171–180 of 260 posts
Earlier quoted context omitted.
> You just replaced ISP tracking with VPN tracking. Yeah, that's the point. People have infinitely more choices for VPN providers than for ISPs. The VPN provider could be in another country. You can even run your own VPN on hosted infra.
> You can even run your own VPN on hosted infra True. But we know very few people do that
Earlier quoted context omitted.
I rather have my VPN track me than ISP does. For example, connection to Signal and Kakaotalk servers is used as an evidence of being a member of a terror organisation (!) in Turkey. Evidence is gathered by Ministry of Communications from the ISPs, whom they have to provide real-time connection data to the State including CGNAT records. With a VPN, it is almost impossible (depending on setup, i.e. NAT) to obtain such…
I guess it depends who your adversary is. If it's the Turkish government, then you are probably safe to trust a foreign mainstream VPN. If you're trying to avoid scrutiny by a five-eyes western government, you need to be somewhat more careful.
Earlier quoted context omitted.
It would, but that’s already generally impossible thanks to everything being on HTTPS (including DNS).
HTTPS typically still have the site domain in clear due to SNI.
Can you eli5 that please?
Earlier quoted context omitted.
HTTPS typically still have the site domain in clear due to SNI.
> HTTPS typically still have the site domain in clear due to SNI. Can you eli5 that please?
Earlier quoted context omitted.
HTTPS typically still have the site domain in clear due to SNI.
> HTTPS typically still have the site domain in clear due to SNI. Can you eli5 that please?
It is possible to encrypt SNI, but most sites do not support that as the setup is non-trivial and error-prone.
Earlier quoted context omitted.
> All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. Not true, at all. There are several good reasons to use VPNs to get a different on-ramp to the otherwise untrusted internet. - Avoid ISP tracking: Your ISP should see only traffic to and from the VPN. - Access content intended for those in other regions: Many sites and services only show certain c…
You just replaced ISP tracking with VPN tracking And your "VPN in YouTube ads" surely does that
Earlier quoted context omitted.
> HTTPS typically still have the site domain in clear due to SNI. Can you eli5 that please?
To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification. It is possible to encrypt SNI, but most sites do not support that as t…
So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website
Earlier quoted context omitted.
To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification. It is possible to encrypt SNI, but most sites do not support that as t…
Huh So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website
It's also worth pointing out that tethered/hotspot data shared to the iPhone with a VPN enabled at the iPhone level will not travel through the VPN, but will rather leak your phone's IP: https://apple.stackexchange.com/questions/266871/is-there-a-...
That seems like expected behavior, or at least one worth testing with an IP checker or something on the tethered device. I would be pretty surprised if I connected to a VPN on my mobile device, then tethered to it, and my traffic went over the VPN tunnel. I would just establish a VPN tunnel on the tethered device if I wanted that.
i would not expect it to work like that
i’d think my traffic is protected, why protect it twice
Earlier quoted context omitted.
VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.
> VPNs were always meant to carry internal traffic to a private network, not the public internet This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through…
Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic when you are using a VPN to mask your Internet access. There have been multiple instances of this in the past [1][2] and ongoing (e.g. DNS [3]), and ISP "middleboxes" have been historically the biggest impediment in rolling out new features.
Ubiquitous HTTPS has shut down a lot of that shit, but until DNS-over-HTTPS becomes actual mainstream DNS (and SSL SNI!) will still leak a lot of information to entities that have a direct financial interest in collecting, packaging and selling this data to advertisers - there is a reason why ISPs oppose any legislation that turns them into "dumb pipes" after all.
Security-wise, at least if you are using any kind of untrusted network (e.g. university campus, public hotspots) a decent VPN software that uses the OS-provided firewall to completely drop any incoming and outgoing packets except for the VPN tunnel connection is also a massive benefit.
The downside of course is that you are now forced to trust the VPN provider instead of the ISP - but at least the VPN provider market is healthy and extremely competitive, which means any sort of shady bullshit would be a virtual death sentence, unlike the ISP market where you are in many cases stuck with one or two options.
Not to forget, VPNs also provide privacy on the "other end": as many providers don't cycle through IP addresses sometimes for months, advertising providers can track your movement across the Internet simply by collecting your origin IP. A good VPN provider regularly changes the origin IP visible to sites you access.
[1] https://www.privateinternetaccess.com/blog/comcast-still-use...
[2] https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hija...
[3] https://www.csoonline.com/article/2953718/t-mobile-caught-in...