Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPNs are not the solution to a policy problem

asininetech.com

Post reply on HN
Print view View original

81–90 of 228 posts

Re: VPNs are not the solution to a policy problem

#81

Post by confounded »

jfoutz wrote: post #61

Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X's household researching cancer treatment? Will they step down this year? I can't help but think military bases would google their next deployment, that's another…

Those people will have VPNs and other security measures. This is about exploiting ordinary people to widen the power differential between the two.

Re: VPNs are not the solution to a policy problem

#82

Post by mirimir »

angry-hacker wrote: post #68
mirimir wrote: post #55

Earlier quoted context omitted.

Because you have much more choice for VPN providers than for ISPs. And you can change VPN periodically, far more easily than changing ISP. Also, you can use nested chains of VPNs, much like Tor, to distribute trust. So adversaries must compromise multiple providers, quickly enough that logs will be available. Edit: Also, you can pick VPN providers outside your adversary's sphere of influence. That's standard advice f…

And now both of your vpn owners have your data connected to your ips. You do have more choice but if both of them sell the data, it doesn't make any difference.

Right, you still need to trust someone.

If it really matters, you use nested VPN chains. Three deep is my standard, and I've managed six. Latency can be a couple seconds, but hey.

Re: VPNs are not the solution to a policy problem

#83

Post by danisth »

bdarnell wrote: post #33
Goopplesoft wrote: post #18

A heads up: theres a really nice project called Streisand[1] which provides a multi-protocol VPN with very little effort. You can launch one on a cheap cloud provider (like DO, if their policy allows). [1] https://github.com/jlund/streisand

I've used streisand on DO (while traveling in China) and it worked well. There's also a similar project called algo[1] which provides a single protocol with maximum security, in contrast to streisand's multi-protocol flexibility (and increased surface area). https://github.com/trailofbits/algo

Would a 512mb RAM DO server be enough for this? I've been looking for an alternative to a VPN for a while, but it would only be cost effective with the $5 option.

Re: VPNs are not the solution to a policy problem

#84

Post by confounded »

surement wrote: post #26
FridgeSeal wrote: post #20

No, they're not. The solution is getting strong, enforced laws that protect our privacy and punish those who break them. But for the moment, with advertisers viewing themselves as gods gift to the internet who think that all your information belongs to them simply by virtue of existing, and who will go to great lengths to acquire and store it all (for perpetuity), a solution is needed, and part of that is VPN's.

In general, you can still identify users for advertising purposes without knowing their IP address.

3rd party cookies and fingerprinting js is hugely different from "full take" at source.

Re: VPNs are not the solution to a policy problem

#86

Post by ballenf »

jmclnx wrote: post #8

Well a quick google came up with this: http://www.pcmag.com/article2/0,2817,2495932,00.asp https://www.bestvpn.com/best-linux-vpn/

The PCMag survey felt very heavily weighted to who they get referral fees from. Every top rated VPN had a special link and referral offer.

That being said I used it and ended up choosing one that they recommended basically due to lack of info from other sources that is timely. Was a couple months ago.

Re: VPNs are not the solution to a policy problem

#87

Post by rz2k »

byuu wrote: post #36

Another thing often overlooked with VPNs is that they're just not that fast. I have a 600/40 connection, and I've tried at least six for-pay VPN providers. The fastest one I found (won't mention as my goal isn't to advertise for them) hits, at best, 100/30. And even then, only over L2TP. For whatever reason, OpenVPN is always slower on every PC I've tried this with. And obviously, you gain a good deal of latency, esp…

I've used SoftEther VPN software on the type of cheap VPS you find on lowendbox.com.

I notice little if any change in speed. If anything, download speeds seem more consistent in speed without long pauses (or momentary bursts in speed).

It's very easy to install and configure, but I'm not sure how good it is at addressing the point of having a VPN, since I don't know how well the software has been audited by other people, and I wouldn't know where to begin. The same goes for how I must trust the VPS provider.

Re: VPNs are not the solution to a policy problem

#88

Post by staticsafe »

jdoliner wrote: post #76

Why aren't VPNs, and more broadly encryption, a solution to this problem? "Waving the wand of a technical solution," as the post pejoratively calls it, isn't such an unreasonable thing to do with an inherently technical problem. This problem only exists because of other technical wands we waved. Why solve this problem with policy? Policy is hard to get passed, hard to keep passed and even when it is passed often time…

At the risk of sounding increasingly naive:

I believe policy is important as a part of the solution because it is a matter of protecting the general public not just a select technically capable.

Yes, policy is hard and can be useless but I still believe it is an important goal to fight towards.

You can care about your privacy, use a VPN and use the democratic process to enact policy change. Those things need not be mutually exclusive. VPNs are only a part of the solution and incomplete, not the solution.

Re: VPNs are not the solution to a policy problem

#89

Post by jfoutz »

confounded wrote: post #81
jfoutz wrote: post #61

Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X's household researching cancer treatment? Will they step down this year? I can't help but think military bases would google their next deployment, that's another…

Those people will have VPNs and other security measures. This is about exploiting ordinary people to widen the power differential between the two.

I think you overestimate the average politician. They may not bother with the internet. I'm confident Senator Lamar does not.

But really, i don't think it would take very long to figure out where he and his staff in DC and in Tennessee live. I don't know what the data purchase rates are, so that could be expensive. But buy the data for a bunch of neighborhoods. Perhaps 50,000 people. watch the data for a while, query strings with Lamar would be good indicators.

Heck, make some really finely targeted ads on Facebook.

I think the reality is most news sourced this way would be super tabloidish. i mean, you're going to figure out what porn they look at faster than what policy they're developing.

Re: VPNs are not the solution to a policy problem

#90

Post by andreyf »

confounded wrote: post #81
jfoutz wrote: post #61

Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X's household researching cancer treatment? Will they step down this year? I can't help but think military bases would google their next deployment, that's another…

Those people will have VPNs and other security measures. This is about exploiting ordinary people to widen the power differential between the two.

If my ISP were to sell my data, how would they refer to me to the buyers? Would it be legal for them to use a cookie identifier in HTTP traffic they routed?
Post reply on HN