Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN – Very Precarious Narrative

schub.io

Post reply on HN
Print view View original

171–180 of 281 posts

Re: VPN – Very Precarious Narrative

#171

Post by viraptor »

alasdair_ wrote: post #169
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

>Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine that he's using an email service that doesn't use HTTPS. Because the Internet is more than the stuff that lives on port 443? What does the author do about UDP packets? It’s interesting that you mention email.…

That would imply the author cares enough about privacy / security to use VPN to hide for example POP3, but not enough to immediately drop an email provider which uses unencrypted POP3 service. And that's a strange argument.

Re: VPN – Very Precarious Narrative

#172

Post by viraptor »

sigmar wrote: post #125
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

>most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? What percentage of (typically rushed) people at an airport will notice that a website is loading over http instead of https? SSLsplit is pretty useful.

SSL everywhere is also a good workaround for this: https://www.eff.org/https-everywhere

Re: VPN – Very Precarious Narrative

#173

Post by pizzazzaro »

cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you.

A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile.

Payment information - some prefer to use cryptocurrency, which in their minds, is private. Again, once metadata connects you, there's no denying that that's you.

A third party consultant takes your payment? Maybe. Especially if you've got some anonymizing layer to your credit card info that has earned a similar trust. This will of course add to the cost of the transaction.

Even the way you type can connect you. Sufficient amounts of text - such as this reply - are usually enough.

Re: VPN – Very Precarious Narrative

#174

Post by floatboth »

dvcrn wrote: post #158
jacobsenscott wrote: post #124

Earlier quoted context omitted.

TOR browser, or TAILS in a vm are both far superior to a VPN if you actually care about privacy. It is less convenient than using a VPN though - so lots of people sacrifice privacy and money for convenience and the feeling of privacy.

I agree but your bandwidth will take a massive hit. I pay for my fiber so I can have fast internet, with TOR I would only be able to use a fraction of that.

You can e.g. use Tor for surfing and no proxy for YouTube and other places you need speed for.

Re: VPN – Very Precarious Narrative

#175

Post by m0dest »

_b8r0 wrote: post #147
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A…

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility?

This hasn't been possible until WPA3, which has barely started rolling out.

Re: VPN – Very Precarious Narrative

#176

Post by jeltz »

kmonsen wrote: post #78
ikeboy wrote: post #10

Earlier quoted context omitted.

Which case are you talking about? You have no links in the "no-log" section. Other fatal flaws in that section, fwiw >Starting with the obvious, if you pay for a VPN service, they have to keep your user account and associated payment information and your payment history. So, unless you are using a fake identity and an anonymous credit card (is that even possible these days?), your VPN account will be linked to your a…

Bitcoin has very little anonymity as well BTW. Probably less than credit cards.

Many VPN services also accept cash.

Re: VPN – Very Precarious Narrative

#177

Post by jeltz »

zaarn wrote: post #54

>In most circumstances, VPNs do absolutely nothing to enhance your data security or privacy. >Acting as they do, and promoting commercial VPN providers as a solution to potential issues does more harm than good. I think this ignores the fact that some users have different threatmodels, sometimes the privacy threat model of a user does include their ISP for various reasons (think China). > Starting with the obvious, i…

As far as I know you can still get anonymous credit cards, and if not most VPNs accept mailed cash. I doubt that your VPN will try to collect DNA from all mailed in cash.

Re: VPN – Very Precarious Narrative

#178

Post by tya99 »

pizzazzaro wrote: post #173
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. Payment information - some p…

> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you.

Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not.

Essentially VLAN2 all traffic is routed direct to my ISP, and VLAN3 all traffic is routed to VPN. My machine normally sits in VLAN3. I make sure not to log into anything social media related or tied to my real identity.

If I need to do banking, Facebook or something like that I'll use a device in VLAN2 (a separate computer).

All phones and devices like that are broadcasting information anyway so those are in VLAN2 as well, unless they are devices with LineageOS and no Google Apps.

> A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile.

See in this scenario I would have a system in VLAN3 that I use for my downloading, and another computer in VLAN2 that is used for the facebooking. I use a hardened browser with https://github.com/ghacksuserjs/ghacks-user.js that hardens the browser and helps against fingerprinting.

I also use a number of addons, for various purposes

That requires hardening. Currently I use

* CleanURLs https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking)

* CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/

* Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN)

* Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in)

* HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/

* Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ (no to AMP)

* Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB)

* uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ (block adverts)

* uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)

Re: VPN – Very Precarious Narrative

#179

Post by CKN23-ARIN »

m0dest wrote: post #175
_b8r0 wrote: post #147

Earlier quoted context omitted.

> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A…

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.

Many ways to do this.

Make the password widely-known. Announce it over the intercom. Post it on the walls.

Offer both encrypted and non-encrypted SSIDs. The non-encrypted SSID could even just be a captive portal with instructions to connect to the encrypted SSID.

If you're feeling wild, use WPA2 Enterprise, and accept any credentials.

Re: VPN – Very Precarious Narrative

#180

Post by 0xf00d »

m0dest wrote: post #175
_b8r0 wrote: post #147

Earlier quoted context omitted.

> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A…

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.

It is already possible using a combination of WPA Enterprise (802.1x) and RADIUS. The RADIUS server is configured to accept any username/password combination, effectively providing an open access point but isolating its users because the 802.1x scheme employs different key material for each user (not completely sure about that key material part but I think that's how it works).
Post reply on HN