Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla VPN

blog.mozilla.org

Post reply on HN
Print view View original

491–500 of 531 posts

Re: Mozilla VPN

#491

Post by afiori »

saurik wrote: post #436
vsl wrote: post #407

Earlier quoted context omitted.

Being a stateless protocol is the big one, for mobile. There’s more: https://fastmail.blog/2014/12/23/jmap-a-better-way-to-email/

That "stateless" paragraph in that article is explicitly referring to the per-connection message identifiers I was referring to; but that state burden is mostly carried by the server (which is put in the awkward position of dealing with separate clients with individual state sharing a mailbox) not the client (which by definition has a unique state anyway), which the article even admits. I will argue that if you use t…

> push notification... That is so totally the fault of the mobile networks and OS people

The issue for mobile is that unrestricted push notifications are a serious battery drain. I think that JMAP makes the correct choice here, a push notification is just an external action/url, how the notification is delivered to the human is left out of the protocol. I would say that it allows for both openness and centralization without a bias for one or the other.

Re: Mozilla VPN

#492

Post by ccktlmazeltov »

r3trohack3r wrote: post #328
ccktlmazeltov wrote: post #168

Earlier quoted context omitted.

Most people use a VPN because it lets them have a different geolocation (to watch Netflix in a different country, access thepiratebay, etc.) If you do use a VPN to mask your traffic, there are two questions to ask yourself: 1. who are you masking your traffic from? 2. can you trust the VPN network more? In general, you cannot trust a VPN network more, and HTTPS is the solution as it provides end-to-end encryption wit…

HTTPS protects content. Content requires a warrant in the united states. The bulk metadata programs, as far as we know, only collect metadata. Which two IP addresses communicated, the routes they took, the size of the payloads, etc. are all "metadata". HTTPS, AFAIK, does not solve this.

Using a VPN adds indirection but can give you a sense of false security as well.

Metadata is obviously the least important data to analyze, but for example a VPN does not hide the size of payloads. TLS 1.3 do addresses that and let's you randomly pad messages but I don't think anybody use that.

Re: Mozilla VPN

#493

Post by r3trohack3r »

toyg wrote: post #330
mike_d wrote: post #311

Earlier quoted context omitted.

> compromising foreign VPN services is within the NSA's wheelhouse This is the explicit danger of VPN providers. Even if the provider is not complicit (which I believe applies to the likes of Mozilla), it still creates a centralized aggregation site for collection. I'm not even sure a US-based VPN provider is safe. GCHQ just conducts the interception and would share the data with NSA. At that point, you are at the me…

> I'm not even sure a US-based VPN provider is safe. Oh, I am sure that it is not safe, thanks to the PATRIOT Act. Even if they were not storing any metadata, VPN providers can be compelled to 1) share all data about their subscribers, which will include you, then 2) silently wiretap and decrypt everything. US courts will rubber-stamp, as they've consistently done in the past, and "that's all, folks". Sadly it's not…

Again, from what I understand, this would be active surveillance targeting an individual and the bulk data would not be collected (even if technically feasible given the mechanism for collecting the individual's data).

From write-ups of the 2013 leaks, we saw references to violations of the legal theory used to justify the Presidential Surveillance Program. One of those violations was them unintentionally collecting the wrong data, due to how the ISP was bundling packets or something like that, which constituted a warrantless search, and they supposedly took that very seriously because it jeopardized the whole program.

My take on the surveillance program is that they try very hard to be law abiding, even if they have to stretch what the law means to justify the program. If you are worried they have a warrant for your communication, a VPN isn't going to help you. If they don't have a warrant, they will avoid U.S. citizen's content like the plague for fear of compromising the whole program.

Re: Mozilla VPN

#494

Post by folmar »

sjy wrote: post #404
saurik wrote: post #381

Earlier quoted context omitted.

What, exactly, do you feel is deficient about IMAP vs. JMAP, other than the latter being a protocol that doesn't require a bespoke parser? The only thing even remotely semi-annoying about IMAP that I can think of is the way message identifiers are per-connection (but in some very important way that actually makes sense).

I’ve never been able to search my entire mail archive quickly over IMAP, using Gmail or Fastmail. Mobile IMAP clients seem especially slow and inconsistent.

Server-side search on K9 works fine, but you have to select that you want it.

Re: Mozilla VPN

#495

Post by michaelbuckbee »

cbsks wrote: post #345
deadbunny wrote: post #262

Earlier quoted context omitted.

Maybe I'm missing something but doesn't Fastmail use open standards? For example I access my Fastmail calendar on my phone and desktop using caldav. Isn't it down to the app to support those standards?

Fastmail does support the CalDAV standard, but calendly does not: https://help.calendly.com/hc/en-us/community/posts/245299227... That’s entirely calendly’s fault.

I _completely_ agree with you - but it leaves me in the same spot either way as I've yet to find a Calendly competitor that will work with CalDAV.

An open spec is great, but it has to be adopted to be used.

Re: Mozilla VPN

#496

Post by folmar »

lilyball wrote: post #256
stilisstuk wrote: post #254

Earlier quoted context omitted.

I feel a bit different: Email is a standard. You are talking about an app. Send later is the job of the application,not the standard. Same with reply all. Intelligent priority inbox is _hard_ but i. Principle the same. When you use gmail you conflate the standard with the app.

I largely agree with this, except that "Send Later" really does want some form of server support so it will happen even if you quit the app (especially on mobile). That said, there are third-party apps that do this, such as Spark (though they require storing your credentials on their servers). Priority inbox is also something that can be done client-side. FWIW FastMail does actually have internal flags for "$ismailin…

The Google way, aka masquerading flags as special folders seems to work good for non-aware clients.

IMAP actually has client-defined flags, but support on the clients is sketchy and not uniform

Re: Mozilla VPN

#497

Post by folmar »

josefresco wrote: post #484
jacobsenscott wrote: post #386

Earlier quoted context omitted.

Do people use phone support? I've never used it for anything in my life. If I was unable to make something work without phone support I would just switch to another service.

Yes, if you need an immediate response. It also helps you push through "level 1" support much faster than a traditional ticketing/email system.

If the ticketing system is sane not so much. Obviusly this is always troublesome with the big players.

Re: Mozilla VPN

#499

Post by r3trohack3r »

closeparen wrote: post #221
wongarsu wrote: post #160

Earlier quoted context omitted.

Unless I set up my own VPN I'll share a VPN server and IP with other people. That makes my traffic inherently more anonymous once it has left the VPN server, since you can't correlate traffic to a single person anymore. So even if traffic in the data center is analyzed, that's better than my ISP analyzing traffic. Thus we only have to establish that the VPN provider is at least as trustworthy as my ISP. That's a pret…

You should expect that the government can compel a VPN provider to correlate traffic to subscriber information exactly the same way it does with a residential ISP.

If they have a warrant a VPN isn't going to protect you. If you think you are under active surveillance, you want more than a VPN.

Write-ups of the 2013 leaks revealed they did not compel ISPs to correlate traffic to subscriber information. It doesn't seem like they had any subscriber information in their database, only enough metadata about the communications to later compel a ISP to provide the subscriber information _postmortem_ (i.e. who did this cellphone number belong to on this date?).

ISPs weren't even compelled to share that metadata. It was a voluntary program. Some ISPs said no. Others said yes and then later backed out. In the end something like 80% of the traffic the NSA was after was able to be collected through the ISPs that voluntarily shared their data.

But, again, this was 2013. 2013 was forever ago, things may have changed.

Re: Mozilla VPN

#500

Post by r3trohack3r »

WealthVsSurvive wrote: post #310
r3trohack3r wrote: post #111

Every time someone mentions a VPN provider in my techie social circles, the "A VPN doesn't protect you" crowd piles in, usually with links to something like: https://gist.github.com/joepie91/5a9909939e6ce7d09e29 I don't understand this argument, but would like to. I run https://everytwoyears.org , a political non-profit focused on ending the warrantless metadata collection of U.S. citizens' communications. From every…

They are explicitly collecting both the metadata and the content of all communications they are able to. They have burned their own when someone raises a complaint about their methods or dares to introduce crypto that respects constitutionality( https://en.wikipedia.org/wiki/Thomas_Andrews_Drake ).

I'm not able to see anything here that references the content being collected. Maybe I'm not looking closely enough?
Post reply on HN