Live data from Hacker News

Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

stratumsecurity.com

31–40 of 78 posts

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#31
This looks like a great way to get started with EC2, VPN or no. I've been thinking about it, but one thing still puzzles me. You choose an AMI, but does Amazon effectively create an EBS instance for you and populate it with a copy of the AMI?

I don't see any mention of an EBS instance being created, so I'm not quite sure how you can write to the filesystem at all. I'm sure I'm missing something here, but I'm not quite sure what. Thoughts?

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#32
post #5

It's worth noting that the quoted "$0.50 a month" only applies for the first year, after which it will cost $0.02 an hour or ~$15 a month.

You might be able to signup for a new account and get another free year.... if the deal is still on by then.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#33
post #17

What's a good solution for iPhone/iPad over wireless?

iPad has VPN built in, not sure about iPhone.

It's the same: L2TP/IPSec, PPTP, Cisco IPSec.

It's annoying though because it is unable to auto-reconnect to VPN after it locks for a few minutes

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#34

Earlier quoted context omitted.

Seems like a perfect use case for EC2 on demand. Only run the VPN node when you are on an open wireless network and need the VPN security. Shut it down otherwise. That would make it harder to run, but it would greatly reduce the cost. I'd pay $0.02 for an hour's worth of security while stopping off at a coffee shop.

It wouldn't be much harder to run. You can start and stop the instance using the command line tools, so you could easily wrap the whole lot into a script which started the server and brought up the VPN link, then when youre finished take down the link then the server, all in once command. The API-based management is what makes cloud providers really special.

Hopefully these scripts would eventually evolve into a client management panel, making this as easy to the general populace as Firesheep.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#35
post #9

Earlier quoted context omitted.

The amortized cost of a reserved instance is only $7.47 per month.

Only if you choose the 3 year reserved micro instance plan. Both the 1yr and 3yr plans are $0.007 per hour, with different one-time fees: 1yr: $54 one-time fee: $0.007 * 24 * 365 = $61.32 + $54 = $115.32 / 12 = $9.61 per month. 3yr: $82 one-time fee: $0.007 * 24 * 365 = $61.32 * 3yr = $183.96 + $82 = $265.96 / 36 = $7.39 per month. http://aws.amazon.com/ec2/pricing/

Whoops, yes, $7.39. I was taking the prices from memory and remembered the $82 as $85.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#36

This looks like a great way to get started with EC2, VPN or no. I've been thinking about it, but one thing still puzzles me. You choose an AMI, but does Amazon effectively create an EBS instance for you and populate it with a copy of the AMI? I don't see any mention of an EBS instance being created, so I'm not quite sure how you can write to the filesystem at all. I'm sure I'm missing something here, but I'm not quit…

The AMI recommended in the post is pre-configured to use EBS. Makes things a lot easier that way!

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#37
post #17

What's a good solution for iPhone/iPad over wireless?

You can replace the install of openvpn with openswan to provide a strong tunnel that's compatible with iOS. There should be prebuilt packages for ubuntu.

http://www.openswan.org/

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#38
To anyone who desires this level of security but doesn't want to have to go through the trouble of a VPN, using SSH tunnels works just as effectively.

Assuming you have access to a remote Linux/BSD box, you can (from Linux) `ssh -D 1025 remote.host.address` then proxy your browser's SOCKS proxy to localhost:1025.

On Windows, using PuTTY, one can simply go into the Tunnel menu, hit the "Dynamic" radio button, type in 1025 and click "add" to achieve the same effect.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#39

To anyone who desires this level of security but doesn't want to have to go through the trouble of a VPN, using SSH tunnels works just as effectively. Assuming you have access to a remote Linux/BSD box, you can (from Linux) `ssh -D 1025 remote.host.address` then proxy your browser's SOCKS proxy to localhost:1025. On Windows, using PuTTY, one can simply go into the Tunnel menu, hit the "Dynamic" radio button, type in…

SideStep does all of this for you. You can forgo the whole OpenVPN section (Steps 12 through 22) if you just want to use SideStep.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#40
post #20

Earlier quoted context omitted.

Thanks for the explanation! There are a few things I don't understand fully, could you please talk a bit more? “since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall).” I believe on OS X the SOCKS proxy is applied globally, unlike Windows where you have to do per-application settings. So aside from DNS queries, I guess other TCP connections should go throu…

For the purpose of defeating FireSheep, ssd -D works just fine. OpenVPN in the configuration of the blog post utilizes 443/tcp, which is open at most places, while the ports required for PPTP/L2TP/IPSec could be closed.

Worst than just "ports" AFAIK: last I checked PPTP required use of either GRE or its own protocol (I can't remember which)--so not TCP nor UDP, and thus more likely to be blocked or simply NATed incorrectly. I don't recall how L2TP works, but I bet it uses a different IP protocol as well. I'm not sure if it's common to use L2TP unless it's tunneled in IPsec these days. IPsec can run over UDP if configured correctly. (I always encountered the UDP transport in the context of NAT-T which has/had its own set of problems. For example, it used to be the case that many IPsec "servers" had a problem with more than a single NAT-T client behind the same NAT. Not sure if that's still the case as this stuff is no longer my job, thankfully.)
Post reply on HN