4 ms·
I don't think there is any way that any VPN company can convince me they aren't secretly run by the CIA or some other country's equivalent.
by blindriver 2y ago
I don't think there is any way that any VPN company can convince me they aren't secretly run by the CIA or some other country's equivalent.
- radicaldreamer 2y agoHow about iCloud Private Relay?
- jiveturkey 2y agoor MPR (https://invisv.com/articles/relay https://invisv.com/articles/relay) in general.
- lordofgibbons 2y agoThe way I look at it is that my ISP is very open about collecting and selling "anonymized" data based on users' internet usage. On the other hand, a reputable VPN provider has everything to lose if word got out that they collect or sell information. The privacy calculus is: 100% chance vs some small chance.
- GoofballJones 2y agoLegit question: What can an ISP collect when most of the time I'm going to secure "https:" websites? I mean, they can only see the website I'm going to, but not what is going on there, right? Is just collecting where people are going that lucrative to sell?
- agieocean 2y agoThat + other data can be used to build a behavorial profile so it's not what your ISP is doing necessarily but what the people they sell the data to are doing with it (or the people they sell to)
- lordofgibbons 2y agoThere's what websites/apps you use, but also your behavior patterns. Are you a night owl? How often do you check some website or app. I'm sure there's a lot of other information they do gather based on the "metadata"
- eptcyka 2y agoDNS records and net flow data. They can also inject JS in http sites, hijack domaijs to do the same, do traffic shaping. But I am biased, I work for a VPN company.
- 112233 2y agoNot what they can, what they MUST as required by law. Assuming US, see DTA aka CALEA - at any time little green men with a warrant can ask for tranparrent packet capture of ISP client's traffic. Also, in many places (Europa) there is collection and retention requirements for ISPs.
- Spooky23 2y agoThe DNS data is super useful for developing a demographic profile. For example, they could pretty trivially assert with high confidence that a pregnant woman is in your home or that you’re shopping for a car. The tinfoil hat scenarios are interesting as well.
- Salgat 2y agoThat's assuming the financial incentivize of an intelligence agency is not sufficient to cover the risk.
- threecheese 2y agoEven if the VPN provider is doing something naughty-ish, just decoupling netflow info from your IRL id/address/financials/probably TV habits info has value. Even if you can’t control the usage of behavior data by multiple organizations, you can try to “anonymize” it at the boundaries between them. Indirection, to minimize how much becomes associated with your identity. Really only valid for individual company adversaries though, depends on your threat model I guess. Edit: it’s sad that I need a threat model
- jesperwe 2y agoNot even https://mullvad.net/en/why-mullvad-vpn https://mullvad.net/en/why-mullvad-vpn? (The only VPN I've heard of that allows you to pay anonymously with cash)
- ipaddr 2y agoIt's more most smaller VPN brands are surprisingly owned by one company Nord.. It's not all vpns it's just if you took 100 brands 90 of them are owned leased from Nord
- cedws 2y agoI don’t know about CIA, but something about Proton has always felt off.
- tucnak 2y agoThe fact that it's shown in all Hollywood films as "secure" email, and Navy Seals guys on youtube are recommending it in unison—should tell you all you need to know... Not to mention the DDoS protection racket the Israelis (coordinated with the BND) pulled on Proton for traffic analysis. See their own statement on the matter: https://proton.me/support/protonmail-israel-radware https://proton.me/support/protonmail-israel-radware DE-CIX is a known SIGINT collection site.
- fransje26 2y agoWell, it wouldn't be the first encryption-related Swiss company run by the CIA. :-) https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG