Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

stratumsecurity.com

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#41

Post by rmc »

mfringel wrote: post #31

This looks like a great way to get started with EC2, VPN or no. I've been thinking about it, but one thing still puzzles me. You choose an AMI, but does Amazon effectively create an EBS instance for you and populate it with a copy of the AMI? I don't see any mention of an EBS instance being created, so I'm not quite sure how you can write to the filesystem at all. I'm sure I'm missing something here, but I'm not quit…

You don't need an EBS to run an instance on EC2.

You can just run the instance as normal. It has a root filesystem, you can write to it etc. However if you stop the instance, then all your changes are lost. The EBS is only needed if you actually need disk space.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#42

Post by rmc »

chopsueyar wrote: post #21
epo wrote: post #15

Just curious, if you already have decent hosting couldn't you just implement this by installing openvpn on your existing virtual machine (or whatever)? Is there anything which specifically requires EC2?

I guess you just have to be careful of bandwidth overage. Don't use it with Netflix too much.

The same caveat about bandwidth usage applies to EC2. You have to pay (twice in & out) for EC2 traffic.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#43

Post by huhtenberg »

Splines wrote: post #8
trueluk wrote: post #2

I normally just do my tunneling with ssh -D. Is there an advantage of using SSH VPN instead of SSH as a SOCKS proxy?

I've never used OpenVPN (and am not a network expert), but my guess is that it shims into your network stack somehow, so it's transparent to any application? Maybe, it's just a guess. Otherwise, it doesn't seem to make much sense. I'm running a low-tech setup like this with sshd on my home router and PuTTY on my laptop, acting as a SOCKS proxy, and there are several applications that don't know how to talk to a SOCKS…

> it shims into your network stack somehow

It doesn't. It merely installs a virtual network adapter and then you get creative with the routing table to pass the traffic you want through that adapter.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#44

Post by nodata »

tpahax0r wrote: post #7
riobard wrote: post #6

Earlier quoted context omitted.

I was wondering the same thing. The post went through all the steps to setup SSH VPN while SSH tunneling works pretty well and requires almost-zero config on the server… OTOH I saw the value of using PPTP or L2TP-based VPN. It is supported on most systems by default. I set up one for iPhone because you cannot do SSH tunneling on it. On non-*nix systems there is usually no SSH installed by default. I opened my PPTP/L2…

SideStep basically automates ssh -D for you and sets up a local SOCKS proxy. However SOCKS proxies (and thus the current version of Sidestep) can only protect TCP traffic that supports SOCKS proxies. For example, you can't tunnel your DNS requests over a proxy (without tinkering with Firefox's about:config). Also, since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have…

If you want complete privacy where ALL of your IP traffic is tunneled out, OpenVPN (or other tunneling layer 3 solution) is the way to go.

If you don't have a static ip at home, OpenVPN with this configuration will mean loss of privacy to everyone on the internet.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#46

Post by arst »

rmc wrote: post #41
mfringel wrote: post #31

This looks like a great way to get started with EC2, VPN or no. I've been thinking about it, but one thing still puzzles me. You choose an AMI, but does Amazon effectively create an EBS instance for you and populate it with a copy of the AMI? I don't see any mention of an EBS instance being created, so I'm not quite sure how you can write to the filesystem at all. I'm sure I'm missing something here, but I'm not quit…

You don't need an EBS to run an instance on EC2. You can just run the instance as normal. It has a root filesystem, you can write to it etc. However if you stop the instance, then all your changes are lost. The EBS is only needed if you actually need disk space.

Micros (which are what you get on the free tier) are only available as EBS-backed instances.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#47

Post by kayoone »

MicahWedemeyer wrote: post #10
tessro wrote: post #5

It's worth noting that the quoted "$0.50 a month" only applies for the first year, after which it will cost $0.02 an hour or ~$15 a month.

Seems like a perfect use case for EC2 on demand. Only run the VPN node when you are on an open wireless network and need the VPN security. Shut it down otherwise. That would make it harder to run, but it would greatly reduce the cost. I'd pay $0.02 for an hour's worth of security while stopping off at a coffee shop.

couldnt attackers then grab your EC2 dashboard cookie and possibly compromise your EC2 instance ?

I mean if you need to login there first via an unsecure session, its not really that much safer

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#48

Post by bostonvaulter2 »

kayoone wrote: post #47
MicahWedemeyer wrote: post #10

Earlier quoted context omitted.

Seems like a perfect use case for EC2 on demand. Only run the VPN node when you are on an open wireless network and need the VPN security. Shut it down otherwise. That would make it harder to run, but it would greatly reduce the cost. I'd pay $0.02 for an hour's worth of security while stopping off at a coffee shop.

couldnt attackers then grab your EC2 dashboard cookie and possibly compromise your EC2 instance ? I mean if you need to login there first via an unsecure session, its not really that much safer

But the EC2 login should be via https, although I'm not 100% sure that is actually the case.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#49

Post by trueluk »

kayoone wrote: post #47
MicahWedemeyer wrote: post #10

Earlier quoted context omitted.

Seems like a perfect use case for EC2 on demand. Only run the VPN node when you are on an open wireless network and need the VPN security. Shut it down otherwise. That would make it harder to run, but it would greatly reduce the cost. I'd pay $0.02 for an hour's worth of security while stopping off at a coffee shop.

couldnt attackers then grab your EC2 dashboard cookie and possibly compromise your EC2 instance ? I mean if you need to login there first via an unsecure session, its not really that much safer

Your AWS dashboard would be compromised if you waited until you were on the open wireless network to run the EC2 instance, but attackers would not be able to compromise the EC2 instance. Once the instance has been created you can't change the Key Pair. You also can only download the private key associated with the Key Pair once, which is right when you create it. But of course, an attacker could stop or terminate your instance if he gained access to your AWS dashboard.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#50

Post by crocowhile »

tpahax0r wrote: post #28
crocowhile wrote: post #16

Earlier quoted context omitted.

AlwaysVPN is what I use.

Looking at the cost, the EC2 setup is a lot cheaper.

Depends on usage. I bought $5 or $10 worth of GB traffic few years ago and I have most of it still left to be used. Even just 1gb is plenty for the occasional browsing at starbucks or at the airport.
Post reply on HN