Live data from Hacker News

Don't Use VPN Services (2016)

gist.github.com

31–40 of 61 posts

Re: Don't Use VPN Services (2016)

#31
post #22

Some VPN provider's claims were verified in court and thus it's known they don't keep logs, so the article's claims just fall apart: https://www.techspot.com/news/82259-keeping-private-5-vpns-h... Edit: Many coutries have mandatory data retention policies [1], so if you're from one of those countries it's virtually guaranteed that your internet usage logs for the last months/years are logged somewhere. On the otherha…

Some other VPN providers claims were tested by hackers and security researchers and found wanting [0].

The point the article was trying to make was you can never be sure which providers are trustworthy and which ones are not, and even the trustworthy ones today might not be trustworthy tomorrow and you have no way to verify whether they are or aren’t keeping logs.

0: https://www.comparitech.com/blog/vpn-privacy/ufo-vpn-data-ex...

Re: Don't Use VPN Services (2016)

#32
post #22

Some VPN provider's claims were verified in court and thus it's known they don't keep logs, so the article's claims just fall apart: https://www.techspot.com/news/82259-keeping-private-5-vpns-h... Edit: Many coutries have mandatory data retention policies [1], so if you're from one of those countries it's virtually guaranteed that your internet usage logs for the last months/years are logged somewhere. On the otherha…

from that link there is only one "verified" case, and that is with PIA, all others are audits from private firms, or seizure of one particular server that is assuming just a dumb node. even with PIA it's not sure what exactly was asked because its not a USA company, so if i ask you to give me logs for a server in USA, but you don't keep the logs on that server, can you say we dont keep logs on that server.

and do you have time to verify every source of information.

Re: Don't Use VPN Services (2016)

#33

Unless you explicitly need speed, or they're your only option, why do people use VPNs for privacy over Tor? Do they provide any benefits other than being faster? I thought Tor was a much more secure option if privacy in particular is your objective.

People use VPNs at the router level, pushing all network traffic through it. They're also commonly used for torrenting. Both of those require speed.

Additionally, there are still benefits to using a VPN in addition to tor: https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN...

Re: Don't Use VPN Services (2016)

#34

Unless you explicitly need speed, or they're your only option, why do people use VPNs for privacy over Tor? Do they provide any benefits other than being faster? I thought Tor was a much more secure option if privacy in particular is your objective.

TOR exit nodes are more likely to be flagged than VPN servers.

Though even for accessing TOR, using a VPN is a good idea. If you're planning of doing stupid things like mailing in a bomb threat to delay your exams because you haven't studied enough and you're using TOR, the usage itself will point at you if you're the only person using it. Had they used a VPN to access TOR, they wouldn't have been caught that easily.

[1] https://www.forbes.com/sites/runasandvik/2013/12/18/harvard-...

Re: Don't Use VPN Services (2016)

#35
post #15

Earlier quoted context omitted.

I'm interested. I thought the proposed tracking and logging requirements on ISPs never made it through parliament. Do you have any details of the requirements and agencies with access?

Your comment made me look into this in further detail and you may be right; it seems the situation isn't as bad as it once was. > in April 2018, when the high court found the government’s power to order private companies to store communications data, including internet history, to be in breach of citizens' right to privacy. It seems the original proposal has been watered down and then challenged in court. I'm wonderi…

Also, the article makes the weird jump from the fact that it's possible a VPN provider might log you, and possible a government or similarly powerful entity might request those logs, and possible that they might then get them - to the idea that you therefore must assume that will happen.

Jumping through all kinds of administrative hurdles is still a hurdle, even for a government (in fact, in many ways - especially for a government!). A court may not force a VPN provider to hand over logs, and a a VPN provider may have little legal exposure in a country anyhow.

Even if a government somehow managed to get permission to see them, if a VPN provider doesn't have any (or none sufficiently detailed) it's pretty likely it will not suffer much for not having logs (especially given that various privacy laws might even make it illegal to keep unnecessary privacy-sensitive data floating around), and courts tend not to punish even illegal court-order violating behavior when the party was required to engage in that behavior (e.g. by law). If anything, that's a modicum of risk with a high potential reward (publicity here we come!)

And even if a VPN service maintains logs - what kind of logs? There are a lot packets floating around on a VPN, and storing metadata for every single one strikes me as a pretty excessive expense if there's no really good business case for it. Tying various incomplete logs together doesn't always reconstruct the whole story, so it's pretty plausible some logs may still contain less data than would be retrievable if you didn't use a VPN.

All in all it strikes me as invalid reasoning to assume that merely because it's possible a VPN might not keep traffic private that it will in practice leak said traffic. That does not appear to be the path of least resistance. So even if some UK government agency were to have the intent to track some of your traffic - a VPN might well prevent that or at least make it much more expensive (in both time and effort) for said agency to achieve that.

Re: Don't Use VPN Services (2016)

#36
The article raises a few very good concerns about using VPN services, however, the headline is completely misguided. There are valid reasons to use VPN, some even mentioned in the article. One just should not consider is a silver bullet which magically protects you in all aspects. And it is good to warn about non-obvious weaknesses of the concept, especially as most readers are not security experts.

It is however important to tell users, where using a VPN can greatly enhance safety. It does protect your traffic up to the VPN provider. This protects from unsafe local networks and also from any state actor in the country you are in. It doesn't protect from state actors in the country where the VPN exit point is, but depending on which states both are in, can make quite a difference.

Re: Don't Use VPN Services (2016)

#37
post #22

Some VPN provider's claims were verified in court and thus it's known they don't keep logs, so the article's claims just fall apart: https://www.techspot.com/news/82259-keeping-private-5-vpns-h... Edit: Many coutries have mandatory data retention policies [1], so if you're from one of those countries it's virtually guaranteed that your internet usage logs for the last months/years are logged somewhere. On the otherha…

Their upstream providers are happy to tap the traffic if someone with enough $$$ knocks on their door. Also, why are these companies registered in Panama or the British Virgin Islands?

https://en.wikipedia.org/wiki/Offshore_financial_centre

Re: Don't Use VPN Services (2016)

#38

> Because a VPN in this sense is just a glorified proxy. The VPN provider can see all your traffic, and do with it what they want - including logging. Wow, I didn't know VPN providers have broken SSL and can read all that traffic. This was on the frontpage before. Are people just upvoting it for the clickbait headline without reading the points that are being made?

They don't need to look in the content, they only need to check your DNS queries

That is why one should use DNS over https, so to track your DNS queries they would have to track your requests at the DNS server.

Re: Don't Use VPN Services (2016)

#39
I think it is pretty funny that his suggestion is that you should setup your own VPN. Your hosting provider knows your real identity and is going to shut you down very quickly if something happens and is far more likely to yield to legal pressure because they don't earn money from privacy. Meanwhile for a VPN provider it would at least make sense to invest into a legal team that at least throws empty threats into the recycling bin instead of "selling you out" as soon as there is even a hint that you are a problematic customer.

Re: Don't Use VPN Services (2016)

#40
post #25

In defence of the big VPN providers. 1) Why would you keep logs, when you could then be compelled to hand them over? 2) As setting up a VPN company is easy/cheap, you conversely have to spend a large pile of cash to advertize your way to the top. The only asset you really end up with is your name/reputation. Publicly burning a customer would be incredibly expensive. Adjusts tinfoil hat I think the point about VPN pro…

If there are trusted and untrusted agents, and you can’t tell the two groups apart, it’s sensible not to trust anyone.

Also, the government, in addition to setting up honeypots, could simply require the providers to log. The way that it works, there are only a couple of people in the company who need to be aware of that; such fact will never be known to the public. There is zero audit trail.

Post reply on HN