5 ms·

How trustworthy are these VPN services? I use them because it's the best I can do, but I'm very suspicious. I would think the NSA is misappropriating my tax do

by n8cpdx 5y ago

How trustworthy are these VPN services? I use them because it's the best I can do, but I'm very suspicious. I would think the NSA is misappropriating my tax dollars if they hadn't compromised all of the VPN providers years ago. We also know the US has a history of selling compromised security equipment (https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-...) Don't get me wrong, I wish the NSA wasn't what it is, but if I'm paying for the federal government to be doing work, I expect them to do it exceedingly well. So what's the case the United States is so incompetent as to let Mullvad go untapped? Edit: the answer is that there apparently is no case. maqp was writing up the answer to my question in a response to another comment while I was writing mine. Edit 2: My personal threat model largely accepts that the NSA, CIA, and FBI can have their way with me in the unlikely event that they notice my existence. I can live with that because they have no reason to take notice. Despite my annoying moral values, I'm not a threat to the state. However, I find the focus on nation-state actors in an ad for a service that clearly can't protect from them to be distressingly dishonest.

badRNG 5y ago
There's a difference between what the NSA and CIA can do and what the FBI can do. Even if you are an outspoken dissident, the FBI likely won't burn the supposed fact that they have backdoored all VPN companies to try to prosecute you. The value in clandestine backdoors like these are for intelligence, not law enforcement.
- voxic11 5y ago
  With parallel construction the FBI doesn't need to burn anything.
bjoli 5y ago
I generally don't trust VPNs that seem to have a huge budget to spend on advertising, because that usually means they have had a shotload of investment that a VPN service will never be able to return to the investors. These VPNs are invariably owned in some weird ownership structure in jurisdictions I don't have any confidence in.
causi 5y ago
Depends on what you want to use a VPN for. If your use case is pirating the latest TV show, any VPN that's been subpoenaed and produced no records like PIA will be fine. If your use case is something that could get you in trouble with actual authorities, you'd be a fool to ever use your own internet connection. A clean (never had any of your PII or files on it) computer and a long-range wifi antenna to a public hotspot is the only level of security I find acceptable. The computer should never visit any sites you visit and obviously should never log into anything. Ideally while using it you should shut down your personal wifi so the potentially compromised hot computer never detects it as the strongest wifi signal. The correct level of paranoia is behaving in such a way that all your systems could be fully compromised and it would still never link to your real identity. If you're scared of anything short of a signal locator van you're doing it wrong.
- horsawlarway 5y ago
  Generally speaking - You want a library computer booted from a throw away bootable usb drive, located in a library a few hours away from your residence.
  - runnerup 5y ago
    And never the same library. Probably change your hardware frequently as well or even use disposable devices. Also don't commute to them in a traceable way (no personal vehicle, no Uber, no taxi with credit card, no public transportation without mask to cover facial recognition + outfit changes). Real "vs. NSA" security is nigh impossible right now for any persistent operation. Especially given ARGUS style eye-in-the-sky citywide object tracking. Maybe the most successful model would be an actual homeless person who wanders by walking and hitchiking and never sleeps in the same area twice.
- 0-_-0 5y ago
  > A clean (never had any of your PII or files on it) computer and a long-range wifi antenna to a public hotspot is the only level of security I find acceptable. People that used that method have been caught.
seniorivn 5y ago
if you knew history of development of all mighty special agencies(look at ussr/russia, china etc), you would know that you could become of interest to them, even if you don't think you are a threat. One of the benefits of mass surveillance(for the state) is that people of interest have no way of communicating with the world securely/secretly, they have to assume that everything is tapped and actively hostile to their communication setups. That means that you could be recognized as a part of shortest path to undermine some person of interest, and there is no reason for you to assume that they will hesitate to harm you and your safety/comfort

by n8cpdx 5y ago

badRNG 5y ago

There's a difference between what the NSA and CIA can do and what the FBI can do. Even if you are an outspoken dissident, the FBI likely won't burn the supposed fact that they have backdoored all VPN companies to try to prosecute you. The value in clandestine backdoors like these are for intelligence, not law enforcement.

voxic11 5y ago
With parallel construction the FBI doesn't need to burn anything.

bjoli 5y ago

I generally don't trust VPNs that seem to have a huge budget to spend on advertising, because that usually means they have had a shotload of investment that a VPN service will never be able to return to the investors. These VPNs are invariably owned in some weird ownership structure in jurisdictions I don't have any confidence in.

causi 5y ago

Depends on what you want to use a VPN for. If your use case is pirating the latest TV show, any VPN that's been subpoenaed and produced no records like PIA will be fine. If your use case is something that could get you in trouble with actual authorities, you'd be a fool to ever use your own internet connection. A clean (never had any of your PII or files on it) computer and a long-range wifi antenna to a public hotspot is the only level of security I find acceptable. The computer should never visit any sites you visit and obviously should never log into anything. Ideally while using it you should shut down your personal wifi so the potentially compromised hot computer never detects it as the strongest wifi signal. The correct level of paranoia is behaving in such a way that all your systems could be fully compromised and it would still never link to your real identity. If you're scared of anything short of a signal locator van you're doing it wrong.

horsawlarway 5y ago
Generally speaking - You want a library computer booted from a throw away bootable usb drive, located in a library a few hours away from your residence.
- runnerup 5y ago
  And never the same library. Probably change your hardware frequently as well or even use disposable devices. Also don't commute to them in a traceable way (no personal vehicle, no Uber, no taxi with credit card, no public transportation without mask to cover facial recognition + outfit changes). Real "vs. NSA" security is nigh impossible right now for any persistent operation. Especially given ARGUS style eye-in-the-sky citywide object tracking. Maybe the most successful model would be an actual homeless person who wanders by walking and hitchiking and never sleeps in the same area twice.
0-_-0 5y ago
> A clean (never had any of your PII or files on it) computer and a long-range wifi antenna to a public hotspot is the only level of security I find acceptable. People that used that method have been caught.

seniorivn 5y ago

if you knew history of development of all mighty special agencies(look at ussr/russia, china etc), you would know that you could become of interest to them, even if you don't think you are a threat. One of the benefits of mass surveillance(for the state) is that people of interest have no way of communicating with the world securely/secretly, they have to assume that everything is tapped and actively hostile to their communication setups. That means that you could be recognized as a part of shortest path to undermine some person of interest, and there is no reason for you to assume that they will hesitate to harm you and your safety/comfort