2 ms·

>(you undoubtedly had to pay for that VPN with a legal name and payment information.) I used Bytesized-Hosting, which allows you to pay for their VPS with bitc

>(you undoubtedly had to pay for that VPN with a legal name and payment information.) I used Bytesized-Hosting, which allows you to pay for their VPS with bitcoins. I only had to provide a username, password, and a junk email address. AirVPN, among other VPN providers, also allow you to pay with Bitcoins, which can be anonymized over TOR for that particular transaction. I am not sure how much it helps protect the conifdentiality of the user, but many VPNs also claim to delete their OpenVPN logs immediately after a session has ceased. Though, I suppose if a three letter agency wanted dirt on someone, this policy would be easy enough to circumvent.

ckozlowski 13y ago
That is possible, yes. Not many VPN services do that, but as Sanddancer pointed out, there are ways. However, for most, it's an inconvenience that presents a barrier to entry. (Judgements aside.) As for logs, it would be great to believe that they would be true to their word. However, that requires placing trust in the service provider. While I would give the benefit of the doubt in that most probably are true to their policy, I wouldn't want the weak link in my security chain to be the faith that my VPN provider isn't logging. Regardless, since they are hosting the connection, they can discern the user. The capability exists, even if they promise not to use it. Removing the capability eliminates this source of worry. Going back to the original post and kishor's comment, he/she highlights the point that regarding the technical solutions available, there's a range between having the most security solution, and the fastest and most convenient. Tor, VPN+anonymized payment and other methods will provide a greater degree of protection than say, using your credit card to simply buy a VPN. At the end of the day, one needs to assess their security requirements against the degree of inconvenience they're willing to endure. Are they at risk of a nation-state ruthlessly pursuing them by any means? If so, then every protection is needed. If it just needs to be made difficult enough to protect against a cursory inspection, then a VPN might suffice. As with all security discussions, The likelihood and potential impact of the threat determines the degree of mitigations one needs.

ckozlowski 13y ago

That is possible, yes. Not many VPN services do that, but as Sanddancer pointed out, there are ways. However, for most, it's an inconvenience that presents a barrier to entry. (Judgements aside.) As for logs, it would be great to believe that they would be true to their word. However, that requires placing trust in the service provider. While I would give the benefit of the doubt in that most probably are true to their policy, I wouldn't want the weak link in my security chain to be the faith that my VPN provider isn't logging. Regardless, since they are hosting the connection, they can discern the user. The capability exists, even if they promise not to use it. Removing the capability eliminates this source of worry. Going back to the original post and kishor's comment, he/she highlights the point that regarding the technical solutions available, there's a range between having the most security solution, and the fastest and most convenient. Tor, VPN+anonymized payment and other methods will provide a greater degree of protection than say, using your credit card to simply buy a VPN. At the end of the day, one needs to assess their security requirements against the degree of inconvenience they're willing to endure. Are they at risk of a nation-state ruthlessly pursuing them by any means? If so, then every protection is needed. If it just needs to be made difficult enough to protect against a cursory inspection, then a VPN might suffice. As with all security discussions, The likelihood and potential impact of the threat determines the degree of mitigations one needs.