7 ms·

> VPNs were always meant to carry internal traffic to a private network, not the public internet This. And the idea that these so called ‘VPN’ services somehow

by Aaargh20318 4y ago

> VPNs were always meant to carry internal traffic to a private network, not the public internet This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through any other internet connection.

w14 4y ago
> There is no point to them. What about this? "Under the provisions of the Investigatory Powers (IP) Act, it is now possible for the Law Enforcement Agency (LEA) community to lawfully obtain Internet Connection Records (ICR) in support of their investigations. Following the completion of some initial trial activities, work is now underway to provision a national ICR service." https://www.digitalmarketplace.service.gov.uk/digital-outcomes-and-specialists/opportunities/17267 https://www.digitalmarketplace.service.gov.uk/digital-outcom...
- jolux 4y ago
  And what makes you trust that the VPN provider wouldn’t share these records if asked?
  - crest 4y ago
    Pick one in a suitable jurisdiction with a track record of sending such records and requests for them to the bit bucket?
  - autoexec 4y ago
    In the end you have to trust someone or you might as well just stay offline forever. In the US, very few people have much choice in their ISP. If you are lucky you might have more than two options. Many ISPs are known to be untrustworthy. They outright state they will mine your internet history and sell it. If I have the choice between an ISP who I know will sell my browsing history and a VPN which might, but claims not to? Well, I know which one I'm going to pick.
    - thayne 4y ago
      They also state they can and will shut down your service for copyright infringement.
      - autoexec 4y ago
        If ISPs don't shut down people's accounts they'll get sued for billions in fines. There are still open court cases against multiple ISPs for not cutting enough people off from the internet. So far, courts have agreed with the RIAA/MPA who paid good money for the laws we have.
        thayne 4y ago
        Yes, the media industry is certainly more to blame here. Although, the current ISP oligopoly means that there are less companies to sue or otherwise bully. And it doesn't help that some major ISPs are owned by companies that also produce copyrighted content they want to protect.
  - slt2021 4y ago
    use VPN provider that does not store these ICR records and is physically unable to fulfill such request
  - jeffbee 4y ago
    Moreover, why do you imagine that the VPN is not being operated by the NSA? THere are really a few different kinds of VPN operators: intelligence services, organized criminals, and legit businesses. You have no way of determining which is which.
  - bad416f1f5a2 4y ago
    I’ve heard the idea of “competing jurisdictions” advanced here: run your own Wireguard VM in China or Russia and route traffic through that box, with the goal of essentially introducing unfriendly international borders in your traffic. Ideally your Russian VM provider would be uninterested in responding to an American subpoena. The other concept I’ve heard put out is to add layers - your traffic hits Vultr, then Hetzner, then etc etc. Conceivably if you cross enough jurisdictions you can make it very difficult for a legal adversary to attack your traffic. Would I bet on this for activities I needed to remain exceptionally private? No - but if I needed relatively consistently low latency traffic and a decent baseline of privacy it might just work.
autoexec 4y ago
> All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. Not true, at all. There are several good reasons to use VPNs to get a different on-ramp to the otherwise untrusted internet. - Avoid ISP tracking: Your ISP should see only traffic to and from the VPN. - Access content intended for those in other regions: Many sites and services only show certain content to people who enter the internet from specific places. - Limit the amount of activity linked by trackers: Visiting certain sites only from different IPs/browsers will help keep logs of that traffic isolated from the logs of your other browsing. - Allows you to connect to sites and services that cannot connect back to you once you've disconnected: A lot of people, even those with dynamic IPs, keep their address for months or years at a time. VPNs provide a great way to cycle through IPs. VPNs don't solve every problem, but they're a powerful tool to keep in your tookbox. There are many many very valuable uses for VPNs some that offer privacy/security benefits and some that are just plain useful. It's wild to hear anyone say that "There is no point to them."
- Shared404 4y ago
  Thank you for saving me the typing. No it's not gonna make you an invisible unhackable ghost, but at least I don't have to worry about my ISP screwing me over.
  - dTal 4y ago
    Why are you worried about your ISP tracking you but not the VPN company? In effect you've simply added another ISP on top.
    - a1369209993 4y ago
      Most people can switch VPN companies more easily than they can switch ISPs.
      - Shared404 4y ago
        This is the case for me. I _know_ that my ISP is untrustworthy, I've read the ToS.It's also bundled with my apartment and I can't switch. What I can switch however is what VPS company I use, or what commercial VPN I connect to. Plus, the harm from being banned by a VPN is a lot lower than an ISP, as low as the chances of either are.
wyager 4y ago
> And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable I trust Mullvad more than I trust Optimum.
- Aaargh20318 4y ago
  But the point is you shouldn't trust either of them.
chakalakasp 4y ago
Thing is, if you ping experts in the privacy field (like Mike Bazzell, the former FBI OSINT guy who billionaires and celebs hire to keep their personal info off the internet), they will all say the VPNs are a very important tool to create a layer of privacy between you and the site you are visiting and also a good tool to prevent said sites from easily profiling you. No, they are not a panacea -- much like the security universe, the privacy universe requires lots of other active and passive behavioral and technological changes to properly lock things down to whatever standard you require for your threat model. But they are very much an important tool. For a small subset of people it's literally a tool that protects their life. So yeah, it's a kinda a big deal if it leaks. (Which is why most privacy experts, were you to tell them you were sufficiently paranoid, would have you fire up a pfSense and link it permanently to a VPN service and then run a separate brand of VPN software on whatever device, so that you have two layers going through two companies.)
- mike_d 4y ago
  > who billionaires and celebs hire to keep their personal info off the internet I also do this type of work on the side. When it matters a device level VPN is never the correct option, because every OS leaks to some extent. They get a device where the cellular components have been disabled and it can only connect to a fixed wifi AP carried by one of their EP guys that tunnels the traffic back to a datacenter.
mschuster91 4y ago
> This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic when you are using a VPN to mask your Internet access. There have been multiple instances of this in the past [1][2] and ongoing (e.g. DNS [3]), and ISP "middleboxes" have been historically the biggest impediment in rolling out new features. Ubiquitous HTTPS has shut down a lot of that shit, but until DNS-over-HTTPS becomes actual mainstream DNS (and SSL SNI!) will still leak a lot of information to entities that have a direct financial interest in collecting, packaging and selling this data to advertisers - there is a reason why ISPs oppose any legislation that turns them into "dumb pipes" after all. Security-wise, at least if you are using any kind of untrusted network (e.g. university campus, public hotspots) a decent VPN software that uses the OS-provided firewall to completely drop any incoming and outgoing packets except for the VPN tunnel connection is also a massive benefit. The downside of course is that you are now forced to trust the VPN provider instead of the ISP - but at least the VPN provider market is healthy and extremely competitive, which means any sort of shady bullshit would be a virtual death sentence, unlike the ISP market where you are in many cases stuck with one or two options. Not to forget, VPNs also provide privacy on the "other end": as many providers don't cycle through IP addresses sometimes for months, advertising providers can track your movement across the Internet simply by collecting your origin IP. A good VPN provider regularly changes the origin IP visible to sites you access. [1] https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use... [2] https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hijacking-your-dns-traffic/ https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hija... [3] https://www.csoonline.com/article/2953718/t-mobile-caught-in-crossfire-of-injected-ad-war-between-shady-ad-networks-and-google.html https://www.csoonline.com/article/2953718/t-mobile-caught-in...
- neilalexander 4y ago
  > Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic No, you're just delegating those capabilities to some completely unregulated random actors instead. > which means any sort of shady bullshit would be a virtual death sentence This assumes that their shady bullshit is discovered by someone. I would bet good money that the vast majority of it isn't. They could be sampling traffic and selling it to other companies without modifying it and users would never be any the wiser. Honestly, I wish we could get past this broken narrative that VPNs are a panacea.
eru 4y ago
> There is no point to them. There might be no point to their security and privacy, but they are still good for getting foreign-country Netflix.
enlyth 4y ago
In the UK if you download a TV show or other copyrighted material without a VPN, you can get a letter from your ISP as a warning together with a list of the content you've downloaded, and they may terminate your service if you continue. A VPN solves this, and does protect your privacy, so your comment is just needless hyperbole.
Angostura 4y ago
You're paying to insert a potential man-in-the-middle attack. That's got to be worth something.
raxxorraxor 4y ago
That would be true if we didn't have regional content blocking, location tracking and general surveillance by supposedly democratic states. I recommend VPN services in regions where legislation of your home country might difficulties getting data.

w14 4y ago

> There is no point to them. What about this? "Under the provisions of the Investigatory Powers (IP) Act, it is now possible for the Law Enforcement Agency (LEA) community to lawfully obtain Internet Connection Records (ICR) in support of their investigations. Following the completion of some initial trial activities, work is now underway to provision a national ICR service." https://www.digitalmarketplace.service.gov.uk/digital-outcomes-and-specialists/opportunities/17267 https://www.digitalmarketplace.service.gov.uk/digital-outcom...

jolux 4y ago
And what makes you trust that the VPN provider wouldn’t share these records if asked?
- crest 4y ago
  Pick one in a suitable jurisdiction with a track record of sending such records and requests for them to the bit bucket?
- autoexec 4y ago
  In the end you have to trust someone or you might as well just stay offline forever. In the US, very few people have much choice in their ISP. If you are lucky you might have more than two options. Many ISPs are known to be untrustworthy. They outright state they will mine your internet history and sell it. If I have the choice between an ISP who I know will sell my browsing history and a VPN which might, but claims not to? Well, I know which one I'm going to pick.
  - thayne 4y ago
    They also state they can and will shut down your service for copyright infringement.
    - autoexec 4y ago
      If ISPs don't shut down people's accounts they'll get sued for billions in fines. There are still open court cases against multiple ISPs for not cutting enough people off from the internet. So far, courts have agreed with the RIAA/MPA who paid good money for the laws we have.
      - thayne 4y ago
        Yes, the media industry is certainly more to blame here. Although, the current ISP oligopoly means that there are less companies to sue or otherwise bully. And it doesn't help that some major ISPs are owned by companies that also produce copyrighted content they want to protect.
- slt2021 4y ago
  use VPN provider that does not store these ICR records and is physically unable to fulfill such request
- jeffbee 4y ago
  Moreover, why do you imagine that the VPN is not being operated by the NSA? THere are really a few different kinds of VPN operators: intelligence services, organized criminals, and legit businesses. You have no way of determining which is which.
- bad416f1f5a2 4y ago
  I’ve heard the idea of “competing jurisdictions” advanced here: run your own Wireguard VM in China or Russia and route traffic through that box, with the goal of essentially introducing unfriendly international borders in your traffic. Ideally your Russian VM provider would be uninterested in responding to an American subpoena. The other concept I’ve heard put out is to add layers - your traffic hits Vultr, then Hetzner, then etc etc. Conceivably if you cross enough jurisdictions you can make it very difficult for a legal adversary to attack your traffic. Would I bet on this for activities I needed to remain exceptionally private? No - but if I needed relatively consistently low latency traffic and a decent baseline of privacy it might just work.

autoexec 4y ago

> All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. Not true, at all. There are several good reasons to use VPNs to get a different on-ramp to the otherwise untrusted internet. - Avoid ISP tracking: Your ISP should see only traffic to and from the VPN. - Access content intended for those in other regions: Many sites and services only show certain content to people who enter the internet from specific places. - Limit the amount of activity linked by trackers: Visiting certain sites only from different IPs/browsers will help keep logs of that traffic isolated from the logs of your other browsing. - Allows you to connect to sites and services that cannot connect back to you once you've disconnected: A lot of people, even those with dynamic IPs, keep their address for months or years at a time. VPNs provide a great way to cycle through IPs. VPNs don't solve every problem, but they're a powerful tool to keep in your tookbox. There are many many very valuable uses for VPNs some that offer privacy/security benefits and some that are just plain useful. It's wild to hear anyone say that "There is no point to them."

Shared404 4y ago
Thank you for saving me the typing. No it's not gonna make you an invisible unhackable ghost, but at least I don't have to worry about my ISP screwing me over.
- dTal 4y ago
  Why are you worried about your ISP tracking you but not the VPN company? In effect you've simply added another ISP on top.
  - a1369209993 4y ago
    Most people can switch VPN companies more easily than they can switch ISPs.
    - Shared404 4y ago
      This is the case for me. I _know_ that my ISP is untrustworthy, I've read the ToS.It's also bundled with my apartment and I can't switch. What I can switch however is what VPS company I use, or what commercial VPN I connect to. Plus, the harm from being banned by a VPN is a lot lower than an ISP, as low as the chances of either are.

wyager 4y ago

> And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable I trust Mullvad more than I trust Optimum.

Aaargh20318 4y ago
But the point is you shouldn't trust either of them.

chakalakasp 4y ago

Thing is, if you ping experts in the privacy field (like Mike Bazzell, the former FBI OSINT guy who billionaires and celebs hire to keep their personal info off the internet), they will all say the VPNs are a very important tool to create a layer of privacy between you and the site you are visiting and also a good tool to prevent said sites from easily profiling you. No, they are not a panacea -- much like the security universe, the privacy universe requires lots of other active and passive behavioral and technological changes to properly lock things down to whatever standard you require for your threat model. But they are very much an important tool. For a small subset of people it's literally a tool that protects their life. So yeah, it's a kinda a big deal if it leaks. (Which is why most privacy experts, were you to tell them you were sufficiently paranoid, would have you fire up a pfSense and link it permanently to a VPN service and then run a separate brand of VPN software on whatever device, so that you have two layers going through two companies.)

mike_d 4y ago
> who billionaires and celebs hire to keep their personal info off the internet I also do this type of work on the side. When it matters a device level VPN is never the correct option, because every OS leaks to some extent. They get a device where the cellular components have been disabled and it can only connect to a fixed wifi AP carried by one of their EP guys that tunnels the traffic back to a datacenter.

mschuster91 4y ago

> This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic when you are using a VPN to mask your Internet access. There have been multiple instances of this in the past [1][2] and ongoing (e.g. DNS [3]), and ISP "middleboxes" have been historically the biggest impediment in rolling out new features. Ubiquitous HTTPS has shut down a lot of that shit, but until DNS-over-HTTPS becomes actual mainstream DNS (and SSL SNI!) will still leak a lot of information to entities that have a direct financial interest in collecting, packaging and selling this data to advertisers - there is a reason why ISPs oppose any legislation that turns them into "dumb pipes" after all. Security-wise, at least if you are using any kind of untrusted network (e.g. university campus, public hotspots) a decent VPN software that uses the OS-provided firewall to completely drop any incoming and outgoing packets except for the VPN tunnel connection is also a massive benefit. The downside of course is that you are now forced to trust the VPN provider instead of the ISP - but at least the VPN provider market is healthy and extremely competitive, which means any sort of shady bullshit would be a virtual death sentence, unlike the ISP market where you are in many cases stuck with one or two options. Not to forget, VPNs also provide privacy on the "other end": as many providers don't cycle through IP addresses sometimes for months, advertising providers can track your movement across the Internet simply by collecting your origin IP. A good VPN provider regularly changes the origin IP visible to sites you access. [1] https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use... [2] https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hijacking-your-dns-traffic/ https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hija... [3] https://www.csoonline.com/article/2953718/t-mobile-caught-in-crossfire-of-injected-ad-war-between-shady-ad-networks-and-google.html https://www.csoonline.com/article/2953718/t-mobile-caught-in...

neilalexander 4y ago
> Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic No, you're just delegating those capabilities to some completely unregulated random actors instead. > which means any sort of shady bullshit would be a virtual death sentence This assumes that their shady bullshit is discovered by someone. I would bet good money that the vast majority of it isn't. They could be sampling traffic and selling it to other companies without modifying it and users would never be any the wiser. Honestly, I wish we could get past this broken narrative that VPNs are a panacea.

eru 4y ago

> There is no point to them. There might be no point to their security and privacy, but they are still good for getting foreign-country Netflix.

enlyth 4y ago

In the UK if you download a TV show or other copyrighted material without a VPN, you can get a letter from your ISP as a warning together with a list of the content you've downloaded, and they may terminate your service if you continue. A VPN solves this, and does protect your privacy, so your comment is just needless hyperbole.

Angostura 4y ago

You're paying to insert a potential man-in-the-middle attack. That's got to be worth something.

raxxorraxor 4y ago

That would be true if we didn't have regional content blocking, location tracking and general surveillance by supposedly democratic states. I recommend VPN services in regions where legislation of your home country might difficulties getting data.