Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who Owns, Operates, and Develops Your VPN Matters

opentech.fund

Post reply on HN
Print view View original

71–80 of 203 posts

Re: Who Owns, Operates, and Develops Your VPN Matters

#71

Post by ghssds »

davepeck wrote: post #17
fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

(3) The fare aggregator that sold you a ticket to visit BFE conveniently also geoblock that very place.

Re: Who Owns, Operates, and Develops Your VPN Matters

#72

Post by arewethereyeta »

timpera wrote: post #37
arewethereyeta wrote: post #34

That's why we sell only the service [1] and point our users to the default app install (Wireguard in our case). Ever since Holla VPN and the entire Brightdata/Luminati clusterf~ VPNs are a risky business for users. Most of them are proxy nodes underneath, they rent you datacenter IPs while they sell your residential internet to third parties. [1] https://www.anonymous-proxies.net/products/

Do you have a source that shows that popular VPN providers such as Mullvad or NordVPN actually sell your residential internet to third parties? That's a bold claim, but pretty scary if true.

yes, search for NordVPN vs Luminatti (guys behind Holla VPN) scandal: "nordvpn luminati lawsuit patent". Basically Luminatti, now known as bright data, reached out to NordVPN in order to utilise their user's internet as residential proxy nodes. NordVPN thought otherwise and created their own network instead (Oxylabs if I'm not mistaken). They are still in patent wars I believe.

I don't know anything bad about Mullvad! That being said I, as a small business owner in this space, will not use any of them, ever. I know it sounds like a "yeah right" because I sell the services but I know better.

Re: Who Owns, Operates, and Develops Your VPN Matters

#73

Post by rpcope1 »

timpera wrote: post #37
arewethereyeta wrote: post #34

That's why we sell only the service [1] and point our users to the default app install (Wireguard in our case). Ever since Holla VPN and the entire Brightdata/Luminati clusterf~ VPNs are a risky business for users. Most of them are proxy nodes underneath, they rent you datacenter IPs while they sell your residential internet to third parties. [1] https://www.anonymous-proxies.net/products/

Do you have a source that shows that popular VPN providers such as Mullvad or NordVPN actually sell your residential internet to third parties? That's a bold claim, but pretty scary if true.

I mean can they really even if you're using off the shelf client software like plain OpenVPN?

Re: Who Owns, Operates, and Develops Your VPN Matters

#74

Post by verisimi »

flumpcakes wrote: post #65
john01dav wrote: post #60

Earlier quoted context omitted.

What about (3) "bypass government censorship"? UK and China are examples of where this is desirable. This is different from (1) because it's broader than just streaming shows and is about authoritarian rather than capitalist restrictions.

I think the general discussion is conflating censorship with age restrictions. Lumping the UK with China is very disingenuous. The UK law is stipulating adult content can only be viewed if you are provably over 18. They are putting all of that responsibility onto the websites/platforms to enforce that. If a child goes to a shop and tries to buy a pornographic magazine and they are denied, is that censorship? If a chi…

[flagged]

Re: Who Owns, Operates, and Develops Your VPN Matters

#75

Post by giobox »

martin_a wrote: post #13
busterarm wrote: post #10

Earlier quoted context omitted.

You can operate your own VPN (algovpn, openvpn, etc). There's low utility to doing so, but it's fairly straightforward these days. Or run Tailscale (and a self-hosted DERP relay).

I did this for a while in combination with a PiHole setup on a small vultr.com package. Utility in that was that the traffic of all devices was routed through a "PiHoled VPN", so very little advertisements came through...

A cheap VPS instance + DNS with adblock + self hosted VPN used to be great until around ~5 years ago, when a great many websites (especially streaming sites) just started blocking any IP range associated with a VPS provider. I've given up using VPSes as VPN exit nodes now.

Re: Who Owns, Operates, and Develops Your VPN Matters

#76

Post by 5f3cfa1a »

zoeysmithe wrote: post #24
fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

This is my feeling too. I also don't think these people realize how none of these groups can refuse a subpoena so the scenario of "the government coming after me," doesn't get addressed either. Worse, some of these are tied to foreign nation state intelligence, who are now analyzing your data when before they couldn't because they didnt have a relationship with your ISP. Domestically, I wouldnt be surprised if all of…

I suspect every single VPN, including the ones who claim to not log, maintains or exposes enough information for a dedicated adversary to make a convincing case if they want. I give a little extra credit to Mullvad simply because I can put cash in the mail, but even then if a significant adversary wants to know you are connecting, they will.

> Domestically, I wouldnt be surprised if all of this data from US owned VPNs is shipped to the NSA or other groups and analyzed. After the Snowden reveals its hard to really see this stuff as conspiracy anymore.

Even the "friendly" international ones aren't in the clear. Sweden isn't in FVEY, but they're in Fourteen Eyes. And we know from the XKeyscore leaks that the NSA hoovers up metadata like there's no tomorrow. I'd bet my house that anyone who connects to a commercial VPN or _especially_ to Tor lights up like a Christmas tree on the NSAs board – so they might not know for sure what you're doing, but they know you are possibly doing something.

Apple's Private Relay is probably the best chance to actually blend in, but estimates are 1-2% usage for "average users" and 3-5% for Wikimedia editors who I'd assume to have a technical slant. That's an order of magnitude too low for a crowd to exist to blend into, and with two friendly US entities on both sides of the privacy equation, I wouldn't rely on it to stand up against significant scrutiny.

> The only practical use case I can think of is torrents where the legal and political will to subpoena a vpn provider is low, so its this weird loophole where you can torrent but your ISP will never be informed. For now I suppose until the IP holders think the legal fees are worth it or get a law passed to sidestep subpeonas.

My analysis tends towards this: there's a gradient of behavior that is "tolerated" at each step. If you want to torrent, a cheap VPN is tolerated and your crimes will be overlooked... because it's far better to catch serious criminals through that VPN. If you want to buy LSD from a dark web site, Tor lets your crimes be overlooked, because the big fish are the sellers. If you want to commit a significant crime, TLAs know everything about you already and the DEA/HSI/FBI/USPIS/IRS-CI or your local equivalents are ready to parallel construct your ass to the wall when you become noticeable enough.

But maybe I'm not as pessimistic as you – the vast majority of people aren't at the far end of the spectrum, so if you want to infringe copyrights, $60 to Mullvad for a year is what you want.

Re: Who Owns, Operates, and Develops Your VPN Matters

#77

Post by stordoff »

vincnetas wrote: post #41

How realistic is possibility that some VPN providers use clients (computers of person who installed VPN) to just be able to crawl (or rent crawl infra) sites and make it look like regular residential traffic? (This is speculation i heard somewhere) Like reverse VPN :) on one side makes client look like he's accessing internet from VPN exit location, and on the other end allowing for money someone to pretend that he's…

There are various services that do this, e.g. BrightData:

> Bright Data is the World’s Largest Residential Proxy IP Network providing companies the ability to emulate a real user in any country, city or carrier (ASN) in the world. [...] Bright Data has an SDK (software development kit) that is implemented into applications. Bright SDK provides an attractive alternative to advertisements by providing the app user with the choice to opt-in to Bright Data’s network instead. For every user that opts-in to the Bright Data network, Bright Data pays a monthly fee to the application vendor, who passes that value on to the user by not displaying ads.

I haven't heard of any of the VPN providers doing this, but it wouldn't really surprise me.

Re: Who Owns, Operates, and Develops Your VPN Matters

#78

Post by elondaits »

davepeck wrote: post #17
fujigawa wrote: post #7

Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand. I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identit…

Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable. But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity". I live in Seattle and Mullvad VPN seems to have bought…

What about a malicious DNS (on a public spoofed or hacked WiFi) that forwards you to a lookalike domain? Unfortunately many times public WiFi doesn’t work with Google’s or Cloudflare’s DNS servers (I think the Deutsche Bahn’s WiFi was such a case, if I remember correctly, but I know I came across a few on the last few years while traveling). I don’t think there’s anything protecting against that when you’re using a browser.

Sometimes circumstances force one to connect to a public WiFi (e.g. airports, where WiFi is always super dodgy).

Re: Who Owns, Operates, and Develops Your VPN Matters

#79

Post by arewethereyeta »

rpcope1 wrote: post #73
timpera wrote: post #37

Earlier quoted context omitted.

Do you have a source that shows that popular VPN providers such as Mullvad or NordVPN actually sell your residential internet to third parties? That's a bold claim, but pretty scary if true.

I mean can they really even if you're using off the shelf client software like plain OpenVPN?

maybe, harder tho and they will refuse to do so because that client install is close to malware on some providers. That's why we only hand out the config and instruct the user to install the official app.

Re: Who Owns, Operates, and Develops Your VPN Matters

#80

Post by thisislife2 »

aborsy wrote: post #50

Do people here trust their ISPs more than their VPN providers? That’s the question! On the other hand, as far as privacy from the end point is concerned, users can be identified regardless of IP addresses. Visit fingerprint.com, you will get an identifier, then connect to a privacy VPN and change servers once in a while. The website will identify you, tell you are the same user visited last week from such location, a…

I do trust my ISP more than any foreign VPN service providers because I have the option to take my ISP to court if they violate my rights. I stopped caring about anonymity on political subjects when I realised not being anonymous made me more civil online, and more mindful of what I want to talk about. (Ofcourse, I can think like this because I have the privilege of living a democracy).
Post reply on HN