5 ms·

From TFA: > VPNs just provide an encrypted tunnel to another ISP, and therefore do not offer anonymity.

by remram 2y ago

andix 2y ago
VPN providers might be much more trustworthy than other ISPs.
- AyyEye 2y ago
  If I ran a spy agency or specialised in blackmail the first thing I'd do would be to run a VPN service. We have no way of auditing their trustworthiness.
  - andix 2y ago
    If VPN providers would do that, it would soon be public knowledge. For some ISPs the abuse of user data is a known fact. So VPN is just the safer bet. But don't get me wrong, I'm not claiming this is impossible, it's just less likely.
    - frankharv 2y ago
      CryptoAG was owned by spooks for decades. What makes you think VPN is different. https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-...
      - andix 2y ago
        It might be true. But I know that the shady cop in my neighborhood could easily put in a request to my ISP to get some data about me. But he could never get the same data from the NSA. I'm not a terrorist, so I don't feel threatened by the NSA. The thing I need to protect myself against is corrupt law enforcement.
        fragmede 2y ago
        So you're saying you have nothing to hide? Gotcha.
        andix 2y ago
        Please tell me how to do it right.
    - thephyber 2y ago
      How long did Israel’s supply chain attack on Hezbollah’s pager source stay clandestine? How long did the USA keep it hidden that they owned the Swiss company that manufactured encryption devices for other countries? They are extremely adept at finding ways to use the secret knowledge without blowing their source. A good example of this is the scene in _The Imitation Game_ after they break the Enigma code for the first time, but Alan Turing explains that they can’t notify the allied ship convoy without leaking that fact.
      - andix 2y ago
        As long as you are not a terrorist, all those surveillance programs will never be used against you. It would put those programs to risk, by exposing them. If you need to protect yourself against the most sophisticated surveillance programs, a lot of opsec will be required. VPNs can protect you against some creep in a public WiFi spying on your DNS request. It can protect against some low-tech state run mass surveillance.
        waveBidder 2y ago
        Good thing the US doesn't have an administration that will happily criminalize any opposition
        andix 2y ago
        If this is your threat model, then VPNs are definitively not enough. Still a European VPN provider might be better than nothing.
        JTyQZSnP3cQGa8B 2y ago
        > As long as you are not a terrorist, all those surveillance programs will never be used against you Can you say "as long as you have nothing to hide"? We’ve known since WW2 and maybe further that governments have used surveillance against innocents and people they didn’t like.
        2y ago
  - chefandy 2y ago
    Anybody expecting to get enough privacy to commit crimes using a VPN is definitely naive. I think most people doing important privacy stuff like being whistle blowers in authoritarian regimes knows that well enough. As part of a multi-pronged strategy to reduce the surface area exposed to creepy data brokers, though? Works fine for me.
    - andix 2y ago
      Exactly the point. It's a security measure for regular people, who don't commit crimes and aren't a high value target for government agencies. With a VPN your employee can't track what websites you're visiting over the WiFi in the break room (looking for a new job, visiting the union website for legal advice). The hotel can't track what you're doing on their WiFi. While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal).
      - chefandy 2y ago
        Right. A lot of folks sacrifice the good because it’s not unattainably perfect in tech, especially with security. I think the pressure to improve, on a whole, is a positive thing, but it often makes terrible practical advice.
      - ghostpepper 2y ago
        > regular people, who don't commit crimes and aren't a high value target for government agencies. > While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal). Aren’t these two threat models already completely different? IMHO if an authoritarian government considers what you’re doing to be a crime, you should not be doing it over a VPN you saw advertised on a billboard
        chefandy 2y ago
        I think they’re mostly referring to bypassing countrywide web filters.
- chefandy 2y ago
  If you use a VPN provider that only has one set of servers provided by one hosting provider then sure. If you’re connecting to any number of servers then that’s probably less of a problem. I’m much more concerned with Starbucks collecting data on their free WiFi than one of a number of hosting providers or whoever I sometimes exit through. The services you log into selling that data to the same brokers as everyone else is a much bigger vulnerability IMO.
- remram 2y ago
  Or they might be much less? What is your argument? They have a higher amount of customers who think they need protection. They are an obvious target for surveillance. And as TFA says: > VPN providers that lied about "no logs" never faced any meaningful consequences. https://www.theregister.com/2011/09/26/hidemyass_lulzsec_controversy/ https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...
  - andix 2y ago
    I have no idea what "TFA" refers to. My argument is: Some/many providers are known to abuse user data, are required by law to store them. Are actively and legally selling the data. Most VPN providers don't do that. Some might, but a lower probability is still better than knowing that the ISP is legally required to store your data and give them to the authorities. (this really depends on the country, in some countries ISPs are required not to store connection data, in others they are)
    - kps 2y ago
      TFA = The Featured Article… or something.
- bigfatkitten 2y ago
  Or less, you really have no way to know. You can't verify anything they say.
  - andix 2y ago
    Some VPN providers publish third party reports about their security. My VPN provider does that very extensively. My ISP doesn't do that at all. It's about who you trust more. Your decision to make.
    - bigfatkitten 2y ago
      The problem with those reports is they still mostly come down to the auditor taking the provider's word for it. Maybe the staging environment the auditor looked at doesn't log anything, but what about production? Maybe it doesn't log anything today, but who says it didn't yesterday, and that they won't turn logging (back) on tomorrow? At least where I live, there is strict legislation governing what ISPs can or must collect, and what they do with that information. Offences under that telecommunications interception legislation come with prison sentences, and so there is a strong incentive for individual employees to comply. For some people, moving that exposure to a VPN provider mitigates their risk. For others, it increases it.
ls612 2y ago
What VPNs can offer though are censorship resistance and masking your IP from non-governmental (and perhaps governmental if the logs really aren't kept) third parties. Which for many people is what they really need more so than full tor anonymity.
dilyevsky 2y ago
All i need to setup with my vpn provider is a long ass random number and monero wallet. Show me a residential or business isp that provides this level of privacy
wfn 2y ago
Anonymity, privacy, confidentiality, (edited to add) censorship resistance / circumvention are different properties oftentimes perceived with some overlap. Different products and different audiences will provide / desire/need/prefer different subsets. P.S. also, for some people, privacy from target site/resource/network will be much desirable and more important vs. certain aspects w.r.t their ISP. And finally, there's a scale (see: threat models) - sometimes not leaking info or identity to some website / entity is enough, and there's no need to avoid to avoid state level actors, global passive adversaries, sophisticated timing correlation attacks and other funky creatures. Simplicity and ~zero maintenance (e.g. using some VPN with killswitch option) can be important factors in themselves. edit P.P.S. also see this comment of mine: https://news.ycombinator.com/item?id=43096066 https://news.ycombinator.com/item?id=43096066 ; I legitimately and honestly believe that we should be (re)reading James Mickens rants (the usenix papers) and that this would give us more insight and guidance in relation to such security topics.
kdmtctl 2y ago
Anything and everything depends on the threat model. Often, a popular and trusted VPN is the first and necessary step to hide in the crowd and drop your most logged geo ID, which is the endpoint IP. Additional measures are certainly required.

From TFA: > VPNs just provide an encrypted tunnel to another ISP, and therefore do not offer anonymity.

by remram 2y ago

From TFA: > VPNs just provide an encrypted tunnel to another ISP, and therefore do not offer anonymity.

andix 2y ago

VPN providers might be much more trustworthy than other ISPs.

AyyEye 2y ago
If I ran a spy agency or specialised in blackmail the first thing I'd do would be to run a VPN service. We have no way of auditing their trustworthiness.
- andix 2y ago
  If VPN providers would do that, it would soon be public knowledge. For some ISPs the abuse of user data is a known fact. So VPN is just the safer bet. But don't get me wrong, I'm not claiming this is impossible, it's just less likely.
  - frankharv 2y ago
    CryptoAG was owned by spooks for decades. What makes you think VPN is different. https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-...
    - andix 2y ago
      It might be true. But I know that the shady cop in my neighborhood could easily put in a request to my ISP to get some data about me. But he could never get the same data from the NSA. I'm not a terrorist, so I don't feel threatened by the NSA. The thing I need to protect myself against is corrupt law enforcement.
      - fragmede 2y ago
        So you're saying you have nothing to hide? Gotcha.
        andix 2y ago
        Please tell me how to do it right.
  - thephyber 2y ago
    How long did Israel’s supply chain attack on Hezbollah’s pager source stay clandestine? How long did the USA keep it hidden that they owned the Swiss company that manufactured encryption devices for other countries? They are extremely adept at finding ways to use the secret knowledge without blowing their source. A good example of this is the scene in _The Imitation Game_ after they break the Enigma code for the first time, but Alan Turing explains that they can’t notify the allied ship convoy without leaking that fact.
    - andix 2y ago
      As long as you are not a terrorist, all those surveillance programs will never be used against you. It would put those programs to risk, by exposing them. If you need to protect yourself against the most sophisticated surveillance programs, a lot of opsec will be required. VPNs can protect you against some creep in a public WiFi spying on your DNS request. It can protect against some low-tech state run mass surveillance.
      - waveBidder 2y ago
        Good thing the US doesn't have an administration that will happily criminalize any opposition
        andix 2y ago
        If this is your threat model, then VPNs are definitively not enough. Still a European VPN provider might be better than nothing.
      - JTyQZSnP3cQGa8B 2y ago
        > As long as you are not a terrorist, all those surveillance programs will never be used against you Can you say "as long as you have nothing to hide"? We’ve known since WW2 and maybe further that governments have used surveillance against innocents and people they didn’t like.
        2y ago
- chefandy 2y ago
  Anybody expecting to get enough privacy to commit crimes using a VPN is definitely naive. I think most people doing important privacy stuff like being whistle blowers in authoritarian regimes knows that well enough. As part of a multi-pronged strategy to reduce the surface area exposed to creepy data brokers, though? Works fine for me.
  - andix 2y ago
    Exactly the point. It's a security measure for regular people, who don't commit crimes and aren't a high value target for government agencies. With a VPN your employee can't track what websites you're visiting over the WiFi in the break room (looking for a new job, visiting the union website for legal advice). The hotel can't track what you're doing on their WiFi. While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal).
    - chefandy 2y ago
      Right. A lot of folks sacrifice the good because it’s not unattainably perfect in tech, especially with security. I think the pressure to improve, on a whole, is a positive thing, but it often makes terrible practical advice.
    - ghostpepper 2y ago
      > regular people, who don't commit crimes and aren't a high value target for government agencies. > While traveling to not really democratic countries the government can't spy on you (in many muslim countries the typical US/European browsing behavior is probably illegal). Aren’t these two threat models already completely different? IMHO if an authoritarian government considers what you’re doing to be a crime, you should not be doing it over a VPN you saw advertised on a billboard
      - chefandy 2y ago
        I think they’re mostly referring to bypassing countrywide web filters.
chefandy 2y ago
If you use a VPN provider that only has one set of servers provided by one hosting provider then sure. If you’re connecting to any number of servers then that’s probably less of a problem. I’m much more concerned with Starbucks collecting data on their free WiFi than one of a number of hosting providers or whoever I sometimes exit through. The services you log into selling that data to the same brokers as everyone else is a much bigger vulnerability IMO.
remram 2y ago
Or they might be much less? What is your argument? They have a higher amount of customers who think they need protection. They are an obvious target for surveillance. And as TFA says: > VPN providers that lied about "no logs" never faced any meaningful consequences. https://www.theregister.com/2011/09/26/hidemyass_lulzsec_controversy/ https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...
- andix 2y ago
  I have no idea what "TFA" refers to. My argument is: Some/many providers are known to abuse user data, are required by law to store them. Are actively and legally selling the data. Most VPN providers don't do that. Some might, but a lower probability is still better than knowing that the ISP is legally required to store your data and give them to the authorities. (this really depends on the country, in some countries ISPs are required not to store connection data, in others they are)
  - kps 2y ago
    TFA = The Featured Article… or something.
bigfatkitten 2y ago
Or less, you really have no way to know. You can't verify anything they say.
- andix 2y ago
  Some VPN providers publish third party reports about their security. My VPN provider does that very extensively. My ISP doesn't do that at all. It's about who you trust more. Your decision to make.
  - bigfatkitten 2y ago
    The problem with those reports is they still mostly come down to the auditor taking the provider's word for it. Maybe the staging environment the auditor looked at doesn't log anything, but what about production? Maybe it doesn't log anything today, but who says it didn't yesterday, and that they won't turn logging (back) on tomorrow? At least where I live, there is strict legislation governing what ISPs can or must collect, and what they do with that information. Offences under that telecommunications interception legislation come with prison sentences, and so there is a strong incentive for individual employees to comply. For some people, moving that exposure to a VPN provider mitigates their risk. For others, it increases it.

ls612 2y ago

What VPNs can offer though are censorship resistance and masking your IP from non-governmental (and perhaps governmental if the logs really aren't kept) third parties. Which for many people is what they really need more so than full tor anonymity.

dilyevsky 2y ago

All i need to setup with my vpn provider is a long ass random number and monero wallet. Show me a residential or business isp that provides this level of privacy

wfn 2y ago

Anonymity, privacy, confidentiality, (edited to add) censorship resistance / circumvention are different properties oftentimes perceived with some overlap. Different products and different audiences will provide / desire/need/prefer different subsets. P.S. also, for some people, privacy from target site/resource/network will be much desirable and more important vs. certain aspects w.r.t their ISP. And finally, there's a scale (see: threat models) - sometimes not leaking info or identity to some website / entity is enough, and there's no need to avoid to avoid state level actors, global passive adversaries, sophisticated timing correlation attacks and other funky creatures. Simplicity and ~zero maintenance (e.g. using some VPN with killswitch option) can be important factors in themselves. edit P.P.S. also see this comment of mine: https://news.ycombinator.com/item?id=43096066 https://news.ycombinator.com/item?id=43096066 ; I legitimately and honestly believe that we should be (re)reading James Mickens rants (the usenix papers) and that this would give us more insight and guidance in relation to such security topics.

kdmtctl 2y ago

Anything and everything depends on the threat model. Often, a popular and trusted VPN is the first and necessary step to hide in the crowd and drop your most logged geo ID, which is the endpoint IP. Additional measures are certainly required.