Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN – Very Precarious Narrative

schub.io

Post reply on HN
Print view View original

211–220 of 281 posts

Re: VPN – Very Precarious Narrative

#211

Post by snazz »

chewz wrote: post #186
tyingq wrote: post #5

Seems to ignore two things... a) Your ISP is almost always in the same legal jurisdiction as you are. A VPN need not be. b) A VPN has some incentive to deliver on privacy. Your ISP does not. It's fair to call out that a VPN isn't perfect for either privacy or anonymity. But it clearly can be better than your ISP.

People from the First World have no idea that porn and politically sensitive content is blocked in so many countries. Youtube is heavily censored - you won't be able to watch Charlie Chaplin movies or some lectures on Greek democracy in Thailand. Also this censoring is poorly executed by some ISPs via simple DNS hijacking. As a result your connection is slow and with terrible jitter. As for the proverbial airport/caf…

How would an attacker access your laptop’s filesystem if you’re connected to the same network? I can’t think of any way that would work unless your operating system is horribly misconfigured (maybe to make the entire filesystem a network drive?). And how would a VPN protect you here?

Re: VPN – Very Precarious Narrative

#212

Post by dahfizz »

lifthrasiir wrote: post #87
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

He made this point explicit: > Networks like these make it easy for attackers to get a copy of your network data, and if you send something unencrypted, the results can be quite harmful. The web should be ideally end-to-end encrypted with HTTPS. But in case this assumption breaks down, VPN gives an additional headroom for security. Not much (as explained in the article, and thus should not be advertised so), but stil…

The internet is so much bigger than just websites. HTTPS is great but VPNs provide encryption at a much lower level, where it should be. Even when using https you are exposing a lot of unencrypted data because https is an application layer encryption. It's not enough.

Re: VPN – Very Precarious Narrative

#213

Post by paultopia »

A charming piece of evidence for the IP addresses aren't actually all that useful for tracking point is just how easy it is to evade volume-limitation paywalls on sites like medium: open a clean browser, oh hey, the website has no idea I've already read 3 of your crappy clickbait articles this month! Clearly wouldn't work if they bothered to keep track of IP addresses in addition to cookies or whatever.

Re: VPN – Very Precarious Narrative

#214

Post by chewz »

snazz wrote: post #211
chewz wrote: post #186

Earlier quoted context omitted.

People from the First World have no idea that porn and politically sensitive content is blocked in so many countries. Youtube is heavily censored - you won't be able to watch Charlie Chaplin movies or some lectures on Greek democracy in Thailand. Also this censoring is poorly executed by some ISPs via simple DNS hijacking. As a result your connection is slow and with terrible jitter. As for the proverbial airport/caf…

How would an attacker access your laptop’s filesystem if you’re connected to the same network? I can’t think of any way that would work unless your operating system is horribly misconfigured (maybe to make the entire filesystem a network drive?). And how would a VPN protect you here?

Do you think every single machine/local network access is properly configured, especially with Windows? Not once I have been browsing Point-Of-Sale files in a cafe where I have been using WiFi cause someone did not separate networks. Just an example.

Re: VPN – Very Precarious Narrative

#215

Post by dguido »

simias wrote: post #182
dguido wrote: post #43

The slimy marketing around centralized VPN services is why I consider it a point of pride to include the following as a "feature" in the AlgoVPN readme ( > Anti-features > * Does not support legacy cipher suites or protocols like L2TP, IKEv1, or RSA > * Does not install Tor, OpenVPN, or other risky servers > * Does not depend on the security of TLS > * Does not require client software on most platforms > * Does not c…

> * Does not install Tor, OpenVPN, or other risky servers What do you mean by "risky servers" here? I run OpenVPN on a few servers, is there something I should know?

There's an FAQ in the AlgoVPN documentation that addresses this question (https://github.com/trailofbits/algo/blob/master/docs/faq.md#...):

> Why aren't you using OpenVPN?

> OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to update[1] and maintain[2] the software themselves. OpenVPN depends on the security of TLS[3], both the protocol[4] and its implementations[5], and we simply trust the server less due to past[6] security[7] incidents[8].

[1] https://www.exploit-db.com/exploits/34037/

[2] https://www.exploit-db.com/exploits/20485/

[3] https://tools.ietf.org/html/rfc7457

[4] https://arstechnica.com/security/2016/08/new-attack-can-pluc...

[5] https://arstechnica.com/security/2014/04/confirmed-nasty-hea...

[6] https://sweet32.info/

[7] https://github.com/ValdikSS/openvpn-fix-dns-leak-plugin/blob...

[8] https://www.exploit-db.com/exploits/34879/

Re: VPN – Very Precarious Narrative

#216

Post by smolder »

john_minsk wrote: post #139
AstralStorm wrote: post #55

Earlier quoted context omitted.

And a lot of money to a lawyer who will sue the ISP under privacy laws if it comes to light. It has to be clearly stated in the signed contract that your data will be shared with third parties, in what way and how they will be processed. The company involved would definitely lose any Privacy Shield provisions for the EU and potentially peering rights. Losing enough peering is identical to being disconnected. Class su…

>Class suit of this kind is easy. ...in US

No, definitely not in the US. They sell everything and our treacherous congress specifically voted to allow it.

Re: VPN – Very Precarious Narrative

#217

Post by zamadatix »

m0dest wrote: post #175
_b8r0 wrote: post #147

Earlier quoted context omitted.

> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A…

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.

OWE and an SAE PSK network with a well known PSK do not solve the trust issue of connecting to public Wi-Fi rather only the encryption issue.

Take the example that you are connecting to an SSID named "Airport_Guest_WiFi". In the case of OWE you simply connect and now everything between you and "Airport_Guest_WiFi" is encrypted. In the case of PSK with SAE you connect to "Airport_Guest_WiFi" and exchange information to generate secret keys only you two know. The problem in either scenario is you've just set up encryption not trust. How do you know the "Airport_Guest_WiFi" you connected to was the airports or the attackers?

WPA3 Enterprise solves this issue somewhat but is not realistic to deploy for temporary guest networks.

I argued ever since I heard OWE was going into draft it should have some optional mode for PKI validation. E.g. if you connect to the SSID "guestwifi.airport.com." and the airport signed the hello with the cert for that domain then the client could validate that against it's root stores and have the same level of identity trust it does when connecting to usersbank.com. Clients need not be forced to validate it but at least it gives a realistic option to connecting to such networks.

Re: VPN – Very Precarious Narrative

#218

Post by nobatron »

mirimir wrote: post #16

Damn. I don't even know where to begin. It's true that VPN services at best provide less anonymity than Tor does. And that some, such as HideMyAss (which pwned that LulzSec dude) provide none. But PIA clearly does, as demonstrated now in two criminal investigations.[0] Of course, in both cases, defendants pwned themselves through poor OPSEC. But at least PIA didn't give them up. And the Facebook example. Nobody payin…

I think the author's point is that the ads put out by lots of these VPN providers do suggest that they are a one stop shop to hide your identity.

Re: VPN – Very Precarious Narrative

#219

Post by JetSpiegel »

snazz wrote: post #211
chewz wrote: post #186

Earlier quoted context omitted.

People from the First World have no idea that porn and politically sensitive content is blocked in so many countries. Youtube is heavily censored - you won't be able to watch Charlie Chaplin movies or some lectures on Greek democracy in Thailand. Also this censoring is poorly executed by some ISPs via simple DNS hijacking. As a result your connection is slow and with terrible jitter. As for the proverbial airport/caf…

How would an attacker access your laptop’s filesystem if you’re connected to the same network? I can’t think of any way that would work unless your operating system is horribly misconfigured (maybe to make the entire filesystem a network drive?). And how would a VPN protect you here?

> unless your operating system is horribly misconfigured

So, Windows with (default?) settings?

Re: VPN – Very Precarious Narrative

#220

Post by ylere »

> Starting with the obvious, if you pay for a VPN service, they have to keep your user account and associated payment information and your payment history. So, unless you are using a fake identity and an anonymous credit card (is that even possible these days?), your VPN account will be linked to your actual identity.

Check out https://mullvad.net if you want a VPN that takes anonymity serious. They don't even have real accounts, you just pay (preferably via BTC or even cash via postal mail) towards an account number that is also used as an identifier to authenticate towards the service. While there is no 100% guarantee, I would trust their claim that they do not log.

Post reply on HN