5 ms·

Based on that analysis, I say clearly yes! Privacy is about choosing who to share with, be it a specific group or no-one. Being able to share with a VPN of my c

Based on that analysis, I say clearly yes! Privacy is about choosing who to share with, be it a specific group or no-one. Being able to share with a VPN of my choice (who, if reputable, shouldn't further disseminate my information) is likely a privacy gain compared to being forced to share with my ISP (many of whom would gladly sell my data). Being able to choose to reveal data to Mullvad over Comcast or Verizon seems like a clear win to me.

lijogdfljk 4y ago
Yea i really don't get these people. Frustratingly. Perfect is the enemy of good here. Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.
- Aaargh20318 4y ago
  > Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. The problem is that it doesn’t actually change anything while giving a false sense of security. Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ? Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.
  - hamburglar 4y ago
    This is quite a concrete illustration of the concept of the perfect being the enemy of the good. Thank you.
    - salawat 4y ago
      No... It's a demonstration of adherence the axiom "Don't let perfect be the enemy of good" being misapplied. The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice. Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier. If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state. Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation. The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.
      - P5fRxh5kUvp2th 4y ago
        Russia has the ability to drop a nuke in the region you currently live in, so there's no such thing as safety and therefore why do you have locks on your doors?
        genewitch 4y ago
        i find this extremely doubtful. I see the point of your statement, but i'm willing to bet 99% of all the already built nuclear devices wouldn't work today. There's no way that they're all stored in such a way that the delicate mechanisms are protected from the environment and oxidization, moisture ingress, insects, heat and cold expansion and contraction. That a nation could make a new device is arguable, that a nation could make a device that could be delivered without flying planes over another country is less arguable. Even nukes as they stand would only pose significant threats to certain parts of a country (there was a map floating around the web a few days back of areas of the US most susceptible to the - pardon the pun - fallout from a tactical strike.)
    - P5fRxh5kUvp2th 4y ago
      Especially when you consider that what they're really saying is that a VPN won't hide you from a state level actor. Yeah, of course not, that's not nearly the only reason to use a VPN.
  - P5fRxh5kUvp2th 4y ago
    One wonders if you consider your bedroom to be private despite the fact that a peeping tom can still look through the window.
  - nirvdrum 4y ago
    My VPN provider (Mullvad) doesn't have my full name, address, and social security number. They could build a profile off my account number, sure, so I have to trust that they're not. If they actually aren't, fantastic, I win. If they actually are, I still win, because they have less data to build a profile on me from. I know for certain that my ISP is selling my data, so I'm certainly no worse off. On top of that, I get the benefit of not being tracked everywhere on the web. Or if they are tracking me, they have bogus data. And I can set my exit server to a jurisdiction with more user-friendly privacy laws.
    - Aaargh20318 4y ago
      Mullvad is just the first link in the chain of untrusted systems between you and whatever server you’re connecting to. Also, what better place to tap traffic than the connection of a VPN provider.
      - nirvdrum 4y ago
        > Also, what better place to tap traffic than the connection of a VPN provider. Well, per my previous post, my ISP is definitely a better place. Hell, you don't even need to tap them. They'll just sell you the data, along with other PII. (Setting aside Mullvad' multi-hop support, which would require taps in multiple jurisdictions). I think the point you're trying to make is that this isn't resilient to the NSA monitoring my traffic. I had hoped it was clear from my message that there's another level of privacy I'm concerned with related to intrusive private entities. I'm not expecting the GDPR or similar privacy laws to stop the NSA either, but they serve a useful purpose. I guess I'm banking on Meta and Google not tapping Mullvad. Or even the RIAA or MPAA, for that matter. Because my ISP will very willingly give those entities data. And as long as unencrypted SNI is the norm, my ISP knows more than I want it to know about my browsing behavior. Not to mention the stuff that isn't HTTPS. Sure, Verizon knows I've established a connection an encrypted tunnel and how much bandwidth I routed through it, but that's a level of metadata I'm not concerned with. So, yeah, Mullvad could be logging every packet through their tunnel. They could even assemble a profile based on my account and sell it to all the data brokers and advertising networks. They still don't have my SSN. Even if all of that happened, then I'm still no worse a situation than if I didn't use them because my ISP is doing those things. At worst, I'll be out 5€ for the month.

lijogdfljk 4y ago

Yea i really don't get these people. Frustratingly. Perfect is the enemy of good here. Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.

Aaargh20318 4y ago
> Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it. The problem is that it doesn’t actually change anything while giving a false sense of security. Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ? Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.
- hamburglar 4y ago
  This is quite a concrete illustration of the concept of the perfect being the enemy of the good. Thank you.
  - salawat 4y ago
    No... It's a demonstration of adherence the axiom "Don't let perfect be the enemy of good" being misapplied. The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice. Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier. If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state. Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation. The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.
    - P5fRxh5kUvp2th 4y ago
      Russia has the ability to drop a nuke in the region you currently live in, so there's no such thing as safety and therefore why do you have locks on your doors?
      - genewitch 4y ago
        i find this extremely doubtful. I see the point of your statement, but i'm willing to bet 99% of all the already built nuclear devices wouldn't work today. There's no way that they're all stored in such a way that the delicate mechanisms are protected from the environment and oxidization, moisture ingress, insects, heat and cold expansion and contraction. That a nation could make a new device is arguable, that a nation could make a device that could be delivered without flying planes over another country is less arguable. Even nukes as they stand would only pose significant threats to certain parts of a country (there was a map floating around the web a few days back of areas of the US most susceptible to the - pardon the pun - fallout from a tactical strike.)
  - P5fRxh5kUvp2th 4y ago
    Especially when you consider that what they're really saying is that a VPN won't hide you from a state level actor. Yeah, of course not, that's not nearly the only reason to use a VPN.
- P5fRxh5kUvp2th 4y ago
  One wonders if you consider your bedroom to be private despite the fact that a peeping tom can still look through the window.
- nirvdrum 4y ago
  My VPN provider (Mullvad) doesn't have my full name, address, and social security number. They could build a profile off my account number, sure, so I have to trust that they're not. If they actually aren't, fantastic, I win. If they actually are, I still win, because they have less data to build a profile on me from. I know for certain that my ISP is selling my data, so I'm certainly no worse off. On top of that, I get the benefit of not being tracked everywhere on the web. Or if they are tracking me, they have bogus data. And I can set my exit server to a jurisdiction with more user-friendly privacy laws.
  - Aaargh20318 4y ago
    Mullvad is just the first link in the chain of untrusted systems between you and whatever server you’re connecting to. Also, what better place to tap traffic than the connection of a VPN provider.
    - nirvdrum 4y ago
      > Also, what better place to tap traffic than the connection of a VPN provider. Well, per my previous post, my ISP is definitely a better place. Hell, you don't even need to tap them. They'll just sell you the data, along with other PII. (Setting aside Mullvad' multi-hop support, which would require taps in multiple jurisdictions). I think the point you're trying to make is that this isn't resilient to the NSA monitoring my traffic. I had hoped it was clear from my message that there's another level of privacy I'm concerned with related to intrusive private entities. I'm not expecting the GDPR or similar privacy laws to stop the NSA either, but they serve a useful purpose. I guess I'm banking on Meta and Google not tapping Mullvad. Or even the RIAA or MPAA, for that matter. Because my ISP will very willingly give those entities data. And as long as unencrypted SNI is the norm, my ISP knows more than I want it to know about my browsing behavior. Not to mention the stuff that isn't HTTPS. Sure, Verizon knows I've established a connection an encrypted tunnel and how much bandwidth I routed through it, but that's a level of metadata I'm not concerned with. So, yeah, Mullvad could be logging every packet through their tunnel. They could even assemble a profile based on my account and sell it to all the data brokers and advertising networks. They still don't have my SSN. Even if all of that happened, then I'm still no worse a situation than if I didn't use them because my ISP is doing those things. At worst, I'll be out 5€ for the month.