Attackers can decloak routing-based VPNs

Post by DEADMINCE » Sun, May 12, 2024, 6:24 PM UTC

berkes wrote: post #199

mrangle wrote: post #194

Earlier quoted context omitted.

>Regardless what police or governments want, they have to abide by laws I can't tell if this person actually believes what they wrote, or if it is some kind of attempted public social pressure technique meant to adjust the Overton Window from a rational place. Be it 2024 or 1624, to assert that one trusts the gov to "not fuck them over" takes a special type of naivete. It certainly takes a general obliviousness to th…

I believe what I wrote. Do note that this applies to Western Europe (more precisely: the Netherlands). And do note that "to be f#ed over" is rather broad and personal. While one person might feel they are truly "f#d" by police" when they get a ticket driving their bike without lights at night, that's obviously not what I mean. I am by conviction an Anarchist (though certainly not libertarian), and I do see the times…

Post by sigmoid10 » Mon, May 13, 2024, 9:36 AM UTC

DEADMINCE wrote: post #222

sigmoid10 wrote: post #204

Earlier quoted context omitted.

Yes of course, if you're engaged in low level criminal behaviour, then even these low levels of obfuscation will keep some pressure off your back. But since copyright law is somewhat of a grey area in the EU, you technically don't even need a VPN for that. You could run a VPS somewhere and get the same results much cheaper. But this kind of use case is not something VPN providers can advertise with anyways, so my poi…

You can get a good VPN for $5/month. I don't think you can get a decent VPN with enough bandwidth to use as a tunnel for the same price. And as for infringement being grey in the EU, not really it goes by country. Nothing grey about it in Denmark for example.

Post by sigmoid10 » Mon, May 13, 2024, 9:48 AM UTC

DEADMINCE wrote: post #220

sigmoid10 wrote: post #150

Earlier quoted context omitted.

As I said above, a simple court order can destroy any attempt at privacy. All (serious) VPN providers claim they don't store logs. But that does not mean that a court can't force them to do so. When combined with a gag order you can have someone collecting all your traffic without you even realizing it. And that's just the VPN provider, which usually doesn't own any datacenters. The datacenter providers can also rece…

> All (serious) VPN providers claim they don't store logs. But that does not mean that a court can't force them to do so. When combined with a gag order you can have someone collecting all your traffic without you even realizing it. And that's just the VPN provider, which usually doesn't own any datacenters. The datacenter providers can also receive the orders to either monitor traffic or even install hardware to do…

Post by DEADMINCE » Mon, May 13, 2024, 11:05 AM UTC

sigmoid10 wrote: post #225

DEADMINCE wrote: post #220

Earlier quoted context omitted.

> All (serious) VPN providers claim they don't store logs. But that does not mean that a court can't force them to do so. When combined with a gag order you can have someone collecting all your traffic without you even realizing it. And that's just the VPN provider, which usually doesn't own any datacenters. The datacenter providers can also receive the orders to either monitor traffic or even install hardware to do…

>None of this really matters unless you are doing something illegal enough that the government is interested in you The issue here is that how "illegal" something is depends heavily on where you live. In some places speaking against the government can get you killed [1]. In others, hosting movies can get your house raided by police helicopters [2]. [1] https://www.unesco.org/en/safety-journalists/observatory [2] http…

Post by rnewme » Tue, May 14, 2024, 1:57 AM UTC

isodude wrote: post #77

rnewme wrote: post #73

Earlier quoted context omitted.

What would be the opposite approach, to make sure all traffic goes through VPN, and only VPN, even if user didn't start the VPN connection (default to no connectivity)? Is there better approach then just disabling all other network interfaces?

AFAIK Wireguard will always listen in the default namespace, thus you need to isolate everything else. A fun way of doing it though is to do an ip rule that uses the VRF table, and matches on the user id. That way all traffic from certain users will always end up in the same routing table. You can go further and match on everything except the Wireguard endpoint. With iptables you can MARK the traffic you want to be d…