Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

111–117 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#111

Post by rapind »

zurn wrote: post #102
masmullin wrote: post #22

Earlier quoted context omitted.

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

It's easy for anyone who can do traffic analysis on your traffic, eg your ISP and mass surveillance perpetrators. And whoever your ISP decides to sell or give this data to.

Well your traffic is encrypted (assuming OpenVPN), so all your ISP should be able to see is the amount of data to and from your VPN.

Re: How to build your own VPN if you're wary of commercial options

#112

Post by zurn »

rapind wrote: post #111
zurn wrote: post #102

Earlier quoted context omitted.

It's easy for anyone who can do traffic analysis on your traffic, eg your ISP and mass surveillance perpetrators. And whoever your ISP decides to sell or give this data to.

Well your traffic is encrypted (assuming OpenVPN), so all your ISP should be able to see is the amount of data to and from your VPN.

They can of course see the individual packets and their exact timings. This can be trivially correlated with egress traffic from your VPN gateway to other ISP affiliated networks or web properties. And since it's your private gateway, there is no other traffic mixed in.

Traffic analysis is a term of art in cryptanalysis and SIGINT, in case you were not familiar: https://en.wikipedia.org/wiki/Traffic_analysis

Re: How to build your own VPN if you're wary of commercial options

#113

Post by LinuxBender »

super-io wrote: post #71
LinuxBender wrote: post #26

Earlier quoted context omitted.

There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause. At a minimum, my ISP can not see or tamper…

"At a minimum, my ISP can not see or tamper with DNS requests." Are you encrypting each DNS packet at the source (e.g. your home recursor/DNS-forwwarder)? If yes, when are your sent packets decrypted? At the authoritative nameserver, or at some intermediary recursor? If no, how do you believe that your DNS packets are opaque and tamper resistant? There are very few authoritative nameservers on the internet that accep…

My home ISP can not see my DNS packets. Those are the adversaries I am defending against specifically. All DNS packets on my home ISP are encapsulated in a VPN to my VPS nodes. I also pre-cache popular requests via cron and via settings in Unbound.

From there, for sure, the risk increases. I am not sure I trust DNSSEC to help me much. That said, I rotate through many local recursors at each location, so they have to rewrite my traffic right as it leaves my node. That is doable, but that isn't really what I am defending against. Anything I care about, I validate in a script and write into /etc/hosts.

You are correct, there are not that many recursors that support TLS.

Beyond that, things like software updates I don't trust DNS at all and certainly not public mirrors. I validate packages with GPG signatures. Even that is tricky, because chicken+egg, so I validate the GPG sigs from trusted sources.

On a funny side note, you would be surprised how many people rely on trusting GPG keys that are contained in a package, signed by those same keys, in the same repo.

Re: How to build your own VPN if you're wary of commercial options

#114

Post by tptacek »

LinuxBender wrote: post #113
super-io wrote: post #71

Earlier quoted context omitted.

"At a minimum, my ISP can not see or tamper with DNS requests." Are you encrypting each DNS packet at the source (e.g. your home recursor/DNS-forwwarder)? If yes, when are your sent packets decrypted? At the authoritative nameserver, or at some intermediary recursor? If no, how do you believe that your DNS packets are opaque and tamper resistant? There are very few authoritative nameservers on the internet that accep…

My home ISP can not see my DNS packets. Those are the adversaries I am defending against specifically. All DNS packets on my home ISP are encapsulated in a VPN to my VPS nodes. I also pre-cache popular requests via cron and via settings in Unbound. From there, for sure, the risk increases. I am not sure I trust DNSSEC to help me much. That said, I rotate through many local recursors at each location, so they have to…

DNSSEC doesn't really protect you at all here. The last mile between you and your recursor has no DNSSEC protection at all (DNSSEC is server-to-server). There are a whole bunch of other places to redirect your traffic before and after name resolution. And, of course, DNSSEC offers no privacy whatsoever: any ISP MITM can still see every domain name you're looking up, because DNSSEC is a signing-only protocol.

Re: How to build your own VPN if you're wary of commercial options

#115

Post by rapind »

zurn wrote: post #112
rapind wrote: post #111

Earlier quoted context omitted.

Well your traffic is encrypted (assuming OpenVPN), so all your ISP should be able to see is the amount of data to and from your VPN.

They can of course see the individual packets and their exact timings. This can be trivially correlated with egress traffic from your VPN gateway to other ISP affiliated networks or web properties. And since it's your private gateway, there is no other traffic mixed in. Traffic analysis is a term of art in cryptanalysis and SIGINT, in case you were not familiar: https://en.wikipedia.org/wiki/Traffic_analysis

I was unaware. Thanks for the info!

Re: How to build your own VPN if you're wary of commercial options

#116

Post by SkyMarshal »

blacksmith_tb wrote: post #30
masmullin wrote: post #22

Earlier quoted context omitted.

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

I agree overall, but PIA has may not be the best example, as they have been shown to not keep any data that could be subpoenaed[1]. One nice thing about running your own (if your client machine is on Linux) is being able to use Wireguard[2], which is quite a bit faster than OpenVPN, for example. 1: https://torrentfreak.com/vpn-providers-no-logging-claims-tes... 2: https://www.wireguard.io/performance/

Also worth checking out Shadowsocks, which was originally created to circumvent the GFW:

https://shadowsocks.org/en/index.html

https://en.wikipedia.org/wiki/Shadowsocks

Re: How to build your own VPN if you're wary of commercial options

#117

Post by KingMob »

justinclift wrote: post #110
KingMob wrote: post #34

Earlier quoted context omitted.

Algo is great! For anybody who wants steps on setting it up with an unsupported provider, I wrote a blog post on exactly that recently: http://modulolotus.net/posts/2016-03-28-setting-up-algo/ . I used Vultr, but it should help for any Ubuntu-based server.

Is the "2016" date in your blog post & URL correct? Seems off by a year.

Ooo, good catch. Must have mistyped the year in the filename.
Post reply on HN