5 ms·

I'm not sure how this is at all relevant to the NSA spying - the NSA are gathering details from content providers (like Facebook, Google, Skype), so if you use

I'm not sure how this is at all relevant to the NSA spying - the NSA are gathering details from content providers (like Facebook, Google, Skype), so if you use the VPN to access any of them you are still at risk, or if you communicate using with anyone using one of those services.

rdl 13y ago
It's not the whole solution, but the vast majority of NSA spying is passive "over the wire" stuff. We know they do that, pervasively, and even more, we know foreign countries do that (and filtering, and in some cases lots of fun tampering) on connections (e.g. Great Firewall of China). NSA has been doing passive intercept since inception in the 1940s. PRISM is somewhat ambiguous -- maybe it's a huge secret program where they get blanket access to big sites directly, maybe it's just a UI layer for managing subpoena or warrant results. Protecting your metadata is one thing where a VPN works pretty well. There are still some more advanced attacks (looking at the encrypted traffic flows on lightly loaded links, you can infer what site/activity one is doing, even without decrypting, unless you pad all communications).
- tlrobinson 13y ago
  If the NSA is actually doing widespread monitoring/collection of backbone traffic will a VPN actually help at all? End-to-end encryption seems like right solution. EDIT: nevermind, VPNs do offer obfuscation of "metadata", i.e. your IP address, which I guess is what you were saying. I wonder if you could create a VPN/Tor-like network that automatically picks "exit nodes" closest to the destination to avoid taps... (or even better, avoiding known tapped routes)
  - rdl 13y ago
    We actually do some pretty interesting internal routing for that, but only have 4 geo locations so far. Adding more, and adding some "unique" security features in the future, but wanted to get something out there now. Doing "cross border" that way is probably the most meaningful, assuming many countries set up their monitoring on international links. Being aggregated inside a VPN service helps a lot there. End to end is mostly the right solution, but I'd like to see message/object based encryption (conf and signing) rather than just transport encryption, too. (other metadata includes DNS resolution, and of course all the other protocols and things which aren't encrypted -- it's not JUST an issue of hiding your IP)
    - tlrobinson 13y ago
      So it's possible different hosts will see different IPs for me depending on where they are in the network relative to your locations?
      - bifrost 13y ago
        Yep! Ideally you don't want to use different IPs while visiting the same site because they'll likely block your account, but for sites on different sides of the globe, this is going to happen.
  - bifrost 13y ago
    > I wonder if you could create a VPN/Tor-like network that automatically picks "exit nodes" Yes, we do that. We have some internal traffic balancing and mixing, we will probably put more detail to that before the end of the year. We are looking at the options for VPN-to-Tor as well, however there are some performance challenges to overcome.
prayag 13y ago
It's not clear that this is what's happening. Especially since the companies have vehemently denied such allegations.

rdl 13y ago

It's not the whole solution, but the vast majority of NSA spying is passive "over the wire" stuff. We know they do that, pervasively, and even more, we know foreign countries do that (and filtering, and in some cases lots of fun tampering) on connections (e.g. Great Firewall of China). NSA has been doing passive intercept since inception in the 1940s. PRISM is somewhat ambiguous -- maybe it's a huge secret program where they get blanket access to big sites directly, maybe it's just a UI layer for managing subpoena or warrant results. Protecting your metadata is one thing where a VPN works pretty well. There are still some more advanced attacks (looking at the encrypted traffic flows on lightly loaded links, you can infer what site/activity one is doing, even without decrypting, unless you pad all communications).

tlrobinson 13y ago
If the NSA is actually doing widespread monitoring/collection of backbone traffic will a VPN actually help at all? End-to-end encryption seems like right solution. EDIT: nevermind, VPNs do offer obfuscation of "metadata", i.e. your IP address, which I guess is what you were saying. I wonder if you could create a VPN/Tor-like network that automatically picks "exit nodes" closest to the destination to avoid taps... (or even better, avoiding known tapped routes)
- rdl 13y ago
  We actually do some pretty interesting internal routing for that, but only have 4 geo locations so far. Adding more, and adding some "unique" security features in the future, but wanted to get something out there now. Doing "cross border" that way is probably the most meaningful, assuming many countries set up their monitoring on international links. Being aggregated inside a VPN service helps a lot there. End to end is mostly the right solution, but I'd like to see message/object based encryption (conf and signing) rather than just transport encryption, too. (other metadata includes DNS resolution, and of course all the other protocols and things which aren't encrypted -- it's not JUST an issue of hiding your IP)
  - tlrobinson 13y ago
    So it's possible different hosts will see different IPs for me depending on where they are in the network relative to your locations?
    - bifrost 13y ago
      Yep! Ideally you don't want to use different IPs while visiting the same site because they'll likely block your account, but for sites on different sides of the globe, this is going to happen.
- bifrost 13y ago
  > I wonder if you could create a VPN/Tor-like network that automatically picks "exit nodes" Yes, we do that. We have some internal traffic balancing and mixing, we will probably put more detail to that before the end of the year. We are looking at the options for VPN-to-Tor as well, however there are some performance challenges to overcome.

prayag 13y ago

It's not clear that this is what's happening. Especially since the companies have vehemently denied such allegations.