5 ms·

> Or course they do Let me compare an ISP spying vs a VPN spying: 1. You make DNS request about example.com. Your ISP sees this. Your ISP can see what website

> Or course they do Let me compare an ISP spying vs a VPN spying: 1. You make DNS request about example.com. Your ISP sees this. Your ISP can see what websites you "might" visit. 2. You connect to 1.2.3.4. Your ISP sees this. Your ISP can see what websites you "did" visit. 3. You request some data and receive some data. Your ISP sees the size of the data. If it's not encrypted, it can also see the content. Your ISP can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents. Okay so not using a VPN gives effectively zero privacy. Let's look at a VPN: 1. You connect to a VPN (and let's assume your connection doesn't "leak" insomuch as now _all_ network traffic goes through the VPN). Your ISP can see this. 2. You make DNS request about example.com. Your VPN sees this and your ISP can see a network packet. Your VPN can see what websites you "might" visit, your ISP can't. 2. You connect to 1.2.3.4. Your VPN sees this. Your VPN can see what websites you "did" visit. Your ISP still sees traffic to the VPN. 3. You request some data and receive some data. Your VPN sees the size of the data, and your ISP only sees the aggregate-size of data across all of your sessions. If it's not encrypted, your VPN can also see the content but your ISP should still only see aggregate size. Your VPN can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents. Your ISP will have a tough time fingerprinting content from specific websites. 4. Your ISP can note that you have a high amount of traffic, possibly note that the traffic is going to a known VPN destination, and that your "normal" traffic is now gone. Now, your VPN can see all the stuff that your ISP used to see. In addition, your ISP can now determine that you might be doing something illegal, suspicious, or at the very least "enterprise grade" and demand more money. Have you really gained more privacy?

crtasm 4y ago
> your ISP can now determine that you might be doing something illegal, suspicious and my neighbours can determine I might be doing something illegal when I close my curtains, sure.
tzs 4y ago
> Have you really gained more privacy? No, but you have lost less privacy. The amount of loss of privacy you incur when some particular item of personal information about you is revealed to another party often depends on how much other information that party has about you.
Schroedingersat 4y ago
If the ISP is legally protected from any inquiry or transparency into what they do with the data and is systematically incompetent about protecting it and the vpn exists in a country with good privacy laws, then yeah.
postalrat 4y ago
You increased the number of choices you can make regarding your privacy.
Dayshine 4y ago
Your isp is legally resident in the country most likely to want to spy on you. There are also very few isps per country, so it's less work for the attacker to cover everyone they care about. There are vast numbers of vpns, so total coverage is impossible. They are also very likely to be in a different legal jurisdiction so it's non trivial to do. So, yes, you have, by making yourself a harder target despite having the same amount of centralisation on your part
- xani_ 4y ago
  Same with most VPN providers. Just expands the search from "ask ISP" to "ask ISP, they tell government its a VPN company, ask VPN company". Now, sure, they could "just" delete logs, but their government can "just" tell them not to, or even tell them to live send the logs to them directly. So it's really "which country's government you trust".
  - zepearl 4y ago
    Adding that in general a country's law (data protection/privacy in this context) usually targets its own citizens; traffic related to foreign citizens (as in the case of VPNs) would for sure have a lower degree of protection.
  - travoltaj 4y ago
    There's quite a few VPNs who have been asked to keep logs by the authorities but the VPN providers contest it in court, and since their jurisdiction laws don't need them to, the courts side with the VPN providers. Mullad, OVPN are a couple. What are your opinions on those? Not every country has laws like USA/India, which give the government free reign by citing certain Acts.
- simplyinfinity 4y ago
  my country has between 3 and 20 isp's per city. of a country of 7 million.
  - psd1 4y ago
ascar 4y ago
As others have mentioned you gained privacy from your government that has easy access to whatever information your ISP has but not towards a VPN provider. But the information you leak towards your ISP or VPN isn't the only variable. With a VPN you leak less information to the services you interact with (e.g. your IP is hidden) which undoubtedly increases privacy.
miloignis 4y ago
Based on that analysis, I say clearly yes! Privacy is about choosing who to share with, be it a specific group or no-one. Being able to share with a VPN of my choice (who, if reputable, shouldn't further disseminate my information) is likely a privacy gain compared to being forced to share with my ISP (many of whom would gladly sell my data). Being able to choose to reveal data to Mullvad over Comcast or Verizon seems like a clear win to me.
- lijogdfljk 4y ago
  Yea i really don't get these people. Frustratingly. Perfect is the enemy of good here. Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.
  - Aaargh20318 4y ago
    > Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. The problem is that it doesn’t actually change anything while giving a false sense of security. Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ? Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.
    - hamburglar 4y ago
      This is quite a concrete illustration of the concept of the perfect being the enemy of the good. Thank you.
      - salawat 4y ago
        No... It's a demonstration of adherence the axiom "Don't let perfect be the enemy of good" being misapplied. The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice. Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier. If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state. Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation. The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.
piaste 4y ago
VPN and ISP are similar in term of middlemen, but there is an important difference downstream of said middlemen. With your ISP, you appear on the internet as a residential IP that provides your approximate location and most likely doesn't change very often. The requests you make can be easily correlated by PRISM or any other middleman, or by any CDN running the websites you visit. With a VPN, your exit IP is unrelated to your geographic location, changes very often, and hopefully it is shared among many more users.
- DesiLurker 4y ago
  Also you could use double VPN config from different VPN providers in separate geo locations with openDNS thrown in one of them. then it would be much harder to correlate your traffic out of the mix. its not about perfect secrecy its about becoming hard enough target.
- vel0city 4y ago
  GeoIP services are trash. My current IP on most GeoIP services gives a location >900 miles away. My last IP had a location in another country. I don't think I've ever had a GeoIP lookup resolve within 100 miles for any IP I've had.
  - zmmmmm 4y ago
    My single data point observation is that it gets my city correct nearly 100% of the time and sometimes is able to resolve to a nearby suburb.
    - vel0city 4y ago
      My several datapoints is wildly inconsistent and has never been within several hundred miles. My office: suburb of Chicago My home: downtown Atlanta My friend's house: just outside Phoenix The McDonald's free WiFi: Chicago A church's WiFi: Some random location in Arkansas. I'm in North Texas. Just a few examples I've remembered since making a point to test while I'm out.
  - inetknght 4y ago
yjftsjthsd-h 4y ago
> Now, your VPN can see all the stuff that your ISP used to see. > Have you really gained more privacy? Absolutely, 100%, unambiguously, yes; my ISP openly says that they monetize my data, my VPN says they don't. I'm very happy to gamble that the VPN is telling the truth when faced with the expectation that the ISP is telling the truth.
squeaky-clean 4y ago
My VPN was unable to give the British government any logs or IPs relating to someone who emailed a series of bomb threats using them. As terrible as that is, yeah I feel pretty safe pirating movies using it. But you're right that blindly trusting a VPN without doing any research might be worse than blindly trusting your ISP.
- donedealomg 4y ago
colinmhayes 4y ago
VPNs entire business revolves around not giving up your data, that's why you pay them. ISP business revolves around protecting their monopoly which means making the government happy. Massively different incentives which means they will act differently. If VPN leaks data and people find out they're done. If ISP does nothing changes for them.

crtasm 4y ago

> your ISP can now determine that you might be doing something illegal, suspicious and my neighbours can determine I might be doing something illegal when I close my curtains, sure.

tzs 4y ago

> Have you really gained more privacy? No, but you have lost less privacy. The amount of loss of privacy you incur when some particular item of personal information about you is revealed to another party often depends on how much other information that party has about you.

Schroedingersat 4y ago

If the ISP is legally protected from any inquiry or transparency into what they do with the data and is systematically incompetent about protecting it and the vpn exists in a country with good privacy laws, then yeah.

postalrat 4y ago

You increased the number of choices you can make regarding your privacy.

Dayshine 4y ago

Your isp is legally resident in the country most likely to want to spy on you. There are also very few isps per country, so it's less work for the attacker to cover everyone they care about. There are vast numbers of vpns, so total coverage is impossible. They are also very likely to be in a different legal jurisdiction so it's non trivial to do. So, yes, you have, by making yourself a harder target despite having the same amount of centralisation on your part

xani_ 4y ago
Same with most VPN providers. Just expands the search from "ask ISP" to "ask ISP, they tell government its a VPN company, ask VPN company". Now, sure, they could "just" delete logs, but their government can "just" tell them not to, or even tell them to live send the logs to them directly. So it's really "which country's government you trust".
- zepearl 4y ago
  Adding that in general a country's law (data protection/privacy in this context) usually targets its own citizens; traffic related to foreign citizens (as in the case of VPNs) would for sure have a lower degree of protection.
- travoltaj 4y ago
  There's quite a few VPNs who have been asked to keep logs by the authorities but the VPN providers contest it in court, and since their jurisdiction laws don't need them to, the courts side with the VPN providers. Mullad, OVPN are a couple. What are your opinions on those? Not every country has laws like USA/India, which give the government free reign by citing certain Acts.
simplyinfinity 4y ago
my country has between 3 and 20 isp's per city. of a country of 7 million.
- psd1 4y ago

ascar 4y ago

As others have mentioned you gained privacy from your government that has easy access to whatever information your ISP has but not towards a VPN provider. But the information you leak towards your ISP or VPN isn't the only variable. With a VPN you leak less information to the services you interact with (e.g. your IP is hidden) which undoubtedly increases privacy.

miloignis 4y ago

Based on that analysis, I say clearly yes! Privacy is about choosing who to share with, be it a specific group or no-one. Being able to share with a VPN of my choice (who, if reputable, shouldn't further disseminate my information) is likely a privacy gain compared to being forced to share with my ISP (many of whom would gladly sell my data). Being able to choose to reveal data to Mullvad over Comcast or Verizon seems like a clear win to me.

lijogdfljk 4y ago
Yea i really don't get these people. Frustratingly. Perfect is the enemy of good here. Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.
- Aaargh20318 4y ago
  > Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. The problem is that it doesn’t actually change anything while giving a false sense of security. Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ? Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.
  - hamburglar 4y ago
    This is quite a concrete illustration of the concept of the perfect being the enemy of the good. Thank you.
    - salawat 4y ago
      No... It's a demonstration of adherence the axiom "Don't let perfect be the enemy of good" being misapplied. The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice. Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier. If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state. Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation. The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.

piaste 4y ago

VPN and ISP are similar in term of middlemen, but there is an important difference downstream of said middlemen. With your ISP, you appear on the internet as a residential IP that provides your approximate location and most likely doesn't change very often. The requests you make can be easily correlated by PRISM or any other middleman, or by any CDN running the websites you visit. With a VPN, your exit IP is unrelated to your geographic location, changes very often, and hopefully it is shared among many more users.

DesiLurker 4y ago
Also you could use double VPN config from different VPN providers in separate geo locations with openDNS thrown in one of them. then it would be much harder to correlate your traffic out of the mix. its not about perfect secrecy its about becoming hard enough target.
vel0city 4y ago
GeoIP services are trash. My current IP on most GeoIP services gives a location >900 miles away. My last IP had a location in another country. I don't think I've ever had a GeoIP lookup resolve within 100 miles for any IP I've had.
- zmmmmm 4y ago
  My single data point observation is that it gets my city correct nearly 100% of the time and sometimes is able to resolve to a nearby suburb.
  - vel0city 4y ago
    My several datapoints is wildly inconsistent and has never been within several hundred miles. My office: suburb of Chicago My home: downtown Atlanta My friend's house: just outside Phoenix The McDonald's free WiFi: Chicago A church's WiFi: Some random location in Arkansas. I'm in North Texas. Just a few examples I've remembered since making a point to test while I'm out.
- inetknght 4y ago

yjftsjthsd-h 4y ago

> Now, your VPN can see all the stuff that your ISP used to see. > Have you really gained more privacy? Absolutely, 100%, unambiguously, yes; my ISP openly says that they monetize my data, my VPN says they don't. I'm very happy to gamble that the VPN is telling the truth when faced with the expectation that the ISP is telling the truth.

squeaky-clean 4y ago

My VPN was unable to give the British government any logs or IPs relating to someone who emailed a series of bomb threats using them. As terrible as that is, yeah I feel pretty safe pirating movies using it. But you're right that blindly trusting a VPN without doing any research might be worse than blindly trusting your ISP.

donedealomg 4y ago

colinmhayes 4y ago

VPNs entire business revolves around not giving up your data, that's why you pay them. ISP business revolves around protecting their monopoly which means making the government happy. Massively different incentives which means they will act differently. If VPN leaks data and people find out they're done. If ISP does nothing changes for them.