Earlier quoted context omitted.
Why do people keep mistaking Sweden and Switzerland?
People confuse Switzerland and Swaziland and those two aren't even on the same continent :)
Something something Austria
Attackers can decloak routing-based VPNs
191–200 of 238 posts
Re: Attackers can decloak routing-based VPNs
#192Earlier quoted context omitted.
...and the attacker needs to be in the same L2 network as the victim to trigger the attack. (i guess... didn't read the article, just the post above)
virtual network interfaces are a thing
Sure, but he still needs access to the L2 network, the virtual interface has to be connected/bridged to something.
Unless if you're thinking about a virtual interface and dhcp server directly on the victims pc (bridged to the interface with the dhcp client), but if the attacker can do that, he can also just capture the data directly.
Re: Attackers can decloak routing-based VPNs
#193Not a rethoric question:
Has anyone here compared western VPN services to Russian and Chinese available VPN?
I know you are trading one spy for another, but those two countries are, supposedly, not cooperating with the west. You are also raising a tall flag whem connecting to one of those two countries via VPN.
Appart from that, would it be more "Private" for the regular small time evildoer?
Re: Attackers can decloak routing-based VPNs
#194Earlier quoted context omitted.
False. Like all member states, the Swedish government has officialy ceded jurisdiction and enforcement of certain laws to the EU. Only VPN providers who do not comply with such international court orders get shut down. Look at what happened to vpnlab: The police literally write on their seized domain that they have forcefully attained access to everything, because the provider would not give it away freely: https://v…
You presume that a) all governments are bad, b) law is controlled by these governments and c) we only have to hide from governments. Neither are absolutely true. I mostly trust my (western european) government to not fuck me over when I am abiding the laws. Which I mightn't always do. I mostly trust them to be proportional: e.g. not beat me up or throw me in prison for smoking a spliff or drinking in public. A court…
>Regardless what police or governments want, they have to abide by laws
I can't tell if this person actually believes what they wrote, or if it is some kind of attempted public social pressure technique meant to adjust the Overton Window from a rational place.
Be it 2024 or 1624, to assert that one trusts the gov to "not fuck them over" takes a special type of naivete. It certainly takes a general obliviousness to the news cycle, willful or otherwise. As well as an obliviousness to the logic of self-interest, bureaucratic expediency, State survival, profit motivation, corruption, party politics, and more. It takes an obliviousness to history.
I doubt that few people in law enforcement, public bureaucracies, or even in most elected offices would agree with the statement under discussion. In fact, the most best (or most just) system seems to be mostly built on fail-safes against being fucked over in this manner, even if all systems arguably eventually fall to corruption. Which underscores such government motivation.
If your take is that "in many countries governments are truly life threatening to minorities", then the rest of the Profession of Trust makes no logical sense for the population generally: if the bar is the threat to life. And while that is a sensible ceiling for a "do not trust" conclusion, I would argue that the bar doesn't need to be that high.
Re: Attackers can decloak routing-based VPNs
#195> We want to stress that there are ways an attacker who is on the same network as a targeted user might be able to become their DHCP server
Does this mean your ISP could also perform this attack on you?
IE: If there is a warrant for a wiretap, or otherwise your ISP is malicious?
Re: Attackers can decloak routing-based VPNs
#196Earlier quoted context omitted.
Can you expand on that? Specifically the affiliation with Nordic countries? I’m a Nord VPN customer, I’d quite like to know more — may help inform any future decision on renewing or even staying with them.
In general, Nordic countries are known for their extensive privacy laws, which in theory would make it harder for law enforcement to gain access to your traffic (and with a court order it is very easy to decloak your VPN traffic). However, as all Nordic countries are part of the Schengen Area, they are bound by European laws - and their enforcement. When Europol started cracking down on VPN providers that didn't comp…
HTTPS is not enough for public WiFi. Domain names get leaked due to how the TLS negotiation works, and unencrypted HTTP sites or ones with weak crypto are still more common than they should be.
Plus, many public WiFi networks exist which block SSH or specific websites to keep security auditors happy while allowing VPN to make business people happy. I used such a public WiFi quite recently, which blocked not only SSH but Hacker News - I assume some bad site database misunderstands the name of this site.
As for hiding from governments, I’m not aware of any Western government that has so far gained the power to force its companies to affirmatively lie about whether they have shared logs with the government. So far, they can sometimes force silence, and can sometimes force a previously published canary notice not to be removed, but they haven’t yet had any right confirmed to uphold a compelled lie. So any Western provider that continues to publish suitably broadly worded canary notices on a verifiably still-updated basis (e.g. securely OpenPGP-signed together with a bit of new daily news headlines) is either telling the truth or is lying without being legally forced to do so.
Re: Attackers can decloak routing-based VPNs
#197Earlier quoted context omitted.
No, you're wrong again. I just tested this (simulating routes added by a DHCP option 121) and it works exactly as I said. C is what happens. But it doesn't happen the way you say at all. Only the traffic heading to the new 121 routes are blocked - why is it blocked? because the routes are on the physical interface, and the firewall rules blocks all off-VPN traffic (except traffic to the VPN endpoint itself) The tunne…
Could you please show me a rule so I can "try it"? I'd love it if this worked. Let's say: - the physical interface name is "wlan0" - the VPN virtual interface name is "tun0" - the VPN server is 10.1.1.1 on TCP port 8888 - the DHCP server on initial lease sends "0.0.0.0/0 via 10.8.8.8" - the DHCP server on renew sends the above rule and also "10.0.0.0/8 via 10.9.9.9" - Before the renew, traffic not routed via 10.8.8.8…
[deleted]
Re: Attackers can decloak routing-based VPNs
#198Earlier quoted context omitted.
The only problem with this persons comments is saying "you're wrong" "you're confused" so much. The actual content is 100%. Get over the "you're wrong" tone and ingest the tech message. It's really a misnomer to call the firewall a kill switch since it isn't reacting, it's already in effect, already blocking the bad traffic before the bad traffic happens. No switch is thrown. Any vpns that DO work that way are silly…
I can see how you can write rules that block "bad traffic", but I can't see how you write them so they don't also block some "good traffic" when the network assigns a routing rule. I think the person here might be glossing over writing overzealous rules that cause the VPN connection to go down when an Option 121 route is assigned, when the ideal solution leaves the VPN functional (and causes tunneled traffic to ignor…
That has already been explained a couple times over.
Re: Attackers can decloak routing-based VPNs
#199Earlier quoted context omitted.
You presume that a) all governments are bad, b) law is controlled by these governments and c) we only have to hide from governments. Neither are absolutely true. I mostly trust my (western european) government to not fuck me over when I am abiding the laws. Which I mightn't always do. I mostly trust them to be proportional: e.g. not beat me up or throw me in prison for smoking a spliff or drinking in public. A court…
>Regardless what police or governments want, they have to abide by laws I can't tell if this person actually believes what they wrote, or if it is some kind of attempted public social pressure technique meant to adjust the Overton Window from a rational place. Be it 2024 or 1624, to assert that one trusts the gov to "not fuck them over" takes a special type of naivete. It certainly takes a general obliviousness to th…
I believe what I wrote.
Do note that this applies to Western Europe (more precisely: the Netherlands). And do note that "to be f#ed over" is rather broad and personal. While one person might feel they are truly "f#d" by police" when they get a ticket driving their bike without lights at night, that's obviously not what I mean.
I am by conviction an Anarchist (though certainly not libertarian), and I do see the times and places where government did absolutely f# over minorities here¹. But: hear me out: those are cases where the government, through democratic mandate, made (extremely) bad laws. And then had to abide by their own laws. Sometimes forced by the -independent- courts². Democracy works: "we, the people, voted for incompetent and blasé governors, racists even, who then turned out to be imcompetent and blasé. And in doing so f*d minorities". It's not the government, really, but the will of the people!
Do I trust the police force (the institude)? Not really. But I don't need to, because it is kept in check by a functioning democratic system and courts. Again, this is not the US. Nor Somalia or South Africa. Do I trust a police officer (a human)? Quite probably; in the Netherlands a majority isn't power-tripping nazi scum but rather people with a (imo weird) calling to help.
¹ e.g. a still ongoing case at https://en.wikipedia.org/wiki/Dutch_childcare_benefits_scand...
² e.g. https://en.wikipedia.org/wiki/Nitrogen_crisis_in_the_Netherl...*