13 ms·

If I were a governmental entity - I'd go ahead and set up my very own honeypot VPN provider. I'd then log everything - whilst providing exceptional service - an

If I were a governmental entity - I'd go ahead and set up my very own honeypot VPN provider. I'd then log everything - whilst providing exceptional service - and play the long game - collect as much data from people who self-select themselves as requiring large amounts of anonymity (the paranoid/people who can't access Hulu overseas/criminals/terrorists). I'd wait a few years and then use said data to slowly infiltrate various groups - looking to grab the big fish that are hopefully well separated from the VPN service and then take them down quietly. Hell - I might even turn a nice little profit on the side. Reality check: if your credit card details are visible to a third party - you're not anonymous. Note: I don't actually believe the above to actually be the case in reality - but one must remember that stuff like Room 641A weren't that long ago (http://en.wikipedia.org/wiki/Room_641A http://en.wikipedia.org/wiki/Room_641A). This is an example of where worst case thinking, despite its negative reputation, can help protect oneself from falling prey to the faulty assumptions that bring down complex systems (Will the generators kick in on time? What if the VPN provider is already compromised? Did we double check that after cleaning the safety valves - we didn't block any of them?).

jacquesm 14y ago
I'd set up a forum where I'd review these things to make sure that new entrants to the game would flock to my bugged services. I'd give articles there titles that suggest that the competition does not take your privacy seriously.
- benologist 14y ago
  Why use a forum? It'd be much easier to just set up a blog and anonymously write heavily baited articles for other site's communities.
- antihero 14y ago
  I'd write an article on TorrentFreak and post it on Hacker News...
Zirro 14y ago
"If I were a governmental entity..." In that case, you would be a governmental entity which does not care much for the rights of your citizens. Instead, pick a service in a country with a transparent, low corruption-government. I suggest the Scandinavian countries.
- rahimnathwani 14y ago
  The legal jurisdiction and/or technical location of the service might be a country with a transparent government, but how would you know that the service isn't owned or operated by a government entity from some other country?
- Xylakant 14y ago
  Why can't any interested entity set up a company in the Scandinavian states? So how would that really help?
  - PeterisP 14y ago
    In order to be safe from unreasonable government "requests", it is not enough to set up a limited liability company located in a 'safe' country - you need to have everything (including yourself) in 'safe' countries. As a blunt example, if you want to properly run a data-sensitive company and be imune to (for example) USA requests to violate anonymity of your customers, you need to ensure at least the following: (a) the company itself is beyond reach of USA - as in examples of UK, Sweden and others caving in to USA requests for things that would/should be legal in these countries but illegal in USA; (b) you and any personell are beyond reach of USA - again, there are examples such as Kim Dotcom, McKinnon, Assange; (c) the company internet resources are beyond reach of USA - examples such as revoking DNS names of spanish companies for transmitting internet-TV in compliance with spanish laws, or some of Mega's non-US domain names revoked before even starting operations; (d) the company money flow is beyond reach of USA - examples of Visa&Mastercard or Paypal blocking payments to sources such as Wikileaks or, IIRC, distributors of (locally legal) console modchips.
- tjoff 14y ago
  No government understands IT the slightest, because of that I don't know of a single governmental entity that cares the slightest of the rights of its citizens when it comes to computer and internet stuff. They don't even understand it so how can they be respectful of it? As a Swede, I certainly wouldn't trust the Scandinavian countries for this. It's not uncommon to hear politicians claim that internet anonymity and encryption altogether should be completely abandoned. Also, ISPs typically have numerous laws that forbid eavesdropping, VPNs don't. And seeing as how the government can always ask to get any information they want from any VPN provider (and that the VPN provider is, supposedly, legally obligated to keep records of their customers (in many countries, including Sweden)) using a VPN might be the worst thing you could possibly do, if you want anonymity or integrity. I'm guessing that most VPNs in Sweden straight up Lie about this, when this issue was hot a few years ago you either couldn't get a straight answer or you got one that admitted to record keeping - many (including many of those on torrentfreaks list) just stated that they had to, by law, keep records and that they had to hand them over if asked (with a court order). The law hasn't changed what I know, the PR department of VPN providers probably has though... And even if they don't have any records to share, who is to say they can't, by request, eavesdrop on current traffic. For it to have any real effect I'd choose a VPN that is in another country than the one you are in. Although this will probably not have any real effect either if you attract some serious attention, especially considering that unlike an ISP, a VPN provider could legally betray it's customers without an court order (in exchange for being quiet about it).
skriticos2 14y ago
>> Reality check: if your credit card details are visible to a third party - you're not anonymous. I totally agree. Luckily more and more VPN providers accept Bitcoin payment, so that problem is solved (if you don't connect your wallet to your ID, that is) [1]. I think the more challenging part is not sending personally identifiable information through your VPN or encrypt it properly. Much of the Web is architected to identify you based on the most mundane technical information, like your browser string, cookies, the way you type or those little data leeks that happen here and there. [1] http://www.bestvpnservice.com/blog/vpn-providers-with-bitcoins/ http://www.bestvpnservice.com/blog/vpn-providers-with-bitcoi... ps. No, I don't use a VPN. But I like to stay informed.
- tjoff 14y ago
  >> (if you don't connect your wallet to your ID, that is) Which is not easy. Either you have to mine your bitcoins or you have to trust a third party to exchange your bitcoins in order to disconnect the transaction history from you. But you do have to trust that third party. Those are the only solutions that I know of.
  - skriticos2 14y ago
    Well, you could just by them on the street with paper money [1]. Or you could use one of the shuffling services around [2]. [1] https://localbitcoins.com/ https://localbitcoins.com/ [2] https://www.google.com/#hl=en&q=bitcoin+laundry https://www.google.com/#hl=en&q=bitcoin+laundry
    - tjoff 14y ago
      Both requiring you to trust a third party.
      - chaostheory 14y ago
        Almost everything in modern society, especially most things related to technology, requires trusting a 3rd party at one point or another.
lenazegher 14y ago
>Reality check: if your credit card details are visible to a third party - you're not anonymous. In the UK and US, it's easy to buy pre-paid credit cards with cash.
- deleted 14y ago
  [deleted]
- alive-or-not 14y ago
  Most shops have CCTV, systems like TrapWire can automatically link your identity to the credit card.
  - jliptzin 14y ago
    Only buy them on halloween?
sfx 14y ago
It's worse than Room 641A. All US communications are currently being mined and stored by our gov. (http://en.wikipedia.org/wiki/Utah_Data_Center http://en.wikipedia.org/wiki/Utah_Data_Center) I'm not really sure how much good a VPN will do with this much surveillance. I feel it's only going to get worse. CCTVs feeding into said datacenters? Web, traffic, and dash cams? As long as the common man "has nothing to hide" they don't seem to care.
- GoodIntentions 14y ago
  http://en.wikiquote.org/wiki/Cardinal_Richelieu http://en.wikiquote.org/wiki/Cardinal_Richelieu
mikeratcliffe 14y ago
That would be entrapment.
- otterley 14y ago
  That's an interesting legal conclusion. Can you cite any cases that support this assertion?
kmkemp 14y ago
Being a customer to a VPN service isn't a crime. Why are people paranoid about paying for a legal service?
- chc 14y ago
  I can't tell if you're being obtuse or naive, but the implication here is that you're going to use them to less-than-legal ends. The link at the beginning of the article is to a guy facing 15 years for hacking Sony. For another example that would be familiar to readers of the OP site, many US ISPs are now inspecting their customers' traffic to look out for media piracy, and a VPN is the obvious way to circumvent that.
  - kmkemp 14y ago
    No, I'm being completely serious. VPN's are a legitimate service with legitimate uses. Anonymity has merit even if you are 100% legal. I can't imagine someone being convicted of a crime based on only their participation with a VPN service. Sure, you are still trusting a 3rd party to do what it is they say that they will, but I don't see why people care if the government or whoever knows that they use a VPN service. Hell, I use one for work and I don't expect that the government will be knocking on my door because of it.
    - chc 14y ago
      You're arguing with something nobody ever said. The point isn't that using an anonymous VPN is a crime, but that people who use an anonymous/private VPN are more likely to have something to hide, which means you'll find a lot of people committing crime there.
      - kmkemp 14y ago
        There is ample discussion on this page regarding the anonymous subscription option of bitcoins. The post I responded to claims: "Reality check: if your credit card details are visible to a third party - you're not anonymous." But that's missing the point since keeping the users' activity anonymous is what matters... not that they are customers.
frio 14y ago
> Reality check: if your credit card details are visible to a third party - you're not anonymous. After attending a local security conference last year (Kiwicon), I briefly tried to see how anonymous I could make myself online. In NZ, we're lucky to have anonymous prepaid credit cards -- "Prezzy Cards" -- which our postal service sells. Turns out that several VPN services (I ended up using hidemyass.com) will accept them. Alongside an anonymous mail service for the actual account, it's pretty straightforward to head to an internet cafe, boot your laptop into something like Tails, and then create a completely anonymous VPN connection. Not that I'd personally go to that extent, but it's nice to know that you can achieve a reasonable degree of anonymity online.
- joshschreuder 14y ago
  I'm not sure how viable it would be in NZ, but in the strip search prank call case (as seen recently in the film Compliance), the perpetrator bought calling cards from a couple of Walmarts. They were able to trace the serial number of the card back to the stores, and comparing video from both, found the guy on film walking out of both stores. So even these prepaid credit cards might not be completely infallible. More information here: http://en.wikipedia.org/wiki/Strip_search_prank_call_scam#Investigation_and_criminal_trial http://en.wikipedia.org/wiki/Strip_search_prank_call_scam#In...
  - frio 14y ago
    For sure -- the physical aspect is definitely something worth mitigating too (in both the case of the Prezzy Card store, and the Net Cafes having video). If I was going full paranoid, I'd probably find some way of altering my appearance too -- but that seemed like it involved overly much effort at the time :). I was just surprised that, with a little effort, it wasn't actually that hard to gain a markedly greater degree of anonyminity than you'd usually have.

jacquesm 14y ago

I'd set up a forum where I'd review these things to make sure that new entrants to the game would flock to my bugged services. I'd give articles there titles that suggest that the competition does not take your privacy seriously.

benologist 14y ago
Why use a forum? It'd be much easier to just set up a blog and anonymously write heavily baited articles for other site's communities.
antihero 14y ago
I'd write an article on TorrentFreak and post it on Hacker News...

Zirro 14y ago

"If I were a governmental entity..." In that case, you would be a governmental entity which does not care much for the rights of your citizens. Instead, pick a service in a country with a transparent, low corruption-government. I suggest the Scandinavian countries.

rahimnathwani 14y ago
The legal jurisdiction and/or technical location of the service might be a country with a transparent government, but how would you know that the service isn't owned or operated by a government entity from some other country?
Xylakant 14y ago
Why can't any interested entity set up a company in the Scandinavian states? So how would that really help?
- PeterisP 14y ago
  In order to be safe from unreasonable government "requests", it is not enough to set up a limited liability company located in a 'safe' country - you need to have everything (including yourself) in 'safe' countries. As a blunt example, if you want to properly run a data-sensitive company and be imune to (for example) USA requests to violate anonymity of your customers, you need to ensure at least the following: (a) the company itself is beyond reach of USA - as in examples of UK, Sweden and others caving in to USA requests for things that would/should be legal in these countries but illegal in USA; (b) you and any personell are beyond reach of USA - again, there are examples such as Kim Dotcom, McKinnon, Assange; (c) the company internet resources are beyond reach of USA - examples such as revoking DNS names of spanish companies for transmitting internet-TV in compliance with spanish laws, or some of Mega's non-US domain names revoked before even starting operations; (d) the company money flow is beyond reach of USA - examples of Visa&Mastercard or Paypal blocking payments to sources such as Wikileaks or, IIRC, distributors of (locally legal) console modchips.
tjoff 14y ago
No government understands IT the slightest, because of that I don't know of a single governmental entity that cares the slightest of the rights of its citizens when it comes to computer and internet stuff. They don't even understand it so how can they be respectful of it? As a Swede, I certainly wouldn't trust the Scandinavian countries for this. It's not uncommon to hear politicians claim that internet anonymity and encryption altogether should be completely abandoned. Also, ISPs typically have numerous laws that forbid eavesdropping, VPNs don't. And seeing as how the government can always ask to get any information they want from any VPN provider (and that the VPN provider is, supposedly, legally obligated to keep records of their customers (in many countries, including Sweden)) using a VPN might be the worst thing you could possibly do, if you want anonymity or integrity. I'm guessing that most VPNs in Sweden straight up Lie about this, when this issue was hot a few years ago you either couldn't get a straight answer or you got one that admitted to record keeping - many (including many of those on torrentfreaks list) just stated that they had to, by law, keep records and that they had to hand them over if asked (with a court order). The law hasn't changed what I know, the PR department of VPN providers probably has though... And even if they don't have any records to share, who is to say they can't, by request, eavesdrop on current traffic. For it to have any real effect I'd choose a VPN that is in another country than the one you are in. Although this will probably not have any real effect either if you attract some serious attention, especially considering that unlike an ISP, a VPN provider could legally betray it's customers without an court order (in exchange for being quiet about it).

skriticos2 14y ago

>> Reality check: if your credit card details are visible to a third party - you're not anonymous. I totally agree. Luckily more and more VPN providers accept Bitcoin payment, so that problem is solved (if you don't connect your wallet to your ID, that is) [1]. I think the more challenging part is not sending personally identifiable information through your VPN or encrypt it properly. Much of the Web is architected to identify you based on the most mundane technical information, like your browser string, cookies, the way you type or those little data leeks that happen here and there. [1] http://www.bestvpnservice.com/blog/vpn-providers-with-bitcoins/ http://www.bestvpnservice.com/blog/vpn-providers-with-bitcoi... ps. No, I don't use a VPN. But I like to stay informed.

tjoff 14y ago
>> (if you don't connect your wallet to your ID, that is) Which is not easy. Either you have to mine your bitcoins or you have to trust a third party to exchange your bitcoins in order to disconnect the transaction history from you. But you do have to trust that third party. Those are the only solutions that I know of.
- skriticos2 14y ago
  Well, you could just by them on the street with paper money [1]. Or you could use one of the shuffling services around [2]. [1] https://localbitcoins.com/ https://localbitcoins.com/ [2] https://www.google.com/#hl=en&q=bitcoin+laundry https://www.google.com/#hl=en&q=bitcoin+laundry
  - tjoff 14y ago
    Both requiring you to trust a third party.
    - chaostheory 14y ago
      Almost everything in modern society, especially most things related to technology, requires trusting a 3rd party at one point or another.

lenazegher 14y ago

>Reality check: if your credit card details are visible to a third party - you're not anonymous. In the UK and US, it's easy to buy pre-paid credit cards with cash.

deleted 14y ago
[deleted]
alive-or-not 14y ago
Most shops have CCTV, systems like TrapWire can automatically link your identity to the credit card.
- jliptzin 14y ago
  Only buy them on halloween?

sfx 14y ago

It's worse than Room 641A. All US communications are currently being mined and stored by our gov. (http://en.wikipedia.org/wiki/Utah_Data_Center http://en.wikipedia.org/wiki/Utah_Data_Center) I'm not really sure how much good a VPN will do with this much surveillance. I feel it's only going to get worse. CCTVs feeding into said datacenters? Web, traffic, and dash cams? As long as the common man "has nothing to hide" they don't seem to care.

GoodIntentions 14y ago
http://en.wikiquote.org/wiki/Cardinal_Richelieu http://en.wikiquote.org/wiki/Cardinal_Richelieu

mikeratcliffe 14y ago

That would be entrapment.

otterley 14y ago
That's an interesting legal conclusion. Can you cite any cases that support this assertion?

kmkemp 14y ago

Being a customer to a VPN service isn't a crime. Why are people paranoid about paying for a legal service?

chc 14y ago
I can't tell if you're being obtuse or naive, but the implication here is that you're going to use them to less-than-legal ends. The link at the beginning of the article is to a guy facing 15 years for hacking Sony. For another example that would be familiar to readers of the OP site, many US ISPs are now inspecting their customers' traffic to look out for media piracy, and a VPN is the obvious way to circumvent that.
- kmkemp 14y ago
  No, I'm being completely serious. VPN's are a legitimate service with legitimate uses. Anonymity has merit even if you are 100% legal. I can't imagine someone being convicted of a crime based on only their participation with a VPN service. Sure, you are still trusting a 3rd party to do what it is they say that they will, but I don't see why people care if the government or whoever knows that they use a VPN service. Hell, I use one for work and I don't expect that the government will be knocking on my door because of it.
  - chc 14y ago
    You're arguing with something nobody ever said. The point isn't that using an anonymous VPN is a crime, but that people who use an anonymous/private VPN are more likely to have something to hide, which means you'll find a lot of people committing crime there.
    - kmkemp 14y ago
      There is ample discussion on this page regarding the anonymous subscription option of bitcoins. The post I responded to claims: "Reality check: if your credit card details are visible to a third party - you're not anonymous." But that's missing the point since keeping the users' activity anonymous is what matters... not that they are customers.

frio 14y ago

> Reality check: if your credit card details are visible to a third party - you're not anonymous. After attending a local security conference last year (Kiwicon), I briefly tried to see how anonymous I could make myself online. In NZ, we're lucky to have anonymous prepaid credit cards -- "Prezzy Cards" -- which our postal service sells. Turns out that several VPN services (I ended up using hidemyass.com) will accept them. Alongside an anonymous mail service for the actual account, it's pretty straightforward to head to an internet cafe, boot your laptop into something like Tails, and then create a completely anonymous VPN connection. Not that I'd personally go to that extent, but it's nice to know that you can achieve a reasonable degree of anonymity online.

joshschreuder 14y ago
I'm not sure how viable it would be in NZ, but in the strip search prank call case (as seen recently in the film Compliance), the perpetrator bought calling cards from a couple of Walmarts. They were able to trace the serial number of the card back to the stores, and comparing video from both, found the guy on film walking out of both stores. So even these prepaid credit cards might not be completely infallible. More information here: http://en.wikipedia.org/wiki/Strip_search_prank_call_scam#Investigation_and_criminal_trial http://en.wikipedia.org/wiki/Strip_search_prank_call_scam#In...
- frio 14y ago
  For sure -- the physical aspect is definitely something worth mitigating too (in both the case of the Prezzy Card store, and the Net Cafes having video). If I was going full paranoid, I'd probably find some way of altering my appearance too -- but that seemed like it involved overly much effort at the time :). I was just surprised that, with a little effort, it wasn't actually that hard to gain a markedly greater degree of anonyminity than you'd usually have.