VPN – Very Precarious Narrative • Hacker News Board

Re: VPN – Very Precarious Narrative

#221

Post by prophesi » Mon, Apr 08, 2019, 1:41 PM UTC

cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

It should be noted that SSLstrip is a thing. Those sites would need to properly force HTTPS, which is easy to get wrong. And it's much easier to allow both HTTP/HTTPS.

Re: VPN – Very Precarious Narrative

#222

Post by pbhjpbhj » Mon, Apr 08, 2019, 1:45 PM UTC

amdavidson wrote: post #205

pbhjpbhj wrote: post #189

Earlier quoted context omitted.

A foreign provide surely has more, in the legal realm, than a domestic one?

What legal protection from the NSA does a foreign (to the USA) provider have? Signals intelligence from foreign sources is the NSA's exact mission. At least the NSA has a purported requirement not to do domestic spying, even if Snowden proved that's not being followed.

I was thinking that a domestic entity has no protections from the NSA, they have to open up if NSA says so "for national security reasons"? Whilst a foreign entity has not requirements to do so. Both domestic and foreign entities are subject to the same practical abilities; ergo a foreign entity is safer?

As for "no domestic spying", I thought the five-eyes group spied on each other to order so as to circumvent those requirements in domestic law??

Re: VPN – Very Precarious Narrative

#223

Post by dangerface » Mon, Apr 08, 2019, 1:46 PM UTC

tyingq wrote: post #5

Seems to ignore two things... a) Your ISP is almost always in the same legal jurisdiction as you are. A VPN need not be. b) A VPN has some incentive to deliver on privacy. Your ISP does not. It's fair to call out that a VPN isn't perfect for either privacy or anonymity. But it clearly can be better than your ISP.

> Your ISP is almost always in the same legal jurisdiction as you are. A VPN need not be.

Most of them are registered in five eyes countries, or twelve eyes. If they have anything in the US even if its just a single server they will claim jurisdiction over the lot.

There are too many agreements and loopholes to rely on the whole jurisdiction thing. Unless you use a 100% Estonia VPN company and server with no other locations you are not safe, even then its not enough. 5 years ago Sweeden was the safest country for privacy, things change.

> A VPN has some incentive to deliver on privacy. Your ISP does not.

While they generally don't an ISP can give you better privacy than a VPN, no worries about dns leaks, they can route every one through a low latency mixer etc.

I would rather pay an extra £20 a month to my ISP for real privacy than pay a VPN £5 a month for fake peace of mind.

Re: VPN – Very Precarious Narrative

#224

Post by pbhjpbhj » Mon, Apr 08, 2019, 1:51 PM UTC

headmelted wrote: post #203

pbhjpbhj wrote: post #187

Earlier quoted context omitted.

I don't think your analysis is complete. Most VPN's raison d'être is providing privacy. If it's publicly known that they don't then that kills their business. An ISP is tasked with connecting prior to the internet, they don't make claims about privacy, they can reveal information about clients without necessarily putting anyone off, most of the clients for large ISPs have probably never heard of a VPN. If a VPN wante…

>There was a paper a little while ago, they directly identified pages by mitm-ing HTTPS by using meta-data (page size alone IIRC). Success was something like 80%. Link please. I don't doubt what you're saying, I'm just really interested in reading more about this.

https://scirate.com/arxiv/1403.0297

>We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. //

Re: VPN – Very Precarious Narrative

#225

Post by scoutt » Mon, Apr 08, 2019, 1:56 PM UTC

Regarding "no logs", it is true that the VPN has to check if your account is valid, or maybe how many devices you can connect. But one thing is monitoring and another, different thing is to log that information.

Also, this doesn't mean that the traffic or destination addresses are also logged at the VPN (the most important data).

But, is also true that you'll never know.

Re: VPN – Very Precarious Narrative

#226

Post by el_cujo » Mon, Apr 08, 2019, 2:12 PM UTC

I'm surprised he doesn't mention torrenting directly. I have no stats to back this up, but I would assume the vast majority of people who get VPNs do so for torrenting. I agree that the current advertising riding the wave of the facebook hate/privacy "awareness" is scummy, but nothing in the article seems to say VPNs aren't effective from hiding your TPB traffic from your ISP, which if I had to guess is the real most popular use-case.

Re: VPN – Very Precarious Narrative

#227

Post by el_cujo » Mon, Apr 08, 2019, 2:14 PM UTC

nobatron wrote: post #218

mirimir wrote: post #16

Damn. I don't even know where to begin. It's true that VPN services at best provide less anonymity than Tor does. And that some, such as HideMyAss (which pwned that LulzSec dude) provide none. But PIA clearly does, as demonstrated now in two criminal investigations.[0] Of course, in both cases, defendants pwned themselves through poor OPSEC. But at least PIA didn't give them up. And the Facebook example. Nobody payin…

I think the author's point is that the ads put out by lots of these VPN providers do suggest that they are a one stop shop to hide your identity.

He's right about the scummy advertising, but I think he goes a little too hard-core contrarian in the end by basically suggesting the only reason to have a VPN is for airport/starbucks wifi.

Re: VPN – Very Precarious Narrative

#228

Post by _ea1k » Mon, Apr 08, 2019, 2:22 PM UTC

cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel. But in reality, the services that really need security are going over TLS, where at least the connection itself is secure (presuming that you are taking the same safeguards that you'd take on a "secure" network). In reality, no internet network is naturally secure and the only security are these transport level encryptions.

But, of course, there is more to it than that. What about the unencrypted connections? DNS access and logging? Ironically these are what people tend to worry the least about but are the most likely to be compromised. A VPN can be very helpful here.

The article brushed across this distinction in a way that I think may have just been confusing to anyone that didn't already understand it. The net effect is that they might see these two pieces of advice as contradictory.

Re: VPN – Very Precarious Narrative

#229

Post by t0astbread » Mon, Apr 08, 2019, 2:24 PM UTC

I still have a few questions after reading that text:

1) I'm not entirely convinced on the IP address tracking thing yet. Sure, you probably sit behind a NAT device on your home internet connection. But what about mobile? Are cellular networks NATed? Also, do trackers really not use IP addresses for tracking? It seems like a stable identifier as long as the "victim" is not obscuring it and as long as you can somehow link it to the victim's next IP address (unless it's static).

2) How are DNS queries not sensitive information? They tell what services you use on the web. It's how you use the internet. I don't really want any untrusted party to see that.

Re: VPN – Very Precarious Narrative

#230

Post by fonosip » Mon, Apr 08, 2019, 2:40 PM UTC

cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

We usually do not have a choice of ISP. A VPN gives you the option of where to "attach" to the internet. As an added bonus at that point you can filter ads, malware, tracking.