31–40 of 41 posts
Earlier quoted context omitted.
Are they? I can lease a VPS for under $12 a year. I don’t know of a VPN service that cheap unless it’s free and has limitations.
that cheap? where?
Why is it not illegal to sell this type of data everywhere?
Why is it not illegal to sell this type of data everywhere?
" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.
What blows my mind is the number of people signing up for these "VPN" services thinking it's secure. Time and time again we've found that they are logging and if they aren't it's logged at the flow point (as linked in this article). I'm fine with VPN to evade restrictions or whatever purpose you want, but stop pretending it's all that different. I can say though for a fact that a few of the largest security companies…
Is anyone actually pretending it’s different? Most people I talk to buy VPN services to avoid legal threats from pirated movies or to avoid traffic surveillance from their local ISP / workplace / institution. I’ve never heard someone describe it like a hard-to-denonymize tor node or anything.
Earlier quoted context omitted.
Are they? I can lease a VPS for under $12 a year. I don’t know of a VPN service that cheap unless it’s free and has limitations.
That would have lower bandwidth, no easy way to switch countries, and your server IP is completely static and identifiable (worse privacy). And it's more likely to be a datacenter IP which is blocked.
Earlier quoted context omitted.
An adversary who can see your vpn traffic can use traffic analysis [1] to correlate known protocol packet patterns and timestamps to netflow traces to known destinations serving known content with matching timestamps from vpn termination points. [1] https://en.m.wikipedia.org/wiki/Traffic_analysis
Would this still be an effective attack if you used a single VPN provider with multiple hops and your adversary was not someone like a nation state? Alternatively, what if you did basic VPN chaining (e.g. you vpn to a pfsense instance or something on a VPS and configure outbound traffic on that server to be routed through a commercial VPN)?
Earlier quoted context omitted.
" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.
Can I have your netflow data?
Earlier quoted context omitted.
Is anyone actually pretending it’s different? Most people I talk to buy VPN services to avoid legal threats from pirated movies or to avoid traffic surveillance from their local ISP / workplace / institution. I’ve never heard someone describe it like a hard-to-denonymize tor node or anything.
Also to prevent people on your local network from snooping on your traffic and stealing credentials and other sensitive data that might be passed over the wire. I once had my AWS API keys compromised this way. It was a pain to resolve that situation. I'm a lot more careful now.
Presumably you were copying them over the network unencrypted?
Earlier quoted context omitted.
An adversary who can see your vpn traffic can use traffic analysis [1] to correlate known protocol packet patterns and timestamps to netflow traces to known destinations serving known content with matching timestamps from vpn termination points. [1] https://en.m.wikipedia.org/wiki/Traffic_analysis
Would this still be an effective attack if you used a single VPN provider with multiple hops and your adversary was not someone like a nation state? Alternatively, what if you did basic VPN chaining (e.g. you vpn to a pfsense instance or something on a VPS and configure outbound traffic on that server to be routed through a commercial VPN)?
Can someone explain to me why anyone would use a consumer VPN versus SSH tunneling through to a nation with secure data privacy laws if you know what you're doing, other than convenience or the number of countries you can connect to for Netflix purposes maybe?