VPNs on iOS are a scam

> It's a Virtual Private Network connection, you create a Virtual (not physical) Private Network (between your device and another device/server) there's no real difference between a site-to-site VPN and a client-access VPN other than if the devices at each end route more than just the partner traffic over the private network.

The difference is one end is not a network but an endpoint part of a network. Multiple client access VPNs can be part of the same subnet.

> If I connect a "site-to-site VPN" between my computer and your computer, if I add a route to send all traffic for a particular network to your computer as the next hop, that makes it "client-access" for that particular network, if I add a default route it then sends any internet request I make to your device as the next hop.

In site-to-site VPN, your computer would need to route a separate site network as would the remote end. With client access only the remote end routes a sparate network. Windows for example cannot be used (unless server versions) to provide site-to-site connectivity because it does not route between NICs. Your tunnel IP is used for connectivity with client access but with site-to-site the remote end expects you to adverise a route or have a separate config for a static route back to some other network on your end which is what it will route (won't work otherwise). Hope that is more clear. You can turn your nix box to a s2s vpn terminator but in every VPN type this requires different config which is why the different terms exist.

Thing is, if you ping experts in the privacy field (like Mike Bazzell, the former FBI OSINT guy who billionaires and celebs hire to keep their personal info off the internet), they will all say the VPNs are a very important tool to create a layer of privacy between you and the site you are visiting and also a good tool to prevent said sites from easily profiling you. No, they are not a panacea -- much like the security universe, the privacy universe requires lots of other active and passive behavioral and technological changes to properly lock things down to whatever standard you require for your threat model. But they are very much an important tool. For a small subset of people it's literally a tool that protects their life.

So yeah, it's a kinda a big deal if it leaks. (Which is why most privacy experts, were you to tell them you were sufficiently paranoid, would have you fire up a pfSense and link it permanently to a VPN service and then run a separate brand of VPN software on whatever device, so that you have two layers going through two companies.)

This might be the most pedantic thread (on my part, too) I was ever part of. :)

The earliest reference to VPN I can find in the RFCs, RFC2547, seems to call the "destination" (the network spanned by the tunnel) the VPN, not the tunnel itself:

    "If all the sites in a VPN are owned by the same enterprise, the VPN
    is a corporate "intranet".  If the various sites in a VPN are owned
    by different enterprises, the VPN is an "extranet".  A site can be in
    more than one VPN; e.g., in an intranet and several extranets.  We
    regard both intranets and extranets as VPNs."

That same RFC has only one mention of encryption at all, in passing, and as being optional (note the "and/or"):

    A security-conscious VPN user might want to ensure that some or all
    of the packets which traverse the backbone are authenticated and/or
    encrypted.

It does not seem to me that privacy was implied.

I still think that VPNs were invented to connect smaller private networks to a larger private network together, where private != privacy. (But rather related to authorities, such as using "private IP addresses" in e.g. 10.0.0.0/8, instead of publicly routable ones.)

Privacy was a (good, likely popular) option, but just not part of the strict definition of what a VPN is (much unlike today).

I’ve heard the idea of “competing jurisdictions” advanced here: run your own Wireguard VM in China or Russia and route traffic through that box, with the goal of essentially introducing unfriendly international borders in your traffic. Ideally your Russian VM provider would be uninterested in responding to an American subpoena.

The other concept I’ve heard put out is to add layers - your traffic hits Vultr, then Hetzner, then etc etc. Conceivably if you cross enough jurisdictions you can make it very difficult for a legal adversary to attack your traffic.

Would I bet on this for activities I needed to remain exceptionally private? No - but if I needed relatively consistently low latency traffic and a decent baseline of privacy it might just work.

> In the 1990s/2000s I can recall the "experts" advising against leaving computers connected to the internet when not in use. Today, "tech" companies try to compel people to leave their computers connected 24/7.

There is a lot of wisdom we've thrown away from those days. Software phoning home was viewed as malicious and there were lists of applications that did it to shame companies and warn others to stay away. Pretty much every OS and major application today would rightly have been considered Spyware.

If we'd kept "Never use your real name/info on the internet" the world would be a better place. The rule allowed for E-commerce so we'd still have amazon, but facebook and all its problems wouldn't exist.

Pop-ups were considered evil, and we fought to stamp them out but today the same annoyance is commonplace and accepted, they just show up as modal windows and cookie banner notices.