Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Easily connect to a VPN in a country of your choice

github.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: Show HN: Easily connect to a VPN in a country of your choice

#51

Post by drvdevd »

mrmondo wrote: post #45
kobayashi wrote: post #21

It's bad enough of an idea to connect to an open/untrusted WiFi network - now we're showing HN how to connect to random VPNs all over the world? My cursory opinion of this is that it's the worst idea ever I've ever seen make HN's front page.

I couldn't agree more, and in JavaScript to top it off! Seriously people - don't just randomly connect to VPNs: you're essentially bridging your computer / network to a completely untrusted network that's more than likely to have all manor of people doing nefarious / dangerous things on it - do you really want to put yourself at risk as well as be associated with them?

I haven't actually looked at the code yet, but to be fair, if your connection through any VPN is completely encrypted (e.g. HTTPS only), then it's not much different to most ISPs...

They can grab metadeta but this is already being done with all the traffic we generate anyway, one should assume.

Re: Show HN: Easily connect to a VPN in a country of your choice

#53

Post by matthewaveryusa »

mrmondo wrote: post #46
dgfgfdagasdfgfa wrote: post #29

Earlier quoted context omitted.

It's only bad if you think it's secure. It's not like a secured wifi is likely to be secure, either.

Most people don't understand whys secure and what's not, remember we live in a society where people generally don't know that connecting to a 'free' wireless network without a password means that all your traffic is completely unencrypted.

Not if you have a VPN, and not https websites. Only unencrypted traffic is unencrypted.

Re: Show HN: Easily connect to a VPN in a country of your choice

#54

Post by neurostimulant »

drvdevd wrote: post #51
mrmondo wrote: post #45

Earlier quoted context omitted.

I couldn't agree more, and in JavaScript to top it off! Seriously people - don't just randomly connect to VPNs: you're essentially bridging your computer / network to a completely untrusted network that's more than likely to have all manor of people doing nefarious / dangerous things on it - do you really want to put yourself at risk as well as be associated with them?

I haven't actually looked at the code yet, but to be fair, if your connection through any VPN is completely encrypted (e.g. HTTPS only), then it's not much different to most ISPs... They can grab metadeta but this is already being done with all the traffic we generate anyway, one should assume.

Aren't VPN networks can specify DNS server the client should use after the connection established? That would allows DNS spoofing and MITM attacks.

Re: Show HN: Easily connect to a VPN in a country of your choice

#55

Post by kijin »

neurostimulant wrote: post #54
drvdevd wrote: post #51

Earlier quoted context omitted.

I haven't actually looked at the code yet, but to be fair, if your connection through any VPN is completely encrypted (e.g. HTTPS only), then it's not much different to most ISPs... They can grab metadeta but this is already being done with all the traffic we generate anyway, one should assume.

Aren't VPN networks can specify DNS server the client should use after the connection established? That would allows DNS spoofing and MITM attacks.

Even with DNS spoofing, you can't MITM an encrypted connection with pinned public keys. That includes Google, GitHub, most social networks, and any SSH host to which you have previously connected.

Almost everything I do while on the move falls into this tamper-proof category. It's been a while since I stopped caring which Wi-Fi I connect to. I just borrow anyone's connection and tunnel right through.

Re: Show HN: Easily connect to a VPN in a country of your choice

#56

Post by stevekemp »

koolba wrote: post #22
kobayashi wrote: post #21

It's bad enough of an idea to connect to an open/untrusted WiFi network - now we're showing HN how to connect to random VPNs all over the world? My cursory opinion of this is that it's the worst idea ever I've ever seen make HN's front page.

> My cursory opinion of this is that it's the worst idea ever I've ever seen make HN's front page. Not disputing that it's the worst but it could be even more worse. It's missing the key component: a curl | bash install and upgrade script running over HTTP (not HTTPS). In this case it'd be extra hilarious as upgrades would presumably go over your existing VPN connection which could then hijack the script and run arbi…

This looks like a node version of the previously submitted go tool `autovpn`, which I commented on previously:

https://news.ycombinator.com/item?id=13454960

This code also writes remote-content to a file, and then passes that to openvpn. Scary stuff.

Re: Show HN: Easily connect to a VPN in a country of your choice

#57

Post by noja »

kijin wrote: post #55
neurostimulant wrote: post #54

Earlier quoted context omitted.

Aren't VPN networks can specify DNS server the client should use after the connection established? That would allows DNS spoofing and MITM attacks.

Even with DNS spoofing, you can't MITM an encrypted connection with pinned public keys. That includes Google, GitHub, most social networks, and any SSH host to which you have previously connected. Almost everything I do while on the move falls into this tamper-proof category. It's been a while since I stopped caring which Wi-Fi I connect to. I just borrow anyone's connection and tunnel right through.

> That includes Google, GitHub, most social networks, that includes Google, GitHub, most social networks,

Nearly all websites do not using pinning.

Re: Show HN: Easily connect to a VPN in a country of your choice

#59

Post by drvdevd »

noja wrote: post #57
kijin wrote: post #55

Earlier quoted context omitted.

Even with DNS spoofing, you can't MITM an encrypted connection with pinned public keys. That includes Google, GitHub, most social networks, and any SSH host to which you have previously connected. Almost everything I do while on the move falls into this tamper-proof category. It's been a while since I stopped caring which Wi-Fi I connect to. I just borrow anyone's connection and tunnel right through.

> That includes Google, GitHub, most social networks, that includes Google, GitHub, most social networks, Nearly all websites do not using pinning.

So you would still need a trusted cert though right for the TLS MITM? And presumably SSH is not affected any more than on the open internet?

Anyway, while these may be valid attack vectors, since I started getting traffic injected by my ISP a few years ago, and DNS hijacked for advertising, my level of trust has dropped to the same as that of some $VPN, wherever, or $WIFI.

But that's just my opinion.

Re: Show HN: Easily connect to a VPN in a country of your choice

#60

Post by dguido »

rahimnathwani wrote: post #44
dguido wrote: post #35

Earlier quoted context omitted.

I already did. Here is how to createa a self-hosted VPN server at a cloud provider of your choice. Don't trust your network traffic to anyone but yourself: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th... https://github.com/trailofbits/algo

Do you have users in China? I'm curious whether IKEv2 works well through GFW. I use Shadowsocks (on my Asus router, and on my Android/iOS devices), and it works well. What would I gain in ease-of-use, performance, or security by switching to Algo?

It won't work. Algo is not for censorship avoidance. It's right up top in the readme. Sorry!
Post reply on HN