11 ms·

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on lever

• tomrod 1y ago
  Commercial VPNs do indeed vaguely promise to protect your data, access, etc. For those of us that are technical but unschooled, what resources would you recommend we learn from?
  • busterarm 1y ago
    You can operate your own VPN (algovpn, openvpn, etc). There's low utility to doing so, but it's fairly straightforward these days. Or run Tailscale (and a self-hosted DERP relay).
    • martin_a 1y ago
      I did this for a while in combination with a PiHole setup on a small vultr.com package. Utility in that was that the traffic of all devices was routed through a "PiHoled VPN", so very little advertisements came through...
      • giobox 1y ago
        A cheap VPS instance + DNS with adblock + self hosted VPN used to be great until around ~5 years ago, when a great many websites (especially streaming sites) just started blocking any IP range associated with a VPS provider. I've given up using VPSes as VPN exit nodes now.
    • doublerabbit 1y ago
      The caveat with this is you're going to encounter every Cloudflare capture possible.
    • jonny_eh 1y ago
      > You can operate your own VPN On what infra? Can you trust that one? Doesn't that solution just move the problem down one level?
      • 5f3cfa1a 1y ago
        The answer is always "maybe" until you bring your threat model to the table. I use a VPN to watch IPTV & download torrents without my ISP sending me nasty letters. Mullvad is great for that. I would trust it in conjunction with Tor to protect me from low-level crimes. I wouldn't run trust either it or Tor, alone or in combination, to run a marketplace the DEA would become interested in. If your threat model is obscuring your home IP to hide your IP from above board HTTPS sites, a DIY VPN probably is great. If it's to do low level crime, a cheap VPN is probably enough. Anything else, good luck.
        • busterarm 1y ago
          This. Between the parent and the other one, it's almost like I specifically pointed out the limited utility of this approach and all of the Well Acktshually posters had to spell it out anyway. I was responding to someone who said they were technical, so it should be assumed they can work this all out for themselves.
          • tomrod 1y ago
            You provided some great breadcrumbs. I appreciate your responses.
        • em-bee 1y ago
          a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. also any server that i can use is likely blocked by wikipedia, youtube, reddit, and others because they detect and block hosting services.
          • 5f3cfa1a 1y ago
            > a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. Again, threat model matters – hide your identity from whom? You certainly won't hide it from someone who can seize payment records. You will struggle to hide it from someone who has control of enough of the internet to correlate data across sites, like Google or Cloudflare. But if you're looking to be pseudonymous in the face of a single site, or a small set of sites that don't conspire to unmask users? It might work just fine. (unless as you rightly note they block your hosting service's ASN;-))
  • deleted 1y ago
    [deleted]
  • gardnr 1y ago
    The gist of the report summary is that VPN companies can be really shady. At the same time, these companies enjoy an undeserved implicit trust from the public. Sending all our data through an untrusted intermediary is a bad idea. Installing software from an unknown company (that hijacks the machine's entire network stack) is not a good way to protect data. It all really depends on what you are protecting against. For the average person wanting to protect data and avoid being tracked, setting up thoughtful DNS infra, and a basic firewall, is probably more effective than using a commercial VPN from your home network. For public networks, it's probably safer to set up a VPN server on your home network and use that in case you need to connect to public wifi or some other potentially hostile network. I'm not aware of any authoritative article on this topic but I generally share writings by Schneier. This one touches on the subject: https://www.schneier.com/blog/archives/2021/06/vpns-and-trust.html https://www.schneier.com/blog/archives/2021/06/vpns-and-trus...
• some-guy 1y ago
  Mine is simple: avoid my ISP complaining about torrents.
  • IlikeKitties 1y ago
    And shitposting here in germany has become slightly more dangerous. If you use a vpn to call your local politician an idiot, you are much less likely to get into legal trouble.
    • NoMoreNicksLeft 1y ago
      Here in the United States, I don't know that I could trust the vpn to protect me from that. I remember an incident from a few years ago, some idiot at Harvard emailed in a bomb threat to get out of finals. They arrested him only a few hours later. It's possible he misused the vpn, but I suspect that they merely contacted the vpn provider, got a shortlist of people going through that endpoint, and eliminated all of them not in Boston. Didn't require any Stuxnet-type fuckery or super-secret technology. Be careful and good luck.
      • jofla_net 1y ago
        I remember that, Schneier talked about it on his blog. It was actually tor (the threat came from tor), and harvard 'found' him by constantly logging what connections were going to known tor entries from on campus. As it turns out he was one or possibly the only one using tor that morning from harvard. Bruce outlines it that he certainly could have stayed tight-lipped (all evidence was circumstantial) but, nevertheless confessed as soon as they approached him.
        • sodality2 1y ago
          Network traffic analysis/DPI strikes again. I wonder how many people think that their VPN usage obscures their identity, when the flow of traffic at certain times gives X% probability that this person visited the site based on the timing/size/speed/length of each TCP stream, increasing in confidence every repeated visit. Hell, how often will someone download a file of exactly 7060378032 bytes? It may not be damning evidence, but it'll surely put you under suspicion; sometimes that's all it takes. I'm looking forward to when VPNs always throw up chaff traffic.
• davepeck 1y ago
  Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought approximately all of the ad space on public transit over the past couple months. Their messaging is all about "freeing the internet" and fighting the power. It's deeply silly and, I worry, probably quite good at attracting new customers who have no need for (or understanding of) VPNs whatsoever.
  • deleted 1y ago
    [deleted]
  • jkaplowitz 1y ago
    Also (3) work around overbroad restrictions on public Wi-Fi, which still sometimes do things like block Reddit or HN or SSH. But I guess more typical consumers than those of us here are less likely to experience those obstacles.
  • john01dav 1y ago
    What about (3) "bypass government censorship"? UK and China are examples of where this is desirable. This is different from (1) because it's broader than just streaming shows and is about authoritarian rather than capitalist restrictions.
    • flumpcakes 1y ago
      I think the general discussion is conflating censorship with age restrictions. Lumping the UK with China is very disingenuous. The UK law is stipulating adult content can only be viewed if you are provably over 18. They are putting all of that responsibility onto the websites/platforms to enforce that. If a child goes to a shop and tries to buy a pornographic magazine and they are denied, is that censorship? If a child tries to see an 18 film at the Cinema and is denied, is that censorship? The fact is both of these were freely and easily done on the Internet as most websites do not verify a users age. I do not like the online safety act as it is, but it is not "censorship".
• zoklet-enjoyer 1y ago
  I use a VPN to access crypto apps that I'm geoblocked from
• zoeysmithe 1y ago
  This is my feeling too. I also don't think these people realize how none of these groups can refuse a subpoena so the scenario of "the government coming after me," doesn't get addressed either. Worse, some of these are tied to foreign nation state intelligence, who are now analyzing your data when before they couldn't because they didnt have a relationship with your ISP. Domestically, I wouldnt be surprised if all of this data from US owned VPNs is shipped to the NSA or other groups and analyzed. After the Snowden reveals its hard to really see this stuff as conspiracy anymore. Weird technical issues happen because a lot of services don't keep vpn's in mind. I saw a lot of people were having issues connecting to multiplayer game servers. The vpn provider broke something, maybe it was on a blacklisted IP, maybe increased latency, maybe the IP is in the wrong region and people are connecting to a NA server but are in LATAM, etc. I really dont know the use case for a vpn, not to mention advertising snooping happens on the application level anyway. Its javascript running on my browser and html5 and heaven knows what else analyzing me for ads, not "what IP did you connect from." Lastly, there are privacy tools like onion and running a browser with no js active. These vpn types dont do that. They're actually not getting the privacy and security they want because tor is slow and a no-js firefox is unfun. So this weird cargo cult of VPNs has appeared, similar to stuff like "disable UAC" and other "computer enthusiast" knowledge you see in gamer or low information forums. Its the blind leading the blind here and these capitalist opportunists absolutely are taking advantage of that. "I'm safe I have a vpn," is a normal thing to say even though its almost entirely wrong. The only practical use case I can think of is torrents where the legal and political will to subpoena a vpn provider is low, so its this weird loophole where you can torrent but your ISP will never be informed. For now I suppose until the IP holders think the legal fees are worth it or get a law passed to sidestep subpeonas.
  • TGower 1y ago
    Many major VPN providers claim to keep no logs, and some have had third party audits supporting that claim. Subpeonas don't do anything if the company doesn't keep logs.
    • deleted 1y ago
      [deleted]
• NoMoreNicksLeft 1y ago
  I was a Suddenlink cable internet customer, and they threatened to reveal my identifying information to copyright trolls. The $4/month was cheaper than a court judgement against me or the $250/month+ it'd cost to subscribe to all the various streaming services and premium cable channels (magazine/books/music/movies is probably closer to $4000/month in retail price tags). Last week I thought to myself "what if I downloaded the entire Book-of-the-Month-Club since 1924?" VPNs work. I never got another single nasty letter from Suddenstink. A few months back, I sat down for a week with a free trial of an obscure webapp, downloaded all of their data and formatted it into json via the javascript console, and pirated by first webapp. Since it's not making xhr calls constantly, it's even snappier than the official one. I'm inventing new piracy methodology. Some of us are more dedicated than the rest of you.
• giancarlostoro 1y ago
  I used to pay for IPredator because it allowed me to "port forward" without exposing my actual IP. Used to host minecraft servers for friends behind a Swedish IP. Also funnily enough, I could login to it on my college computers and bypass the college firewall.
• spikej 1y ago
  Most non-technical people I know that have VPNs simply have it for streaming media from platforms that geo-restrict. It's a cat and mouse game as the provider bans servers/providers.
• immibis 1y ago
  I pay to route my traffic through a barely known intermediary to obscure its origin. It all depends on your threat model for that traffic. If the traffic itself is not sensitive (or already encrypted) but you want to obscure the origin from the destination, or the destination from your ISP, it works.
• aydyn 1y ago
  Are you sure they aren't just giving you a politically correct answer? In my estimation the main reason people use VPNs is for pr*n and piracy and they may not want to just flat out admit it.
  • nobody9999 1y ago
    >In my estimation the main reason people use VPNs is for pr*n and piracy I get the piracy part, but why would someone want/need VPN for pr0n? That's not a gotcha or snark, I don't understand why folks would "need" vpn for that (assuming it's not* non-consensual, which includes hidden cameras and/or animals or children -- neither of whom can actually provide meaningful consent) as long as it's legal.
    • ookkay 1y ago
      Pornhub is blocked in 21 U.S. states (including Texas and Florida) and heavily crippled in the UK.
      • nobody9999 1y ago
        >Pornhub is blocked in 21 U.S. states (including Texas and Florida) and heavily crippled in the UK. Fair enough. And likely a host of other sites too, I guess.
• michaelt 1y ago
  > when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identity theft" I always assumed that was like head shops selling water pipes for "tobacco smoking" A fig leaf, to keep their business respectable and the credit card processors off their backs.
• oceanplexian 1y ago
  > I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers If you think they sell millions of subscriptions to "prevent identity theft" I have a bridge to sell you. Your friends and relatives aren't going to tell you that they are using it for p0rn, online dating, to buy taboo things online, etc. That's the main use case for VPN software and that's why people are buying it. Doesn't matter if it works the perception that it works is more than enough.
• cyanydeez 1y ago
  ok, but lets be honest: would they really tell you they're using it to make sure the government doesn't know they're a furry?
• sequin 1y ago
  Making sensible choices requires thinking things through, and understanding what it really is that you are doing, or refrain from doing it. Experts are just as prone to neglecting this as novices. But expressing your misgivings about prevailing orthodoxies is an ungrateful undertaking as it tends to make people angry, and there is little honour to be had in getting vindicated.
• crossroadsguy 1y ago
  On the contrary so far to me only the so called non-technical users' VPN use cases have made any sense to me - "I want to access/do this site/streaming/p2p. I can't do this without a VPN. Hence I am using a VPN". That's it. No drama, no virtue signalling, no lecturing. Just a need. It's the technical users whose myriad VPN use cases rather baffle me which in most cases eventually achieve little to none other than some sort of feeling of satisfaction or maybe placebo.
• 1970-01-01 1y ago
  Additionally, all these VPNs do it with very pretty graphics. If the OSes went overboard with their Wi-Fi and Ethernet connection graphics, embellishing the connection security[1], VPN services would evaporate. [1] UNIVERSAL-->SECURE CONNECTION https://youtube.com/v/zXyG_HncULU https://youtube.com/v/zXyG_HncULU