3 ms·

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible. On the other hand, if you

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible. On the other hand, if you are using an ISP provided gateway device..

CodeWriter23 2y ago
You mean like a pwned home router?
radiowave 2y ago
Or become the DHCP server on whatever third party wifi you're connected to.
smarx007 2y ago
> arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings. The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust.
- SahAssar 2y ago
  > A.k.a merely the no. 1 selling point for most VPN offerings. I thought the selling point was protection against hackers. No, was it your ISP seeing your (basically always HTTPS encrypted) traffic? Or facebook/google harvesting your data? Or russian hackers? Or watching netflix from other countries? Or data-harvesters watching your traffic? Or if you just really like downloading linux ISOs? I also think I heard something about snowden and NSA tracking in a few ads. Something something cheaper airplane tickets? Either way, it's all scary and for the low fee of 5$ per month (sign up for 3 years and you get 3 months free with my code!) you don't have to worry your pretty little head about it anymore. Don't worry about that our company is registered in Bermuda and is just 3 months old.
  - acdha 2y ago
    There are super shady VPN providers but that doesn’t mean local network risks can be ignored. For example, how frequently do you hear about compromised networks of routers and access points? Attackers could be using those for far more stealthy means. Also, remember when Verizon decided to helpfully inject cross-domain tracking cookies into their customers’ traffic? Do you really want to gamble that some MBA wouldn’t start to think about ways to monetize activity collection from VPN users? Some provider won’t sell schools, coffee shops, etc. a service which will block the “wrong” traffic and that just quietly expands to cover, say, women looking for family planning advice or college students in Florida looking for trans support?
- mschuster91 2y ago
  > The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust. Sadly, there are carriers on this planet who think it's a good idea to charge ridiculous prices for mobile data (Germany) or to block hotspot functionality unless you pay up (US, see [1] for the technical background - both Apple and Google are complicit). In a world where politicians would care about their people, there would be no need for wifi hotspots to exist in the first place. Additionally, there are certain advertising brokers such as utiq that cooperate with major phone networks to provide detailed tracking, so they and advertisers know pretty precisely who you are just because you tethered your laptop to your phone. And finally, you can't trust your phone ISP either - Verizon got caught red-handed injecting tracking "supercookies" into their customers' traffic [2], thank God at least that vector got closed with everyone and their dog going HTTPS. In general: anything involving residential ISPs is rife with scams. [1] https://news.ycombinator.com/item?id=20460438 https://news.ycombinator.com/item?id=20460438 [2] http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ http://webpolicy.org/2014/10/24/how-verizons-advertising-hea...
- prmoustache 2y ago
  > Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings. Isn't the #1 selling point of general consumer's (not Enterprise) VPNs to stream video and audio from another country?
tgsovlerkhgsel 2y ago
That's one of the commonly advertised reasons to use VPNs: protection in untrusted WiFi networks.
flir 2y ago
Surely one of the big use-cases for a VPN is that the network you're connected to is untrusted?
Aurornis 2y ago
The risk is outside the home: Using a VPN at the coffee shop, hotel, office, etc.
threePointFive 2y ago
"the DCHP server" implies it is somehow a special device on your network, which is a flawed assumption. DHCP works on an broadcast protocol and your device will accept the first offer. The fact that the most common residential configuration is for your DHCP to be hosted on your router and thus likely the first to respond is inconsequential to the fact that any hostile device on your network could use this exploit.
- pushedx 2y ago
  not implying anything in that regard, I can imagine a clever attack which involves a local malicious dhcp implementation
- immibis 2y ago
  That's not at all guaranteed. The residential gateway most likely contains a hardware switch and a CPU, which also does the routing. The CPU is attached to the switch like any other device, though probably with less physical-layer bits, and some of them aren't all that fast.
justanotherjoe 2y ago
what are you insinuating? I still need to be spelt out. Are you saying that ISP's gateway device have any incentives to decloak my vpn traffic? Sounds like a huge liability for no reason? Surely they will be out of business it sounds so bad?

CodeWriter23 2y ago

You mean like a pwned home router?

radiowave 2y ago

Or become the DHCP server on whatever third party wifi you're connected to.

smarx007 2y ago

> arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings. The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust.

SahAssar 2y ago
> A.k.a merely the no. 1 selling point for most VPN offerings. I thought the selling point was protection against hackers. No, was it your ISP seeing your (basically always HTTPS encrypted) traffic? Or facebook/google harvesting your data? Or russian hackers? Or watching netflix from other countries? Or data-harvesters watching your traffic? Or if you just really like downloading linux ISOs? I also think I heard something about snowden and NSA tracking in a few ads. Something something cheaper airplane tickets? Either way, it's all scary and for the low fee of 5$ per month (sign up for 3 years and you get 3 months free with my code!) you don't have to worry your pretty little head about it anymore. Don't worry about that our company is registered in Bermuda and is just 3 months old.
- acdha 2y ago
  There are super shady VPN providers but that doesn’t mean local network risks can be ignored. For example, how frequently do you hear about compromised networks of routers and access points? Attackers could be using those for far more stealthy means. Also, remember when Verizon decided to helpfully inject cross-domain tracking cookies into their customers’ traffic? Do you really want to gamble that some MBA wouldn’t start to think about ways to monetize activity collection from VPN users? Some provider won’t sell schools, coffee shops, etc. a service which will block the “wrong” traffic and that just quietly expands to cover, say, women looking for family planning advice or college students in Florida looking for trans support?
mschuster91 2y ago
> The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust. Sadly, there are carriers on this planet who think it's a good idea to charge ridiculous prices for mobile data (Germany) or to block hotspot functionality unless you pay up (US, see [1] for the technical background - both Apple and Google are complicit). In a world where politicians would care about their people, there would be no need for wifi hotspots to exist in the first place. Additionally, there are certain advertising brokers such as utiq that cooperate with major phone networks to provide detailed tracking, so they and advertisers know pretty precisely who you are just because you tethered your laptop to your phone. And finally, you can't trust your phone ISP either - Verizon got caught red-handed injecting tracking "supercookies" into their customers' traffic [2], thank God at least that vector got closed with everyone and their dog going HTTPS. In general: anything involving residential ISPs is rife with scams. [1] https://news.ycombinator.com/item?id=20460438 https://news.ycombinator.com/item?id=20460438 [2] http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ http://webpolicy.org/2014/10/24/how-verizons-advertising-hea...
prmoustache 2y ago
> Coffee shop wi-fi? A.k.a merely the no. 1 selling point for most VPN offerings. Isn't the #1 selling point of general consumer's (not Enterprise) VPNs to stream video and audio from another country?

tgsovlerkhgsel 2y ago

That's one of the commonly advertised reasons to use VPNs: protection in untrusted WiFi networks.

flir 2y ago

Surely one of the big use-cases for a VPN is that the network you're connected to is untrusted?

Aurornis 2y ago

The risk is outside the home: Using a VPN at the coffee shop, hotel, office, etc.

threePointFive 2y ago

"the DCHP server" implies it is somehow a special device on your network, which is a flawed assumption. DHCP works on an broadcast protocol and your device will accept the first offer. The fact that the most common residential configuration is for your DHCP to be hosted on your router and thus likely the first to respond is inconsequential to the fact that any hostile device on your network could use this exploit.

pushedx 2y ago
not implying anything in that regard, I can imagine a clever attack which involves a local malicious dhcp implementation
immibis 2y ago
That's not at all guaranteed. The residential gateway most likely contains a hardware switch and a CPU, which also does the routing. The CPU is attached to the switch like any other device, though probably with less physical-layer bits, and some of them aren't all that fast.

justanotherjoe 2y ago

what are you insinuating? I still need to be spelt out. Are you saying that ISP's gateway device have any incentives to decloak my vpn traffic? Sounds like a huge liability for no reason? Surely they will be out of business it sounds so bad?