3 ms·

Tor/VPNs/HTTPS is a pretty broad spectrum of protections. Everyone on the web now pretty much uses HTTPS all the time. Most people don't use a VPN but I imagine

by jgwil2 3y ago

Tor/VPNs/HTTPS is a pretty broad spectrum of protections. Everyone on the web now pretty much uses HTTPS all the time. Most people don't use a VPN but I imagine most HN users do or at least know how. Very few people use Tor. What benefits do VPNs bring over just HTTPS? What benefits does Tor bring over VPNs? And do any of these actually solve anything if you continue to use Google, Meta or similar services?

r3trohack3r 3y ago
If you’re in the United States, a VPN can provide a lot of cover by disassociating the HTTPS packets metadata from your ip address. I wrote a blog post on tactical privacy a while back that I think is still relevant: https://everytwoyears.org/2020/07/13/tactical-privacy.html https://everytwoyears.org/2020/07/13/tactical-privacy.html
- jgwil2 3y ago
  Thanks, the blog post is very straightforward and practical
jstarfish 3y ago
> What benefits do VPNs bring over just HTTPS? Doxxing/blackmail protection. If a few people collude to secure moderator positions at different sites and each gains access to IP logs (or someone just bruteforces/exploits the site and dumps logs), anybody can be outed across those sites-- the adversary has effectively compromised the server and can map page accesses directly to your IP. They don't break HTTPS, they break the weaker link-- the trust of the server owner. The next step is gaining access to the VPN provider's logs (they don't keep any, right? Right?). They all keep logs. Even if they say they don't, assume they do. Nobody is held accountable for lying about it. Again, not breaking HTTPS, but breaking the weaker link-- an unscrupulous VPN owner already exploiting the trust of you, the customer. Tor is the only "safe" way to be anonymous, but even that is dead through fingerprinting, gatekeeping and forced Javascript enabling.

3 ms·

Tor/VPNs/HTTPS is a pretty broad spectrum of protections. Everyone on the web now pretty much uses HTTPS all the time. Most people don't use a VPN but I imagine

by jgwil2 3y ago

r3trohack3r 3y ago
If you’re in the United States, a VPN can provide a lot of cover by disassociating the HTTPS packets metadata from your ip address. I wrote a blog post on tactical privacy a while back that I think is still relevant: https://everytwoyears.org/2020/07/13/tactical-privacy.html https://everytwoyears.org/2020/07/13/tactical-privacy.html
- jgwil2 3y ago
  Thanks, the blog post is very straightforward and practical
jstarfish 3y ago
> What benefits do VPNs bring over just HTTPS? Doxxing/blackmail protection. If a few people collude to secure moderator positions at different sites and each gains access to IP logs (or someone just bruteforces/exploits the site and dumps logs), anybody can be outed across those sites-- the adversary has effectively compromised the server and can map page accesses directly to your IP. They don't break HTTPS, they break the weaker link-- the trust of the server owner. The next step is gaining access to the VPN provider's logs (they don't keep any, right? Right?). They all keep logs. Even if they say they don't, assume they do. Nobody is held accountable for lying about it. Again, not breaking HTTPS, but breaking the weaker link-- an unscrupulous VPN owner already exploiting the trust of you, the customer. Tor is the only "safe" way to be anonymous, but even that is dead through fingerprinting, gatekeeping and forced Javascript enabling.