Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN – Very Precarious Narrative

schub.io

Post reply on HN
Print view View original

251–260 of 281 posts

Re: VPN – Very Precarious Narrative

#251

Post by [deleted] »

bitreality wrote: post #152
comex wrote: post #66

Earlier quoted context omitted.

The demands mentioned in your link did reference specific US legislation: FISA section 702.

Before all this information got leaked, nobody knew about FISA section 702, nor had any idea how it was being interpreted and acted on by government agencies. I think it's quite clear that the secret courts in the US put huge demands on organizations to share and collect data on government behalf. Even worse, the organizations can not even publicly disclose information from the proceedings. Until I see something to c…

[deleted]

Re: VPN – Very Precarious Narrative

#252

Post by ridgewell »

_ea1k wrote: post #228
cantrevealname wrote: post #57

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine t…

I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel. But in reality, the services that really need security are going over TLS, where at least the connection itself is secure (presuming that you are taking the same safeguards that you'd take on a "secure" network). In reality, no internet network is naturally…

>But in reality, the services that really need security are going over TLS, where at least the connection itself is secure.

I think other considerations include whether or not the sites that you visit implement HSTS. While many sites do support HTTPS-only logins, several webservices are actually quite vulnerable to software such as SSLstrip[1], which redirects hijacked users to plaintext HTTP pages whenever feasible.

While many sites implement TLS, several sites don't implement HSTS. I am not sure about the HSTS policies of the top 3000 sites so I will not comment on that.

[1]https://moxie.org/software/sslstrip/

Re: VPN – Very Precarious Narrative

#253

Post by ridgewell »

mattnewport wrote: post #17

I have a pretty limited selection of ISPs available to me in my area and they make no effort to promise any kind of anonymity or privacy. Indeed here in Canada ISPs have frequently given subscriber contact information to copyright holders to issue warnings based on bittorrent usage without being legally required to. When visiting the UK certain IPs are blocked by ISPs. I can choose from a wide variety of VPN provider…

>Canada ISPs have frequently given subscriber contact information to copyright holders to issue warnings based on bittorrent usage without being legally required to.

This is false. ISPs do not disclose your personal information for copyright complaints.

Industry, Science and Economic Development Canada explicitly states that subscriber information is only disclosed "if ordered to do so by a court ... as part of a copyright infringement lawsuit." [1]

Copyright infringement suits are known to have happened, but they are rare because the limit for non-commercial infringement is $5,000, which is generally not worth pursuing through the courts.

[1] http://www.ic.gc.ca/eic/site/oca-bc.nsf/eng/ca02920.html

Re: VPN – Very Precarious Narrative

#254

Post by netwanderer3 »

danShumway wrote: post #208
netwanderer3 wrote: post #117

Earlier quoted context omitted.

My point is if you are trying to prevent someone to build a profile on you entirely then VPN is useless. For majority of the public who use a VPN provider, they are essentially shifting all the risks of their personal privacy from a highly regulated industry (ISP) to one that is much less regulated (VPN providers). This is a bit similar to all the ICO scams associated with an unregulated cryptocurrency industry. ISP…

> ISP at least will not sell your data to questionable buyers https://techcrunch.com/2019/01/09/us-cell-carriers-still-sel... ISP regulation in the US has completely failed to prevent abuses. I'm not here to argue that you should blindly grab a 4-5$ a month VPN, but absent a technological solution like Tor, this is better than nothing. But if you really think your ISP is more trustworthy than PIA, set up your own VPN…

The only effective way, that I know of, to prevent someone to build a profile on you is by throwing a lot of useless data to confuse them. Blocking their access is not effective because they have multiple ways to get to you, especially when you're just part of a bigger target market. These conventional methods like VPN are simply too easy for them with million of other people also using it.

If you're constantly throwing useless data at them, adding irrelevant URLs or browsing patterns to the data stream then their system will be confused and unable to paint an accurate picture of your profile.

This is borrowed from a similar strategy used by professionals who have gone off-grid and wanted to avoid being tracked. They would pay multiple other people to use their credit/debit cards at various different locations around the world so the system tracking them would be confused and could not pin point their exact current location.

Re: VPN – Very Precarious Narrative

#255

Post by pvg »

mirimir wrote: post #116
tptacek wrote: post #9

Earlier quoted context omitted.

Who cares if they log now? They can be forced to log --- and are in fact running businesses the practically beg the DOJ to force them to log.

So how would the US government force Insorg, which is Russian, to log?

which is Russian

That's a bit like moving from Phoenix to Pyongyang to escape the unconscionable oppression of your local HOA.

Re: VPN – Very Precarious Narrative

#257

Post by crooked-v »

AstralStorm wrote: post #51
crooked-v wrote: post #44

Earlier quoted context omitted.

> You could sure them under wiretapping laws of they did. I assume you meant "sue", but, no, that's not actually a guarantee, because companies can require that you "voluntarily" agree to mandatory arbitration in order to get any service at all.

Those clauses are illegal, much like indemnification by you of a big ISP. Even clauses of choice of law are very suspect. Relying on such a clause to attempt to prevent a civil suit is stupidity, if only because people are not properly informed of what the clause meant, making it void. (I could quote a few cases. But I am not a lawyer. Microsoft and EULA comes to mind.) And by EU law, they are completely null and voi…

> Those clauses are illegal

Not in the US!

https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc...

Re: VPN – Very Precarious Narrative

#258

Post by mirimir »

dvcrn wrote: post #157
mirimir wrote: post #126

Earlier quoted context omitted.

Sure. But each VPS has its own IP address. The VPS provider probably retains logs. And its ISP probably also retains logs. And everything involving that IP address is associated with you.

For incoming traffic yes, but outgoing traffic is heavily dependent on what you use. A lot of virtual spaces use the same outgoing IP

I don't recall seeing that. VPS got their own public IPs. Which would show up in ipchicken or whatever.

Re: VPN – Very Precarious Narrative

#259

Post by mirimir »

chii wrote: post #143
mirimir wrote: post #48

Earlier quoted context omitted.

Well sure you can. But what about all those surveillance cameras? And the license plate cameras? Me, I wouldn't count on those giftcards.

if they don't accept bitcoins, then it's not anonymous.

Some also accept cash by snail mail.

Re: VPN – Very Precarious Narrative

#260

Post by mirimir »

tptacek wrote: post #237
mirimir wrote: post #36

Earlier quoted context omitted.

Which is why many people don't use US-based VPN services.

So that, instead of the US using legal formalisms to gain access to your data, they can simply (under our law) hack it directly? While at the same time, whatever host country is involved can use their legal formalisms to get access to the data? How is that helping you?

It helps me because I use nested VPN chains. And because I alternate jurisdictions. With the goal of complicating log collection.

But in any case, I don't count on nested VPN chains for serious anonymity. Mostly I use them to avoid hassle from torrenting. And conversely, torrenting provides cover traffic, and as well a plausible reason for using VPN services.

But mostly I use nested VPN chains to hide Tor use from local observers. Because Tor usage is far less common than VPN usage, and so far more of a red flag for increased surveillance.

Post reply on HN