Earlier quoted context omitted.
Mullvad?
"decent sized" Lots of small coke companies exist too, to use my analogy again.
Why does size matter? Mullvad is fast, has quite a few locations/endpoints, and good service.
Rejecting data demands, ExpressVPN removes VPN servers in India
101–110 of 116 posts
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#102I'm not very clued in about this but I had a question.
I'm not sure about the privacy angle but if you spin up a node on a cloud provider, install a VPN on it, do your thing and then destroy it, wouldn't it serve just as well as any of these? Apart from the technical complexity of this, how different is it from using a commercial VPN provider?
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#103What if you spin up a VPS based in India and install OpenVPN/Wireguard on it? Surely they can’t demand logs of a box you operate yourself?
The actual order targets both VPS and VPN providers, here's the excerpt:
> Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be:
> a. Validated names of subscribers/customers hiring the services
> b. Period of hire including dates
> c. IPs allotted to / being used by the members
> d. Email address and IP address and time stamp used at the time of registration / on-boarding
> e. Purpose for hiring services
> f. Validated address and contact numbers
> g. Ownership pattern of the subscribers / customers hiring services
https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04....
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#104> With virtual locations, the registered IP address matches the country you have chosen to connect to, while the server is physically located in another country. How does this work then? How can you have a Indian IP address, while the server is located in the UK?
How does Geo-location from IP work anyway? From my knowledge it's just figuring out the ISP the IP-block is assigned to, and finding out the address of the ISP. But technically a computer anywhere in the world can have any IP? Or since I don't know anything about routing: are there routing rules that would think "This is an Indian IP, I'm going to forward this data towards India"?
There isn't a standard way to do this, and all depends on people using random "Geo IP" databases. Most of these databases are made using a variety of sources, though primarily the easiest is to see what ASN the IP address belongs to, and then you just put all those IPs as belonging to that ISPs country. This covers 90% of the domestic users. What ExpressVPN has to do is, simply convince one of these ASNs to allow announcing a IP block from them on BGP, and that will work until some GeoIP database finds out and changes the country for whatever IP block ExpressVPN got.
In some cases, traceroutes from different locations around the world can be used to roughly triangulate the location. Though you may find the datacenter to be inside of earth if the IP is actively being used for unicast :)
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#105Earlier quoted context omitted.
It seems pretty clear to me at least for the Netflix case. - Content providers care because they want to sell exclusive per-region licenses. - Netflix doesn't really care, in fact the may benefit from more content available to their users. The end result is that Netflix will do the bare minimum to keep the content providers satisfied. Steam is more of a concern because they have different prices per region. But IIRC…
That is also true for Netflix and they do care. Indian monthty subscription is much lower priced and starts ~2$ than U.S. that costs like $20[1] Geolocation is largely a feature in products and in licensing because there is big purchasing power difference between rich and poor countries. Netflix has been more tolerant in the past of region bypass than others for the same reason they didn't crackdown on password shari…
Would getting the cheaper subscription not require the user to have a valid mode of payment that can be attributed to India? I do not understand how credit cards work, but I suppose the company probably can atleast obtain the card holder's country?
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#106I'm not very clued in about this but I had a question. I'm not sure about the privacy angle but if you spin up a node on a cloud provider, install a VPN on it, do your thing and then destroy it, wouldn't it serve just as well as any of these? Apart from the technical complexity of this, how different is it from using a commercial VPN provider?
You lose anonymity. Your cloud provider would have all your details and most certainly have a log of all IPs used by you. If someone came looking for an IP, they would trace it back to you.
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#107I'm not very clued in about this but I had a question. I'm not sure about the privacy angle but if you spin up a node on a cloud provider, install a VPN on it, do your thing and then destroy it, wouldn't it serve just as well as any of these? Apart from the technical complexity of this, how different is it from using a commercial VPN provider?
You lose anonymity. Your cloud provider would have all your details and most certainly have a log of all IPs used by you. If someone came looking for an IP, they would trace it back to you.
Thank you.
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#108Earlier quoted context omitted.
I assume you are talking about the chrome plugin "the great suspender"; I am not sure what controversy you refer to? What happened to it?
See https://github.com/greatsuspender/thegreatsuspender/issues/1...
Better link https://github.com/greatsuspender/thegreatsuspender/issues/1...
> TLDR: The old maintainer appears to have sold the extension to parties unknown, who have malicious intent to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension (published to the web store but NOT to GitHub), arbitrary code was executed from a remote server, which appeared to be used to commit a variety of tracking and fraud actions. After Microsoft removed it from Edge for malware, v7.1.9 was created without this code: that has been the code distributed by the web store since November, and it does not appear to load the compromised script. However, the malicious maintainer remains in control, however, and can introduce an update at any time. It further appears that, while v7.1.9 was what was listed on the store, those who had the hostile v7.1.8 installed did NOT automatically receive the malware-removing update, and continued running the hostile code until Google force-disabled the extension.
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#109Earlier quoted context omitted.
Realistically, these things are mainly used to pirate and break the ToS of various websites ("Netflix from other countries", "buy games at cheaper rates"). With ISPs in some countries selling their customers' browsing data to advertisers, I don't think these shady VPN companies are much worse than not using them for a shockingly large amount of people. Mullvad seems to come out pretty clean whenever these shady VPN p…
I see these posts, and my gut feeling is that Mullvad is probably fairly trustworthy at this moment in time, but the more word of their service spreads the more likely I would assume it is that they get approached by the type of government representatives you don’t say no to. (I.e. I assume success to be a death knell for a service like this.) I’m not a customer, but I’ve considered it from a privacy perspective (in…
>I see these posts, and my gut feeling is that Mullvad is probably fairly trustworthy at this moment in time, but the more word of their service spreads the more likely I would assume it is that they get approached by the type of government representatives you don’t say no to.
AFAIK (IANAL etc.) for that to happen several changes to Swedish laws would be required. And the follow up question would be what those demands possibly would be? And of course Mullvad's technical ability to comply?
For some comparison, you could look at the Swedish ISP Bahnhof, which quite publicly fights against the Swedish implementation of the data retention and requests by Swedish authorities. Repeatedly getting Sweden slapped by the EG court. (Which could also be compared with how Signal responds to requests for information about their users which they don't collect.)
There are (again AFAIK, IANAL) no NSL like laws in Sweden.
Re: Rejecting data demands, ExpressVPN removes VPN servers in India
#110> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?
Going diskless is not a complete defense (nothing is), but it still helps against certain attack vectors. Borrowing from Mullvad's blog post on the topic[1]: - If the computer is powered off, moved or confiscated, there is no data to retrieve. - Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved. https:…
But VPNs already promise not to log anything, so running in RAM makes about as much sense as "double encryption" (actually I think some VPNs do offer such a thing, and people are gullible enough to accept it).