Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

stratumsecurity.com

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#11

Post by tedunangst »

trueluk wrote: post #2

I normally just do my tunneling with ssh -D. Is there an advantage of using SSH VPN instead of SSH as a SOCKS proxy?

ssh -D: socks proxy. only works with some apps. tunnels at the "data stream" level.

ssh vpn: tunnels all packets at the "network" level. bad because running TCP over TCP can have erratic performance. good because it covers all traffic.

openvpn: tunnels using UDP, so you don't have the TCP on TCP problems. it's just more work to set up than ssh vpn, but still probably easier than full blown ipsec.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#12

Post by trotsky »

Better choice than a lot of the VPN services out there. The free services should be presumed to have some sort of ulterior motive to get a look at your traffic (including, potentially, much more nefarious ones than a firesheep user). Even premium services should be considered carefully, you have little way of knowing what amount of tracking or inspection of your packets is going on - and such concentrators make an excellent target for hackers.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#13

Post by noodle »

this sounds like a pretty viable business idea, actually. in the past, i've looked for a simple VPN service provider to help secure non-techie friends' laptop work at a starbucks or whatever. couldn't find anything decent. seems like people might be willing to pay some $ for this if it were turned into something commercialized.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#16

Post by crocowhile »

noodle wrote: post #13

this sounds like a pretty viable business idea, actually. in the past, i've looked for a simple VPN service provider to help secure non-techie friends' laptop work at a starbucks or whatever. couldn't find anything decent. seems like people might be willing to pay some $ for this if it were turned into something commercialized.

AlwaysVPN is what I use.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#18

Post by chopsueyar »

ronnier wrote: post #14

I'm use my LinkSys router loaded with a Linux firmware to do this at no additional costs. I wrote up how I did it, http://ronnie.me/articles/rdp_over_ssh_with_a_linksys_router

When I read the original article, I thought "Why can't every consumer have this who has home broadband?"

I'm sure comcast would not like it, and the dynamic ip issue.

Re: Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month

#20

Post by riobard »

tpahax0r wrote: post #7
riobard wrote: post #6

Earlier quoted context omitted.

I was wondering the same thing. The post went through all the steps to setup SSH VPN while SSH tunneling works pretty well and requires almost-zero config on the server… OTOH I saw the value of using PPTP or L2TP-based VPN. It is supported on most systems by default. I set up one for iPhone because you cannot do SSH tunneling on it. On non-*nix systems there is usually no SSH installed by default. I opened my PPTP/L2…

SideStep basically automates ssh -D for you and sets up a local SOCKS proxy. However SOCKS proxies (and thus the current version of Sidestep) can only protect TCP traffic that supports SOCKS proxies. For example, you can't tunnel your DNS requests over a proxy (without tinkering with Firefox's about:config). Also, since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have…

Thanks for the explanation! There are a few things I don't understand fully, could you please talk a bit more?

“since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall).”

I believe on OS X the SOCKS proxy is applied globally, unlike Windows where you have to do per-application settings. So aside from DNS queries, I guess other TCP connections should go through SOCKS? That should cover the major problem of FireSheep.

Also, since on Windows/OS X/iOS there is no default OpenVPN clients, I use PPTP/L2TP/IPSec-based VPN instead because they are available by default. Is there any advantage of OpenVPN over them?

Post reply on HN