Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

101–110 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#101

Post by y4mi »

sigjuice wrote: post #82
blacksmith_tb wrote: post #30

Earlier quoted context omitted.

I agree overall, but PIA has may not be the best example, as they have been shown to not keep any data that could be subpoenaed[1]. One nice thing about running your own (if your client machine is on Linux) is being able to use Wireguard[2], which is quite a bit faster than OpenVPN, for example. 1: https://torrentfreak.com/vpn-providers-no-logging-claims-tes... 2: https://www.wireguard.io/performance/

Never heard of Wireguard before, but it looks really cool, especially the mosh-like roaming. However, I found this warning on their website. WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change.

its also versioned with a double zero: v0.0.20170517 and the repositories are marked unstable.

also, the protocol itself is still considered 'version 0' with lots of possible changes on their website.

looking forward to it maturing though.

Re: How to build your own VPN if you're wary of commercial options

#102

Post by zurn »

masmullin wrote: post #22
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

It's easy for anyone who can do traffic analysis on your traffic, eg your ISP and mass surveillance perpetrators. And whoever your ISP decides to sell or give this data to.

Re: How to build your own VPN if you're wary of commercial options

#103

Post by milankragujevic »

masmullin wrote: post #22
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

FYI MPAA can and will go after you even for a small site with 100 of visitors daily. They went after me, tried to sue me, got my servers shut down and sent lots of scary emails to my personal email.

Re: How to build your own VPN if you're wary of commercial options

#104

Post by 7ewis »

rbritton wrote: post #24

I operate my own VPN endpoint for a couple reasons: 1. I frequently need to connect via open, untrusted local networks, such as those at hotels. 2. Many commercial VPNs (e.g., PIA) end up having some portion of their endpoint IPs end up on blacklists and break a lot of sites. Anonymity from the government is a lower priority than both of the above, and I acknowledge the lack of it in my risk model. Initially I starte…

What was wrong with Streisand?

That's why I have been using and recommending for a while, I've not had any speed issues. Currently running it on a t2.micro in AWS.

Re: How to build your own VPN if you're wary of commercial options

#105

Post by super-io »

super-io wrote: post #77

"First your website uses SNI..." s/uses/may use/ Not every website uses SNI. For example, the majority of sites linked to from HN do not use SNI. Also, there are workarounds when SNI is not supported. Workarounds have been published by one major corporation who authors a popular web server software and runs a cloud hosting service. Is SNI "the only way to do it"? No. There is another way to do stream encryption for m…

Correction: The above draft was not the one I was thinking of. Here it is:

http://www.ietf.org/archive/id/draft-luotonen-ssl-tunneling-...

Re: How to build your own VPN if you're wary of commercial options

#107

Post by drdaeman »

drdaeman wrote: post #70
drewg123 wrote: post #63

Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers. Is there something about OpenVPN that doesn't support GCM?

AFAIK OpenVPN officially has GCM mode support since v2.4, which is relatively recent (official release December 2016). I'm sure it was also present in 2.3.x - at the very least I'm certain that 2.3.10 I have on one host supports TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 - but it could be distro-specific backports or something like that. At least 2.3 changelogs don't mention anything about AEAD or GCM specifically, and GCM…

Update: no I was wrong. OpenVPN v2.3.x has two connections, a control channel and data channel. That TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 (defined by `tls-cipher` setting) is a control channel, and data channel doesn't support GCM.

Anyway, 2.4 is out already.

Re: How to build your own VPN if you're wary of commercial options

#108

Post by Feld0 »

closeparen wrote: post #28
masmullin wrote: post #22

Earlier quoted context omitted.

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

The MPAA will serve an automated DMCA notice to your VPS provider, who will terminate your account at the very least.

Not all hosts are US-based, though; some hosts in other countries prefer to get a court order in their own jurisdiction before taking action against a customer.

Re: How to build your own VPN if you're wary of commercial options

#109

Post by intopieces »

A lot of the focus of VPN discussion centers around logging, and around whether their provider is prepared to hole themselves up in their compounds like Branch Davidians to protect their info.

That misses the point. If the government wants to hack you, steal your traffic, etc, they can, VPN or not, 'no-log' VPN or not.

The point behind consumer-level VPNs is more to prevent the ISP-level tracking, the ad-targeting, etc, and to keep out hackers and get around government/institution blockers. For this, whatever well-reviewed service will do.

Re: How to build your own VPN if you're wary of commercial options

#110

Post by justinclift »

KingMob wrote: post #34
TACIXAT wrote: post #4

Alternatively, just use Algo. [1] It's a self-hosted, hardened IPSEC VPN that automates setup on multiple cloud providers. 1. https://github.com/trailofbits/algo

Algo is great! For anybody who wants steps on setting it up with an unsupported provider, I wrote a blog post on exactly that recently: http://modulolotus.net/posts/2016-03-28-setting-up-algo/ . I used Vultr, but it should help for any Ubuntu-based server.

Is the "2016" date in your blog post & URL correct? Seems off by a year.
Post reply on HN