5 ms·

When the topic of VPN comes up, there are often posts which criticize the use of a VPN for the use case of privacy. These posts are often absolutist in nature a

When the topic of VPN comes up, there are often posts which criticize the use of a VPN for the use case of privacy. These posts are often absolutist in nature and fail to address specific threat models. Of course a VPN isn't going to protect your privacy from state level actors - I doubt that it is possible anyway. Why I use a VPN: 1. I don't want many of the sites I browse to know my IP. 2. My US ISP corrupted my government to allow them to steal my data. I don't know if I can trust my VPN provider, but I know for certain that I can't trust my thieving ISP. 3. I frequently connect through untrustworthy networks when traveling. Yes, SSL helps, but going through a VPN is an added layer of abstraction. I am not a network security expert, so criticism of these three use cases is highly welcome.

s_dev 4y ago
All of this can be achieved through a person VPN rather than a commercial subscription one by ssh -D whateverPort user@ip_address and setting up a SOCKS proxy in Firefox on that same port. >there are often posts which criticize the use of a VPN Often they specifically critique the likes of NordVPN etc. The off the shelf solutions rather than personally setup VPNs. What disgusts me is that they charge fees that are multiples of what it costs to run a basic Linode or DO Droplet for a month and a virtual machine is far more useful than a commercial VPN.
- Chiron1991 4y ago
  That's the premium you pay for not having to deal with hosting and configuration. There are plenty of people - even in the tech community - who lack the knowledge to handle this themselves.
- iceburgcrm 4y ago
  A basic droplet is $5 this is $7 dollars plus it gives you email relay. If you already have a droplet unused sure but otherwise being able to change ip in different countries adds some additional value for 2 dollars more.
  - a012 4y ago
    I used to self-host VPN on different public clouds but most of the time got many captcha challenges (even banned, depends on websites/CDN) and I gave up, then switched to Mullvad the captcha challenges reduces a lot.
- TechBro8615 4y ago
  I agree with this completely. However, in this particular instance, I could make an argument for using – or at least subscribing to – Mozilla VPN simply as a method of supporting the organization. It's vital that Mozilla maintains a strong engineering force counteracting monopolies who push loss-leading products to capture markets like web browsing and email. You don't have to even use it, but every dollar of revenue that Mozilla can attribute to their privacy products and services means one less dollar is needed from their hostage deal with Google.
- GauntletWizard 4y ago
  A personal VPN hides my "True IP", but it doesn't mix my traffic with thousands of others and shift that ip randomly over a few days. That's the great, albiet unfortunate, value of retail VPNs; other people are using them and your traffic mixed with theirs. Being a totally anonymous but unique individual is less valuable in today's marketing morass is less valuable than being one of many in a VPNs IP space.
AtNightWeCode 4y ago
The one and only thing a VPN does is that it switches your IP to another. It has absolutely nothing to do with privacy or security. An IP-address is just a single metric among hundreds that are used on the web to track users. IPs are also typically not equal to a user. It is common that an IP is a set of users and IPs often change when it comes to consumer ISPs. VPN makes sense in TCP-scenarios like Bittorrent but for web it is pretty much useless in itself.
- jasec57322 4y ago
  You are incorrect. If you use any currently standard protocol such as wireguard, openvpn, IPSEC with Suite-B ciphers you are getting 'enhanced-privacy'* from eavesdroppers on your local network, which eliminates alot of low-tier/easy MiTM attacks. A two-layer/double tunnel is pretty-good for mitigating against most commercial data collection by eavesdroppers. (Though your tunnel-exit/last-VPN-hop, (varying by client-destination protocol), and the destination IPs/sites will still be able to collect data of course). *Consider privacy a vector. Suite-B ciphers are not perfect, letalone their freely-available implementations.
autotune 4y ago
My primary use case for a VPN is staying relatively secure while connected to wifi in a coffee shop. Maybe I am just basic though.
_8j50 4y ago
I have had this argument too many times. It is a combination of cargo-culting and a flawed understanding of basic security principles. I use paid VPN services a lot as well as cloudflare warp. I understand and accept the risks the anti-vpn crowd keeps repeating. In the US, your local ISP and like you pointed out sites that sell and mine info about you are much higher risk of compromising your privacy or posing a security risk. My traffic enters hostile network territory once it is delivered to my ISP router or the remote end of a VPN tunnel. Take NordVPN for example, I don't use them but it is more difficult but still possible for law enforcement or surveillance/ad companies to coerce or collude with Nord than with site owners and ISPs. TLS metadata including timestamp, SNI and other details along with my IP are known to Nord. To my ISP, they know my current location, usually social security number , birthday and whatever info their router can gather is known to them. Sites I visit without a VPN have my IP user-agent and whatever they collect with JS. A VPN removes the IP collection by sites and traffic sniffing by ISPs that can and do sell to whoever can pay them a fee. VPN providers pause a significantly reduced risk than ISPs and they reduce risk from sites you visit. If you research a VPN provider and pick ones that have the most to lose by working against your interest, you reduce the risk even further. Setting up a VPS and maintaining is a hard dealbreaker for me since I don't have the time and even if I did there is a shit-tom of more productive things I would rather do. But even if that is the case, which VPS provider should I trust more than a VPN provider? Digitalocean or cloud providers? You know, few months ago I needed to setup a VPS fast, I must have tried 5+ including DO amd OVH. They needed to collect my email, some of them were picky about what card I used, others like DO wanted my phone to be valid, it was crazy! Only one weird vps provider let me but they didn't provision it after waiting a while. OVH wanted more info back and forth eventually after a few days supposedly they let me have a VPS but I no longer needed it after wasting money at so many places. Whether for anti-abuse reasons or anti-privacy VPS providers these days are hostile, they need too much info from you so how can you trust them with all your traffic? Mullvad, PIA and Proton along with many others let you sign up with cash or giftcards and you can use a fake name/address. The only info they have TLS sni/metadata and your IP. They purposely get the least amount of identifying information from you. I said cargo-culting because the people that oppose VPNs had some setup work for them and they think that and only that is ideal. I see extremely talented security folk say that and similar cargo-culting on other subjects like how you shouldn't have an AV/EDR or just use only mac and Linux if you want to be secure lol.

s_dev 4y ago

All of this can be achieved through a person VPN rather than a commercial subscription one by ssh -D whateverPort user@ip_address and setting up a SOCKS proxy in Firefox on that same port. >there are often posts which criticize the use of a VPN Often they specifically critique the likes of NordVPN etc. The off the shelf solutions rather than personally setup VPNs. What disgusts me is that they charge fees that are multiples of what it costs to run a basic Linode or DO Droplet for a month and a virtual machine is far more useful than a commercial VPN.

Chiron1991 4y ago
That's the premium you pay for not having to deal with hosting and configuration. There are plenty of people - even in the tech community - who lack the knowledge to handle this themselves.
iceburgcrm 4y ago
A basic droplet is $5 this is $7 dollars plus it gives you email relay. If you already have a droplet unused sure but otherwise being able to change ip in different countries adds some additional value for 2 dollars more.
- a012 4y ago
  I used to self-host VPN on different public clouds but most of the time got many captcha challenges (even banned, depends on websites/CDN) and I gave up, then switched to Mullvad the captcha challenges reduces a lot.
TechBro8615 4y ago
I agree with this completely. However, in this particular instance, I could make an argument for using – or at least subscribing to – Mozilla VPN simply as a method of supporting the organization. It's vital that Mozilla maintains a strong engineering force counteracting monopolies who push loss-leading products to capture markets like web browsing and email. You don't have to even use it, but every dollar of revenue that Mozilla can attribute to their privacy products and services means one less dollar is needed from their hostage deal with Google.
GauntletWizard 4y ago
A personal VPN hides my "True IP", but it doesn't mix my traffic with thousands of others and shift that ip randomly over a few days. That's the great, albiet unfortunate, value of retail VPNs; other people are using them and your traffic mixed with theirs. Being a totally anonymous but unique individual is less valuable in today's marketing morass is less valuable than being one of many in a VPNs IP space.

AtNightWeCode 4y ago

The one and only thing a VPN does is that it switches your IP to another. It has absolutely nothing to do with privacy or security. An IP-address is just a single metric among hundreds that are used on the web to track users. IPs are also typically not equal to a user. It is common that an IP is a set of users and IPs often change when it comes to consumer ISPs. VPN makes sense in TCP-scenarios like Bittorrent but for web it is pretty much useless in itself.

jasec57322 4y ago
You are incorrect. If you use any currently standard protocol such as wireguard, openvpn, IPSEC with Suite-B ciphers you are getting 'enhanced-privacy'* from eavesdroppers on your local network, which eliminates alot of low-tier/easy MiTM attacks. A two-layer/double tunnel is pretty-good for mitigating against most commercial data collection by eavesdroppers. (Though your tunnel-exit/last-VPN-hop, (varying by client-destination protocol), and the destination IPs/sites will still be able to collect data of course). *Consider privacy a vector. Suite-B ciphers are not perfect, letalone their freely-available implementations.

autotune 4y ago

My primary use case for a VPN is staying relatively secure while connected to wifi in a coffee shop. Maybe I am just basic though.

_8j50 4y ago

I have had this argument too many times. It is a combination of cargo-culting and a flawed understanding of basic security principles. I use paid VPN services a lot as well as cloudflare warp. I understand and accept the risks the anti-vpn crowd keeps repeating. In the US, your local ISP and like you pointed out sites that sell and mine info about you are much higher risk of compromising your privacy or posing a security risk. My traffic enters hostile network territory once it is delivered to my ISP router or the remote end of a VPN tunnel. Take NordVPN for example, I don't use them but it is more difficult but still possible for law enforcement or surveillance/ad companies to coerce or collude with Nord than with site owners and ISPs. TLS metadata including timestamp, SNI and other details along with my IP are known to Nord. To my ISP, they know my current location, usually social security number , birthday and whatever info their router can gather is known to them. Sites I visit without a VPN have my IP user-agent and whatever they collect with JS. A VPN removes the IP collection by sites and traffic sniffing by ISPs that can and do sell to whoever can pay them a fee. VPN providers pause a significantly reduced risk than ISPs and they reduce risk from sites you visit. If you research a VPN provider and pick ones that have the most to lose by working against your interest, you reduce the risk even further. Setting up a VPS and maintaining is a hard dealbreaker for me since I don't have the time and even if I did there is a shit-tom of more productive things I would rather do. But even if that is the case, which VPS provider should I trust more than a VPN provider? Digitalocean or cloud providers? You know, few months ago I needed to setup a VPS fast, I must have tried 5+ including DO amd OVH. They needed to collect my email, some of them were picky about what card I used, others like DO wanted my phone to be valid, it was crazy! Only one weird vps provider let me but they didn't provision it after waiting a while. OVH wanted more info back and forth eventually after a few days supposedly they let me have a VPS but I no longer needed it after wasting money at so many places. Whether for anti-abuse reasons or anti-privacy VPS providers these days are hostile, they need too much info from you so how can you trust them with all your traffic? Mullvad, PIA and Proton along with many others let you sign up with cash or giftcards and you can use a fake name/address. The only info they have TLS sni/metadata and your IP. They purposely get the least amount of identifying information from you. I said cargo-culting because the people that oppose VPNs had some setup work for them and they think that and only that is ideal. I see extremely talented security folk say that and similar cargo-culting on other subjects like how you shouldn't have an AV/EDR or just use only mac and Linux if you want to be secure lol.