VPN – Very Precarious Narrative • Hacker News Board

Re: VPN – Very Precarious Narrative

#191

Post by chewz » Mon, Apr 08, 2019, 10:34 AM UTC

chewz wrote: post #186

tyingq wrote: post #5

Seems to ignore two things... a) Your ISP is almost always in the same legal jurisdiction as you are. A VPN need not be. b) A VPN has some incentive to deliver on privacy. Your ISP does not. It's fair to call out that a VPN isn't perfect for either privacy or anonymity. But it clearly can be better than your ISP.

People from the First World have no idea that porn and politically sensitive content is blocked in so many countries. Youtube is heavily censored - you won't be able to watch Charlie Chaplin movies or some lectures on Greek democracy in Thailand. Also this censoring is poorly executed by some ISPs via simple DNS hijacking. As a result your connection is slow and with terrible jitter. As for the proverbial airport/caf…

> Thailand’s Junta Got Charlie Chaplin’s ‘The Great Dictator’ Blocked From YouTube YouTube caved to requests from Thailand's military-backed government to block a Thai-subtitled clip from the renowned political satire.

https://www.indiewire.com/2017/06/great-dictator-blocked-tha...

Re: VPN – Very Precarious Narrative

#192

Post by icebraining » Mon, Apr 08, 2019, 10:59 AM UTC

CKN23-ARIN wrote: post #179

m0dest wrote: post #175

Earlier quoted context omitted.

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.

Many ways to do this. Make the password widely-known. Announce it over the intercom. Post it on the walls. Offer both encrypted and non-encrypted SSIDs. The non-encrypted SSID could even just be a captive portal with instructions to connect to the encrypted SSID. If you're feeling wild, use WPA2 Enterprise, and accept any credentials.

"WPA and WPA2 don't provide forward secrecy, meaning that once an adverse person discovers the pre-shared key, they can potentially decrypt all packets encrypted using that PSK transmitted in the future and even past, which could be passively and silently collected by the attacker. This also means an attacker can silently capture and decrypt others' packets if a WPA-protected access point is provided free of charge at a public place, because its password is usually shared to anyone in that place. In other words, WPA only protects from attackers who don't have access to the password."

https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of...

Re: VPN – Very Precarious Narrative

#193

Post by oedmarap » Mon, Apr 08, 2019, 11:02 AM UTC

It seems that the author's target audience is highly non-technical readers. I'm not sure if the article does more harm than good by just citing existing technologies that aren't used by privacy-minded power users without pointing towards proven solutions as well, even if they may require effort to implement. All is not lost.

The article touches on the OpenVPN protocol, "commercial" VPN providers (ExpressVPN in the screencap), but just glosses over the availability of better protocols, good providers, useful browser extensions, and democratized DNS encryption.

A combination of a WireGuard VPN provider (Mullvad comes to mind), using only the Firefox browser with a few extensions (such as Multi-Account Containers, HTTPS Everywhere, Privacy Badger, Decentraleyes, etc.), and using DNS over HTTPS (can be enabled in FF as well) will solve most of the problems the article posits. Running AdGuard as a local DNS server with upstream DoH is also something relatively easy to do.

Sure, overall security posture calls for a bit more but a good [VPN + DoH + FF + AdBlocking] setup should be the norm and not the exception; and will definitely pay off dividends rather than just letting a green padlock give users peace of mind.

I'll actually write a how-to on this, since I don't want to seem like I'm just mentioning a solution without actually providing the steps to get there.

Re: VPN – Very Precarious Narrative

#194

Post by zcid » Mon, Apr 08, 2019, 11:14 AM UTC

tya99 wrote: post #178

pizzazzaro wrote: post #173

Earlier quoted context omitted.

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. Payment information - some p…

> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not. Essentially…

I use a very similar list of addons. In addition I recommend:

* CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...

* Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

and I block cookies by default using uMatrix.

Thanks for pointing out CSS Exfil Protection. I hadn't seen that one yet.

Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.

Re: VPN – Very Precarious Narrative

#195

Post by tya99 » Mon, Apr 08, 2019, 11:26 AM UTC

zcid wrote: post #194

tya99 wrote: post #178

Earlier quoted context omitted.

> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not. Essentially…

I use a very similar list of addons. In addition I recommend: * CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker... * Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... and I block cookies by default using uMatrix. Thanks for pointing out CSS Exfil Protection. I hadn't seen that one yet. Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This…

I use a very similar list of addons. In addition I recommend:

> * CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker....

A lot of people recommend that, but you don't need it if you're using ghacks-user.js. The reason is because of privacy.resistFingerprinting.

> * Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode....

> and I block cookies by default using uMatrix.

I use CookieAutodelete on my mobile because unfortunately the container API isn't available on the Android version of Firefox.

The reason I don't use it on my desktop is because there are certain types of things that cannot be cleared.

> APIs do not exist to allow clearing IndexedDB, Service Workers cache, appCache, or cache by host. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false sense of privacy.

* https://github.com/Cookie-AutoDelete/Cookie-AutoDelete/wiki/...

* https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Exte...

> Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.

I might have to check that out.

Re: VPN – Very Precarious Narrative

#196

Post by nuclx » Mon, Apr 08, 2019, 11:32 AM UTC

jedberg wrote: post #89

jwr wrote: post #30

I use VPNs for one main reason: so that my ISP does not build a complete profile of me based on the sites I'm visiting. This can be mitigated to a certain extent by using a VPN. I do not expect to become anonymous or invisible on the internet all of a sudden, I just do not want the guy listening next to my front door to know everything about me. In the US, where personal data is a free-for-all and everybody and their…

But all you've done is kick the can down the road, so now your VPN service can build a profile on you instead.

Then use different VPNs for different types activities, combine it with TOR if necessary. It's not like it's a free lunch.

Re: VPN – Very Precarious Narrative

#197

Post by discordance » Mon, Apr 08, 2019, 11:32 AM UTC

sbr464 wrote: post #42

denschub wrote: post #14

Earlier quoted context omitted.

It's called Tor. And you don't even need a subscription for that.

Although I’m familiar with Tor, my thinking was packaging that concept in a better way, similar to how vpn services market themselves.

You want to sell TOR? - please don't.

Re: VPN – Very Precarious Narrative

#198

Post by FabHK » Mon, Apr 08, 2019, 11:52 AM UTC

tya99 wrote: post #178

pizzazzaro wrote: post #173

Earlier quoted context omitted.

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. Payment information - some p…

> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not. Essentially…

Superb list.

But what world are we living in that one needs a specific browser with 10+ addons and tweaks to have some amount of basic privacy. Lunacy!

Re: VPN – Very Precarious Narrative

#199

Post by progval » Mon, Apr 08, 2019, 11:52 AM UTC

simias wrote: post #182

dguido wrote: post #43

The slimy marketing around centralized VPN services is why I consider it a point of pride to include the following as a "feature" in the AlgoVPN readme ( > Anti-features > * Does not support legacy cipher suites or protocols like L2TP, IKEv1, or RSA > * Does not install Tor, OpenVPN, or other risky servers > * Does not depend on the security of TLS > * Does not require client software on most platforms > * Does not c…

> * Does not install Tor, OpenVPN, or other risky servers What do you mean by "risky servers" here? I run OpenVPN on a few servers, is there something I should know?

It uses openssl, which regularly gets security issues published.

It shouldn't be too bad if you keep your server and clients updated, though (depending on your thread model).

Re: VPN – Very Precarious Narrative

#200

Post by discordance » Mon, Apr 08, 2019, 11:53 AM UTC

droithomme wrote: post #63

Causality1 wrote: post #33

Author has a computer science understanding of VPNs but is breathtakingly ignorant as to the actual use cases of commercial VPNs. They're used for getting around geoocming and media throttling sure, but the biggest use is piracy. Also, his disbelief of anonymous payment methods is incredibly stupid. I can walk into a store right now and get a prepaid visa using cash, no crypto currency shenanigans required.

> I can walk into a store right now and get a prepaid visa using cash WalMart, Target, and many other large retailers retain photographic records of all purchasers. Many cases have been broken by police claiming to have found a match at a WalMart for the purchase of items committed in some crime. So cash purchases of cards is not always a completely anonymous choice.

Got a source on that? - Would be surprised (and disappointed) if Target/Walmart keep pictures of non-authenticated customers linked to the invoice record. Have Google'd around but haven't found anything on that.