4 ms·

Unless you are peering a VPN is just another ISP and like any ISP they are in complete control of your traffic. Imagine you are in a hotel. When you order room

Unless you are peering a VPN is just another ISP and like any ISP they are in complete control of your traffic. Imagine you are in a hotel. When you order room service your food hygiene is in the hands of the hotel chef — the In-room-dining Service Provider (ISP) if you will. You can order takeout instead, but you’re really only delegating food hygiene to a different chef, one that’s harder to track down and with a considerably lower stake in your well-being than the one provided by your hotel manager. I’m more into camping, personally, but even then your produce comes from somewhere else.

blfr 5y ago
That's true but doesn't entirely deny the value of a VPN. For example, using a VPN protects your privacy with the endpoints you connect to: Facebook or even some random forum administrators only see your VPN address and don't know where you are, whether at home, visiting your mom in another state, or staying at a hotel.
atoav 5y ago
The point of VPNs is IMO that some people cannot choose which hotel they are staying at to use your analogy. E.g. if you are traveling into certain countries etc. Or you might wanna create the impression you are coming from somewhere else than you actually do for various reasons. E.g. let's say you want to consume media from a different country. Running your own VPN is practical if it is just about the tunnel, but it gets unwieldy if it is about having one in different countries or if it is about hiding your identity.
- lmm 5y ago
  If you know the food in the particular hotel where you're staying is bad, then yeah, ordering takeout is helpful. But as general advice, the idea that a VPN, any VPN, is going to be inherently more secure than your ISP, any ISP, is nonsense.
  - bradknowles 5y ago
    Depends on how much you trust your ISP. For example, AT&T is in the top five list of ISPs around the world that do Deep Packet Inspection, so that they can throttle your NetFlix and Amazon Prime streaming TV speeds, as well as insert their own ads where they want, etc…. Who knows what else they’re doing? Same with Spectrum. That’s the two high speed carriers that are common here in Austin. Sure, there are smaller carriers in fringe areas, but they are a small fraction of the market. This is why I want a proper SDN. Let me treat the carrier like opaque dumb pipes, and aggregate the bandwidth across those channels, so that I am insulated from total failure if just one of them should go down, and in the expected case I can manage my own traffic shaping the way I want it to be in the house.
PinguTS 5y ago
While I understand your point and I agree and think the same way, there is one small point, which should not be underrated in this: "a VPN is just another ISP" is only true as long as your ISP does NAT and you don't have a publicly available IP. That is true for some mobile networks here in Germany for example. So a VPN (or things like TOR) provide you with one single out-point/edge/end-point that is (hopefully) shared with many many other people. With that you can hide in the crowed and it is very difficult to find you in the crowed. On the other side it would defeat the purpose if the VPN provider limits the number of accounts on one out-point/edge/end-point to improve performance, because then it would defeat the purpose.
- tolleydbg 5y ago
  Each connection is NATed through the VPN though and the fact that the port number does not change makes it possible to make inferences about connections a user has made through the tunnel and inject arbitrary data into the connections. https://www.usenix.org/system/files/sec21-tolley.pdf https://www.usenix.org/system/files/sec21-tolley.pdf
  - kota2 5y ago
    With Wireguard, the listening port does change each time you connect.

blfr 5y ago

That's true but doesn't entirely deny the value of a VPN. For example, using a VPN protects your privacy with the endpoints you connect to: Facebook or even some random forum administrators only see your VPN address and don't know where you are, whether at home, visiting your mom in another state, or staying at a hotel.

atoav 5y ago

The point of VPNs is IMO that some people cannot choose which hotel they are staying at to use your analogy. E.g. if you are traveling into certain countries etc. Or you might wanna create the impression you are coming from somewhere else than you actually do for various reasons. E.g. let's say you want to consume media from a different country. Running your own VPN is practical if it is just about the tunnel, but it gets unwieldy if it is about having one in different countries or if it is about hiding your identity.

lmm 5y ago
If you know the food in the particular hotel where you're staying is bad, then yeah, ordering takeout is helpful. But as general advice, the idea that a VPN, any VPN, is going to be inherently more secure than your ISP, any ISP, is nonsense.
- bradknowles 5y ago
  Depends on how much you trust your ISP. For example, AT&T is in the top five list of ISPs around the world that do Deep Packet Inspection, so that they can throttle your NetFlix and Amazon Prime streaming TV speeds, as well as insert their own ads where they want, etc…. Who knows what else they’re doing? Same with Spectrum. That’s the two high speed carriers that are common here in Austin. Sure, there are smaller carriers in fringe areas, but they are a small fraction of the market. This is why I want a proper SDN. Let me treat the carrier like opaque dumb pipes, and aggregate the bandwidth across those channels, so that I am insulated from total failure if just one of them should go down, and in the expected case I can manage my own traffic shaping the way I want it to be in the house.

PinguTS 5y ago

While I understand your point and I agree and think the same way, there is one small point, which should not be underrated in this: "a VPN is just another ISP" is only true as long as your ISP does NAT and you don't have a publicly available IP. That is true for some mobile networks here in Germany for example. So a VPN (or things like TOR) provide you with one single out-point/edge/end-point that is (hopefully) shared with many many other people. With that you can hide in the crowed and it is very difficult to find you in the crowed. On the other side it would defeat the purpose if the VPN provider limits the number of accounts on one out-point/edge/end-point to improve performance, because then it would defeat the purpose.

tolleydbg 5y ago
Each connection is NATed through the VPN though and the fact that the port number does not change makes it possible to make inferences about connections a user has made through the tunnel and inject arbitrary data into the connections. https://www.usenix.org/system/files/sec21-tolley.pdf https://www.usenix.org/system/files/sec21-tolley.pdf
- kota2 5y ago
  With Wireguard, the listening port does change each time you connect.