to check!) - Avoid censorship even in places like the UK (https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_by_country https://en.wikipedia.org/wiki/Internet_censorship_and_survei...) And more. So there's plenty of use-cases for a VPN in 2021. But it's worth thinking about how the threat model changes as a result of using one especially if you're not hosting it yourself.