3 ms·

Commercial VPNs do indeed vaguely promise to protect your data, access, etc. For those of us that are technical but unschooled, what resources would you recomm

by tomrod 1y ago

Commercial VPNs do indeed vaguely promise to protect your data, access, etc. For those of us that are technical but unschooled, what resources would you recommend we learn from?

busterarm 1y ago
You can operate your own VPN (algovpn, openvpn, etc). There's low utility to doing so, but it's fairly straightforward these days. Or run Tailscale (and a self-hosted DERP relay).
- martin_a 1y ago
  I did this for a while in combination with a PiHole setup on a small vultr.com package. Utility in that was that the traffic of all devices was routed through a "PiHoled VPN", so very little advertisements came through...
  - giobox 1y ago
    A cheap VPS instance + DNS with adblock + self hosted VPN used to be great until around ~5 years ago, when a great many websites (especially streaming sites) just started blocking any IP range associated with a VPS provider. I've given up using VPSes as VPN exit nodes now.
- doublerabbit 1y ago
  The caveat with this is you're going to encounter every Cloudflare capture possible.
- jonny_eh 1y ago
  > You can operate your own VPN On what infra? Can you trust that one? Doesn't that solution just move the problem down one level?
  - 5f3cfa1a 1y ago
    The answer is always "maybe" until you bring your threat model to the table. I use a VPN to watch IPTV & download torrents without my ISP sending me nasty letters. Mullvad is great for that. I would trust it in conjunction with Tor to protect me from low-level crimes. I wouldn't run trust either it or Tor, alone or in combination, to run a marketplace the DEA would become interested in. If your threat model is obscuring your home IP to hide your IP from above board HTTPS sites, a DIY VPN probably is great. If it's to do low level crime, a cheap VPN is probably enough. Anything else, good luck.
    - busterarm 1y ago
      This. Between the parent and the other one, it's almost like I specifically pointed out the limited utility of this approach and all of the Well Acktshually posters had to spell it out anyway. I was responding to someone who said they were technical, so it should be assumed they can work this all out for themselves.
      - tomrod 1y ago
        You provided some great breadcrumbs. I appreciate your responses.
    - em-bee 1y ago
      a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. also any server that i can use is likely blocked by wikipedia, youtube, reddit, and others because they detect and block hosting services.
      - 5f3cfa1a 1y ago
        > a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. Again, threat model matters – hide your identity from whom? You certainly won't hide it from someone who can seize payment records. You will struggle to hide it from someone who has control of enough of the internet to correlate data across sites, like Google or Cloudflare. But if you're looking to be pseudonymous in the face of a single site, or a small set of sites that don't conspire to unmask users? It might work just fine. (unless as you rightly note they block your hosting service's ASN;-))
deleted 1y ago
[deleted]
gardnr 1y ago
The gist of the report summary is that VPN companies can be really shady. At the same time, these companies enjoy an undeserved implicit trust from the public. Sending all our data through an untrusted intermediary is a bad idea. Installing software from an unknown company (that hijacks the machine's entire network stack) is not a good way to protect data. It all really depends on what you are protecting against. For the average person wanting to protect data and avoid being tracked, setting up thoughtful DNS infra, and a basic firewall, is probably more effective than using a commercial VPN from your home network. For public networks, it's probably safer to set up a VPN server on your home network and use that in case you need to connect to public wifi or some other potentially hostile network. I'm not aware of any authoritative article on this topic but I generally share writings by Schneier. This one touches on the subject: https://www.schneier.com/blog/archives/2021/06/vpns-and-trust.html https://www.schneier.com/blog/archives/2021/06/vpns-and-trus...

by tomrod 1y ago

Commercial VPNs do indeed vaguely promise to protect your data, access, etc. For those of us that are technical but unschooled, what resources would you recommend we learn from?

busterarm 1y ago

You can operate your own VPN (algovpn, openvpn, etc). There's low utility to doing so, but it's fairly straightforward these days. Or run Tailscale (and a self-hosted DERP relay).

martin_a 1y ago
I did this for a while in combination with a PiHole setup on a small vultr.com package. Utility in that was that the traffic of all devices was routed through a "PiHoled VPN", so very little advertisements came through...
- giobox 1y ago
  A cheap VPS instance + DNS with adblock + self hosted VPN used to be great until around ~5 years ago, when a great many websites (especially streaming sites) just started blocking any IP range associated with a VPS provider. I've given up using VPSes as VPN exit nodes now.
doublerabbit 1y ago
The caveat with this is you're going to encounter every Cloudflare capture possible.
jonny_eh 1y ago
> You can operate your own VPN On what infra? Can you trust that one? Doesn't that solution just move the problem down one level?
- 5f3cfa1a 1y ago
  The answer is always "maybe" until you bring your threat model to the table. I use a VPN to watch IPTV & download torrents without my ISP sending me nasty letters. Mullvad is great for that. I would trust it in conjunction with Tor to protect me from low-level crimes. I wouldn't run trust either it or Tor, alone or in combination, to run a marketplace the DEA would become interested in. If your threat model is obscuring your home IP to hide your IP from above board HTTPS sites, a DIY VPN probably is great. If it's to do low level crime, a cheap VPN is probably enough. Anything else, good luck.
  - busterarm 1y ago
    This. Between the parent and the other one, it's almost like I specifically pointed out the limited utility of this approach and all of the Well Acktshually posters had to spell it out anyway. I was responding to someone who said they were technical, so it should be assumed they can work this all out for themselves.
    - tomrod 1y ago
      You provided some great breadcrumbs. I appreciate your responses.
  - em-bee 1y ago
    a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. also any server that i can use is likely blocked by wikipedia, youtube, reddit, and others because they detect and block hosting services.
    - 5f3cfa1a 1y ago
      > a DYI VPN may hide my home IP but it does not hide my identity unless the server i route through is not owned by me. Again, threat model matters – hide your identity from whom? You certainly won't hide it from someone who can seize payment records. You will struggle to hide it from someone who has control of enough of the internet to correlate data across sites, like Google or Cloudflare. But if you're looking to be pseudonymous in the face of a single site, or a small set of sites that don't conspire to unmask users? It might work just fine. (unless as you rightly note they block your hosting service's ASN;-))

deleted 1y ago

[deleted]

gardnr 1y ago

The gist of the report summary is that VPN companies can be really shady. At the same time, these companies enjoy an undeserved implicit trust from the public. Sending all our data through an untrusted intermediary is a bad idea. Installing software from an unknown company (that hijacks the machine's entire network stack) is not a good way to protect data. It all really depends on what you are protecting against. For the average person wanting to protect data and avoid being tracked, setting up thoughtful DNS infra, and a basic firewall, is probably more effective than using a commercial VPN from your home network. For public networks, it's probably safer to set up a VPN server on your home network and use that in case you need to connect to public wifi or some other potentially hostile network. I'm not aware of any authoritative article on this topic but I generally share writings by Schneier. This one touches on the subject: https://www.schneier.com/blog/archives/2021/06/vpns-and-trust.html https://www.schneier.com/blog/archives/2021/06/vpns-and-trus...