3 ms·

“that I didn't have a VPN connection running” Likely not telling you something you don’t already know, but many sites persist access logs and can answer “Which

“that I didn't have a VPN connection running” Likely not telling you something you don’t already know, but many sites persist access logs and can answer “Which IPs accessed this account?” for a very long time indeed. If you’re using VPN providers rather than a DIY approach, or even if you DIY through a cloud or other hosting provider, it’s extremely easy to answer questions like, “Which IPs that accessed this account came from known eyeball networks like Comcast?” (or cellular networks). If your goal is masking your true location then all it takes is one slip-up and it’s somewhat irreversible. In security roles, I’ve seen more than one threat actor busted through one slip-up (“Whoops we forgot to VPN when accessing one time, 14 months ago”). If you’re aiming to have a site not know Profile A and Profile B are the same, ditto, except now you also need to not access the site using the same methods, and also consider to what degree your browser / client can be fingerprinted.

data_maan 4y ago
> many sites persist access logs and can answer “Which IPs accessed this account?” for a very long time indeed. What would a very long time actually? I don't have any sysadmin experience, so I'm not sure. One year? Five years? I guess at some point there will be just too much data to keep everyone's logs...
data_maan 4y ago
> If your goal is masking your true location My goal using VPNs was actually an entirely different; you might be surprised by this: One of my Facebook profiles got blocked when I travelled a lot because (I imagine) geography based on my IP addresses changed too quickly and I think they thought I got hacked. My reasoning thus was now to just use one single place Another goal of using a VPN was to decrease the fingerprinting that you also mentioned, since I give LinkedIn one datapoint less. > “Which IPs that accessed this account came from known eyeball networks like Comcast?” (or cellular networks). What exactly do you mean by this, do you mean that because they fingerprint me, when I use the browser without a VPN, they can use the other fingerprinting information to figure out who is behind the VPN? LinkedIn can happily know my geographic location, because that reveals very little about me as a person; what I don't want LinkedIn to know is all the other websites that I visit and I also don't want other entities like Google to be able to connect my real-name LinkedIn and (frugal) CV with my website activity, because I consider that a clear trespassing of my privacy. I guess my only approach is a DIY where I reserve one computer only for LinkedIn and nothing else and when travelling SSH into that. I guess that is what you had in mind with a DIY approach?...

data_maan 4y ago

> many sites persist access logs and can answer “Which IPs accessed this account?” for a very long time indeed. What would a very long time actually? I don't have any sysadmin experience, so I'm not sure. One year? Five years? I guess at some point there will be just too much data to keep everyone's logs...

data_maan 4y ago

> If your goal is masking your true location My goal using VPNs was actually an entirely different; you might be surprised by this: One of my Facebook profiles got blocked when I travelled a lot because (I imagine) geography based on my IP addresses changed too quickly and I think they thought I got hacked. My reasoning thus was now to just use one single place Another goal of using a VPN was to decrease the fingerprinting that you also mentioned, since I give LinkedIn one datapoint less. > “Which IPs that accessed this account came from known eyeball networks like Comcast?” (or cellular networks). What exactly do you mean by this, do you mean that because they fingerprint me, when I use the browser without a VPN, they can use the other fingerprinting information to figure out who is behind the VPN? LinkedIn can happily know my geographic location, because that reveals very little about me as a person; what I don't want LinkedIn to know is all the other websites that I visit and I also don't want other entities like Google to be able to connect my real-name LinkedIn and (frugal) CV with my website activity, because I consider that a clear trespassing of my privacy. I guess my only approach is a DIY where I reserve one computer only for LinkedIn and nothing else and when travelling SSH into that. I guess that is what you had in mind with a DIY approach?...