Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#61

Post by germanier »

mahyarm wrote: post #45
jankotek wrote: post #33

Earlier quoted context omitted.

Put your consideration in Germany, privacy is pretty enforced here.

GEMA is pretty aggressive in Germany. Talking jane random and they don't do file sharing because they are in fear of GEMA.

People are afraid to file share but not because of GEMA which for once has nothing to do with this. Right holders (especially of popular music, movies, and TV shows) connect to torrents and log who is also in the swarm (i.e. uploading and downloading). They then go to court quickly with your IP which orders your ISP to give up your name and address.

Re: How to build your own VPN if you're wary of commercial options

#62

Post by mahyarm »

germanier wrote: post #61
mahyarm wrote: post #45

Earlier quoted context omitted.

GEMA is pretty aggressive in Germany. Talking jane random and they don't do file sharing because they are in fear of GEMA.

People are afraid to file share but not because of GEMA which for once has nothing to do with this. Right holders (especially of popular music, movies, and TV shows) connect to torrents and log who is also in the swarm (i.e. uploading and downloading). They then go to court quickly with your IP which orders your ISP to give up your name and address.

They tell you about GEMA although as the cause of their fear, at least to me. The details, as you say, are probably different.

Re: How to build your own VPN if you're wary of commercial options

#64

Post by icelancer »

mirimir wrote: post #42
eximius wrote: post #32

Earlier quoted context omitted.

Most people who have an opinion between the two suggest algo is the better of them, for what its worth.

Thanks. I've never used either, actually. I just do it manually. Another good option for AWS is OpenVPN Access Server. There's a template.

Also packages in APT; openvpn-as is trivial to set up as long as TUN/TAP is enabled. Has a web portal and everything and serves Windows and MacOS binaries from the self-signed HTTPS page. Easy for most moderately technical users.

Re: How to build your own VPN if you're wary of commercial options

#65

Post by gruez »

andresgottlieb wrote: post #40
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

Vultr ( http://www.vultr.com/?ref=6979836 ) allows you to pay with bitcoin, making it more difficult to trace you

>allows you to pay with bitcoin, making it more difficult to trace you

...but they require a valid credit card/paypal deposit beforehand, which kills the whole point.

Re: How to build your own VPN if you're wary of commercial options

#66

Post by appleiigs »

TACIXAT wrote: post #17
xpaulbettsx wrote: post #10

Like, I'm not sure why anyone thinks that: 1. AWS, DO or Linode won't respond to a subpoena 2. That any of those three won't have extensive logging in place, without the privacy goals that a VPN provider would have You're just switching your ISP to AWS when you do this, which might be better than what you've got, but certainly isn't flawless untraceable security

I really hope people aren't using a VPN for untraceable security. VPNs are for privacy, not for getting away with illegal things.

Yeah, coffee shop wifi is for getting away with illegal things.

Re: How to build your own VPN if you're wary of commercial options

#67

Post by germanier »

mahyarm wrote: post #62
germanier wrote: post #61

Earlier quoted context omitted.

People are afraid to file share but not because of GEMA which for once has nothing to do with this. Right holders (especially of popular music, movies, and TV shows) connect to torrents and log who is also in the swarm (i.e. uploading and downloading). They then go to court quickly with your IP which orders your ISP to give up your name and address.

They tell you about GEMA although as the cause of their fear, at least to me. The details, as you say, are probably different.

Yes, for some reason GEMA has become the scapegoat for all music-related inconveniences in life.

Re: How to build your own VPN if you're wary of commercial options

#69

Post by subliminalpanda »

drewg123 wrote: post #63

Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers. Is there something about OpenVPN that doesn't support GCM?

Maybe he wasn't aware of it? Just my speculation.

In any case, AES-GCM is natively supported by OpenVPN 2.4, and Streisand as it is will configure it for you as part of the NCP ciphers list, with a fallback to AES-CBC if the client is a bit older [0]

[0] https://github.com/jlund/streisand/blob/master/playbooks/rol...

Re: How to build your own VPN if you're wary of commercial options

#70

Post by drdaeman »

drewg123 wrote: post #63

Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers. Is there something about OpenVPN that doesn't support GCM?

AFAIK OpenVPN officially has GCM mode support since v2.4, which is relatively recent (official release December 2016).

I'm sure it was also present in 2.3.x - at the very least I'm certain that 2.3.10 I have on one host supports TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 - but it could be distro-specific backports or something like that. At least 2.3 changelogs don't mention anything about AEAD or GCM specifically, and GCM support is featured in https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes....

Post reply on HN