Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN – Very Precarious Narrative

schub.io

Post reply on HN
Print view View original

41–50 of 281 posts

Re: VPN – Very Precarious Narrative

#41

Post by mirimir »

denschub wrote: post #31
sbr464 wrote: post #26

Earlier quoted context omitted.

I thought with tor you still connect to a single gateway and all traffic is sent to that remote endpoint? Or is it done locally?

Tor, originally from "The Onion Router", works by routing your traffic through multiple Tor nodes. Like an onion, each node only peels off one layer and passes the packet on to whoever is addressed on that layer. Each node only knows the details about the next node. Eventually, the packet will hit an "Exit-Node", at which point it will be routed via the internet through the endpoint, but it's not a single route. And…

Just to clarify, it's Tor clients that select which relays (entry guard, middle and exit) to use in circuits. Also, each relay in a circuit knows (or at least, could know, if it wanted to) both source and destination. But with three-relay circuits, no relay know both user identity and destination.

Also, by default, Tor changes circuits at 10-minute intervals.

Re: VPN – Very Precarious Narrative

#42

Post by sbr464 »

denschub wrote: post #14
sbr464 wrote: post #12

Just a thought—Couldn’t there be a service In front of ~5-1,000 different vpn services that would locally (depending on your subscription level) send each request to a random list of vpn providers (like a random dns provider? Somewhat complicating/obscuring the issue that arises with centralizing your traffic to single endpoint?

It's called Tor. And you don't even need a subscription for that.

Although I’m familiar with Tor, my thinking was packaging that concept in a better way, similar to how vpn services market themselves.

Re: VPN – Very Precarious Narrative

#43

Post by dguido »

The slimy marketing around centralized VPN services is why I consider it a point of pride to include the following as a "feature" in the AlgoVPN readme (

> Anti-features

> * Does not support legacy cipher suites or protocols like L2TP, IKEv1, or RSA

> * Does not install Tor, OpenVPN, or other risky servers

> * Does not depend on the security of TLS

> * Does not require client software on most platforms

> * Does not claim to provide anonymity or censorship avoidance

> * Does not claim to protect you from the FSB, MSS, DGSE, or FSM

It's incredible how quickly services that massively centralize bulk consumer web traffic were normalized. This is not ok. Further, most of these services are located in "exotic" locales with uncertain legal protections, anonymous or psuedo-anonymous owners, and make barely enough revenue to hire more than 3 or 4 staff members to maintain and secure their own infrastructure. This whole industry is a slow motion disaster.

Re: VPN – Very Precarious Narrative

#44

Post by crooked-v »

AstralStorm wrote: post #38
jwr wrote: post #30

I use VPNs for one main reason: so that my ISP does not build a complete profile of me based on the sites I'm visiting. This can be mitigated to a certain extent by using a VPN. I do not expect to become anonymous or invisible on the internet all of a sudden, I just do not want the guy listening next to my front door to know everything about me. In the US, where personal data is a free-for-all and everybody and their…

The ISP can easily build a reasonably reliable profile based just on packet size and timing. TLS and most VPNs do nothing to these. If they actually wanted to. You could sure them under wiretapping laws if they did. If you cannot trust your ISP, you cannot really have any privacy without truly extensive measures. Not even Tor is enough, it does not pad and change timing enough. The real problem is cookies, requiremen…

> You could sure them under wiretapping laws of they did.

I assume you meant "sue", but, no, that's not actually a guarantee, because companies can require that you "voluntarily" agree to mandatory arbitration in order to get any service at all.

Re: VPN – Very Precarious Narrative

#45

Post by mindslight »

mirimir wrote: post #16

Damn. I don't even know where to begin. It's true that VPN services at best provide less anonymity than Tor does. And that some, such as HideMyAss (which pwned that LulzSec dude) provide none. But PIA clearly does, as demonstrated now in two criminal investigations.[0] Of course, in both cases, defendants pwned themselves through poor OPSEC. But at least PIA didn't give them up. And the Facebook example. Nobody payin…

Of course one has to wonder how much of that "poor OPSEC" is actually just parallel construction. The linked article doesn't sound like it. But on the other hand with the way mass market VPN software generally works, how many people are going to be absolutely sure that all of their traffic definitely went out the tunnel?

The FBI having access to an NSA-provided tool that takes some IP addresses and returns other "associated" IP addresses (from trivial packet correlation on PIA's upstream) would produce a pattern of investigation that essentially looks the same.

Re: VPN – Very Precarious Narrative

#46

Post by netwanderer3 »

jwr wrote: post #30

I use VPNs for one main reason: so that my ISP does not build a complete profile of me based on the sites I'm visiting. This can be mitigated to a certain extent by using a VPN. I do not expect to become anonymous or invisible on the internet all of a sudden, I just do not want the guy listening next to my front door to know everything about me. In the US, where personal data is a free-for-all and everybody and their…

If you use Chrome browser or Android phone then Google is already able to build a profile on you. They have multiple ways to ID every session and individual browsing tab to link them back to your profile. VPN is completely irrelevant in their game.

Re: VPN – Very Precarious Narrative

#47

Post by danShumway »

AstralStorm wrote: post #38
jwr wrote: post #30

I use VPNs for one main reason: so that my ISP does not build a complete profile of me based on the sites I'm visiting. This can be mitigated to a certain extent by using a VPN. I do not expect to become anonymous or invisible on the internet all of a sudden, I just do not want the guy listening next to my front door to know everything about me. In the US, where personal data is a free-for-all and everybody and their…

The ISP can easily build a reasonably reliable profile based just on packet size and timing. TLS and most VPNs do nothing to these. If they actually wanted to. You could sure them under wiretapping laws if they did. If you cannot trust your ISP, you cannot really have any privacy without truly extensive measures. Not even Tor is enough, it does not pad and change timing enough. The real problem is cookies, requiremen…

> You could sure them under wiretapping laws of they did.

Has this ever worked though? Cursory searching, I don't see or know of any examples of lawsuits that have actually succeeded on this front. And it's not like ISPs have never given consumers an opportunity before.[0]

[0]: https://www.cnet.com/news/verizon-draws-fire-for-monitoring-...

Re: VPN – Very Precarious Narrative

#48

Post by mirimir »

Causality1 wrote: post #33

Author has a computer science understanding of VPNs but is breathtakingly ignorant as to the actual use cases of commercial VPNs. They're used for getting around geoocming and media throttling sure, but the biggest use is piracy. Also, his disbelief of anonymous payment methods is incredibly stupid. I can walk into a store right now and get a prepaid visa using cash, no crypto currency shenanigans required.

Well sure you can. But what about all those surveillance cameras? And the license plate cameras? Me, I wouldn't count on those giftcards.

Re: VPN – Very Precarious Narrative

#49

Post by comex »

tptacek wrote: post #11
alphabettsy wrote: post #7

They are some valid points in the post, but ISPs collect and will market your data, including browsing data. They recently changed positions and claim they won’t anymore, but there’s no reason to trust them and they’re still using your data for targeted ads meaning they still retain the data. https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-...

The point of the post isn't that you should trust your ISP.

Indeed. Instead it falsely implies that you don’t need to, by glossing over the limits of what HTTPS encrypts and what it doesn’t. And it encourages users to avoid VPNs, making them subject to data collection by their ISP whether they know it or not.
Post reply on HN