3 ms·

NordVPN! But only because Internet Historian’s ads are too effective. In fact, it’s been a saga. https://www.youtube.com/watch?v=iFZ_N1Faf_E&ab_channel=vonFuers

NordVPN! But only because Internet Historian’s ads are too effective. In fact, it’s been a saga. https://www.youtube.com/watch?v=iFZ_N1Faf_E&ab_channel=vonFuerstMedia https://www.youtube.com/watch?v=iFZ_N1Faf_E&ab_channel=vonFu... is probably my favorite, but there are like 40 more. (https://www.youtube.com/watch?v=0p9J9cI0t7M&ab_channel=vonFuerstMedia https://www.youtube.com/watch?v=0p9J9cI0t7M&ab_channel=vonFu... etc.) But if you need security, roll your own VPN. You can set up a Digital Ocean droplet as one. It's a pain, but you only need to do it once. I'm not sure there's much of a persuasive reason to use any of these big providers. That's why they always fall back on claims of security – unsophisticated users always fall for it.

Hamuko 5y ago
NordVPN doesn't have an entirely spotless record. https://www.theverge.com/2019/10/21/20925065/nordvpn-server-breach-vpn-traffic-exposed-encryption https://www.theverge.com/2019/10/21/20925065/nordvpn-server-...
fragmede 5y ago
Whats your threat model, that a Digital Ocean droplet is a viable VPN host? It's trivially tracebackable to you.
- sillysaurusx 5y ago
  How so? All you see is that a random DO droplet is pinging your service. You'd need a legal request to get any further info about the droplet. And in that situation, it's equivalent to any other VPN service that will comply with legal requests.
  - Xavdidtheshadow 5y ago
    A good VPN won't _have_ logs, so they _can't_ comply with legal requests (instead of won't)
    - sillysaurusx 5y ago
      Do you really trust that? With your life? This is precisely the point that the threat model bares its fangs. You can ignore it, but you should be aware that you're putting all your faith in that service. A hypothetical Good VPN doesn't exist in China, for example, because they're legally not allowed to do what you suggest. Many of us don't live in China, but some do. Even outside of China, is it really true that a VPN service will simply give LEO the finger when they ask "Who was downloading child porn off your servers?" I'm skeptical they can.
      - Jach 5y ago
        That's the thing though, not all legal requests get the same weight or priority. I wouldn't trust a VPN to not roll over for your example cp case, but I think a middle finger equivalent isn't unreasonable for the less severe and more common case of receiving a complaint that the IP was observed as part of a swarm seeding copyrighted material. For lesser things, where does DO sit on the spectrum of will rat you out (which ISPs do), and likely won't rat you out (basically any paid VPN because their reputation depends on not doing so)?
  - penagwin 5y ago
    He is talking about government level threats, DO provides no benefit. I'll add that rolling your own means you're the only one exiting that IP address, so if your threat model involves websites profiling you and/or alternative accounts that won't help.
    - sillysaurusx 5y ago
      Where did someone mention government level threats? If the threat model is a government, Tor is the only safe solution, and only after extensive training and safeguards. Using anything else is actually-crazy.
      - nl 5y ago
        If your threat isn't a government level threat, then a digital ocean based VPN probably gives enough protection.
- nl 5y ago
  It's traceable with a US warrant. If you are outside the US this is sufficient protection for many people. For example even close US allies (eg five eyes) have to go through the US court system to get this warrant, and that is a slow, annoying process when you aren't based in the US. It raises the level of friction to meaning it will only happen for somewhat major investigations. If you are a major drug dealer, then yes, they'll do it. If they catch you with some small amount of some drug, then it's unlikely they'll chase it.
aasasd 5y ago
https://archive.is/qBBF3 https://archive.is/qBBF3 The original article is deleted for some reason, though.

Hamuko 5y ago

NordVPN doesn't have an entirely spotless record. https://www.theverge.com/2019/10/21/20925065/nordvpn-server-breach-vpn-traffic-exposed-encryption https://www.theverge.com/2019/10/21/20925065/nordvpn-server-...

fragmede 5y ago

Whats your threat model, that a Digital Ocean droplet is a viable VPN host? It's trivially tracebackable to you.

sillysaurusx 5y ago
How so? All you see is that a random DO droplet is pinging your service. You'd need a legal request to get any further info about the droplet. And in that situation, it's equivalent to any other VPN service that will comply with legal requests.
- Xavdidtheshadow 5y ago
  A good VPN won't _have_ logs, so they _can't_ comply with legal requests (instead of won't)
  - sillysaurusx 5y ago
    Do you really trust that? With your life? This is precisely the point that the threat model bares its fangs. You can ignore it, but you should be aware that you're putting all your faith in that service. A hypothetical Good VPN doesn't exist in China, for example, because they're legally not allowed to do what you suggest. Many of us don't live in China, but some do. Even outside of China, is it really true that a VPN service will simply give LEO the finger when they ask "Who was downloading child porn off your servers?" I'm skeptical they can.
    - Jach 5y ago
      That's the thing though, not all legal requests get the same weight or priority. I wouldn't trust a VPN to not roll over for your example cp case, but I think a middle finger equivalent isn't unreasonable for the less severe and more common case of receiving a complaint that the IP was observed as part of a swarm seeding copyrighted material. For lesser things, where does DO sit on the spectrum of will rat you out (which ISPs do), and likely won't rat you out (basically any paid VPN because their reputation depends on not doing so)?
- penagwin 5y ago
  He is talking about government level threats, DO provides no benefit. I'll add that rolling your own means you're the only one exiting that IP address, so if your threat model involves websites profiling you and/or alternative accounts that won't help.
  - sillysaurusx 5y ago
    Where did someone mention government level threats? If the threat model is a government, Tor is the only safe solution, and only after extensive training and safeguards. Using anything else is actually-crazy.
    - nl 5y ago
      If your threat isn't a government level threat, then a digital ocean based VPN probably gives enough protection.
nl 5y ago
It's traceable with a US warrant. If you are outside the US this is sufficient protection for many people. For example even close US allies (eg five eyes) have to go through the US court system to get this warrant, and that is a slow, annoying process when you aren't based in the US. It raises the level of friction to meaning it will only happen for somewhat major investigations. If you are a major drug dealer, then yes, they'll do it. If they catch you with some small amount of some drug, then it's unlikely they'll chase it.

aasasd 5y ago

https://archive.is/qBBF3 https://archive.is/qBBF3 The original article is deleted for some reason, though.