Live data from Hacker News

Don't Use VPN Services (2016)

gist.github.com

41–50 of 61 posts

Re: Don't Use VPN Services (2016)

#41
This article has been debunked multiple times. It misses the point entirely.

Use VPN to change your local ISP to foreign ISP. The foreign ISP is better precisely because it is foreign. The direction doesn't matter.

Ideally pick across poorly cooperating jurisdictions.

Re: Don't Use VPN Services (2016)

#42

I think it is pretty funny that his suggestion is that you should setup your own VPN. Your hosting provider knows your real identity and is going to shut you down very quickly if something happens and is far more likely to yield to legal pressure because they don't earn money from privacy. Meanwhile for a VPN provider it would at least make sense to invest into a legal team that at least throws empty threats into the…

There are hosting providers you don't need to give out your real identity to use and would fight any attempts of getting the details they do have on you, to law enforcement or others.

Obviously if you want to protect your identity, you need to do that at every level, if you're hosting your VPN somewhere, that includes from the platform you're hosting your VPN at.

Re: Don't Use VPN Services (2016)

#43
post #22

Some VPN provider's claims were verified in court and thus it's known they don't keep logs, so the article's claims just fall apart: https://www.techspot.com/news/82259-keeping-private-5-vpns-h... Edit: Many coutries have mandatory data retention policies [1], so if you're from one of those countries it's virtually guaranteed that your internet usage logs for the last months/years are logged somewhere. On the otherha…

Their upstream providers are happy to tap the traffic if someone with enough $$$ knocks on their door. Also, why are these companies registered in Panama or the British Virgin Islands?

They don't have a data retention policy [1]. The European Union for example requires "the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC" for up to 2 years:

[1] https://en.wikipedia.org/wiki/Data_retention

Re: Don't Use VPN Services (2016)

#44

Earlier quoted context omitted.

Their upstream providers are happy to tap the traffic if someone with enough $$$ knocks on their door. Also, why are these companies registered in Panama or the British Virgin Islands?

https://en.wikipedia.org/wiki/Offshore_financial_centre

I get that - but building trust comes not with a company registration in a tax heaven.

Re: Don't Use VPN Services (2016)

#45
post #22

Some VPN provider's claims were verified in court and thus it's known they don't keep logs, so the article's claims just fall apart: https://www.techspot.com/news/82259-keeping-private-5-vpns-h... Edit: Many coutries have mandatory data retention policies [1], so if you're from one of those countries it's virtually guaranteed that your internet usage logs for the last months/years are logged somewhere. On the otherha…

It's logically impossible to verify, but any number of facts can be easily disproved by one evidence, previously unknown

Re: Don't Use VPN Services (2016)

#46
post #25

In defence of the big VPN providers. 1) Why would you keep logs, when you could then be compelled to hand them over? 2) As setting up a VPN company is easy/cheap, you conversely have to spend a large pile of cash to advertize your way to the top. The only asset you really end up with is your name/reputation. Publicly burning a customer would be incredibly expensive. Adjusts tinfoil hat I think the point about VPN pro…

>1) Why would you keep logs, when you could then be compelled to hand them over?

Yeah that's a good point. If you keep logs then your legal team will have to do more work. It actually costs more to keep logs and customers will leave you for a competitor, meanwhile there is no opportunity to earn extra money.

Re: Don't Use VPN Services (2016)

#47

I think it is pretty funny that his suggestion is that you should setup your own VPN. Your hosting provider knows your real identity and is going to shut you down very quickly if something happens and is far more likely to yield to legal pressure because they don't earn money from privacy. Meanwhile for a VPN provider it would at least make sense to invest into a legal team that at least throws empty threats into the…

There are hosting providers you don't need to give out your real identity to use and would fight any attempts of getting the details they do have on you, to law enforcement or others. Obviously if you want to protect your identity, you need to do that at every level, if you're hosting your VPN somewhere, that includes from the platform you're hosting your VPN at.

> and would fight any attempts of getting the details they do have on you

That sounds like one of those things that original article says "can never be verified". Correct me if I'm wrong.

Re: Don't Use VPN Services (2016)

#48
There are a few VPN services (about 3) that are recommended by both privacytools.io (https://www.privacytools.io/providers/vpn/) and the freedom of the press foundation (https://freedom.press/training/choosing-a-vpn/).

Some accept anonymous cash payments like mullvad and do not require any information.

Everyone here probably knows VPNs are not an all-in solution for privacy nor security but they're certainly a good added layer to add and most likely have better privacy standards than most ISPs.

A person more concerned about privacy should just add one or more layers above/below the VPN ... like ISP > VPN > Tor for instance at the price of substantially lower performance ...

Or you could do the opposite with a cash accepting VPN such as Mullvad ... and only connect to them using ISP > Tor > VPN which would also provide a decent layer that would avoid the massive "maicious high risk flagging" of Tor Exit nodes everywhere while preventing the VPN provider from knowing your IP. You certainly have to hit less captchas with VPNs than with Tor ...

There are also quite a few VPN/VPS providers accepting Monero that can be used and paid for "anonymously" for adding more layers.

If you live in a large city with a decent view on places offering free legal public wifi, you could also buy a long range Wifi Directionnal Antenna and USB Wifi adapter to add such layer while remaining at home and avoid having to move to such places. Mac address randomization is trivial and integrated in most OSes now. Again it's not perfect but it's an added "convenient" layer not requiring physical moving.

Re: Don't Use VPN Services (2016)

#49

I think it is pretty funny that his suggestion is that you should setup your own VPN. Your hosting provider knows your real identity and is going to shut you down very quickly if something happens and is far more likely to yield to legal pressure because they don't earn money from privacy. Meanwhile for a VPN provider it would at least make sense to invest into a legal team that at least throws empty threats into the…

There are hosting providers you don't need to give out your real identity to use and would fight any attempts of getting the details they do have on you, to law enforcement or others. Obviously if you want to protect your identity, you need to do that at every level, if you're hosting your VPN somewhere, that includes from the platform you're hosting your VPN at.

Since someone already answered the second part, I'll take the first,

>There are hosting providers you don't need to give out your real identity to use

Even if you don't give them your real identity, they have access to the IP address you are connecting from which to a big enough adversary is enough to identify you.

Re: Don't Use VPN Services (2016)

#50

Unless you explicitly need speed, or they're your only option, why do people use VPNs for privacy over Tor? Do they provide any benefits other than being faster? I thought Tor was a much more secure option if privacy in particular is your objective.

TOR exit nodes are more likely to be flagged than VPN servers. Though even for accessing TOR, using a VPN is a good idea. If you're planning of doing stupid things like mailing in a bomb threat to delay your exams because you haven't studied enough and you're using TOR, the usage itself will point at you if you're the only person using it. Had they used a VPN to access TOR, they wouldn't have been caught that easily.…

Thanks! This makes sense.
Post reply on HN