Live data from Hacker News

VPNs are not the solution to a policy problem

asininetech.com

91–100 of 228 posts

Re: VPNs are not the solution to a policy problem

#91
post #61

Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X's household researching cancer treatment? Will they step down this year? I can't help but think military bases would google their next deployment, that's another…

The Video Privacy Protection Act was passed after Supreme Court nominee Robert Bork's rental history was leaked to a newspaper.

Re: VPNs are not the solution to a policy problem

#92
post #22

One thing I was wondering, beyond your own personal ISP, does this mean that the backbone providers, the Level 3's of the world, are going to get into selling data to advertisers? I was feeling personally ok because I use an ISP with a strong privacy pledge, but I wonder if their uplink is going to be selling my data. Though I guess it's less of a concern since the backbones don't have the complete personally identif…

What incentive does a tier-1 provider have to collect data from their clients? Keep in mind their customers are not individuals, but large orgs: data-centers, corporations, office-buildings, universities, et al. They lack the strong correlation of "1 IP" => "1 customer" that a residential ISP tends to enjoy; they also lack the storage infrastructure that an AMZN, GOOG, MSFT, et al. tend to have as a function of doing business. (Since the problem tier 1 providers aim to solve tends to require large workingsets, not large datasets at rest per se, they tend to need RAM more than durable storage.) I imagine the infrastructure needed upstream to track such traffic would be immense & costly, and more importantly it would just not be very applicable to the provider's major product offering.

Furthermore just what would their end game be? Per all the DOCSIS whitepapers I've read: my residential ISP intends to sell me any number of "over the top" services: a plethora of cable channels, their own streaming services, VoIP, alarm systems, whole home DVR, etc. There is a lot of money to be made there in terms of equipment rental, upkeep, and paid programming. More importantly most of it goes right into their pockets. The way I see it, it's not about selling the data, it's about using it themselves.

Compare that to a tier-1 provider who has one job: get a drop to my network fabric. Their business revolves around (A) doing that regionally, (B) maintaining good peering, and (C) being extremely competent network engineers. As I see it a tier 1 provider has far less incentive to spy on their users compared to a residential ISP. This doesn't obviate the need for caution of course, since nation-state level actors have all the more reason to spy on tier-1 providers simply due to the volume of traffic that can be intercepted.

Re: VPNs are not the solution to a policy problem

#93
post #82

Earlier quoted context omitted.

And now both of your vpn owners have your data connected to your ips. You do have more choice but if both of them sell the data, it doesn't make any difference.

Right, you still need to trust someone. If it really matters, you use nested VPN chains. Three deep is my standard, and I've managed six. Latency can be a couple seconds, but hey.

What's the advantage of 6 nested VPNs over VPN + Tor?

Re: VPNs are not the solution to a policy problem

#94

Earlier quoted context omitted.

I went looking for a spreadsheet I once saw, apparently it's become a website. https://thatoneprivacysite.net/vpn-section/

France runs a warrantless mass surveillance program [1]. It is one of the countries our OpSec consultant specifically recommends taking clean computers to. It is labelled, by "That One Privacy Site" as NOT being an "enemy of the Internet" (whatever that means). Difficult to take the rest of its recommendations seriously. [1] http://www.cnn.com/2013/07/05/world/europe/france-surveillan...

IDK as the methodology is open and you can just email the guy asking for this information to be included I'm not sure what the problem is.

There are a lot of lists of VPNS and though this one didn't help me choose mine, and ranks mine very low, I thought it answered the question the best.

Re: VPNs are not the solution to a policy problem

#95
post #65

Earlier quoted context omitted.

Also, you can pay for a VPN without revealing your identity. Not so with ISPs. I use a VPN, for instance, to mask my Tor usage from my ISP. (I'm an American using the Internet in the United States.)

True. But the VPN provider effectively knows who you are, because they see your IP address. Or rather, a resourceful adversary can get your IP address from the VPN provider, and then get your identity from your ISP. If you chain VPNs, however, it certainly makes sense to lease the second/indirect VPN anonymously.

I don't think IP alone will not be sufficient, for ex i am sure my ISP extensibly NATs the network and shares the same IP for many users. So much so that Google keeps asking for captcha every couple of days

Re: VPNs are not the solution to a policy problem

#96
post #73

At the end of the day, it is obvious that policy is the right direction to stop this bleed of infringement. However; be it noted: those who have the capability to circumvent, or ethically "get around" such enchroachment; have a responsibilty to free those who may be entagled by that which is "freedom limiting". The argugment could be had, however; is it really freedom limiting for others to know your web history? Obv…

Some food for thought: Such data can include say, the fact that a certain person enjoys some fetishes or maybe some other similarly compromising data.

The possibility for blackmail exists and therefore the possibility of your freedom being curtailed.

Re: VPNs are not the solution to a policy problem

#97
post #36

Another thing often overlooked with VPNs is that they're just not that fast. I have a 600/40 connection, and I've tried at least six for-pay VPN providers. The fastest one I found (won't mention as my goal isn't to advertise for them) hits, at best, 100/30. And even then, only over L2TP. For whatever reason, OpenVPN is always slower on every PC I've tried this with. And obviously, you gain a good deal of latency, esp…

You can setup your own on digital ocean or aws light sail you will get better bandwidth... IP will not be blocked as it will not be known vpn IP and it can be rotated.. not saying these are solutions to the privacy problem only the technical ones

Re: VPNs are not the solution to a policy problem

#98
post #83

Earlier quoted context omitted.

I've used streisand on DO (while traveling in China) and it worked well. There's also a similar project called algo[1] which provides a single protocol with maximum security, in contrast to streisand's multi-protocol flexibility (and increased surface area). https://github.com/trailofbits/algo

Would a 512mb RAM DO server be enough for this? I've been looking for an alternative to a VPN for a while, but it would only be cost effective with the $5 option.

Yes. Your bottleneck will most likely be network and CPU speed as that's used for encryption. Google around for specific numbers, but my intuition is that network will max out before CPU does even on the $5/mo instance.

Re: VPNs are not the solution to a policy problem

#99
post #36

Another thing often overlooked with VPNs is that they're just not that fast. I have a 600/40 connection, and I've tried at least six for-pay VPN providers. The fastest one I found (won't mention as my goal isn't to advertise for them) hits, at best, 100/30. And even then, only over L2TP. For whatever reason, OpenVPN is always slower on every PC I've tried this with. And obviously, you gain a good deal of latency, esp…

Potentially a workaround is getting a business account/connection. I doubt most businesses will want any kind of data gathering. So they'll be exempt but obviously more expensive. Could be worth it for no speed loses/VPN hassle.

Maybe they'll even offer pay for privacy on consumer accounts? It's just the price you pay when most people don't know about the issue, or don't understand the issue, or don't care about the issue.

Post reply on HN