3 ms·

A more constructive response is to explain why it won't work.

by bagels 2y ago

some_furry 2y ago
A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work. My first post in this thread has a link that explains why VPN services aren't trustworthy. But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN. Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor. The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model. https://www.malwarebytes.com/blog/news/2024/10/tor-browser-and-firefox-users-should-update-to-fix-actively-exploited-vulnerability https://www.malwarebytes.com/blog/news/2024/10/tor-browser-a... Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN. If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate. Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.
- LWIRVoltage 2y ago
  There is one reason- VPN traffic, vs tor traffic monitoring. Tor traffic stands out and that has been used to nab people famously, like that bomb hoax incident. Which suggests cloaking tor with a solid VPN is the way to go. Yes, bridges may be an option as well, but I don't know that their ease of use is where it should be for everyone wanting to be hidden
  - bauruine 2y ago
    IIRC they used NetFlow data to find the only Tor user. So as long as your VPN doesn't use a different exit than entry IP it's as easy to find you as the Tor user.
- akimbostrawman 2y ago
  Or you know just use both because even the most shady VPN is more trustworthy than any ISP. There of course is always the option to just use a trustworthy vpn that even implements traffic analysis protection like mullvad
anigbrowl 2y ago
Burden of proof is on the proponent.

A more constructive response is to explain why it won't work.

by bagels 2y ago

A more constructive response is to explain why it won't work.

A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work. My first post in this thread has a link that explains why VPN services aren't trustworthy. But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN. Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor. The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model. https://www.malwarebytes.com/blog/news/2024/10/tor-browser-and-firefox-users-should-update-to-fix-actively-exploited-vulnerability https://www.malwarebytes.com/blog/news/2024/10/tor-browser-a... Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN. If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate. Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.

LWIRVoltage 2y ago
There is one reason- VPN traffic, vs tor traffic monitoring. Tor traffic stands out and that has been used to nab people famously, like that bomb hoax incident. Which suggests cloaking tor with a solid VPN is the way to go. Yes, bridges may be an option as well, but I don't know that their ease of use is where it should be for everyone wanting to be hidden
- bauruine 2y ago
  IIRC they used NetFlow data to find the only Tor user. So as long as your VPN doesn't use a different exit than entry IP it's as easy to find you as the Tor user.
akimbostrawman 2y ago
Or you know just use both because even the most shady VPN is more trustworthy than any ISP. There of course is always the option to just use a trustworthy vpn that even implements traffic analysis protection like mullvad

anigbrowl 2y ago

Burden of proof is on the proponent.