When does the "ISPs selling your data" begin, and is a VPN without logging all that's needed?
Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
1–10 of 28 posts
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#2There are no clear answers; all the info about this is a bit fuzzy because there's no requirement for ISPs to disclose past or current activities surrounding their selling of data.
The bill was actually enacted to prevent privacy rules which hadn't even gone into effect yet, which means that technically, ISPs would have already been able to sell such data. However, the consensus seems to be that ISPs were only selling "anonymized" data, and this move will embolden them to push further into invasive practices.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#3Wherever you VPN to, your connection still comes out somewhere. If that happens to be in the US, datacenters still have ISPs. If you're visiting a site hosted in the US, that's on some ISP too. Basically, if Level3, CenturyLink, and Verizon decide that they want to collect and sell profiles based on browsing profiles, there's not a way around it. It'd be easier to build a profile on a direct subscriber (e.g. Comcast profile on a subscriber of theirs) but installing OpenVPN on a DO droplet won't magically save you from this if you're in the US.
Will they actually do it? Well, can they make money from it? Do you trust Comcast to be a good steward of your privacy in the absence of a legal requirement to do so? Comcast did a hard pull on my credit when switching my account to a new address because they were too incompetent to update it and ended up creating a second account as a new customer for me. Comcast is my only option of ISP, as it is for many many other apartment dwellers and many single-family homes as well.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#4Answering the question of choosing a VPN is complex and varies by what's important to you. Like with security, there are few black and white answers.
The VPN comparison chart [1] is the best reference I've seen on the dozens of factors one might care about.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#5VPNs aren't really private. They can see everything that an ISP could see if you weren't using one. It's just a level of indirection.
I trust ISP companies more than I trust VPN companies because ISP companies are in the USA and are much larger (so engage in less risky behavior), so they at least have to sell data in aggregate and scrub PII
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#6There are a large number of VPNs, commercial or otherwise, that someone can use. Where I live, I have a very small number of ISPs to choose from and they would all have my billing information if I used them. Some of the VPNs offer connections in other countries, and some of them claim not to log. The VPN's ISP would see my data move around, but wouldn't have my billing information. The VPN would, but if it's commercial I can likely sue them if they do something egregious with it.
In my opinion, VPNs help more than hurt privacy, assuming you choose a reputable one to use.
If a person wants anonymity, then go for Tor or Freenet.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#7Wherever you VPN to, your connection still comes out somewhere. If that happens to be in the US, datacenters still have ISPs. If you're visiting a site hosted in the US, that's on some ISP too. Basically, if Level3, CenturyLink, and Verizon decide that they want to collect and sell profiles based on browsing profiles, there's not a way around it. It'd be easier to build a profile on a direct subscriber (e.g. Comcast…
There is not much useful data to gleaned from an encrypted VPN connection. If you're referring to the ISPs monitoring what the VPN proxies for you that data would be useless as well since it would be the aggregate over everyone using the VPN. It wouldn't be possible to build browsing profiles if every request originates from the VPNs IP address.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#8There are no clear answers; all the info about this is a bit fuzzy because there's no requirement for ISPs to disclose past or current activities surrounding their selling of data. The bill was actually enacted to prevent privacy rules which hadn't even gone into effect yet, which means that technically, ISPs would have already been able to sell such data. However, the consensus seems to be that ISPs were only sellin…
Yea great point. A lot of headlines are portraying this as a sudden new practice rather than an attempt to formalize the rules governing existing practices.
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#9You could always setup your own VPN on a VPS with
Re: Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?
#10IMHO the ideal situation to selectively play along. A router running Linux/BSD which can be configured have regular, VPN and Tor route is the ideal situation to avoid scrutiny from third parties.
Connections to Facebook, Google, Amazon, etc. should go un-tunneled. It's good to feed the beast with data it already owns anyway.
Connection to porn websites (say by your 16-year-old cousin who came to stay at your place for the weekend) and other ethically debatable content should be routed via Tor. Connections to torrents should be routed via VPN[1].
I understand that some people here prefer their personal VPN against a VPN provider like TorGuard, etc. There's no good and poor solution here, everything depends on the use case. A VPN provider will be handling thousands of encrypted connections and gives you a dozen exit nodes. From each exit node thousands of different connections are routed. It's way harder to target and isolate a user, even for a medium state-level actor.
Conversely, if you route all your connections from, say a DO droplet, you're controlling the droplet, but you have one exit point for all your connections... It's extremely easy to target your connections for a state level actor.
Of course there are thousands of schemes one can choose. Everything depends on the use case.