8 ms·

I feel like most of those VPN services are using very borderline marketing and like to keep a lot of information blurry. As far as I know, in a lot of country

by maeln 6y ago

I feel like most of those VPN services are using very borderline marketing and like to keep a lot of information blurry. As far as I know, in a lot of country (like France) it is a legal obligation to keep logs and be able to identify one of your customer if the police demands it. Therefore, if you have server in France or any country with similar rules, you can't operate a "0 log" service. And since those kinds of services have servers everywhere (and it is even one of their selling point), it is extremely unlikely that they don't keep you data and will hand it to the police (willingly or not) if requested. And if their own server get breached, you can get the info of all the customers who used the breached server. So I find the claim of those services that they provide "more privacy" pretty lousy. Yes they do hide your IP addresses, but that's far from being the only data use to fingerprint you. And if it is to protect you against a Wi-Fi that you don't trust or your ISP, sure it works, but you move the trust from them to your VPN provider. Fighting against geofencing is good though.

cyberlab 6y ago
I agree. A VPN should only ever be used for the following: - Shifting traffic over a VPN when using untrusted/sketchy wifi hotspots - Spoofing your geo-location to use geo-specific content And that's it. If privacy is your goal, Tor is much more suitable since it's not a single-hop proxy like a VPN and compartments all your traffic. (But of course Tor is not a silver bullet and there are caveats).
- sodality2 6y ago
  What about avoiding copyright letters?
  - cyberlab 6y ago
    If someone is determined enough, they just subpoena the VPN and ask for logs. Since a VPN is a single-hop proxy, your real IP is trivially exposed. Even if the VPN provider claims they don't keep logs. There's no way of proving they don't keep logs, and you need to hope the server you connect to is not compromised in some way. And VPN providers are known to use cheap colocation servers/Virtual Private Servers which have questionable security.
    - lordofgibbons 6y ago
      Have there been any known cases of someone being identified for copywrite violation while using a VPN service?
    - StavrosK 6y ago
      > If someone is determined enough This sweeps the entire benefit under the rug. If someone isn't determined enough, a VPN solves your problem.
- ComodoHacker 6y ago
  - Routing traffic over untrusted home/office ISP - Censorship circumvention
  - ignoramous 6y ago
    > Censorship circumvention In some countries, censorship circumvention usually require sophistication that not all VPNs provide. A few like getoutline.com, getlantern.io, and psiphon.ca specialize in that. In most countries, VPNs aren't even needed to circumvent censorship. Apps like getintra.org, GreenTunnel employ simpler techniques to bypass firewalls. > Routing traffic over untrusted home/office ISP With TLS v1.3 and DoH / DoT, I think VPNs may no longer be required if "hiding traffic" is the only need. Hiding IPs, however; (of both the client's from the server and the server's from the ISP) would continue to require the use of VPNs.
    - hiq 6y ago
      > With TLS v1.3 and DoH / DoT, I think VPNs may no longer be required if "hiding traffic" is the only need. You, as a user, have little control over whether the servers you connect to support TLS 1.3 and eSNI / ECH.
- vehemenz 6y ago
  Depends on the VPN. ExpressVPN is HK/CCP owned, so I wouldn't worry too much about my privacy being violated for petty copyright infringements (BitTorrent).
  - mistersquid 6y ago
    > ExpressVPN is HK/CCP owned Thank you for this callout. Had no idea. Comparing VPN services, I’ve found ExpressVPN to be highly rated. The aforementioned callout means ExpressVPN may not be the best service for me. In lieu of specific technical criteria regarding VPN services, who are the go-to (aka “top of mind” or “A list”) providers that privacy conscious, technically adroit (e.g. web dev with some sysadmin knowledge but little networking knowhow) users prefer? In other words, I’m looking for VPN recommendations but no longer trust my own Google-fu (advert rabbit hole) to discern what is a “good” choice.
    - schmorptron 6y ago
      I've never used any vpn myself, but whenever I come across the topic in tech circles people seems to recommend mullvad. Can't vouch for them or anything, but might be worth looking into.
    - imposterr 6y ago
      Mullvad is probably the best choice for most. It's the company Mozilla is relying on for their VPN service as well.
    - kaba0 6y ago
      I personally use ProtonVPN.
  - voidmain0001 6y ago
    VPNPro doesn't list ExpressVPN as having Chinese ownership. Wikipedia[1] claims it operates in the British Virgin Islands, and Quora claims the same. That written, a comment on Quora claims that it's owned by the CIA. Ha ha! [1] https://en.wikipedia.org/wiki/ExpressVPN https://en.wikipedia.org/wiki/ExpressVPN [2] https://www.quora.com/Who-owns-Express-VPN https://www.quora.com/Who-owns-Express-VPN
- hnlmorg 6y ago
  What about tunnelling into a trusted network? That's what a VPN is really for. The other uses are more side effects exploiting the encryption and tunnelling properties of VPN rather than the original intended purpose of a VPN.
  - croutonwagon 6y ago
    I think hes talking about VPN's in the context of these companies selling vpn services under the guise of "privacy" or "security". ProtonVPN, Nord, Mozillas, Mullvad and there are a ton others, many with less than stellar reputations and some that outright lie. Thats a bit separate from a road warrior, corporate vpn or even one that one may host on a VPS that they have full control over and are willing to allow the hosting provider still see the traffic. As in, they trust the hosting provider more than the transit provider. Think University/Campus networks, public gov networks, or even some ISP's or corp networks.
    - hnlmorg 6y ago
      I got the context. My point is that the whole “privacy” VPN industry is snake oil and people miss the point of VPNs when they buy into these services.
      - croutonwagon 6y ago
        I wouldn't go that far. There are some reasons that one could be useful. I dont personally have a use case cause I have other mitigations in place but i wouldn't consider a company like Verizon particularly trustworthy in general. Even Comcast has been known to inject ads. The core tenant of these VPN services is trust, with it they dont survive, but for an ISP with a de-facto monopoly thats a non factor. There are also plenty of sites and services that use IP tracking. Google is really bad but others are doing it behind the scenes and not telling you. Reddit 100% does. Amazon too. To the point that if i proxy my connection and try and login to one of my google accounts i sometimes have to verify or go through recovery. So in some cases its better than no vpn. And I wouldn't use any authenticated service over tor that i wish to keep. There are so many malicious relays and exit nodes. TOR is easily tracked at the nation-state level. China can axe tor traffic, even with bridges and OBFS4 configured. With a service like nord, you can get on and do your thing to bypass the great wall for the most part. And the the great firewall drops that connection you have a very large pool to choose from for your next. So there are definitely some reasons I could understand some would use them based on their own assessments/needs.
- qw3rty01 6y ago
  Tor is explicitly not private, only anonymous. The end node can see all the traffic you send through it if it's not encrypted. If privacy is your main concern, tor is definitely not the right tool to use.
  - cyberlab 6y ago
    > TOR is explicitly not private, only anonymous It depends on how you use Tor. For example, visiting your own personal homepage and then using the same relay to visit a NSFW site would be bad OPSEC. Also, Tor comes pre-installed with HTTPS Everywhere, and you can toggle a setting that disables all http traffic if you're worried about sketchy exit nodes analyzing your plaintext traffic. Remember: Tor can't read your mind. If you want true anonymity you have to go through extraordinary lengths to achieve it, and even then, you could make mistakes.
    - qw3rty01 6y ago
      The caveats you're mentioning are exactly why tor is a bad tool if privacy is your main goal. None of those concerns would be an issue with a service that focused on privacy. Also HTTPS everywhere isn't enough; you also need ESNI, which requires server support.
      - xvector 6y ago
        And even if ESNI was ubiquitous, a malicious exit would simply perform a reverse DNS lookup and have very high certainty about which sites you’re visiting.
- hendersoon 6y ago
  You're missing two major use-cases. 1) Piracy (the most common, I would imagine) 2) Evading content-blocking. For example, going to Facebook at work.
dgellow 6y ago
The entire VPN industry is really shady. Their marketing is entirely based on creating literal FUD (fear, uncertainty, doubt) and sell their service as the perfect and cheap solution. The presence they have on youtube ads and other mainstream platform ads is really disturbing.
- kfreds 6y ago
  I hear what you're saying but that generalization isn't fair. Check out IVPN for instance. They do a lot of things right: https://www.ivpn.net/ethics/ https://www.ivpn.net/ethics/
- xvector 6y ago
  Mullvad doesn’t do this, most providers do but I agree that this generalization is unfair to the VPN being discussed here.
dahfizz 6y ago
Another benefit is that VPNs raise the bar for investigation. You are not safe from the FBI or interpol, but for "petty crimes" like pirating you are safe(r). Comcast basically has automated the process of sending you a cease and desist if they detect you are torrenting something you shouldn't. Mozilla doesn't.
kfreds 6y ago
> As far as I know, in a lot of country (like France) it is a legal obligation to keep logs and be able to identify one of your customer if the police demands it. Not for all types of services. ISPs are sometimes under obligation to log, but VPN services don't belong in that category. I can't speak for others but we have contacts with legal experts (in a few jurisdictions) that alert us to changing laws. Ultimately if a country required us to start logging we would just cancel all of our machines there and leave. On the topic of trustworthiness, you are completely right of course that VPN users put a lot of trust in their VPN provider. There is also the lemon market aspect - the information and competence asymmetry between user and operator. That begs the question of how to ascertain trustworthiness. We think things like this help: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns/ https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns... https://mullvad.net/blog/2019/6/3/system-transparency-future/ https://mullvad.net/blog/2019/6/3/system-transparency-future...
- chelmzy 6y ago
  Are you an employee at Mullvad? Just want to say thank you for the excellent product and does Mullvad plan to except Monero in the future?
  - kfreds 6y ago
    Hi! Thank you. I’m pretty sure it’s on the roadmap.
    - deleted 6y ago
      [deleted]
- potency 6y ago
  I would love to use Mullvad, but I need split tunneling on a per-process basis (Windows), since there is the occasional website that hates VPN-based servers. I have a special browser installation I use for such occasions, but few VPN providers offer per-process VPN exceptions. Any chance Mullvad is considering this feature?
kibwen 6y ago
You're correct that scummy, overselling advertisements make the whole VPN industry look bad, but Mozilla's VPN is provided by Mullvad, who doesn't engage in those sorts of advertisements. FWIW, I've looked into Mullvad and even had beers with some of their programmers (all of whom appeared to be Scandinavian anarchist/anti-authoritarian types) and I think Mozilla made an good choice with that partnership. (Of course, don't take my word for it; do your own research, or just host your own VPN.)
- 2OEH8eoCRo0 6y ago
  Mullvad is the bees knees. The cats meow.
  - edm0nd 6y ago
    A real humdinger

by maeln 6y ago

cyberlab 6y ago

I agree. A VPN should only ever be used for the following: - Shifting traffic over a VPN when using untrusted/sketchy wifi hotspots - Spoofing your geo-location to use geo-specific content And that's it. If privacy is your goal, Tor is much more suitable since it's not a single-hop proxy like a VPN and compartments all your traffic. (But of course Tor is not a silver bullet and there are caveats).

sodality2 6y ago
What about avoiding copyright letters?
- cyberlab 6y ago
  If someone is determined enough, they just subpoena the VPN and ask for logs. Since a VPN is a single-hop proxy, your real IP is trivially exposed. Even if the VPN provider claims they don't keep logs. There's no way of proving they don't keep logs, and you need to hope the server you connect to is not compromised in some way. And VPN providers are known to use cheap colocation servers/Virtual Private Servers which have questionable security.
  - lordofgibbons 6y ago
    Have there been any known cases of someone being identified for copywrite violation while using a VPN service?
  - StavrosK 6y ago
    > If someone is determined enough This sweeps the entire benefit under the rug. If someone isn't determined enough, a VPN solves your problem.
ComodoHacker 6y ago
- Routing traffic over untrusted home/office ISP - Censorship circumvention
- ignoramous 6y ago
  > Censorship circumvention In some countries, censorship circumvention usually require sophistication that not all VPNs provide. A few like getoutline.com, getlantern.io, and psiphon.ca specialize in that. In most countries, VPNs aren't even needed to circumvent censorship. Apps like getintra.org, GreenTunnel employ simpler techniques to bypass firewalls. > Routing traffic over untrusted home/office ISP With TLS v1.3 and DoH / DoT, I think VPNs may no longer be required if "hiding traffic" is the only need. Hiding IPs, however; (of both the client's from the server and the server's from the ISP) would continue to require the use of VPNs.
  - hiq 6y ago
    > With TLS v1.3 and DoH / DoT, I think VPNs may no longer be required if "hiding traffic" is the only need. You, as a user, have little control over whether the servers you connect to support TLS 1.3 and eSNI / ECH.
vehemenz 6y ago
Depends on the VPN. ExpressVPN is HK/CCP owned, so I wouldn't worry too much about my privacy being violated for petty copyright infringements (BitTorrent).
- mistersquid 6y ago
  > ExpressVPN is HK/CCP owned Thank you for this callout. Had no idea. Comparing VPN services, I’ve found ExpressVPN to be highly rated. The aforementioned callout means ExpressVPN may not be the best service for me. In lieu of specific technical criteria regarding VPN services, who are the go-to (aka “top of mind” or “A list”) providers that privacy conscious, technically adroit (e.g. web dev with some sysadmin knowledge but little networking knowhow) users prefer? In other words, I’m looking for VPN recommendations but no longer trust my own Google-fu (advert rabbit hole) to discern what is a “good” choice.
  - schmorptron 6y ago
    I've never used any vpn myself, but whenever I come across the topic in tech circles people seems to recommend mullvad. Can't vouch for them or anything, but might be worth looking into.
  - imposterr 6y ago
    Mullvad is probably the best choice for most. It's the company Mozilla is relying on for their VPN service as well.
  - kaba0 6y ago
    I personally use ProtonVPN.
- voidmain0001 6y ago
  VPNPro doesn't list ExpressVPN as having Chinese ownership. Wikipedia[1] claims it operates in the British Virgin Islands, and Quora claims the same. That written, a comment on Quora claims that it's owned by the CIA. Ha ha! [1] https://en.wikipedia.org/wiki/ExpressVPN https://en.wikipedia.org/wiki/ExpressVPN [2] https://www.quora.com/Who-owns-Express-VPN https://www.quora.com/Who-owns-Express-VPN
hnlmorg 6y ago
What about tunnelling into a trusted network? That's what a VPN is really for. The other uses are more side effects exploiting the encryption and tunnelling properties of VPN rather than the original intended purpose of a VPN.
- croutonwagon 6y ago
  I think hes talking about VPN's in the context of these companies selling vpn services under the guise of "privacy" or "security". ProtonVPN, Nord, Mozillas, Mullvad and there are a ton others, many with less than stellar reputations and some that outright lie. Thats a bit separate from a road warrior, corporate vpn or even one that one may host on a VPS that they have full control over and are willing to allow the hosting provider still see the traffic. As in, they trust the hosting provider more than the transit provider. Think University/Campus networks, public gov networks, or even some ISP's or corp networks.
  - hnlmorg 6y ago
    I got the context. My point is that the whole “privacy” VPN industry is snake oil and people miss the point of VPNs when they buy into these services.
    - croutonwagon 6y ago
      I wouldn't go that far. There are some reasons that one could be useful. I dont personally have a use case cause I have other mitigations in place but i wouldn't consider a company like Verizon particularly trustworthy in general. Even Comcast has been known to inject ads. The core tenant of these VPN services is trust, with it they dont survive, but for an ISP with a de-facto monopoly thats a non factor. There are also plenty of sites and services that use IP tracking. Google is really bad but others are doing it behind the scenes and not telling you. Reddit 100% does. Amazon too. To the point that if i proxy my connection and try and login to one of my google accounts i sometimes have to verify or go through recovery. So in some cases its better than no vpn. And I wouldn't use any authenticated service over tor that i wish to keep. There are so many malicious relays and exit nodes. TOR is easily tracked at the nation-state level. China can axe tor traffic, even with bridges and OBFS4 configured. With a service like nord, you can get on and do your thing to bypass the great wall for the most part. And the the great firewall drops that connection you have a very large pool to choose from for your next. So there are definitely some reasons I could understand some would use them based on their own assessments/needs.
qw3rty01 6y ago
Tor is explicitly not private, only anonymous. The end node can see all the traffic you send through it if it's not encrypted. If privacy is your main concern, tor is definitely not the right tool to use.
- cyberlab 6y ago
  > TOR is explicitly not private, only anonymous It depends on how you use Tor. For example, visiting your own personal homepage and then using the same relay to visit a NSFW site would be bad OPSEC. Also, Tor comes pre-installed with HTTPS Everywhere, and you can toggle a setting that disables all http traffic if you're worried about sketchy exit nodes analyzing your plaintext traffic. Remember: Tor can't read your mind. If you want true anonymity you have to go through extraordinary lengths to achieve it, and even then, you could make mistakes.
  - qw3rty01 6y ago
    The caveats you're mentioning are exactly why tor is a bad tool if privacy is your main goal. None of those concerns would be an issue with a service that focused on privacy. Also HTTPS everywhere isn't enough; you also need ESNI, which requires server support.
    - xvector 6y ago
      And even if ESNI was ubiquitous, a malicious exit would simply perform a reverse DNS lookup and have very high certainty about which sites you’re visiting.
hendersoon 6y ago
You're missing two major use-cases. 1) Piracy (the most common, I would imagine) 2) Evading content-blocking. For example, going to Facebook at work.

dgellow 6y ago

The entire VPN industry is really shady. Their marketing is entirely based on creating literal FUD (fear, uncertainty, doubt) and sell their service as the perfect and cheap solution. The presence they have on youtube ads and other mainstream platform ads is really disturbing.

kfreds 6y ago
I hear what you're saying but that generalization isn't fair. Check out IVPN for instance. They do a lot of things right: https://www.ivpn.net/ethics/ https://www.ivpn.net/ethics/
xvector 6y ago
Mullvad doesn’t do this, most providers do but I agree that this generalization is unfair to the VPN being discussed here.

dahfizz 6y ago

Another benefit is that VPNs raise the bar for investigation. You are not safe from the FBI or interpol, but for "petty crimes" like pirating you are safe(r). Comcast basically has automated the process of sending you a cease and desist if they detect you are torrenting something you shouldn't. Mozilla doesn't.

kfreds 6y ago

> As far as I know, in a lot of country (like France) it is a legal obligation to keep logs and be able to identify one of your customer if the police demands it. Not for all types of services. ISPs are sometimes under obligation to log, but VPN services don't belong in that category. I can't speak for others but we have contacts with legal experts (in a few jurisdictions) that alert us to changing laws. Ultimately if a country required us to start logging we would just cancel all of our machines there and leave. On the topic of trustworthiness, you are completely right of course that VPN users put a lot of trust in their VPN provider. There is also the lemon market aspect - the information and competence asymmetry between user and operator. That begs the question of how to ascertain trustworthiness. We think things like this help: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns/ https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns... https://mullvad.net/blog/2019/6/3/system-transparency-future/ https://mullvad.net/blog/2019/6/3/system-transparency-future...

chelmzy 6y ago
Are you an employee at Mullvad? Just want to say thank you for the excellent product and does Mullvad plan to except Monero in the future?
- kfreds 6y ago
  Hi! Thank you. I’m pretty sure it’s on the roadmap.
  - deleted 6y ago
    [deleted]
potency 6y ago
I would love to use Mullvad, but I need split tunneling on a per-process basis (Windows), since there is the occasional website that hates VPN-based servers. I have a special browser installation I use for such occasions, but few VPN providers offer per-process VPN exceptions. Any chance Mullvad is considering this feature?

kibwen 6y ago

You're correct that scummy, overselling advertisements make the whole VPN industry look bad, but Mozilla's VPN is provided by Mullvad, who doesn't engage in those sorts of advertisements. FWIW, I've looked into Mullvad and even had beers with some of their programmers (all of whom appeared to be Scandinavian anarchist/anti-authoritarian types) and I think Mozilla made an good choice with that partnership. (Of course, don't take my word for it; do your own research, or just host your own VPN.)

2OEH8eoCRo0 6y ago
Mullvad is the bees knees. The cats meow.
- edm0nd 6y ago
  A real humdinger