33 ms·

Microsoft bakes a VPN into Edge and turns it on

608 points by bluish29 4y ago

_mwnc 4y ago
I don't like this. When I add a URL to the address bar I want TCP/IP traffic to be directed to only the remote address I requested, and not have traffic relayed through some third party.
- hbrn 4y ago
  I have bad news for you. traceroute news.ycombinator.com
  - doublerabbit 4y ago
    Besides the point, 18 hops to get to HN via my colo server in London, UK; what is cogentco doing with the excessive routing? 1 24 ms 24 ms 25 ms 10.0.0.1 2 32 ms 25 ms 24 ms x.x.x.x 3 28 ms 28 ms 27 ms core-router-b-nlc.netwise.co.uk [185.17.175.246] 4 29 ms 25 ms 25 ms core-router-hex.netwise.co.uk [185.17.175.240] 5 29 ms 25 ms 26 ms te0-7-0-17.505.rcr21.b015534-1.lon01.atlas.cogentco.com [216.168.64.16] 6 27 ms 25 ms 25 ms be2186.ccr22.lon01.atlas.cogentco.com [154.54.61.70] 7 27 ms 25 ms 28 ms be2870.ccr41.lon13.atlas.cogentco.com [154.54.58.173] 8 94 ms 93 ms 94 ms be2317.ccr41.jfk02.atlas.cogentco.com [154.54.30.185] 9 103 ms 100 ms 100 ms be2806.ccr41.dca01.atlas.cogentco.com [154.54.40.106] 10 118 ms 117 ms 117 ms be2112.ccr41.atl01.atlas.cogentco.com [154.54.7.158] 11 130 ms 130 ms 134 ms be2687.ccr41.iah01.atlas.cogentco.com [154.54.28.70] 12 147 ms 146 ms 181 ms be2927.ccr21.elp01.atlas.cogentco.com [154.54.29.222] 13 155 ms 155 ms 156 ms be2930.ccr32.phx01.atlas.cogentco.com [154.54.42.77] 14 172 ms 348 ms 192 ms be2941.rcr52.san01.atlas.cogentco.com [154.54.41.33] 15 198 ms 202 ms 205 ms te0-0-2-0.rcr12.san03.atlas.cogentco.com [154.54.82.70] 16 209 ms 165 ms 165 ms te0-0-2-3.nr11.b006590-1.san03.atlas.cogentco.com [154.24.18.194] 17 166 ms 171 ms 203 ms 38.96.10.250 18 165 ms 162 ms 162 ms news.ycombinator.com [209.216.230.240]
    - pGuitar 4y ago
      I got 30 hops from Atlanta/Comcast but hops from 9 to 30 are "blank" like this: 30 * * * the last non-blank hop is this: 8 M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.921 ms GIGLINX-INC.bar1.SanDiego1.Level3.net (4.16.105.98) 60.600 ms M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.882 ms
    - jdthedisciple 4y ago
      only 8 hops for me from Europe
    - dhaavi 4y ago
      Cogent is the third biggest network on the Internet by CAIDA AS Rank. Your connection used it for pretty much all the distance.
    - ziml77 4y ago
      Is that excessive? It looks like it's taking the most direct route it can. First goes west to NY, then goes south to DC, south again to Atlanta, and then makes a series of westward hops to Houston, El Paso, Phoenix, and San Diego. And I'm guessing the hops within London and San Diego would be something like a router for local traffic, a router for regional traffic, and a router for international/interstate traffic.
  - deleted 4y ago
    [deleted]
  - _mwnc 4y ago
    Sorry I misspoke I know that routing traffic isn't a direct peer to peer connection but that's different from ALL traffic going through one company. I'm not an expert on internet routing but it seems to me a bit disconcerting how much of web traffic is already routed through cloudflare servers. This centralization scares me.
- criddell 4y ago
  Do a traceroute and see how many third parties your traffic is going through. You probably don't get many point-to-point connections.
  - deleted 4y ago
    [deleted]
dodgerdan 4y ago
I don’t think Adguard, the Russian tech company registered in cyprus, but with mostly Russian employees living in Russia has our best interests at heart.
- lizardactivist 4y ago
  What makes you say that? And this is not really about Adguard, it's about Microsoft, Cloudflare, and Edge.
- aussiesnack 4y ago
  Your evidence seems to be repetition of the word 'Russia'. Seems a tad thin.
- imbnwa 4y ago
  What bothers me about Adguard is offering HTTPS cert spoofing as a means to duplicate uBo's dynamic filtering behavior
- gdy 4y ago
  Of course, we all stand by our beloved president who is threatening to start a nuclear war. What's not to like.
stereoradonc 4y ago
Edge-VPN is primarily Cloudfare. Now Cloudfare has potentially even "more" data about users. They don't have an ad platform, yet. What will stop Cloudfare from accumulating and then targeting the users through "Bing-Ads"?
- zarmin 4y ago
  Did you misspell Cloudflare as Cloudfare three times?
  - sdmike1 4y ago
    Sure, they did, but that doesn't make their point any less relevant...
    - zarmin 4y ago
      Okay?
kazinator 4y ago
"Let's use our browser to herd users into our walled network, where our competitors cannot track them as easily as we are able to."
- donmcronald 4y ago
  I think this is the real reason for the "VPN in a browser" trend. It's about getting exclusive access to browsing data. Imagine Facebook data collection, but without being able to ignore it. That's where we're headed. Watch for Google to release a "security" product that does something similar. IMO Apple, Microsoft, and (eventually) Google are going to use their platform dominance to usurp Facebook's ad business. That's why Facebook is making a big bet on VR. It's not that they see VR as a naturally popular platform. It's simply one of the last platforms that could be popular (for the near future), isn't already dominated by a major player, and has network effects that make it a critical mass platform similar to how Facebook works. If they can buy their way in, they own the whole market. This kind of thing should get these companies obliterated by regulators. It's shameless, blatant, anti-competitive behavior where they're using their dominance in one market to gain an extremely unfair advantage in another. The goal is to move the entire ad market away from the open web and into closed platforms like OSes and browsers.
  - kazinator 4y ago
    VPNs can destroy net neutrality. The internet can be reduced to a dumb pipe that gives everyone equal bandwidth, which is used to operate VPNs, inside of which entirely private rules apply that are inscrutable from the outside.
sylens 4y ago
Had to move off of Edge to Brave a few weeks back after sticking it out longer than I should have. I really liked Edge on both Windows and macOS but they keep adding stuff that I don't want to the browser.
aborsy 4y ago
The move benefits foreign companies, weakening the domestic industry. Let’s see how fast EU can move and regulate the traffic access. For instance, demanding that the servers should be accessible only to the local governments.
0xbadcafebee 4y ago
Isn't this basically just Chrome's data saver? They never called it a VPN but they did send all your traffic to Google.
sproketboy 4y ago
bborud 4y ago
Second time today Hacker News makes Firefox look good.
- saiya-jin 4y ago
  Seriously, I can't grok why people here don't use it more often. Web is 100% usable, what doesn't work in it doesn't work in latest chrome neither. Web development is fine too, just different, not worse. But whatever, use chrome for dev work if you love it, and Firefox for everything else, especially Internet proper (plus you get another full testing browser, not just spoofing user-agent) Its a great product, and ublock origin make it by far the best on the market for internet not only for me, across any devices ever made, period.
  - bborud 4y ago
    _I_ can't grok why _I_ haven't switched. :-) So this weekend I'll make an effort to switch from Chrome.
    - pessimizer 4y ago
      https://github.com/aris-t2/customcssforfx https://github.com/aris-t2/customcssforfx Here's something to use if the UI makes you really upset. Also you will probably miss translation: https://addons.mozilla.org/en-US/firefox/addon/traduzir-paginas-web/ https://addons.mozilla.org/en-US/firefox/addon/traduzir-pagi...
marshray 4y ago
I wonder how it respects legal web censorship orders imposed on ISPs like those of China and UK.
- perlgeek 4y ago
  I hear the Great Chinese Firewall is pretty good at blocking VPNs, they'll likely be able to block this one pretty quickly.
  - marshray 4y ago
    Sounds like this one is going to appear on the network like https connections to Cloudflare.
rmason 4y ago
I am not saying that they'd do it but what would prevent Microsoft from 'theoretically' collecting your information themselves and then selling it back to your ISP?
xnx 4y ago
Sounds pretty handy for data-scraping!
BLO716 4y ago
The trend towards 0-configuration VPNs though make it totally compelling to just port your traffic home. I'm not trying to be a fan-boi, but I want ALL my traffic off the network of snoop. I'm just going to go out there and say Ubuiti and Teleport with WifiMan on phone/tablets/computers and 0 config bar codes, I mean its ALMOST frictionless for my family to do this setup once its going. I least try to do this while we travel and are out of network range. How do people feel about this?
- gzer0 4y ago
  how about a tailscale exit node running on a computer at home takes 10 seconds to setup and I can use my home IP from anywhere on earth
dathinab 4y ago
Hm, I think this is mainly an form of advertisement move to compel more users to use edge/not switch away from it. Reason: By now many non-technical people think a VPN is necessary (or at least recommendable) for "safety". Through how a VPN actually helps/works most non-technical people do not understand at all. For Microsoft providing a VPN which by default is only enabled on public WiFi and similar isn't too expensive. They also need to compete with Apples Privacy Relay feature. So putting bias aside it seems a good thing. But there are some gotchas: 1. a VPN is not per-se privacy protecting, it is only that if the VPN provider legally binding agrees to not sell out the users data. 2. a major browser which tries to force itself on all windows users providing a VPN for free hurt the VPN market due to the unfair competitive advantage this VPN has. 3. It could normalize for many people that VPNs do not necessary have a feature to avoid geo-blocking => make it easier for legislation targeting such features to pass 4. also more centralization for cloudflair Through if you ignore all this from a pure "common peoples security" perspective (i.e. not state actor attacks) this is an neat improvement. There are still to many things which allow attacks due to not using HTTPS and for non state-level attackers the best attack vector are public hotspots and similar where this VPN automatically is enabled. E.g. common security problem is HTTP(not s) redirect links in e.g. mails, which an attacker could trivially rewrite to point you to their site which automatically proxies the site you originally wanted to go to. Worst offender I saw was a FIN-tec site using emailing http(not s) redirect links containing the auth token for the initial account setup...
kingaillas 4y ago
Everybody is suspicious of Microsoft's motives but I think in this, you gotta consider how many windows systems are out there used by security novices. Lots of people are computer savvy but want to use a computer to do something else not under the umbrella of hobbyist sysadmin work. I don't see the downside here, again, considering the multi-millions average users Windows/Edge has. If you are savvy enough to roll your own VPN using algo from Trail of Bits, then do that. If you are able to weigh the pros and cons of VPNs from having one or not, or which one to use, you are ahead of 99.99% of the people this will help.
edpichler 4y ago
> "...it lacks one important feature users seek in a virtual private network: an ability to bypass geo-block. In the case of Edge’s VPN, you won’t be able to choose any server location..."
sedatk 4y ago
> and turns it on for CANARY users which is a completely normal thing. This kind of sensationalism really hurts everyone.
collaborative 4y ago
Strangely enough Opera's VPN has suddenly started working after a long period of not being "available" and pushing their paid version
drexlspivey 4y ago
Pretty cool to see Wireguard, a protocol that is only a few years old, making it so fast into the linux kernel and now into Edge. Literally shipping into billions of devices in such a small amount of time.
tonymet 4y ago
Microsoft obviously benefits from the ability to collect more tracking signals. Even over HTTPS they will have many traffic signals to use for ads targeting. Just be mindful of any feature and who it benefits. These companies aren't charities.
Justin_K 4y ago
Why don't we just call it what it is: "Microsoft redirects all browser traffic through their servers". At first it sounds great but in two years when the start selling the data or start injecting ads, what will the privacy advocates think then? How long until Microsoft decides they don't like your site, so they're going to block it? Yet another move towards centralization of the internet, NO THANKS.
SavageBeast 4y ago
So Edge users are going to be impacted by this - whats that like 35 people outside the development team who made it?
omgomgomgomg 4y ago
Did anyone test this? Is it better than operas "vpn"? Can the user configure various geolocations?
Nifty3929 4y ago
Privacy from our government is becoming illegal. I believe that with widespread adoption of VPN services, at some point in the next few years the government will prohibit ISPs from sending traffic to foreign VPN services - for our protection.
Thorentis 4y ago
Just wait. VPNs, under the guise of privacy, will be used to continue mass surveillance operations. Soon you won't be able to access certain sites unless you're using an "official" VPN.
remram 4y ago
Back in the days, a network relay at the application later was called a proxy. Any reason we are now calling this VPN?
- crazygringo 4y ago
  Yes, because proxies and VPNs are totally different. Proxies are generally unencrypted and a new connection is usually made per-request. VPN's are inherently encrypted and maintain a single connection. They're totally different technologies. So hope that answers your question.
  - remram 4y ago
    None of this is true. Proxies use HTTP and can therefore use "keep-alive"; they are usually HTTPS. VPN are usually UDP and therefore connectionless. The usual difference is that they operate at application layer (proxy) or ethernet/IP (VPN). Which would make this a proxy, not a VPN.
    - deleted 4y ago
      [deleted]
sh1mmer 4y ago
Can someone explain to me how this is different from apple’s privacy relay? Is it because it’s all traffic instead of just some traffic Apple designates as “trackers”?
29athrowaway 4y ago
The Microsoft Network is back apparently. The AOL-like hell that the Microsoft Network was in the 90s makes its return in its Neo-Internet Explorer dystopian nightmare.
jfdi 4y ago
Nice work MSFT
yenwodyah 4y ago
I wouldn't care about this VPN if it weren't for the fact that I can't ignore it. There's an option to hide it from the toolbar, but every time I open an incognito window it pops back up again. It's incredibly annoying.
4258204984 4y ago
hda2 4y ago
I can see it now: Microsoft: "Sorry $site_owner, We (some unaccountable ML model) detected that you have violated some rule (we will not tell you which) and as a result, your website can no longer be accessed. This decision is final and permanent." There are other ways to protect user privacy without conveniently putting yourself in charge. They pulled the same move with UEFI and secure boot Microsoft needs to be investigated and fined.
- josephcsible 4y ago
  Especially timely given that https://news.ycombinator.com/item?id=33036748 https://news.ycombinator.com/item?id=33036748 just happened.
la_fayette 4y ago
There will be times when more people are fed up with all the corporate BS. Duckduckgo, Lineageos, Firefox, Protonmail, ... is all working fine for me. I don't miss any corp tech.
tarunmuvvala 4y ago
The walled gardens are raising their walls. The plan is to sell the corporates VPN enabled services. The corporate will buy it without hesitation too if it comes bundled with Office 365.
mrtri 4y ago
jawadch93 4y ago
[dead]
MrPatan 4y ago
What do I need to do to disable this?
vinay_ys 4y ago
In India, it is illegal to operate an open unauthenticated wifi. All public Internet access requires a secure auth and you have to present a government ID to the operator to get access. (This applies to getting a mobile SIM card or landline Internet at home as well). This is to deter anonymous illicit activity being conducted from from public Internet locations (like cafes, bus/train/airport stations etc.) Also, same real identity requirement is now applied to VPN operators. Additionally, they have to collect and retain traffic logs, and cooperate with government cybercrime investigations. Obviously there are potential loopholes – apparently a lot of VPN services are planning to continue operating services with Indian residents with servers not physically hosted in India without logs. Apple with its Private Relay and now Microsoft with Edge Browser VPN – don't provide VPN with exit nodes hosted in foreign jurisdictions. I'm curious to know if they will cooperate with requirements to collect/retain logs as well.
ChoGGi 4y ago
That's nice I suppose... The only time I use Edge is when something Microsoft opens it, then I have to close it.
sirmike_ 4y ago
Lol the traffic is Capped at 1gb. It’s also super obscure. Only in small rollouts to edge canary users. It’s opt in I believe and It can be turned off. Even MSFT isn’t going to pay the network bill for everyone forever Split decision if this is a true good faith thing for consumers. Time will tell. I can easily see where it’s a great thing on one hand but also a terrible one too. This is where a company’s integrity comes in.
peanut_worm 4y ago
Doesn’t that mean that all my connections are routed MS servers? How is MS more trustworthy than my ISP
sswam 4y ago
andrewstuart2 4y ago
Why do I always get a bad feeling about the motivations behind stuff like this? I want to believe it's for better privacy and security, but it's being driven by a corporation or two, and that makes me 100% suspicious. Like, for example, suddenly Edge is no longer respecting local DNS options and my pihole protects one fewer device from the real dangers to privacy. I don't want to be cynical so often, but this really doesn't feel like a benevolent move. Yeah, it's conditional at the moment, but as with Chrome and manifest v3, among many other examples, I'm losing my faith that anything with the potential to increase ad revenue will remain turned off for long.
- spicybright 4y ago
  Anything that decides to wrap around your internet traffic without telling you should definitely raise your antennas. Even if they had the best intentions, it's pretty easy to botch these things which erode your privacy even more.
- pricci 4y ago
  About the pihole problem, redirect all calls to port 53 to your pihole. If Edge is using DoH, you're out of luck.
  - numpad0 4y ago
    Does something like `source 0.0.0.0 dest 8.8.8.8 dport 443 action drop` work for DoH?
- deleted 4y ago
  [deleted]
- d0mine 4y ago
  "bad feeling" is too generous. Microsoft is famous for its ubiquitous telemetry. It is not a suspicion, data collection is a fact. today. already.
- jahewson 4y ago
  The motivation here is surely reducing ad tracking.
graypegg 4y ago
When did the world start trusting any company with a VPN more than their ISP? I still find the privacy pitch to be flakey at best, where at least I can choose who’s aware of my traffic, but getting past geo-blocks really seems to be the most obvious consumer value, which this Cloudflare vpn lacks.
- zapataband1 4y ago
  I thought it was when all the ISPs started basically giving away your private info to the government and repeatedly lied about it
- hot_gril 4y ago
  It can go either way. Many ISPs are known to be nasty, but hardly anyone sees the effects of that, so it's hard to tell. I think VPNs market "more security," people mostly blindly buy it, and everyone is happy. Yeah, to me, a VPN is only a way around geo restrictions.
- nvllsvm 4y ago
  For some - it was when their ISP started sending their customers scary sounding letters regarding certain downloaded movies and shows. Some ISPs also needlessly block certain sites (ex. Verizon blocks nyaa.si)
- wintermutestwin 4y ago
  My ISP actively lobbied to be able to harvest (steal) my data. Who do I trust more: the guy who says that they aren't selling my data, or the guy who corrupted my government so that they can actively sell me out (not to mention their monopoly)? Sure, the first guy could be a liar, but I know that the second guy is a thief. I don't care about geo-blocking - my only threat model is to keep a scumbag ISP at bay. Edit: I should add that keeping sites I browse from knowing my IP is also part of my threat model.
  - MichaelCollins 4y ago
    VPN also has my credit card number, real name, etc. VPN doesn't have that; their data is worth less than the data my ISP could sell.
ohbtvz 4y ago
...in a "canary" (basically a nightly build), for some users, for some specific cases (unsecure http, public wifi).
legrande 4y ago
Edge is a reskinned Chromium browser with Microsoft tracking and telemetry baked in. Just because they have a VPN now, it doesn't make it any more private/secure. Why do people use Edge? If you're any way privacy conscious you wouldn't use Microsoft products.
- Kwpolska 4y ago
  My primary browser is Firefox. I have Edge as my backup browser for sites that don’t work with Firefox, and sometimes for watching stuff. There is no reason for me to install Chrome. (And Microsoft isn’t that bad, even if Edge sometimes does weird things.)
  - Koshkin 4y ago
    > for watching stuff ... while the browser is watching you [1]. > Microsoft isn’t that bad Yes it is. That bad. [1] https://en.wikipedia.org/wiki/In_Soviet_Russia https://en.wikipedia.org/wiki/In_Soviet_Russia
- timbit42 4y ago
  I'd choose Edge over Chrome if I didn't have better options.
- cookiengineer 4y ago
  I would be cautious with such assumptions. There is a good reason why Trident is alive and kicking, people just don't know about it. But it's the reason for more than 98% of exploits, because shitty software of Microsoft still uses Trident to render MSHTML based documents (office etc). The same will be true for a traffic-observing webview2, for decades to come. And it will never be removed again, because of Microsoft's development philosophy.
- A4ET8a8uTh0 4y ago
  In my case, it is the default browser at my current company. I don't know the reasoning behind it, but we are also forced into Teams. Corporate requirements is my reason. FWIW, it is not bad performance-wise.
wintermutestwin 4y ago
While I would never use a VPN service fronted by a data thieving company, I really hope that VPN usage goes more mainstream so that companies can't have "no access from VPN" as a security strategy. Ally bank recently did this and many others have intermittent issues due to flagging, etc.
- hibikir 4y ago
  Security teams don't block certain VPN traffic for fun.When a certain IP block has been running credential stuffing attacks all month long, It's very reasonable to see any request from said block with a lot of suspicion. In many cases, 99.9% of login attempts from certain IP blocks are just fraudulent, and there might be more requests from one of said blocks than legitimate requests from the rest of the world combined. Completely blocking a VPN is often too blunt an instrument, but even the best alternatives are unfriendly to legitimate traffic. The most user-friendly thing you can do is to rely on bonus security controls, like asking for two factor authentication for everything. No, you will not be able to log into anything from a new device, even, without the two factor. A very understandable tradeoff for a bank, but we'll end up seeing that for any account protecting anything of relatively low value. If your second factor is tied to, say, a phone, it's not going to be fun to wait to replace it if it's lost. But in a world where most traffic is coming from a VPN, there aren't many good alternatives.
  - egberts1 4y ago
    For my home gateway, all HTTPS, VPN, SSTP, SMTP, PPTP, IPSec, UDP, DNS, and proxy are blocked. All JavaScript scripts are blanked by Squid ICAP clients. WireGuard to a VPS for DNS resolver/nameserver. Run a mean transparent Squid proxy, Snort/Zeek/Suricata and whitelist bastion dns forwarder. No problem. No spam. No headache.
- VoodooJuJu 4y ago
  I can see this evolving into something worse. >try to connect to ally >vpn not allowed - try connecting through on of our authorized vpn partners: microsoft, nordvpn!, etc.
- 4y ago
oefrha 4y ago
As a generally happy Cloudflare customer, a Cloudflare VPN makes me deeply uneasy. (Yes, I know Warp has been around for a while.) Using it means Cloudflare owns a huge chunk of your Internet traffic end to end and decrypted, a uniquely powerful position to be in. And this is going to be default on in Edge according to TFA, even though it’s only applied to plain HTTP sites by default at the moment.
- sascha_sl 4y ago
  While I agree that it is concerning, WARP doesn't decrypt your traffic unless you sign in to ZeroTrust, enable it in your dashboard and install their CA. Not much you can do about them having decrypted traffic for sites that use them.
  - oefrha 4y ago
    > having decrypted traffic for sites that use them Yes, that’s the huge chunk I’m talking about, and when you use them as your VPN they can effortlessly trace that decrypted traffic to you.
    - sascha_sl 4y ago
      How is that different from not using a VPN?
      - xboxnolifes 4y ago
        Its not, that's the point.
        ViViDboarder 4y ago
        It’s not for one party. The VPN protects your traffic from any party other than Cloudflare. Exactly as it would with any VPN.
      - oefrha 4y ago
        When you don’t use a VPN, at least your traffic to Cloudflare doesn’t carry a unique ID of yours. Effort is required to correlate your traffic, especially if you are CGNAT’ed and share an IP with others, or have a dynamic IP that changes frequently.
chiefalchemist 4y ago
> "However, the VPN will not run while you’re streaming or watching videos — so that you can save up on traffic which is capped at a modest 1 GB per month." OK? And what happens after that? After you go over your 1 GB cap? You're cut off from the internet?
- shmde 4y ago
  They just turn the VPN off ?
  - mdaniel 4y ago
    Heh, I wonder if they just quietly do that in the middle of a session * GET bank.example.com/accounts * GET bank.example.com/accounts/1 vpn disconnect * GET bank.example.com/accounts/1/details <- 403 new IP, who dis?
- ridgered4 4y ago
  How they even id the user for the cap? Some kind of system signature? Requirement of a MS account?
witrak 4y ago
If this "VPN" is under the control of an entity collecting information about users wherever it can what's the sense of the service. "VPN" (in fact the term should be "virtual internet access network") make sense only when it is independent of any entity controlling internet traffic...
RcouF1uZ4gsC 4y ago
> Also, we must be aware of the risks associated with using the built-in VPN services of Microsoft, Apple, and the like. The tools they so generously offer might protect you from being tracked by your Internet Service Provider (ISP), It seems using a VPN from your browser vendor does not increase your risk. I don’t think a VPN would have any information that your browser did not.
- oefrha 4y ago
  People generally don’t tolerate browsers that phone home with any and all accessible information. But if you claim to also run a built-in VPN service...
  - vladvasiliu 4y ago
    What do you mean? I oftentimes see people using Chrome (not Chromium) while logged into a profile. Are you telling me that either those people are actually a minority, or that Chrome doesn't phone home?
- lxgr 4y ago
  Not really: Your browser vendor might push out a malicious update or enable dormant functionality that sends them telemetry on your browsing, or even your entire web traffic, but a VPN definitively does receive all of you traffic (including, at least, the host name of almost all sites you visit). I can observe who my browser/OS talk to (beyond the sites I already visit) – but what happens inside a VPN provider is impossible to tell.
mkl95 4y ago
Serious question - is there a legitimate use case for Edge when a Chrome Stable build is available?
- mrweasel 4y ago
  I'm thinking Microsoft is hoping for the reverse: Why download Chrome when you have a perfectly good Blink based browser already installed.
- jabroni_salad 4y ago
  From a business perspective, IE mode and onedrive userstate sync for o365 customers From a personal perspective, goog and microsoft are basically equivalent and I don't want either of their browsers.
- vladvasiliu 4y ago
  It's already installed and it works well enough. Plus, if I'm using Windows, I'm already sending a bunch of telemetry to MS, so I don't see a reason to go out of my way to send some to goog, too. Also, I'm not a Netflix customer, but I understand that on PC you need Edge to get high-definition (>=1080p) video. Chrome doesn't work (neither does it work on Mac). So the question becomes: is there a legimate use case for Chrome when Edge is available (and is mostly the same thing)? I, personally, am quite against using a Google browser (or derivative), but for my gaming PC where I only launch the browser once in a blue moon, I just can't be bothered to download anything else since Edge works. On my work PC I use Firefox, and am quite happy with it.
- wintermutestwin 4y ago
  Edge is the only Chromium-based browser that allows for Vertical Tabs.
  - netsharc 4y ago
    Vivaldi has it, and it's a Chromium-based browser made by people who left Opera after it was sold to the Chinese. Opera had vertical tabs even a decade or so ago, back when it was still using its own Presto engine (they switched to Chromium and seems to have lost this feature).
strictfp 4y ago
Cue VPNs being banned
jeroen79 4y ago
cloudflare is nasty, its worse giving them all your data then spreading it around.
eatonphil 4y ago
I think Pixel phones (or maybe it's all Google Fi phones) also do this.
smm11 4y ago
I'm going to run my VPN on Edge running a VPN.
_mwnc 4y ago
Hmmm interesting another reason for me to avoid microsoft browsers.
reactspa 4y ago
A crazy thing happened to me on a recent trip to Mexico city. I thought my AT&T mobile plan covered Mexico, but after 2 days it stopped working. So I tried to log into my account online with AT&T. It would keep redirecting me to the Mexico AT&T website instead of the US website. The first time I realized I needed a VPN.
counttheforks 4y ago
pmarreck 4y ago
Imagine still tolerating Windows in 2022
- seabrookmx 4y ago
  Some people play video games. Some people want to use the Adobe suite on user upgradable hardware. If you come out of your bubble you'll see there's plenty of reasons to still use Windows (typing this in Firefox running on Fedora, FWIW).
  - pmarreck 4y ago
    I play video games. Things have actually changed a heck of a lot in the last couple of years and seem to be accelerating thanks to the Steam Deck. 90% of the games I care about now work fine in Linux, sometimes with a little massaging (there are also now many more tools and forum posts to help with this). Modding certain things is occasionally the biggest impediment but that too is getting easier thanks to stuff like https://github.com/frostworx/steamtinkerlaunch https://github.com/frostworx/steamtinkerlaunch , which if you use the Flatpak Steam can be installed via the app installer right alongside it.
    - seabrookmx 4y ago
      You're describing a worse user experience than gaming on Windows. Single player games on Steam is a best case scenario.. Blizzard games, or games with anti cheat are a total pain to run or won't run at all. This is why people tolerate Windows in 2022. I'm not saying I like it, I was just trying to answer your question :)
- rejectfinite 4y ago
  The great thing about Windows is that you can install another browser and set it to default. You don't have to use Edge.
  - blibble 4y ago
    and then every other update it "accidentally" gets set back to Edge
rodolphoarruda 4y ago
Not even god knows what's going on inside that (not so very much) private network.
MikeYasnev007 4y ago
netsharc 4y ago
> The VPN feature, known as “Microsoft Edge Secure Network,” has rolled out to a limited selection of users in the latest Edge Canary version. Now why didn't they call it Microsoft Secure Network! And MSN in short. And next they should start a VPN'ed messaging service, they can name it "MSN Messenger".
rntksi 4y ago
I remember this being done back when Opera 7 was used. I think it had a feature for mobile OS, where it would route requests to Opera's servers and serve clients a minified, smaller version of the page, so people on 2G at the time could still use the web. I don't remember people being outraged at the time at the prospect of a browser having a baked-in VPN option though.
- laundermaf 4y ago
  Don't forget about Google’s own "optimizer" https://en.wikipedia.org/wiki/Google_Web_Accelerator https://en.wikipedia.org/wiki/Google_Web_Accelerator
- int_19h 4y ago
  That was Opera Mini, and it's still around (and popular in areas where Internet speed is still measured in Kbps and/or you pay for data per megabyte). It's not even that it served a minified version, too. It basically did all layout server-side, so the client got something more akin to a PDF of the webpage optimized for its screen size. It also compressed images.
- noja 4y ago
  Yes that was mainly because mobile internet was really slow and using it without Opera's proxy was an exercise in frustration. But do not forget that Opera 7 was release TWENTY YEARS AGO. Things are a bit different now. Think eternal september.
- bityard 4y ago
  I remember this as well and thought it was a neat service. One that I would have liked to emulate using my own proxy in order to save bandwidth on my mobile data but never got around to actually doing. These days with widespread HTTPS, the only way to do this is to bake it into the browser itself. And of course, this was back when you could trust Opera to do what they said they were (or weren't) doing.
- Nextgrid 4y ago
  At the time, spyware was not yet a mainstream business model so there was no outrage because respectable, established companies didn't yet become spyware operators. There was still mutual trust back in the day.
1langisbad 4y ago
bilekas 4y ago
> you can save up on traffic which is capped at a modest 1 GB per month. These days that probably wont even manage the tracking requests being sent from the machine a month.
AlexandrB 4y ago
Interesting to see this on the front page along with https://news.ycombinator.com/item?id=33036748 https://news.ycombinator.com/item?id=33036748 I wonder how long until Microsoft starts blocking sites on their VPN for "your protection".
- mikaelsouza 4y ago
  I think they already do. Just like chrome and firefox block sites that are considered insecure. I don't think they need a VPN for this.
shuntress 4y ago
This is why net neutrality and easy accessible encryption are important.
crazygringo 4y ago
> the VPN will automatically connect when you’re using public Wi-Fi or browsing unsecured networks and sites lacking a valid HTTP certificate. OK, that's actually a pretty decent idea. It's not going to be always-on, but it's providing security specifically for things like coffeeshops/libraries and for sites that don't provide their own security. In other words, it's "backup security", not rerouting all of your "normal" secure traffic at work/home. This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually.
- CogitoCogito 4y ago
  > This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually. How does this protect from having JavaScript injected? Why couldn't the VPN do that?
  - simsla 4y ago
    MITM protection on public networks maybe?
    - CogitoCogito 4y ago
      > MITM protection on public networks maybe? How does this address the fact that the operators of the VPN can certainly modify any content they access over http on your behalf?
      - kevmo314 4y ago
        Better than every public wifi access point being able to.
      - yed 4y ago
        The operators of the VPN in this case are also the developers of the browser. If they want to inject content they can do that without the VPN.
hopfog 4y ago
I run a free browser game where you can start playing immediately, no registration required. The game has a big sandbox element where you can build and paint on the world map. Naturally I've attracted trolls doing everything in their power to grief and ruin it for other players. This has lead me to reluctantly implement moderation tools such as IP bans and proxy detection. I'm currently using a couple of services where I can supply an IP and get a risk score back but I'm worried about false positives. I'm afraid this initiative, while great for privacy, will make my defense measures futile. What should I do? I just want to run a game with as few intrusive barriers as possible. I have no interest in collecting any private data from users whatsoever.
- aaronax 4y ago
  You have to have intrusive barriers. This is true in real life and it is true online. The world is not a graffiti free-for-all because there are barriers: the government (police) is able to apprehend individuals, link that physical individual to an identity (which it issued at birth), and effectively implement consequences to that identity/individual. If you want your site to not be a graffiti free-for-all, you will need a durable way to identify actual people. Twitter, for example, essentially requires a phone number to use their site. Phone numbers are fairly difficult to get anonymously. Therefore, Twitter has a useful link between their users and a physical individual. Other services use other things. The government should implement cryptographic certificate based identities to citizens. Ideally there would be a way to "sign" something that says you are a real citizen without revealing which citizen you are, but is durably unique (subsequent signings identify you as the same citizen). Facebook, Google, etc. are effectively filling this function right now but they leave much to be desired.
  - hopfog 4y ago
    > Ideally there would be a way to "sign" something that says you are a real citizen without revealing which citizen you are, but is durably unique (subsequent signings identify you as the same citizen). This is a truly interesting and groundbreaking idea that would solve all my problems. Do you know if there are any initiatives like that or is it science-fiction?
pGuitar 4y ago
Why do they even need this? With all the spying/telemetry they already do, they probably already know the sites that you visit....
- timbit42 4y ago
  They want to keep everyone else from tracking you so their data is more valuable.
- lucasmullens 4y ago
  Some users might want this feature, which gets them more users. I think outside HN most users would appreciate a free VPN for when they're on public Wi-Fi.
kebman 4y ago
If I'm not mistaken Skype used to be called the most secure video calling app back in the day. Until this: https://lists.randombit.net/pipermail/cryptography/2013-May/004224.html https://lists.randombit.net/pipermail/cryptography/2013-May/...
jll29 4y ago
Microsoft as any company must abide by federal laws, including US FISA court orders.
btown 4y ago
From the article, this is powered by a partnership with Cloudflare. It's worth noting that until August 6 of this year, Cloudflare's WARP VPN would leak your IP address - but only to sites using the Cloudflare network. https://web.archive.org/web/20220609160341/https://developers.cloudflare.com/warp-client/known-issues-and-faq/#why-is-my-public-ip-address-sometimes-visible https://web.archive.org/web/20220609160341/https://developer... And when Cloudflare released their new SOPs for Warp, they did so in a blog post titled "More features, still private" - https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/ https://blog.cloudflare.com/geoexit-improving-warp-user-expe... as referenced in https://developers.cloudflare.com/warp-client/known-issues-and-faq/#does-warp-reveal-my-ip-address-to-websites-i-visit https://developers.cloudflare.com/warp-client/known-issues-a... Microsoft's initial announcement for the feature touted that IP addresses would be masked, and one imagines that they did their diligence with Cloudflare and are enforcing the strong practices that WARP has now rolled out more broadly. But it's worth noting that you're routing through a company to whom the words "still private" encompassed leaking client IP address information to Cloudflare's hosting customers as recently as two months ago.
- judge2020 4y ago
  Warp/1.1.1.1[0] is a product, not a VPN, despite the fact that it tunnels your traffic. Even after the IP address change, the current documentation and promotions for Warp do not call it a VPN. It was never meant to keep your IP hidden from the websites you visit. 0: https://1.1.1.1/ https://1.1.1.1/
  - btown 4y ago
    I wish that were how it had been presented, but they indeed did advertise it as a VPN. From https://blog.cloudflare.com/1111-warp-better-vpn/ https://blog.cloudflare.com/1111-warp-better-vpn/ : "Technically, WARP is a VPN.... We built WARP because we’ve had those conversations with our loved ones too and they’ve not gone well. So we knew that we had to start with turning the weaknesses of other VPN solutions into strengths. Under the covers, WARP acts as a VPN. But now in the 1.1.1.1 App, if users decide to enable WARP, instead of just DNS queries being secured and optimized, all Internet traffic is secured and optimized. In other words, WARP is the VPN for people who don't know what V.P.N. stands for."

608 points by bluish29 4y ago

I don't like this. When I add a URL to the address bar I want TCP/IP traffic to be directed to only the remote address I requested, and not have traffic relayed through some third party.

hbrn 4y ago
I have bad news for you. traceroute news.ycombinator.com
- doublerabbit 4y ago
  Besides the point, 18 hops to get to HN via my colo server in London, UK; what is cogentco doing with the excessive routing? 1 24 ms 24 ms 25 ms 10.0.0.1 2 32 ms 25 ms 24 ms x.x.x.x 3 28 ms 28 ms 27 ms core-router-b-nlc.netwise.co.uk [185.17.175.246] 4 29 ms 25 ms 25 ms core-router-hex.netwise.co.uk [185.17.175.240] 5 29 ms 25 ms 26 ms te0-7-0-17.505.rcr21.b015534-1.lon01.atlas.cogentco.com [216.168.64.16] 6 27 ms 25 ms 25 ms be2186.ccr22.lon01.atlas.cogentco.com [154.54.61.70] 7 27 ms 25 ms 28 ms be2870.ccr41.lon13.atlas.cogentco.com [154.54.58.173] 8 94 ms 93 ms 94 ms be2317.ccr41.jfk02.atlas.cogentco.com [154.54.30.185] 9 103 ms 100 ms 100 ms be2806.ccr41.dca01.atlas.cogentco.com [154.54.40.106] 10 118 ms 117 ms 117 ms be2112.ccr41.atl01.atlas.cogentco.com [154.54.7.158] 11 130 ms 130 ms 134 ms be2687.ccr41.iah01.atlas.cogentco.com [154.54.28.70] 12 147 ms 146 ms 181 ms be2927.ccr21.elp01.atlas.cogentco.com [154.54.29.222] 13 155 ms 155 ms 156 ms be2930.ccr32.phx01.atlas.cogentco.com [154.54.42.77] 14 172 ms 348 ms 192 ms be2941.rcr52.san01.atlas.cogentco.com [154.54.41.33] 15 198 ms 202 ms 205 ms te0-0-2-0.rcr12.san03.atlas.cogentco.com [154.54.82.70] 16 209 ms 165 ms 165 ms te0-0-2-3.nr11.b006590-1.san03.atlas.cogentco.com [154.24.18.194] 17 166 ms 171 ms 203 ms 38.96.10.250 18 165 ms 162 ms 162 ms news.ycombinator.com [209.216.230.240]
  - pGuitar 4y ago
    I got 30 hops from Atlanta/Comcast but hops from 9 to 30 are "blank" like this: 30 * * * the last non-blank hop is this: 8 M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.921 ms GIGLINX-INC.bar1.SanDiego1.Level3.net (4.16.105.98) 60.600 ms M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.882 ms
  - jdthedisciple 4y ago
    only 8 hops for me from Europe
  - dhaavi 4y ago
    Cogent is the third biggest network on the Internet by CAIDA AS Rank. Your connection used it for pretty much all the distance.
  - ziml77 4y ago
    Is that excessive? It looks like it's taking the most direct route it can. First goes west to NY, then goes south to DC, south again to Atlanta, and then makes a series of westward hops to Houston, El Paso, Phoenix, and San Diego. And I'm guessing the hops within London and San Diego would be something like a router for local traffic, a router for regional traffic, and a router for international/interstate traffic.
- deleted 4y ago
  [deleted]
- _mwnc 4y ago
  Sorry I misspoke I know that routing traffic isn't a direct peer to peer connection but that's different from ALL traffic going through one company. I'm not an expert on internet routing but it seems to me a bit disconcerting how much of web traffic is already routed through cloudflare servers. This centralization scares me.
criddell 4y ago
Do a traceroute and see how many third parties your traffic is going through. You probably don't get many point-to-point connections.
- deleted 4y ago
  [deleted]

dodgerdan 4y ago

I don’t think Adguard, the Russian tech company registered in cyprus, but with mostly Russian employees living in Russia has our best interests at heart.

lizardactivist 4y ago
What makes you say that? And this is not really about Adguard, it's about Microsoft, Cloudflare, and Edge.
aussiesnack 4y ago
Your evidence seems to be repetition of the word 'Russia'. Seems a tad thin.
imbnwa 4y ago
What bothers me about Adguard is offering HTTPS cert spoofing as a means to duplicate uBo's dynamic filtering behavior
gdy 4y ago
Of course, we all stand by our beloved president who is threatening to start a nuclear war. What's not to like.

stereoradonc 4y ago

Edge-VPN is primarily Cloudfare. Now Cloudfare has potentially even "more" data about users. They don't have an ad platform, yet. What will stop Cloudfare from accumulating and then targeting the users through "Bing-Ads"?

zarmin 4y ago
Did you misspell Cloudflare as Cloudfare three times?
- sdmike1 4y ago
  Sure, they did, but that doesn't make their point any less relevant...
  - zarmin 4y ago
    Okay?

kazinator 4y ago

"Let's use our browser to herd users into our walled network, where our competitors cannot track them as easily as we are able to."

donmcronald 4y ago
I think this is the real reason for the "VPN in a browser" trend. It's about getting exclusive access to browsing data. Imagine Facebook data collection, but without being able to ignore it. That's where we're headed. Watch for Google to release a "security" product that does something similar. IMO Apple, Microsoft, and (eventually) Google are going to use their platform dominance to usurp Facebook's ad business. That's why Facebook is making a big bet on VR. It's not that they see VR as a naturally popular platform. It's simply one of the last platforms that could be popular (for the near future), isn't already dominated by a major player, and has network effects that make it a critical mass platform similar to how Facebook works. If they can buy their way in, they own the whole market. This kind of thing should get these companies obliterated by regulators. It's shameless, blatant, anti-competitive behavior where they're using their dominance in one market to gain an extremely unfair advantage in another. The goal is to move the entire ad market away from the open web and into closed platforms like OSes and browsers.
- kazinator 4y ago
  VPNs can destroy net neutrality. The internet can be reduced to a dumb pipe that gives everyone equal bandwidth, which is used to operate VPNs, inside of which entirely private rules apply that are inscrutable from the outside.

sylens 4y ago

Had to move off of Edge to Brave a few weeks back after sticking it out longer than I should have. I really liked Edge on both Windows and macOS but they keep adding stuff that I don't want to the browser.

aborsy 4y ago

The move benefits foreign companies, weakening the domestic industry. Let’s see how fast EU can move and regulate the traffic access. For instance, demanding that the servers should be accessible only to the local governments.

0xbadcafebee 4y ago

Isn't this basically just Chrome's data saver? They never called it a VPN but they did send all your traffic to Google.

sproketboy 4y ago

bborud 4y ago

Second time today Hacker News makes Firefox look good.

saiya-jin 4y ago
Seriously, I can't grok why people here don't use it more often. Web is 100% usable, what doesn't work in it doesn't work in latest chrome neither. Web development is fine too, just different, not worse. But whatever, use chrome for dev work if you love it, and Firefox for everything else, especially Internet proper (plus you get another full testing browser, not just spoofing user-agent) Its a great product, and ublock origin make it by far the best on the market for internet not only for me, across any devices ever made, period.
- bborud 4y ago
  _I_ can't grok why _I_ haven't switched. :-) So this weekend I'll make an effort to switch from Chrome.
  - pessimizer 4y ago
    https://github.com/aris-t2/customcssforfx https://github.com/aris-t2/customcssforfx Here's something to use if the UI makes you really upset. Also you will probably miss translation: https://addons.mozilla.org/en-US/firefox/addon/traduzir-paginas-web/ https://addons.mozilla.org/en-US/firefox/addon/traduzir-pagi...

marshray 4y ago

I wonder how it respects legal web censorship orders imposed on ISPs like those of China and UK.

perlgeek 4y ago
I hear the Great Chinese Firewall is pretty good at blocking VPNs, they'll likely be able to block this one pretty quickly.
- marshray 4y ago
  Sounds like this one is going to appear on the network like https connections to Cloudflare.

rmason 4y ago

I am not saying that they'd do it but what would prevent Microsoft from 'theoretically' collecting your information themselves and then selling it back to your ISP?

xnx 4y ago

Sounds pretty handy for data-scraping!

BLO716 4y ago

The trend towards 0-configuration VPNs though make it totally compelling to just port your traffic home. I'm not trying to be a fan-boi, but I want ALL my traffic off the network of snoop. I'm just going to go out there and say Ubuiti and Teleport with WifiMan on phone/tablets/computers and 0 config bar codes, I mean its ALMOST frictionless for my family to do this setup once its going. I least try to do this while we travel and are out of network range. How do people feel about this?

gzer0 4y ago
how about a tailscale exit node running on a computer at home takes 10 seconds to setup and I can use my home IP from anywhere on earth

dathinab 4y ago

Hm, I think this is mainly an form of advertisement move to compel more users to use edge/not switch away from it. Reason: By now many non-technical people think a VPN is necessary (or at least recommendable) for "safety". Through how a VPN actually helps/works most non-technical people do not understand at all. For Microsoft providing a VPN which by default is only enabled on public WiFi and similar isn't too expensive. They also need to compete with Apples Privacy Relay feature. So putting bias aside it seems a good thing. But there are some gotchas: 1. a VPN is not per-se privacy protecting, it is only that if the VPN provider legally binding agrees to not sell out the users data. 2. a major browser which tries to force itself on all windows users providing a VPN for free hurt the VPN market due to the unfair competitive advantage this VPN has. 3. It could normalize for many people that VPNs do not necessary have a feature to avoid geo-blocking => make it easier for legislation targeting such features to pass 4. also more centralization for cloudflair Through if you ignore all this from a pure "common peoples security" perspective (i.e. not state actor attacks) this is an neat improvement. There are still to many things which allow attacks due to not using HTTPS and for non state-level attackers the best attack vector are public hotspots and similar where this VPN automatically is enabled. E.g. common security problem is HTTP(not s) redirect links in e.g. mails, which an attacker could trivially rewrite to point you to their site which automatically proxies the site you originally wanted to go to. Worst offender I saw was a FIN-tec site using emailing http(not s) redirect links containing the auth token for the initial account setup...

kingaillas 4y ago

Everybody is suspicious of Microsoft's motives but I think in this, you gotta consider how many windows systems are out there used by security novices. Lots of people are computer savvy but want to use a computer to do something else not under the umbrella of hobbyist sysadmin work. I don't see the downside here, again, considering the multi-millions average users Windows/Edge has. If you are savvy enough to roll your own VPN using algo from Trail of Bits, then do that. If you are able to weigh the pros and cons of VPNs from having one or not, or which one to use, you are ahead of 99.99% of the people this will help.

edpichler 4y ago

> "...it lacks one important feature users seek in a virtual private network: an ability to bypass geo-block. In the case of Edge’s VPN, you won’t be able to choose any server location..."

sedatk 4y ago

> and turns it on for CANARY users which is a completely normal thing. This kind of sensationalism really hurts everyone.

collaborative 4y ago

Strangely enough Opera's VPN has suddenly started working after a long period of not being "available" and pushing their paid version

drexlspivey 4y ago

Pretty cool to see Wireguard, a protocol that is only a few years old, making it so fast into the linux kernel and now into Edge. Literally shipping into billions of devices in such a small amount of time.

tonymet 4y ago

Microsoft obviously benefits from the ability to collect more tracking signals. Even over HTTPS they will have many traffic signals to use for ads targeting. Just be mindful of any feature and who it benefits. These companies aren't charities.

Justin_K 4y ago

Why don't we just call it what it is: "Microsoft redirects all browser traffic through their servers". At first it sounds great but in two years when the start selling the data or start injecting ads, what will the privacy advocates think then? How long until Microsoft decides they don't like your site, so they're going to block it? Yet another move towards centralization of the internet, NO THANKS.

SavageBeast 4y ago

So Edge users are going to be impacted by this - whats that like 35 people outside the development team who made it?

omgomgomgomg 4y ago

Did anyone test this? Is it better than operas "vpn"? Can the user configure various geolocations?

Nifty3929 4y ago

Privacy from our government is becoming illegal. I believe that with widespread adoption of VPN services, at some point in the next few years the government will prohibit ISPs from sending traffic to foreign VPN services - for our protection.

Thorentis 4y ago

Just wait. VPNs, under the guise of privacy, will be used to continue mass surveillance operations. Soon you won't be able to access certain sites unless you're using an "official" VPN.

remram 4y ago

Back in the days, a network relay at the application later was called a proxy. Any reason we are now calling this VPN?

crazygringo 4y ago
Yes, because proxies and VPNs are totally different. Proxies are generally unencrypted and a new connection is usually made per-request. VPN's are inherently encrypted and maintain a single connection. They're totally different technologies. So hope that answers your question.
- remram 4y ago
  None of this is true. Proxies use HTTP and can therefore use "keep-alive"; they are usually HTTPS. VPN are usually UDP and therefore connectionless. The usual difference is that they operate at application layer (proxy) or ethernet/IP (VPN). Which would make this a proxy, not a VPN.
  - deleted 4y ago
    [deleted]

sh1mmer 4y ago

Can someone explain to me how this is different from apple’s privacy relay? Is it because it’s all traffic instead of just some traffic Apple designates as “trackers”?

29athrowaway 4y ago

The Microsoft Network is back apparently. The AOL-like hell that the Microsoft Network was in the 90s makes its return in its Neo-Internet Explorer dystopian nightmare.

jfdi 4y ago

Nice work MSFT

yenwodyah 4y ago

I wouldn't care about this VPN if it weren't for the fact that I can't ignore it. There's an option to hide it from the toolbar, but every time I open an incognito window it pops back up again. It's incredibly annoying.

4258204984 4y ago

hda2 4y ago

I can see it now: Microsoft: "Sorry $site_owner, We (some unaccountable ML model) detected that you have violated some rule (we will not tell you which) and as a result, your website can no longer be accessed. This decision is final and permanent." There are other ways to protect user privacy without conveniently putting yourself in charge. They pulled the same move with UEFI and secure boot Microsoft needs to be investigated and fined.

josephcsible 4y ago
Especially timely given that https://news.ycombinator.com/item?id=33036748 https://news.ycombinator.com/item?id=33036748 just happened.

la_fayette 4y ago

There will be times when more people are fed up with all the corporate BS. Duckduckgo, Lineageos, Firefox, Protonmail, ... is all working fine for me. I don't miss any corp tech.

tarunmuvvala 4y ago

The walled gardens are raising their walls. The plan is to sell the corporates VPN enabled services. The corporate will buy it without hesitation too if it comes bundled with Office 365.

mrtri 4y ago

jawadch93 4y ago

[dead]

MrPatan 4y ago

What do I need to do to disable this?

vinay_ys 4y ago

In India, it is illegal to operate an open unauthenticated wifi. All public Internet access requires a secure auth and you have to present a government ID to the operator to get access. (This applies to getting a mobile SIM card or landline Internet at home as well). This is to deter anonymous illicit activity being conducted from from public Internet locations (like cafes, bus/train/airport stations etc.) Also, same real identity requirement is now applied to VPN operators. Additionally, they have to collect and retain traffic logs, and cooperate with government cybercrime investigations. Obviously there are potential loopholes – apparently a lot of VPN services are planning to continue operating services with Indian residents with servers not physically hosted in India without logs. Apple with its Private Relay and now Microsoft with Edge Browser VPN – don't provide VPN with exit nodes hosted in foreign jurisdictions. I'm curious to know if they will cooperate with requirements to collect/retain logs as well.

ChoGGi 4y ago

That's nice I suppose... The only time I use Edge is when something Microsoft opens it, then I have to close it.

sirmike_ 4y ago

Lol the traffic is Capped at 1gb. It’s also super obscure. Only in small rollouts to edge canary users. It’s opt in I believe and It can be turned off. Even MSFT isn’t going to pay the network bill for everyone forever Split decision if this is a true good faith thing for consumers. Time will tell. I can easily see where it’s a great thing on one hand but also a terrible one too. This is where a company’s integrity comes in.

peanut_worm 4y ago

Doesn’t that mean that all my connections are routed MS servers? How is MS more trustworthy than my ISP

sswam 4y ago

andrewstuart2 4y ago

Why do I always get a bad feeling about the motivations behind stuff like this? I want to believe it's for better privacy and security, but it's being driven by a corporation or two, and that makes me 100% suspicious. Like, for example, suddenly Edge is no longer respecting local DNS options and my pihole protects one fewer device from the real dangers to privacy. I don't want to be cynical so often, but this really doesn't feel like a benevolent move. Yeah, it's conditional at the moment, but as with Chrome and manifest v3, among many other examples, I'm losing my faith that anything with the potential to increase ad revenue will remain turned off for long.

spicybright 4y ago
Anything that decides to wrap around your internet traffic without telling you should definitely raise your antennas. Even if they had the best intentions, it's pretty easy to botch these things which erode your privacy even more.
pricci 4y ago
About the pihole problem, redirect all calls to port 53 to your pihole. If Edge is using DoH, you're out of luck.
- numpad0 4y ago
  Does something like `source 0.0.0.0 dest 8.8.8.8 dport 443 action drop` work for DoH?
deleted 4y ago
[deleted]
d0mine 4y ago
"bad feeling" is too generous. Microsoft is famous for its ubiquitous telemetry. It is not a suspicion, data collection is a fact. today. already.
jahewson 4y ago
The motivation here is surely reducing ad tracking.

graypegg 4y ago

When did the world start trusting any company with a VPN more than their ISP? I still find the privacy pitch to be flakey at best, where at least I can choose who’s aware of my traffic, but getting past geo-blocks really seems to be the most obvious consumer value, which this Cloudflare vpn lacks.

zapataband1 4y ago
I thought it was when all the ISPs started basically giving away your private info to the government and repeatedly lied about it
hot_gril 4y ago
It can go either way. Many ISPs are known to be nasty, but hardly anyone sees the effects of that, so it's hard to tell. I think VPNs market "more security," people mostly blindly buy it, and everyone is happy. Yeah, to me, a VPN is only a way around geo restrictions.
nvllsvm 4y ago
For some - it was when their ISP started sending their customers scary sounding letters regarding certain downloaded movies and shows. Some ISPs also needlessly block certain sites (ex. Verizon blocks nyaa.si)
wintermutestwin 4y ago
My ISP actively lobbied to be able to harvest (steal) my data. Who do I trust more: the guy who says that they aren't selling my data, or the guy who corrupted my government so that they can actively sell me out (not to mention their monopoly)? Sure, the first guy could be a liar, but I know that the second guy is a thief. I don't care about geo-blocking - my only threat model is to keep a scumbag ISP at bay. Edit: I should add that keeping sites I browse from knowing my IP is also part of my threat model.
- MichaelCollins 4y ago
  VPN also has my credit card number, real name, etc. VPN doesn't have that; their data is worth less than the data my ISP could sell.

ohbtvz 4y ago

...in a "canary" (basically a nightly build), for some users, for some specific cases (unsecure http, public wifi).

legrande 4y ago

Edge is a reskinned Chromium browser with Microsoft tracking and telemetry baked in. Just because they have a VPN now, it doesn't make it any more private/secure. Why do people use Edge? If you're any way privacy conscious you wouldn't use Microsoft products.

Kwpolska 4y ago
My primary browser is Firefox. I have Edge as my backup browser for sites that don’t work with Firefox, and sometimes for watching stuff. There is no reason for me to install Chrome. (And Microsoft isn’t that bad, even if Edge sometimes does weird things.)
- Koshkin 4y ago
  > for watching stuff ... while the browser is watching you [1]. > Microsoft isn’t that bad Yes it is. That bad. [1] https://en.wikipedia.org/wiki/In_Soviet_Russia https://en.wikipedia.org/wiki/In_Soviet_Russia
timbit42 4y ago
I'd choose Edge over Chrome if I didn't have better options.
cookiengineer 4y ago
I would be cautious with such assumptions. There is a good reason why Trident is alive and kicking, people just don't know about it. But it's the reason for more than 98% of exploits, because shitty software of Microsoft still uses Trident to render MSHTML based documents (office etc). The same will be true for a traffic-observing webview2, for decades to come. And it will never be removed again, because of Microsoft's development philosophy.
A4ET8a8uTh0 4y ago
In my case, it is the default browser at my current company. I don't know the reasoning behind it, but we are also forced into Teams. Corporate requirements is my reason. FWIW, it is not bad performance-wise.

wintermutestwin 4y ago

While I would never use a VPN service fronted by a data thieving company, I really hope that VPN usage goes more mainstream so that companies can't have "no access from VPN" as a security strategy. Ally bank recently did this and many others have intermittent issues due to flagging, etc.

hibikir 4y ago
Security teams don't block certain VPN traffic for fun.When a certain IP block has been running credential stuffing attacks all month long, It's very reasonable to see any request from said block with a lot of suspicion. In many cases, 99.9% of login attempts from certain IP blocks are just fraudulent, and there might be more requests from one of said blocks than legitimate requests from the rest of the world combined. Completely blocking a VPN is often too blunt an instrument, but even the best alternatives are unfriendly to legitimate traffic. The most user-friendly thing you can do is to rely on bonus security controls, like asking for two factor authentication for everything. No, you will not be able to log into anything from a new device, even, without the two factor. A very understandable tradeoff for a bank, but we'll end up seeing that for any account protecting anything of relatively low value. If your second factor is tied to, say, a phone, it's not going to be fun to wait to replace it if it's lost. But in a world where most traffic is coming from a VPN, there aren't many good alternatives.
- egberts1 4y ago
  For my home gateway, all HTTPS, VPN, SSTP, SMTP, PPTP, IPSec, UDP, DNS, and proxy are blocked. All JavaScript scripts are blanked by Squid ICAP clients. WireGuard to a VPS for DNS resolver/nameserver. Run a mean transparent Squid proxy, Snort/Zeek/Suricata and whitelist bastion dns forwarder. No problem. No spam. No headache.
VoodooJuJu 4y ago
I can see this evolving into something worse. >try to connect to ally >vpn not allowed - try connecting through on of our authorized vpn partners: microsoft, nordvpn!, etc.
4y ago

oefrha 4y ago

As a generally happy Cloudflare customer, a Cloudflare VPN makes me deeply uneasy. (Yes, I know Warp has been around for a while.) Using it means Cloudflare owns a huge chunk of your Internet traffic end to end and decrypted, a uniquely powerful position to be in. And this is going to be default on in Edge according to TFA, even though it’s only applied to plain HTTP sites by default at the moment.

sascha_sl 4y ago
While I agree that it is concerning, WARP doesn't decrypt your traffic unless you sign in to ZeroTrust, enable it in your dashboard and install their CA. Not much you can do about them having decrypted traffic for sites that use them.
- oefrha 4y ago
  > having decrypted traffic for sites that use them Yes, that’s the huge chunk I’m talking about, and when you use them as your VPN they can effortlessly trace that decrypted traffic to you.
  - sascha_sl 4y ago
    How is that different from not using a VPN?
    - xboxnolifes 4y ago
      Its not, that's the point.
      - ViViDboarder 4y ago
        It’s not for one party. The VPN protects your traffic from any party other than Cloudflare. Exactly as it would with any VPN.
    - oefrha 4y ago
      When you don’t use a VPN, at least your traffic to Cloudflare doesn’t carry a unique ID of yours. Effort is required to correlate your traffic, especially if you are CGNAT’ed and share an IP with others, or have a dynamic IP that changes frequently.

chiefalchemist 4y ago

> "However, the VPN will not run while you’re streaming or watching videos — so that you can save up on traffic which is capped at a modest 1 GB per month." OK? And what happens after that? After you go over your 1 GB cap? You're cut off from the internet?

shmde 4y ago
They just turn the VPN off ?
- mdaniel 4y ago
  Heh, I wonder if they just quietly do that in the middle of a session * GET bank.example.com/accounts * GET bank.example.com/accounts/1 vpn disconnect * GET bank.example.com/accounts/1/details <- 403 new IP, who dis?
ridgered4 4y ago
How they even id the user for the cap? Some kind of system signature? Requirement of a MS account?

witrak 4y ago

If this "VPN" is under the control of an entity collecting information about users wherever it can what's the sense of the service. "VPN" (in fact the term should be "virtual internet access network") make sense only when it is independent of any entity controlling internet traffic...

RcouF1uZ4gsC 4y ago

> Also, we must be aware of the risks associated with using the built-in VPN services of Microsoft, Apple, and the like. The tools they so generously offer might protect you from being tracked by your Internet Service Provider (ISP), It seems using a VPN from your browser vendor does not increase your risk. I don’t think a VPN would have any information that your browser did not.

oefrha 4y ago
People generally don’t tolerate browsers that phone home with any and all accessible information. But if you claim to also run a built-in VPN service...
- vladvasiliu 4y ago
  What do you mean? I oftentimes see people using Chrome (not Chromium) while logged into a profile. Are you telling me that either those people are actually a minority, or that Chrome doesn't phone home?
lxgr 4y ago
Not really: Your browser vendor might push out a malicious update or enable dormant functionality that sends them telemetry on your browsing, or even your entire web traffic, but a VPN definitively does receive all of you traffic (including, at least, the host name of almost all sites you visit). I can observe who my browser/OS talk to (beyond the sites I already visit) – but what happens inside a VPN provider is impossible to tell.

mkl95 4y ago

Serious question - is there a legitimate use case for Edge when a Chrome Stable build is available?

mrweasel 4y ago
I'm thinking Microsoft is hoping for the reverse: Why download Chrome when you have a perfectly good Blink based browser already installed.
jabroni_salad 4y ago
From a business perspective, IE mode and onedrive userstate sync for o365 customers From a personal perspective, goog and microsoft are basically equivalent and I don't want either of their browsers.
vladvasiliu 4y ago
It's already installed and it works well enough. Plus, if I'm using Windows, I'm already sending a bunch of telemetry to MS, so I don't see a reason to go out of my way to send some to goog, too. Also, I'm not a Netflix customer, but I understand that on PC you need Edge to get high-definition (>=1080p) video. Chrome doesn't work (neither does it work on Mac). So the question becomes: is there a legimate use case for Chrome when Edge is available (and is mostly the same thing)? I, personally, am quite against using a Google browser (or derivative), but for my gaming PC where I only launch the browser once in a blue moon, I just can't be bothered to download anything else since Edge works. On my work PC I use Firefox, and am quite happy with it.
wintermutestwin 4y ago
Edge is the only Chromium-based browser that allows for Vertical Tabs.
- netsharc 4y ago
  Vivaldi has it, and it's a Chromium-based browser made by people who left Opera after it was sold to the Chinese. Opera had vertical tabs even a decade or so ago, back when it was still using its own Presto engine (they switched to Chromium and seems to have lost this feature).

strictfp 4y ago

Cue VPNs being banned

jeroen79 4y ago

cloudflare is nasty, its worse giving them all your data then spreading it around.

eatonphil 4y ago

I think Pixel phones (or maybe it's all Google Fi phones) also do this.

smm11 4y ago

I'm going to run my VPN on Edge running a VPN.

_mwnc 4y ago

Hmmm interesting another reason for me to avoid microsoft browsers.

reactspa 4y ago

A crazy thing happened to me on a recent trip to Mexico city. I thought my AT&T mobile plan covered Mexico, but after 2 days it stopped working. So I tried to log into my account online with AT&T. It would keep redirecting me to the Mexico AT&T website instead of the US website. The first time I realized I needed a VPN.

counttheforks 4y ago

pmarreck 4y ago

Imagine still tolerating Windows in 2022

seabrookmx 4y ago
Some people play video games. Some people want to use the Adobe suite on user upgradable hardware. If you come out of your bubble you'll see there's plenty of reasons to still use Windows (typing this in Firefox running on Fedora, FWIW).
- pmarreck 4y ago
  I play video games. Things have actually changed a heck of a lot in the last couple of years and seem to be accelerating thanks to the Steam Deck. 90% of the games I care about now work fine in Linux, sometimes with a little massaging (there are also now many more tools and forum posts to help with this). Modding certain things is occasionally the biggest impediment but that too is getting easier thanks to stuff like https://github.com/frostworx/steamtinkerlaunch https://github.com/frostworx/steamtinkerlaunch , which if you use the Flatpak Steam can be installed via the app installer right alongside it.
  - seabrookmx 4y ago
    You're describing a worse user experience than gaming on Windows. Single player games on Steam is a best case scenario.. Blizzard games, or games with anti cheat are a total pain to run or won't run at all. This is why people tolerate Windows in 2022. I'm not saying I like it, I was just trying to answer your question :)
rejectfinite 4y ago
The great thing about Windows is that you can install another browser and set it to default. You don't have to use Edge.
- blibble 4y ago
  and then every other update it "accidentally" gets set back to Edge

rodolphoarruda 4y ago

Not even god knows what's going on inside that (not so very much) private network.

MikeYasnev007 4y ago

netsharc 4y ago

> The VPN feature, known as “Microsoft Edge Secure Network,” has rolled out to a limited selection of users in the latest Edge Canary version. Now why didn't they call it Microsoft Secure Network! And MSN in short. And next they should start a VPN'ed messaging service, they can name it "MSN Messenger".

rntksi 4y ago

I remember this being done back when Opera 7 was used. I think it had a feature for mobile OS, where it would route requests to Opera's servers and serve clients a minified, smaller version of the page, so people on 2G at the time could still use the web. I don't remember people being outraged at the time at the prospect of a browser having a baked-in VPN option though.

laundermaf 4y ago
Don't forget about Google’s own "optimizer" https://en.wikipedia.org/wiki/Google_Web_Accelerator https://en.wikipedia.org/wiki/Google_Web_Accelerator
int_19h 4y ago
That was Opera Mini, and it's still around (and popular in areas where Internet speed is still measured in Kbps and/or you pay for data per megabyte). It's not even that it served a minified version, too. It basically did all layout server-side, so the client got something more akin to a PDF of the webpage optimized for its screen size. It also compressed images.
noja 4y ago
Yes that was mainly because mobile internet was really slow and using it without Opera's proxy was an exercise in frustration. But do not forget that Opera 7 was release TWENTY YEARS AGO. Things are a bit different now. Think eternal september.
bityard 4y ago
I remember this as well and thought it was a neat service. One that I would have liked to emulate using my own proxy in order to save bandwidth on my mobile data but never got around to actually doing. These days with widespread HTTPS, the only way to do this is to bake it into the browser itself. And of course, this was back when you could trust Opera to do what they said they were (or weren't) doing.
Nextgrid 4y ago
At the time, spyware was not yet a mainstream business model so there was no outrage because respectable, established companies didn't yet become spyware operators. There was still mutual trust back in the day.

1langisbad 4y ago

bilekas 4y ago

> you can save up on traffic which is capped at a modest 1 GB per month. These days that probably wont even manage the tracking requests being sent from the machine a month.

AlexandrB 4y ago

Interesting to see this on the front page along with https://news.ycombinator.com/item?id=33036748 https://news.ycombinator.com/item?id=33036748 I wonder how long until Microsoft starts blocking sites on their VPN for "your protection".

mikaelsouza 4y ago
I think they already do. Just like chrome and firefox block sites that are considered insecure. I don't think they need a VPN for this.

shuntress 4y ago

This is why net neutrality and easy accessible encryption are important.

crazygringo 4y ago

> the VPN will automatically connect when you’re using public Wi-Fi or browsing unsecured networks and sites lacking a valid HTTP certificate. OK, that's actually a pretty decent idea. It's not going to be always-on, but it's providing security specifically for things like coffeeshops/libraries and for sites that don't provide their own security. In other words, it's "backup security", not rerouting all of your "normal" secure traffic at work/home. This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually.

CogitoCogito 4y ago
> This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually. How does this protect from having JavaScript injected? Why couldn't the VPN do that?
- simsla 4y ago
  MITM protection on public networks maybe?
  - CogitoCogito 4y ago
    > MITM protection on public networks maybe? How does this address the fact that the operators of the VPN can certainly modify any content they access over http on your behalf?
    - kevmo314 4y ago
      Better than every public wifi access point being able to.
    - yed 4y ago
      The operators of the VPN in this case are also the developers of the browser. If they want to inject content they can do that without the VPN.

hopfog 4y ago

I run a free browser game where you can start playing immediately, no registration required. The game has a big sandbox element where you can build and paint on the world map. Naturally I've attracted trolls doing everything in their power to grief and ruin it for other players. This has lead me to reluctantly implement moderation tools such as IP bans and proxy detection. I'm currently using a couple of services where I can supply an IP and get a risk score back but I'm worried about false positives. I'm afraid this initiative, while great for privacy, will make my defense measures futile. What should I do? I just want to run a game with as few intrusive barriers as possible. I have no interest in collecting any private data from users whatsoever.

aaronax 4y ago
You have to have intrusive barriers. This is true in real life and it is true online. The world is not a graffiti free-for-all because there are barriers: the government (police) is able to apprehend individuals, link that physical individual to an identity (which it issued at birth), and effectively implement consequences to that identity/individual. If you want your site to not be a graffiti free-for-all, you will need a durable way to identify actual people. Twitter, for example, essentially requires a phone number to use their site. Phone numbers are fairly difficult to get anonymously. Therefore, Twitter has a useful link between their users and a physical individual. Other services use other things. The government should implement cryptographic certificate based identities to citizens. Ideally there would be a way to "sign" something that says you are a real citizen without revealing which citizen you are, but is durably unique (subsequent signings identify you as the same citizen). Facebook, Google, etc. are effectively filling this function right now but they leave much to be desired.
- hopfog 4y ago
  > Ideally there would be a way to "sign" something that says you are a real citizen without revealing which citizen you are, but is durably unique (subsequent signings identify you as the same citizen). This is a truly interesting and groundbreaking idea that would solve all my problems. Do you know if there are any initiatives like that or is it science-fiction?

pGuitar 4y ago

Why do they even need this? With all the spying/telemetry they already do, they probably already know the sites that you visit....

timbit42 4y ago
They want to keep everyone else from tracking you so their data is more valuable.
lucasmullens 4y ago
Some users might want this feature, which gets them more users. I think outside HN most users would appreciate a free VPN for when they're on public Wi-Fi.

kebman 4y ago

If I'm not mistaken Skype used to be called the most secure video calling app back in the day. Until this: https://lists.randombit.net/pipermail/cryptography/2013-May/004224.html https://lists.randombit.net/pipermail/cryptography/2013-May/...

jll29 4y ago

Microsoft as any company must abide by federal laws, including US FISA court orders.

btown 4y ago

From the article, this is powered by a partnership with Cloudflare. It's worth noting that until August 6 of this year, Cloudflare's WARP VPN would leak your IP address - but only to sites using the Cloudflare network. https://web.archive.org/web/20220609160341/https://developers.cloudflare.com/warp-client/known-issues-and-faq/#why-is-my-public-ip-address-sometimes-visible https://web.archive.org/web/20220609160341/https://developer... And when Cloudflare released their new SOPs for Warp, they did so in a blog post titled "More features, still private" - https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/ https://blog.cloudflare.com/geoexit-improving-warp-user-expe... as referenced in https://developers.cloudflare.com/warp-client/known-issues-and-faq/#does-warp-reveal-my-ip-address-to-websites-i-visit https://developers.cloudflare.com/warp-client/known-issues-a... Microsoft's initial announcement for the feature touted that IP addresses would be masked, and one imagines that they did their diligence with Cloudflare and are enforcing the strong practices that WARP has now rolled out more broadly. But it's worth noting that you're routing through a company to whom the words "still private" encompassed leaking client IP address information to Cloudflare's hosting customers as recently as two months ago.

judge2020 4y ago
Warp/1.1.1.1[0] is a product, not a VPN, despite the fact that it tunnels your traffic. Even after the IP address change, the current documentation and promotions for Warp do not call it a VPN. It was never meant to keep your IP hidden from the websites you visit. 0: https://1.1.1.1/ https://1.1.1.1/
- btown 4y ago
  I wish that were how it had been presented, but they indeed did advertise it as a VPN. From https://blog.cloudflare.com/1111-warp-better-vpn/ https://blog.cloudflare.com/1111-warp-better-vpn/ : "Technically, WARP is a VPN.... We built WARP because we’ve had those conversations with our loved ones too and they’ve not gone well. So we knew that we had to start with turning the weaknesses of other VPN solutions into strengths. Under the covers, WARP acts as a VPN. But now in the 1.1.1.1 App, if users decide to enable WARP, instead of just DNS queries being secured and optimized, all Internet traffic is secured and optimized. In other words, WARP is the VPN for people who don't know what V.P.N. stands for."