4 ms·

tl;dr if you want your network to be private, maybe don’t pay a saas to do it. Your ISP already tracks ingress and egress.

by ljm 3y ago

anonym29 3y ago
This is really the unfortunate truth. >90% of global ISP's not only collect but also sell netflow metadata commercially. Nanosecond timestamps, packet sizes, source IPs, destination IP's. Doesn't matter what VPN provider you use, whether you're using Tor, how many residential proxies you're routing through via a complex proxychains config... commercial entities can correlate virtually all of it. Team Cymru is one such buyer of bulk netflow metadata from ISP's (and their upstream providers) around the globe, who do all of the correlation work on their side, and then sell it, under product names like Pure Signal Recon (formerly Augury)... including to law enforcement agencies and the US military... There are also no laws dictating that ISP's must disclose whether or not they are selling that information, and they have no commercial incentive to choose to honestly disclose that they do. If your adversary is NSA/FBI/US Army, or any other deep-pocketed nation-state-level adversaries who Team Cymru is willing to sell to, the safest assumption is that there is absolutely nothing you can do to obscure the origin of your traffic with 100% certainty.
- LeBit 3y ago
  Let's keep this simple. Let's say you are using an ISP to connect to a VPN provider. That VPN provider does what most of them do and SNATs multiple customers connections to a single exit public IP. How can they correlate the encrypted wireguard data from my ISP connection to the VPN provider and then from the VPN provider to the final endpoint (say, ProtonMail)?
  - anonym29 3y ago
    There is a known traffic pattern for a GET request to Protonmail - size of the initial request, # of subsequent requests (for subresources, like CSS, JS, images, etc), and size of those requests, as well as size of those responses. There is a known overhead for encapsulating these requests in an OpenVPN or WireGuard tunnel. So even without looking at the contents of the traffic at all, the metadata your ISP collects can easily reveal that you sent outbound traffic and received inbound traffic that had a high statistical correlation with the expected traffic flow of a request to Protonmail encapsulated within a Wireguard tunnel, to a known VPN node, and then a (known) number of milliseconds before that VPN's upstream provider also made a request that perfectly matched the expected packet flow of Protonmail. If you have visibility into the traffic netflow of both your ISP and the VPN's upstream provider, consider yourself confidently unmasked. The initial fingerprinting laid firm groundwork for your adversary to suspect you went to protonmail, and then the network behavior of the first destination machine you connected to simply offered confirmation of that. In case you're unfamiliar with the concept of website traffic metadata fingerprinting I've discussed above: https://www.ietf.org/archive/id/draft-irtf-pearg-website-fingerprinting-00.html https://www.ietf.org/archive/id/draft-irtf-pearg-website-fin...
- Aerbil313 3y ago
  Hell. Is that amount of global correlation even possible? What if I route through 7 countries? Surely the data of every single ISP on earth cannot be collected in the hands of a single entity? Btw I2P provides imho decent amount of protection for timing and packet sniffing attacks.
  - chrz 3y ago
    The 'surely cannot' part is where one makes a deadly assumption.
  - anonym29 3y ago
    You are correct that not every single ISP sells this data, but for reference, back when Team Cymru's 'Pure Signal Recon' product was advertised under the name 'Augury', Team Cymru claimed that data sources included "90% of global ISPs". They currently claim to be ingesting and processing neflow metadata from over 200 billion (with a b) connections per DAY. So in theory, yes, route through enough ISP's, and you may eventually hit one along the way who isn't selling that data. That said, to my knowledge, no ISPs are required to disclose whether or not they sell metadata, and as profit-oriented corporations, have no incentive to be honest about that if asked. So it's something of a gamble to assume you can definitely find a path through n ISPs where at least one of them does not sell netflow metadata.
Semaphor 3y ago
My main adversary is my own ISP. VPNs are perfect for that. My secondary adversary are companies geoblocking content. VPNs are still perfect for that.
- didntcheck 3y ago
  Which VPNs do you find effective for the second purpose? My small experience of using VPNs is that you just end up suffering from the poor reputation of your exit IPs, which rarely stay secret for long. So you end up blocked or at least frequently CAPTCHA'd on sites that wouldn't have blocked your own IP, and I imagine those that are doing geoblocking have a big blacklist of VPN IPs (I know BBC iPlayer does)
  - Semaphor 3y ago
    I rarely have the need, I use mullvad, and it works for those occasions. But I don’t need to circumvent any serious blocks, most of the time it’s just something being US-only or "not EU", and neither of those sites care much if you circumvent it.

tl;dr if you want your network to be private, maybe don’t pay a saas to do it. Your ISP already tracks ingress and egress.

by ljm 3y ago

tl;dr if you want your network to be private, maybe don’t pay a saas to do it. Your ISP already tracks ingress and egress.

anonym29 3y ago

This is really the unfortunate truth. >90% of global ISP's not only collect but also sell netflow metadata commercially. Nanosecond timestamps, packet sizes, source IPs, destination IP's. Doesn't matter what VPN provider you use, whether you're using Tor, how many residential proxies you're routing through via a complex proxychains config... commercial entities can correlate virtually all of it. Team Cymru is one such buyer of bulk netflow metadata from ISP's (and their upstream providers) around the globe, who do all of the correlation work on their side, and then sell it, under product names like Pure Signal Recon (formerly Augury)... including to law enforcement agencies and the US military... There are also no laws dictating that ISP's must disclose whether or not they are selling that information, and they have no commercial incentive to choose to honestly disclose that they do. If your adversary is NSA/FBI/US Army, or any other deep-pocketed nation-state-level adversaries who Team Cymru is willing to sell to, the safest assumption is that there is absolutely nothing you can do to obscure the origin of your traffic with 100% certainty.

LeBit 3y ago
Let's keep this simple. Let's say you are using an ISP to connect to a VPN provider. That VPN provider does what most of them do and SNATs multiple customers connections to a single exit public IP. How can they correlate the encrypted wireguard data from my ISP connection to the VPN provider and then from the VPN provider to the final endpoint (say, ProtonMail)?
- anonym29 3y ago
  There is a known traffic pattern for a GET request to Protonmail - size of the initial request, # of subsequent requests (for subresources, like CSS, JS, images, etc), and size of those requests, as well as size of those responses. There is a known overhead for encapsulating these requests in an OpenVPN or WireGuard tunnel. So even without looking at the contents of the traffic at all, the metadata your ISP collects can easily reveal that you sent outbound traffic and received inbound traffic that had a high statistical correlation with the expected traffic flow of a request to Protonmail encapsulated within a Wireguard tunnel, to a known VPN node, and then a (known) number of milliseconds before that VPN's upstream provider also made a request that perfectly matched the expected packet flow of Protonmail. If you have visibility into the traffic netflow of both your ISP and the VPN's upstream provider, consider yourself confidently unmasked. The initial fingerprinting laid firm groundwork for your adversary to suspect you went to protonmail, and then the network behavior of the first destination machine you connected to simply offered confirmation of that. In case you're unfamiliar with the concept of website traffic metadata fingerprinting I've discussed above: https://www.ietf.org/archive/id/draft-irtf-pearg-website-fingerprinting-00.html https://www.ietf.org/archive/id/draft-irtf-pearg-website-fin...
Aerbil313 3y ago
Hell. Is that amount of global correlation even possible? What if I route through 7 countries? Surely the data of every single ISP on earth cannot be collected in the hands of a single entity? Btw I2P provides imho decent amount of protection for timing and packet sniffing attacks.
- chrz 3y ago
  The 'surely cannot' part is where one makes a deadly assumption.
- anonym29 3y ago
  You are correct that not every single ISP sells this data, but for reference, back when Team Cymru's 'Pure Signal Recon' product was advertised under the name 'Augury', Team Cymru claimed that data sources included "90% of global ISPs". They currently claim to be ingesting and processing neflow metadata from over 200 billion (with a b) connections per DAY. So in theory, yes, route through enough ISP's, and you may eventually hit one along the way who isn't selling that data. That said, to my knowledge, no ISPs are required to disclose whether or not they sell metadata, and as profit-oriented corporations, have no incentive to be honest about that if asked. So it's something of a gamble to assume you can definitely find a path through n ISPs where at least one of them does not sell netflow metadata.

Semaphor 3y ago

My main adversary is my own ISP. VPNs are perfect for that. My secondary adversary are companies geoblocking content. VPNs are still perfect for that.

didntcheck 3y ago
Which VPNs do you find effective for the second purpose? My small experience of using VPNs is that you just end up suffering from the poor reputation of your exit IPs, which rarely stay secret for long. So you end up blocked or at least frequently CAPTCHA'd on sites that wouldn't have blocked your own IP, and I imagine those that are doing geoblocking have a big blacklist of VPN IPs (I know BBC iPlayer does)
- Semaphor 3y ago
  I rarely have the need, I use mullvad, and it works for those occasions. But I don’t need to circumvent any serious blocks, most of the time it’s just something being US-only or "not EU", and neither of those sites care much if you circumvent it.