Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who Owns, Operates, and Develops Your VPN Matters

opentech.fund

Post reply on HN
Print view View original

101–110 of 203 posts

Re: Who Owns, Operates, and Develops Your VPN Matters

#101

Post by tomrod »

busterarm wrote: post #54
5f3cfa1a wrote: post #48

Earlier quoted context omitted.

The answer is always "maybe" until you bring your threat model to the table. I use a VPN to watch IPTV & download torrents without my ISP sending me nasty letters. Mullvad is great for that. I would trust it in conjunction with Tor to protect me from low-level crimes. I wouldn't run trust either it or Tor, alone or in combination, to run a marketplace the DEA would become interested in. If your threat model is obscur…

This. Between the parent and the other one, it's almost like I specifically pointed out the limited utility of this approach and all of the Well Acktshually posters had to spell it out anyway. I was responding to someone who said they were technical, so it should be assumed they can work this all out for themselves.

You provided some great breadcrumbs. I appreciate your responses.

Re: Who Owns, Operates, and Develops Your VPN Matters

#102

Post by gardnr »

tomrod wrote: post #8
fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Commercial VPNs do indeed vaguely promise to protect your data, access, etc. For those of us that are technical but unschooled, what resources would you recommend we learn from?

The gist of the report summary is that VPN companies can be really shady. At the same time, these companies enjoy an undeserved implicit trust from the public.

Sending all our data through an untrusted intermediary is a bad idea. Installing software from an unknown company (that hijacks the machine's entire network stack) is not a good way to protect data.

It all really depends on what you are protecting against. For the average person wanting to protect data and avoid being tracked, setting up thoughtful DNS infra, and a basic firewall, is probably more effective than using a commercial VPN from your home network.

For public networks, it's probably safer to set up a VPN server on your home network and use that in case you need to connect to public wifi or some other potentially hostile network.

I'm not aware of any authoritative article on this topic but I generally share writings by Schneier. This one touches on the subject: https://www.schneier.com/blog/archives/2021/06/vpns-and-trus...

Re: Who Owns, Operates, and Develops Your VPN Matters

#103

Post by chollida1 »

pydry wrote: post #45
timpera wrote: post #33

Earlier quoted context omitted.

I think Mullvad's market share is still pretty low compared to NordVPN, which actually cornered the market thanks to their suspiciously large advertising budget.

Of the two im more suspicious that NordVPN is a CIA honeypot in the style of Crypto AG.

Based on what? They seem to be one of the reputable players in the industry.

Re: Who Owns, Operates, and Develops Your VPN Matters

#104

Post by leptons »

freedomben wrote: post #49
leptons wrote: post #35

Earlier quoted context omitted.

Damn! I was thinking about switching to Mullvad from PIA, but now I guess I won't.

Yeah, PIA is great. You can even use regular wireguard with it if you don't want to use their client. Been a happy use for many years

I'm a happy PIA user for many years, but I probably won't really trust any US-based VPN with what the Republicans are going to be doing in the next couple of years. They will absolutely destroy all privacy for the "save the children" boogeyman. A VPN not based in the US is the only workaround I can see, and that's if we're even allowed to use them.

Re: Who Owns, Operates, and Develops Your VPN Matters

#105

Post by raquuk »

elondaits wrote: post #78
davepeck wrote: post #17

Earlier quoted context omitted.

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

What about a malicious DNS (on a public spoofed or hacked WiFi) that forwards you to a lookalike domain? Unfortunately many times public WiFi doesn’t work with Google’s or Cloudflare’s DNS servers (I think the Deutsche Bahn’s WiFi was such a case, if I remember correctly, but I know I came across a few on the last few years while traveling). I don’t think there’s anything protecting against that when you’re using a b…

I don't think a malicous DNS Server can redirect your request to a domain that does not result in a certificate warning when using HTTPS.

With browsers adopting DoH, a public WiFi should not be able to interfere with DNS much.

Re: Who Owns, Operates, and Develops Your VPN Matters

#106

Post by aydyn »

fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Are you sure they aren't just giving you a politically correct answer?

In my estimation the main reason people use VPNs is for pr*n and piracy and they may not want to just flat out admit it.

Re: Who Owns, Operates, and Develops Your VPN Matters

#107

Post by michaelt »

elondaits wrote: post #78
davepeck wrote: post #17

Earlier quoted context omitted.

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

What about a malicious DNS (on a public spoofed or hacked WiFi) that forwards you to a lookalike domain? Unfortunately many times public WiFi doesn’t work with Google’s or Cloudflare’s DNS servers (I think the Deutsche Bahn’s WiFi was such a case, if I remember correctly, but I know I came across a few on the last few years while traveling). I don’t think there’s anything protecting against that when you’re using a b…

Your better websites use "HSTS Preloading" to ensure users always get sent to the https version of the site - in which case even if the attacker redirected the DNS resolution, you'd just get an SSL error as the attacker wouldn't have a valid certificate.

Of course, an astonishing number of (even important, high-profile) websites don't bother with HSTS preloading ¯\_(ツ)_/¯

Re: Who Owns, Operates, and Develops Your VPN Matters

#108

Post by aydyn »

flumpcakes wrote: post #65
john01dav wrote: post #60

Earlier quoted context omitted.

What about (3) "bypass government censorship"? UK and China are examples of where this is desirable. This is different from (1) because it's broader than just streaming shows and is about authoritarian rather than capitalist restrictions.

I think the general discussion is conflating censorship with age restrictions. Lumping the UK with China is very disingenuous. The UK law is stipulating adult content can only be viewed if you are provably over 18. They are putting all of that responsibility onto the websites/platforms to enforce that. If a child goes to a shop and tries to buy a pornographic magazine and they are denied, is that censorship? If a chi…

What about all the websites that either shut down or fully blocked the UK? Is that censorship?

Re: Who Owns, Operates, and Develops Your VPN Matters

#109

Post by stackskipton »

TGower wrote: post #46
zoeysmithe wrote: post #24

Earlier quoted context omitted.

This is my feeling too. I also don't think these people realize how none of these groups can refuse a subpoena so the scenario of "the government coming after me," doesn't get addressed either. Worse, some of these are tied to foreign nation state intelligence, who are now analyzing your data when before they couldn't because they didnt have a relationship with your ISP. Domestically, I wouldnt be surprised if all of…

Many major VPN providers claim to keep no logs, and some have had third party audits supporting that claim. Subpeonas don't do anything if the company doesn't keep logs.

I also wouldn’t trust VPN provider standing up to the pressure of really angry Western government. If Mullivad gets US FISA warrant followed by threat to destroy their ability gain access to US payments, they are going to flip logging for you on so fast.

Re: Who Owns, Operates, and Develops Your VPN Matters

#110

Post by atkailash »

davepeck wrote: post #17
fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

Times Square at one point was practically half full of Mullvad ads. I already distrusted it but the sheer amount of money they spent to do that made it shadier to me
Post reply on HN