I rotate between ProtonVPN, self-hosted streisand instances.
Ask HN: What VPN service are you currently using?
301–310 of 344 posts
Re: Ask HN: What VPN service are you currently using?
#302Earlier quoted context omitted.
I have 1GB fiber, do they offer 1GB speeds? How badly would using them as my VPN affect my speed?
If you have 1GB, then forget anything OpenVPN. Use IPSec or Wireguard. With OpenVPN you will bottleneck at ~300Mbit\s. With IPSec and Wireguard I have had no issues getting ~900Mbit\s to my own server.
Do you have any recommendations for wireguard providers? I'd love to try it out, but I don't want to host my own server.
Re: Ask HN: What VPN service are you currently using?
#303Earlier quoted context omitted.
> woefully unparallelisable It certainly doesn't use multiple cores for a single connection, though I've never tested (or reviewed the code) to see if it does manage to spread the computational load of multiple connections over more CPU resource. I've not read the above linked article in detail (no time ATM) but there seems to be mention of offloading AES calculations to compatible hardware, so the bottleneck would a…
Does using multiple cores on a single NIC actually speed up a network connection? If you're doing gigabit with 1500 byte packets, you get 12 ms to encrypt and process each packet -- I'd expect any cross-CPU synchronization to easily blow through that.
If the bottleneck is encryption speed, then you can definitely improve perf by spreading packets across the cores. Inter-core synch isn’t that expensive, and 12us is 24000 cycles on a 2GHz CPU. cmpxchg costs ~20 cycles (https://stackoverflow.com/questions/4187914/average-latency-...).
PS. And you don’t need to submit/receive packets to NIC one by one, either; those things support DMA scatter/gather.
Re: Ask HN: What VPN service are you currently using?
#304Earlier quoted context omitted.
Does using multiple cores on a single NIC actually speed up a network connection? If you're doing gigabit with 1500 byte packets, you get 12 ms to encrypt and process each packet -- I'd expect any cross-CPU synchronization to easily blow through that.
If the bottleneck is encryption speed, then you can definitely improve perf by spreading packets across the cores. Inter-core synch isn’t that expensive, and 12us is 24000 cycles on a 2GHz CPU. cmpxchg costs ~20 cycles ( https://stackoverflow.com/questions/4187914/average-latency-... ). PS. And you don’t need to submit/receive packets to NIC one by one, either; those things support DMA scatter/gather.
That's a really helpful response; thanks!
Re: Ask HN: What VPN service are you currently using?
#305Everyone has an ISP – even the VPN and VPS providers and the websites you visit – have ISPs. Most governments regulate their ISPs to monitor and censor.
To comply with these regulations, ISPs deploy appliance/boxes that can do packet inspection and blocking. It used to be IP blocking and DNS blocking.
As silicon became faster, these boxes have become more powerful. They can operate at multiple 100Gbps+ packet header scale and not just L3/L4, but also L7 packet headers (a.k.a deep packet inspection). Both of my ISPs (home and mobile) do this.
These same appliance companies sell data monetisation solutions to collect and sell metadata – usually done indirectly by a sister entity.
These boxes can also inject ads directly into plain http pages and manipulate DNS responses to do the same nefarious thing. In fact this clickjacking injection is the thing that turned me towards VPNs.
While the VPN solves the clickjacking injection problem, I’m fully aware of the fact that my VPS provider’s ISP maybe logging and selling all the metadata.
Even with https or TLS connections the domain name is revealed in plain text during connection setup. ESNI solves this problem, but no browser supports it by default yet. Other metadata collected usually includes – time, location, connection protocol fingerprinting to uniquely identify devices (TV, phones, laptops etc) behind customer IP address, frequency of access, bytes transferred per connection etc.
The real danger is this – as adtech evolves the lines are blurred between plain advertisement vs personalised experiences and targeted digital brainwashing. Election manipulations, shifting the sentiments (distributed lobbying) in favor of desired outcomes, addictive spending - these become just natural evolution/extensions of this ad tech. With ISPs data mining and selling to invisible companies we won't be cognizant of this manipulation.
Re: Ask HN: What VPN service are you currently using?
#306Everyone has an ISP – even the VPN and VPS providers and the websites you visit – have ISPs. Most governments regulate their ISPs to monitor and censor. To comply with these regulations, ISPs deploy appliance/boxes that can do packet inspection and blocking. It used to be IP blocking and DNS blocking. As silicon became faster, these boxes have become more powerful. They can operate at multiple 100Gbps+ packet header…
DNS over HTTPS would help
Re: Ask HN: What VPN service are you currently using?
#307iVPN, and rather happy with it so far. WireGuard support, and good apps for iOS.
Re: Ask HN: What VPN service are you currently using?
#308Earlier quoted context omitted.
>No, but.... The above error was from my office So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. This is what the browser is messaging. Notifying you that "something is wrong with the connection. Browser is not sure what exactly, thus pointing the finger on the certificate. Perhaps…
>So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. Yup, typically referred to as "SSL Inspection" by the companies that produce products to monitor SSL traffic. Normally this is accompanied by controlling the clients and pushing a cert into their browser to avoid the warning message…
Yikes. I think I like to see the browser warning.
Re: Ask HN: What VPN service are you currently using?
#309Earlier quoted context omitted.
100% this. VPN marketing appears to have really gotten to people, everyone's always asking about it. Real reasons I can see to use a VPN service 1) You want your traffic to reliably egress in that country. i.e. I live in New Zealand but to access some Australian TV on demand, I need to "appear" in Australia. 2) Errr, I can't think of any others. If you are really trying to hide your traffic from your ISP: 1) Change I…
For some of us, we live in jurisdictions where all ISPs are legally required to keep all metadata for all connections. (In tinpot pseudo democracies with governments who fail to understand technology but pass intrusive laws governing it anyway, then declare "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.") In that case, a few bucks per month is a pret…
Did you just describe Australia as a ‘tinpot pseudo democracy’?
Not that this is a high point in Australian politics with the game of musical chairs that is going on. I’ve just never heard someone living there be so down on it.
Re: Ask HN: What VPN service are you currently using?
#310Earlier quoted context omitted.
I have 1GB fiber, do they offer 1GB speeds? How badly would using them as my VPN affect my speed?
IPsec at 1gbps needs a powerful router. A Juniper SRX 320 that I have can only can reach about 500mbps.
Oh man, I've been wanting to pick one of those routers up for some time. What did licensing cost you for your SRX 320?