The short story about the green padlock stating your connection is ‘secure’ is also not true. It depends on the encryption type they use. I don’t have time to go in detail, though for outdated browsers ssl 3.0 is still stated as green...
VPN – Very Precarious Narrative
141–150 of 281 posts
Re: VPN – Very Precarious Narrative
#142Run PiVPN on an t2.nano on AWS. Takes 15 minutes to set up. $5 / month for the instance and 9 cents / GB. Turn off logging. Will cost you a bit more than real VPN services but is completely private.
How is this private? You literally get a private IP directly tied to your AWS account, and by extension your CC.
An actual attempt at privacy would involve chaining at least two VPNs and paying anonymously. Starts to look a lot like TOR, doesn’t it?
This issue with VPNs is, as the article states, people will just use them to log in to Facebook. It’s like putting on fake nose and glasses while at the same time wearing a t-shirt with your name and social security number.
However VPNs are brilliant for getting around horrible ISP, e.g. to participate in P2P networks. In that case, paying for GB is not very ideal.
Re: VPN – Very Precarious Narrative
#143Author has a computer science understanding of VPNs but is breathtakingly ignorant as to the actual use cases of commercial VPNs. They're used for getting around geoocming and media throttling sure, but the biggest use is piracy. Also, his disbelief of anonymous payment methods is incredibly stupid. I can walk into a store right now and get a prepaid visa using cash, no crypto currency shenanigans required.
Well sure you can. But what about all those surveillance cameras? And the license plate cameras? Me, I wouldn't count on those giftcards.
if they don't accept bitcoins, then it's not anonymous.
Re: VPN – Very Precarious Narrative
#144There's a couple of bad faith arguments in this article that I didn't care for: - Regarding user identification, rolling my IP address is trivial with a VPN. Less so on my static IP. - The Facebook example without cookie deletion is a low-effort Straw Man - I reject the leap that "we have figured out that they [VPNs] do not add much to your online privacy". In the very narrow terms defined, yes of course, but either…
What you see as bad faith is actually a direct reflection of the benefits these VPN providers are claiming to provide -- if not explicitly on their own site (publishing false claims in writing often leads to bad outcomes) then at least in the ad copy they give to the Youtube hosts to read.
In ~100% of cases, you're safer SSH-tunneling your traffic to a cheap server at a cloud hosting provider.
Re: VPN – Very Precarious Narrative
#145I use VPNs for one main reason: so that my ISP does not build a complete profile of me based on the sites I'm visiting. This can be mitigated to a certain extent by using a VPN. I do not expect to become anonymous or invisible on the internet all of a sudden, I just do not want the guy listening next to my front door to know everything about me. In the US, where personal data is a free-for-all and everybody and their…
The ISP can easily build a reasonably reliable profile based just on packet size and timing. TLS and most VPNs do nothing to these. If they actually wanted to. You could sure them under wiretapping laws if they did. If you cannot trust your ISP, you cannot really have any privacy without truly extensive measures. Not even Tor is enough, it does not pad and change timing enough. The real problem is cookies, requiremen…
> If they actually wanted to. You could sure them under wiretapping laws if they did.
Could you? I was under the impression that (in the US) the main difference between a phone line and an Internet connection is that former is legally protected against wiretapping and the latter not so much.
Re: VPN – Very Precarious Narrative
#146Earlier quoted context omitted.
Sure, a lot of it may be parallel construction. We do know that the NSA shares with the FBI and other TLAs. If your threat model includes the NSA or the like, VPN services are at best a minor hindrance. Possible options include Tor and "anonymously" using WiFi hotspots. I only know of one fundamental fail for Tor: the relay-early bug that CMU exploited. The others have involved Firefox and Windows bugs. People using…
> Possible options include Tor I thought most folks believe that the NSA/CIA/some other TLA has control of more than 50% of the exit nodes, which should be enough to reconstruct the sources of most traffic.
It seems rival agencies (Chinese, Russian) should be interested in doing the same, or at least denying NSA this capability. I mean adding some exit nodes is not exactly expensive, seems like a low hanging fruit, doesn’t it?
Re: VPN – Very Precarious Narrative
#147> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…
> So why does he need a VPN at the airport?
Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices.
HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic.
When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A subset of these 1s and 0s are the things you're actively telling the computer to do. Most of this stuff is things like ARP, Name resolution services and other stuff that isn't encrypted for perfectly understandable reasons.
Instead, when connecting to an open airport wifi network, a personal decision is made that the connectivity is more important than encryption. Airport wifi connections could and should be encrypted with AP client isolation, but they aren't.
Re: VPN – Very Precarious Narrative
#148Earlier quoted context omitted.
Sure, if you are doing illegal stuff very little of what you can find online will protect you. But if you are hiding from non-law enforcement it is easy to get pretty anonymous.
I guess since I have nothing to hide I have nothing to fear! Thanks friend! We are definitely not living in a surveillance state and we have nothing to worry about as long as we do our jobs cheerfully, obey authority, and conform. I love my life, my job, and my government. There is nothing to see here, everything is normative and fine. Those engaging in crimes though, such as watching region locked content outside th…
I'm not trying to imply this is ethically or morally right. I am trying to say that if you want to hide from the law using a VPN or anything that is easy to find on the internet is not going to help you and believing so is harmful in that you will choose a technology that you think helps you but does not and take too large risks.
Re: VPN – Very Precarious Narrative
#149Earlier quoted context omitted.
Oh come on now. The US Government forces tech companies to share information all the time. http://www.msnbc.com/msnbc/us-government-threatened-yahoo-bi... They certainly can, and will, go after any company they want to, without referencing any specific US legislation.
ISPs and VPNs have different laws then, for example, email providers. Further, Yahoo Mail, would be storing data (thus "voluntary" logging, or in their case, there's few ways around it to deliver their services in any kind of usable way). I repeat, after having evaluated this quite deeply, that there are no mandatory data retention laws in the US, period, for ISPs and VPNs. This is contrast to quite a few jurisdictio…
You're saying that organizations can avoid being subject to providing data if their service does not store the data. But I am not convinced. If the NSA or whatever 3 letter agency demanded the data be made available in a secret court, the company would have no choice but to comply.
They could require this in several ways. They could store the data directly on government servers, or set up a third party server and store the data on there, where both parties could access it. Either way, there is no technical reason the data can NOT be collected, so if the big boys want it, they will get it.
Re: VPN – Very Precarious Narrative
#150> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…
He made this point explicit: > Networks like these make it easy for attackers to get a copy of your network data, and if you send something unencrypted, the results can be quite harmful. The web should be ideally end-to-end encrypted with HTTPS. But in case this assumption breaks down, VPN gives an additional headroom for security. Not much (as explained in the article, and thus should not be advertised so), but stil…
> The web should be ideally end-to-end encrypted with HTTPS.
No. People designing public access networks should use encryption and AP client isolation.