Center for Democracy and Technology Launches VPN Trustworthiness Initiative

Mainstream IP/identity anonymization should be something we're striving for online, both for site visitors and site operators.

Tor is the only project I know of (please comment if you know about others) that removes needing to trust someone from the equation. But Tor is slow and doesn't have many secondary benefits that make it worthwhile to recommend to someone who doesn't care about privacy.

VPNs require trusting a third party, so obviously they aren't great for someone like Snowden. But at least I'm trusting someone I chose instead of being forced to trust Verizon or Comcast. And at least the speeds are good enough to use it for everything, even normal browsing, without feeling guilty that I'm stealing bandwidth from journalists. And at least there are enough benefits that I can recommend VPNs to non-privacy conscious friends and family members.

I dunno. I view this as an unsolved problem. I have no idea how to solve it. But I'm very interested in seeing it solved. I'm glad that Tor exists, but I still don't feel like I could stick it on a router and send literally all of my traffic through it without significant downsides. Certainly I don't think I could install it on my parent's router.

Am I being overly critical? Have things improved, or are there any promising efforts to improve them? I can't even imagine what a technical solution would be that wouldn't rely on bouncing traffic around a bunch of nodes (which doesn't seem to scale well) or aggregating everyone's traffic under a central authority (which is admittedly fragile).

In the meantime I'm using a VPN because it's better than trusting Verizon.

I was talking about commercial, third party services. Roll your own can work better. Tor might be the best option, depending on your adversary: As I understand these things, it works well against corporate tracking and against getting swept up in government mass surveillance; but if you have something in particular to hide from an oppressive government, it may attract attention.

Using commercial VPN services, all you do is shift your Internet gateway from your ISP to your VPN service provider; it's not clear which one is better. They also are honeypots: All someone needs to do is compromise the VPN provider and they have everyone's confidential data. Many VPN providers (almost all of whom, I'd guess) have poor security practices - security is expensive; consider how much security your monthly fee buys. It's just a juicy, high-ROI target.

The creator of Algo, an automated roll-your-own VPN, knows much more more than I do; this is worth reading IMHO:

https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...

All that said, I think you do have a point. I'd try Tor, though.

I use streisand and I love it. Easy setup, lots of options, and most importantly, I don’t have to trust a VPN provider. I do have to trust my cloud provider. But it’s encrypted and, to my knowledge, pretty much opaque to them.

Either way my primary motivation is to obscure my traffic from unscrupulous data traffickers.

And tor is also an option, although I won’t use it.