Live data from Hacker News

Who Owns, Operates, and Develops Your VPN Matters

opentech.fund

141–150 of 203 posts

Re: Who Owns, Operates, and Develops Your VPN Matters

#141
post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Making sensible choices requires thinking things through, and understanding what it really is that you are doing, or refrain from doing it. Experts are just as prone to neglecting this as novices. But expressing your misgivings about prevailing orthodoxies is an ungrateful undertaking as it tends to make people angry, and there is little honour to be had in getting vindicated.

Re: Who Owns, Operates, and Develops Your VPN Matters

#142

Earlier quoted context omitted.

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

Times Square at one point was practically half full of Mullvad ads. I already distrusted it but the sheer amount of money they spent to do that made it shadier to me

Mullvad is rather principled on privacy. You can't even make a real account, you can only generate an account number that you can charge, and I assume they do some sort of clever tricks to keep themselves as blind as possible to who uses the account number. Firefox Relay is also just whitelabeled Mullvad, so they have Mozilla's stamp of approval.

Of the big VPNs, the only one's that have ever felt shady to me are NordVPN and Private Internet Access. NordVPN because of the sheer amount of false advertising they pay YouTubers to do, and Private Internet Access because of how cheap they are and how poorly they maintain their infrastructure. Their .ovpn generated files haven't worked for 2+ years now because they include certificates with malformed revocation dates, and refuse to pay the certificate authority to update them.

Re: Who Owns, Operates, and Develops Your VPN Matters

#143
I don't know why anyone wouldn't assume that any VPN service is run by an intelligence service, potentially one hostile to you, or organized crime.

Consider-- people bring their traffic to you to monitor, and particularly people who are trying to conceal their identity or activities. They pay you for this, which means that if you get collateral benefit you can run at a small loss and undercut any legitimate players (if there are any!) or run levels of advertising that a legitimate business couldn't sustain. -- while its simultaneously one of the most cost effective surveillance plays you could imagine, since it's still primarily funded by the victims.

VPN services also have good deniability for their surveillance. Although (maybe!) your ISP can't surveil the VPNed traffic the VPN provider's ISP can as well as your counterparties ISP (and any other parties brought into the mix by things like third party content). And like any other electronic surveillance, parallel construction can be highly effective.

They can also be stood up by anyone, you can run any number of services. They don't require extremely extensive physical infrastructure, investment, large numbers of employees like running an ISP. You can even target particular actors or populations by using targeted advertising, though it's still most effective as a data hoovering operation.

Particularly for the intelligence actors they also have the benefit that issues like getting harassed by the state are among the complications of this business, but that is potentially less of an issue if you are the state.

And if there were an actually honest provider, they'd be a prime target for infiltration... all that interesting traffic in one place.

Re: Who Owns, Operates, and Develops Your VPN Matters

#144
post #123

Earlier quoted context omitted.

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

The way I see it there's four use cases: - protecting your privacy from your local ISP, WiFi, school, government etc - protecting your privacy from some forms of online tracking - circumventing censorship - circumventing geographical restrictions If you combine masking of your IP address with a web browser that protects you from various types of browser-based fingerprinting, you are more in control of your privacy on…

There's a niche fifth reason. Roaming between upstreams while not having open TCP connections drop. I use multiple ISP's and on mullvad I can swap which wifi/ethernet I'm on and all my connections stay up since wireguard is stateless.

Re: Who Owns, Operates, and Develops Your VPN Matters

#145
Interesting how the comments heading this thread ignore the effect of VPNs on surveillance and data collection for the benefit of online advertising, i.e., the stuff that so-called "tech" companies rely on as a "business model"

Must be that these so-called "tech" companies have no problem figuring out who is the ad target behind each VPN IP address, fingerprinting them and tracking their online behaviour acrosss every computer they use

TIL VPNs actually have _no impact_ on the data collection and ad services "business model"

Re: Who Owns, Operates, and Develops Your VPN Matters

#146

Shameless plug: VP.NET [1] runs in a trusted execution environment (enclave) so you can verify it is doing what it is supposed to do and not anything else! [1] https://vp.net/l/en-US/blog/Don%27t-Trust-Verify

no you can't... you can verify what something is doing, but there's no guarantee it's the same code routing your VPN requests, or that nothing else on the network/server is listening/forwarding your traffic elsewhere.

You can since the enclave attests to what is running!

This is also coupled with the crypto and NAT occuring in-enclave with various timing/obfuscations. It's verifiably private.

Re: Who Owns, Operates, and Develops Your VPN Matters

#147
post #142

Earlier quoted context omitted.

Times Square at one point was practically half full of Mullvad ads. I already distrusted it but the sheer amount of money they spent to do that made it shadier to me

Mullvad is rather principled on privacy. You can't even make a real account, you can only generate an account number that you can charge, and I assume they do some sort of clever tricks to keep themselves as blind as possible to who uses the account number. Firefox Relay is also just whitelabeled Mullvad, so they have Mozilla's stamp of approval. Of the big VPNs, the only one's that have ever felt shady to me are Nor…

>Mullvad is rather principled on privacy. You can't even make a real account, you can only generate an account number that you can charge, and I assume they do some sort of clever tricks to keep themselves as blind as possible to who uses the account number. Firefox Relay is also just whitelabeled Mullvad, so they have Mozilla's stamp of approval.

Yep. And I use the VPN connection (and/or TOR) to re-up my Mullvad VPN when I run low.

Mostly I use the VPN to protect my privacy when posting with a throwaway account here and/or other sites. And of course for torrenting.

What's more, I had some monero (XMR) left over from some other transactions, so I use that to pay for the VPN connection.

As such, unless Mullvad is storing the IP address from which I connect (and they claim they do not), it would be difficult (but not impossible -- I don't always use VPN when posting anonymously/throwaway -- that isn't a challenge!) to identify me through my VPN connections.

Re: Who Owns, Operates, and Develops Your VPN Matters

#148
post #106
post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Are you sure they aren't just giving you a politically correct answer? In my estimation the main reason people use VPNs is for pr*n and piracy and they may not want to just flat out admit it.

>In my estimation the main reason people use VPNs is for pr*n and piracy

I get the piracy part, but why would someone want/need VPN for pr0n? That's not a gotcha or snark, I don't understand why folks would "need" vpn for that (assuming it's not* non-consensual, which includes hidden cameras and/or animals or children -- neither of whom can actually provide meaningful consent) as long as it's legal.

Re: Who Owns, Operates, and Develops Your VPN Matters

#149

Earlier quoted context omitted.

And shitposting here in germany has become slightly more dangerous. If you use a vpn to call your local politician an idiot, you are much less likely to get into legal trouble.

Here in the United States, I don't know that I could trust the vpn to protect me from that. I remember an incident from a few years ago, some idiot at Harvard emailed in a bomb threat to get out of finals. They arrested him only a few hours later. It's possible he misused the vpn, but I suspect that they merely contacted the vpn provider, got a shortlist of people going through that endpoint, and eliminated all of th…

[deleted]

Re: Who Owns, Operates, and Develops Your VPN Matters

#150
post #83
post #45

Earlier quoted context omitted.

Of the two im more suspicious that NordVPN is a CIA honeypot in the style of Crypto AG.

I also think this is the scandal waiting to emerge in this space; with what we know from Snowden/CryptoAG/Encrypted message app sting operations etc it is borderline impossible for me to believe not one of the major players is owned by a State level intelligence service.

That and all those Tor nodes too.
Post reply on HN