top | item 13987405

VPNs Are Absolutely a Solution to a Policy Problem

385 points| mobitar | 9 years ago |journal.standardnotes.org | reply

256 comments

order
[+] mundo|9 years ago|reply
Well allow me to retort.

This article is saying, basically, that the tendency of ISPs to try to monetize user data is a natural consequence of capitalism, and trying to curb that tendency with legislation is ineffectual compared to the real solutions (fight monopolies, and everyone use a VPN).

I don't buy it. Roughly the same argument could be made about virtually any regulation. "Corporations are incentivized to pollute, so there's no point trying to stop them. Buy a water filter." "People will always try to get heroin, so there's no point in restricting it. Get some naloxone." Damn near every regulation is an attempt to counteract some profit-motivated tendency which is the unfortunate consequence of capitalism. And as regulations go, user data is a lot easier to regulate than drugs or pollution.

"Just get a VPN" might be good advice for individuals, but it is emphatically not the society-wide solution to data privacy. We can and should continue to fight for good legislation that protects us.

[+] dkhenry|9 years ago|reply
I think you missed the authors real point. The selling of data isn't the policy you need to fight. The monopoly power of ISP's is the problem you must push back on. The author has rightly pointed out that regulating your way to your goal is not a solution. He is advocating for a free market solution which is much more robust then one that hinges on the right people being in power for all eternity.
[+] asimpletune|9 years ago|reply
I think what the author saying is incredibly valid and the pollution example doesn't exactly equate.

Ideally, you wouldn't rely on trust, i.e. Policy, you would rely on math. As far as we know, judging from the Wikileaks releases, encryption still works.

With pollution, it is a policy issue, because there's no mathematical way to prevent polluters. So we have to negotiate amongst lawmakers, regular people, and corporations.

I think what the author is saying here is that we shouldn't bet our privacy and safety on who is in charge, as we are always one flick of the pen away from losing those protections. I think this is especially the case when there is a mathematical solution to the problem, that doesn't require trust. Obviously, having math and policy would be an added bonus.

[+] zpallin|9 years ago|reply
Came here to say exactly this.

We are all engineers and can understand the concept of a patch versus a refactor. Yes, a refactor may be harder, but there is never an excuse to rely indefinitely on a patch; that's how you get burned with technical debt.

The government needs to change to be more responsive to the people and not constantly sell them out at the flick of a pen. Yes, use a VPN! But don't buy the message that there isn't more that can be done. There is, and many people are working tirelessly to see it through. Don't ignore or devalue their efforts to make a better system for people.

[+] rqebmm|9 years ago|reply
Allow me to followup in support: I work for a private VPN company (that coincidentally used to be a dial-up ISP), and the owner/leadership is very active in lobbying state and federal legislatures to pass privacy-oriented legislation. In other words: someone who's worked for decades on both sides of the issue acknowledges that legislation is the best solution.

https://www.goldenfrog.com/blog/category/policy

[+] matthewaveryusa|9 years ago|reply
I find the outrage rather interesting. Google and Facebook are basically everywhere sniffing as much data as they can. I actually don't mind if another party starts collecting the data as well. Go nuts.

Google is already toying with the idea of creating VPNs for consumers. In the case of the pixel it's legit because they allow you to opt-in to VPNing to google servers on untrusted WIFI connections. The irony is that now google has even more data on you. Once your VPN exits, you can still get MitMed/injected on non-TLS resources, so what is the VPN really doing for you? The only thing the VPN does is control which party will spy on you.

The blind lead the blind I guess.

[+] r00fus|9 years ago|reply
Speaking about pollution, we should definitely create a way to pollute web traffic. When the enemy has heat-seeking technology, we have to start using chaff/ECM.

VPNs are a tool, but it's easier for users to install a plugin that pollutes their data than to enable VPN.

[+] ianopolous|9 years ago|reply
I think the key difference is selling one person's internet history mostly only affects that person's privacy. The environment on the other hand is a common good, and any damage to it hurts everyone. Similarly, someone taking heroin doesn't only hurt themselves, they are likely to hurt people around them as well.
[+] problems|9 years ago|reply
It's a lot easier to see many pollution problems and the harm often is more direct and quantifiable - with a privacy issue the harm is often abstract and harder to see.

I think privacy and pollution regulations can be good, but they need to be carefully tracked and aren't always effective.

The best solution for you is always to be a vigilant consumer. Something like this can be protected entirely by doing so. Pollution is harder to defend against. Using a VPN is a great strategy to mitigate these issues before they're allowed to happen to you.

[+] cmurf|9 years ago|reply
The article didn't use the term, but it's basically arguing there are such things as natural monopolies, and that ISPs are examples of them.

Fighting monopolies is an argument for more aggressive application of competition law, to break up monopolies, and disallow anti-competitive conglomeration. But again the article doesn't bring up anti-trust.

The article also doesn't account for the fact that an ISP, without net neutrality regulation, can block or throttle or charge extra, for VPN usage.

[+] LeifCarrotson|9 years ago|reply
You're absolutely right that a broad regulatory solution would be a good thing - but we shouldn't ignore a technical solution when it's available. By analogy, we have pretty good regulations about the contents of your home not being stolen. But you should still lock your doors when you leave.
[+] wavefunction|9 years ago|reply
The only thing is, I shouldn't have to pay for a VPN to continue enjoying some measure of privacy when I'm paying for the ISP's service. This is just some MBA's "great idea" to "leverage previously untapped revenue sources" rather than a real need by struggling firms grasping at any life-line.

It's disgusting, and I'm disgusted (_yet again_) by the mercenary Republican Party. They are declaring war on me and my loved ones and the vast majority of our fellow Americans and anyone else unfortunate to have to use an internet connection in the US (and live under the rest of their insane policies).

For the record, I signed up for a personal VPN two weeks ago because this anti-consumer outcome was assured with the current party in power in the US.

[+] eterm|9 years ago|reply
I'm not sure how VPNs are a solution.

Politically, it means that people who should be getting angry about reduced privacy are "comfortable" with the fact they can work around it, while a new generation grows up with fewer and fewer expectations of what privacy means. It's short term protection in return for normalization of anti-private behaviours and long term damage.

But I also have a problem with it technically:

Issue: You don't trust ISPs to not sell browsing history.

Solution? Provision a virtual server, set-up a VPN and tunnel.

But your server still has a service provider. It might not be literally tied to your billing information but that was never going to be anyway.

You've shifted which ISP gets to sell the data from "home provider" to "virtual server provider", but there is still browsing data isn't there and it's just as valuable from a private single-use VPN as it is from your home connection.

[+] xraystyle|9 years ago|reply
> But your server still has a service provider. It might not be literally tied to your billing information but that was never going to be anyway.

The idea is to use a VPN provider that keeps no logs and runs many concurrent connections NAT'd behind the same public IP address. That way your traffic is mixed in with everyone else's who's using the service and provides you with an additional layer of anonymity.

[+] itstriz|9 years ago|reply
There are no foolproof security solutions, only varying degrees of who you trust with what. There are many VPN providers who claim to keep no logs on user activity. If their claims are true, that is a better option than Comcast or AT&T since the VPN provider with no logs has no data to sell or share.

* edited for spelling error

[+] spudlyo|9 years ago|reply
In the US most folks only have a handful of service providers to choose from. There are a huge number of VPN/PaaS/HaaS providers you can choose from, it shouldn't be hard to find one that respects your privacy.
[+] 6d6b73|9 years ago|reply
I plan on automatically switching VPS provider for my VPN on a monthly basis. So even if they get one month of data, they won't get it all.
[+] alistproducer2|9 years ago|reply
So I was a call-in on NPR today (http://www.wbur.org/onpoint/2017/03/29/internet-privacy-cong...) that discussed the ISP privacy issue. I brought up the crowd funding initiatives to buy Republican's info as well as the Democrat's unwillingness to make use of this issue. The call-ins were unanimously against what the congress did.

edit: Here's the GofundMe trying to raise money to buy their Internet history. Something tells me this dude is going to run off with the money though

http://resistancereport.com/resistance/crowdfunding-lawmaker...

[+] bluetidepro|9 years ago|reply
These "jokes" are already getting incredibly stale and silly. I don't get it at all. A provider is not just going to let you come in, even with say a billion USD, and buy X individual's data. That's not how it would work at all, this is not just like some sort of self-checkout to get someone's data.

And even if it was remotely like that, I can guarantee you that the providers will go to lengths to make sure they didn't just lobby millions (speculating, of course) to get this through and then throw the same congress members under the bus that they lobbied to and then hand out their data to get them in trouble with the public.

[+] slg|9 years ago|reply
>Other articles have argued that VPNs are not a solution to a policy problem, because you can’t necessarily trust a VPN provider, or some VPN providers don’t encrypt your data properly. That may be the case, but that’s an easily solvable problem. And there are no monopolies on VPNs. This is something that a market economy can solve in a year.

It has been a few years since my Econ 101 class, but I suggest the author Google "market for lemons". Users have no way to verify the intentions of VPN providers as there is natural information asymmetry. Trust is not an issue that market economies have come up with a good solution to fix. The solution we often use ironically enough happens to be policy and regulation. So maybe this is a policy problem.

[+] loteck|9 years ago|reply
Everybody is right. It doesn't have to be either-or.

You can select a paid VPN service that helps protect you from specific adversaries. You can roll your own VPN on your own VPS that helps protect you in some use cases.

You can, and should, advocate for good privacy policy.

[+] nawitus|9 years ago|reply
"That may be the case, but that’s an easily solvable problem."

So, how is that problem solved? I can't see what VPN companies are really doing inside their stack. They might very well be logging everything and I have no way to find out other than to "trust them" - so there's no real market mechanism to choose a VPN provider which doesn't log anything.

I suppose it could be in the contract.. so does VPN contracts have a clause like that, and how is it enforced?

[+] juliangoldsmith|9 years ago|reply
>I can't see what VPN companies are really doing inside their stack.

You can always run your own VPN. Buy a cheap VPS, and set up OpenVPN to route traffic through it.

[+] M_Grey|9 years ago|reply
The counter-arguments:

A VPN that sells your information and eventually, inevitably is caught, will lose their entire business. Meanwhile they can make a perfectly good profit just... providing the desired service. There are also people who take the time to investigate these various services, and you can do some work to find one that meets standards you deem to be acceptable.

There isn't going to be a perfect solution here, but the issues with VPN's are really not the issues you raise. My concerns are: Google and other major sites endlessly pestering VPN users with CAPTCHA requests, or the government actually making them illegal. Your concerns are largely answered by researching which product you're willing to buy, not unlike all other similar decisions in life.

[+] asimpletune|9 years ago|reply
Someone could make a program that inspects the packets on your local network. If they're encrypted then the connection is safe. They could then start a register of VPNs and rate them.

This is just the start though, you'd also have to guard against common keys and other various gotchas.

Also, another idea is VPN providers might start seeing it as a business opportunity to provide robust, secure connections and advertise how they work. These claims could easily be verified.

Just a start, I'm not an expert in networking, but it seems fairly doable. Obviously MITM is always possible if you're not connecting via ssl.

Also, this could be the impetus for further decentralizing the internet, although who knows how far that's out. The centralization of the internet might have taken things too far and killed the golden goose by abusing their position, incentivizing an acceleration of full decentralization, like with IPFS and their ilk.

[+] danellis|9 years ago|reply
"Companies selling your data is nothing new—Facebook and Google have been doing it for decades."

Is there any evidence for this? I'm pretty sure that in the case of Google, at least, it's a flat-out lie. In fact, they state in massive letters: "We do not sell your personal information to anyone." (https://privacy.google.com/how-ads-work.html) Who would they even sell it to? They're at an advantage having that data themselves.

[+] ballenf|9 years ago|reply
You're right: selling the data would be selling the golden goose. Instead the data is milked for all it's worth by pimping it out to advertisers.
[+] int_19h|9 years ago|reply
Allow me to rephrase this entire debate in terms that might sound more familiar.

Point: Locked doors and a shotgun under the bed is not a solution to the violent crime problem. We also need laws, and police to enforce them.

Counterpoint: Locked doors and a shotgun under the bed is absolutely a solution to the violent crime problem. You can't rely on laws, because they can easily go away with a stroke of the pen.

[+] M_Grey|9 years ago|reply
Most of us: I lock my doors and might have a gun just in case, but I recognize the value and role of laws. In the real world we have to accept that we need to defend ourselves, and also act collectively through politics and law to protect each other.
[+] r00fus|9 years ago|reply
Locked doors and a shotgun fails when a) the perpetrators have more guns than you and b) when your shotgun "misfires" and causes more damage than the threat.

But it's a false dichotomy. We need (the rights to have) both. Defense in depth.

[+] jkern|9 years ago|reply
Instead of using a VPN I think I'm just going to create a script that randomly requests various websites 24/7. So don't cut off the signal to your ISP just drown it in a lot of meaningless noise
[+] Nightshaxx|9 years ago|reply
As great as this is, it brings up two problems:

1. VPNs are slow: They will never get widespread adoption because people pay for internet speeds and want them. Not to mention many people use internet that is so slow that VPNs are just not viable. I try to use a VPN at least when I go on public WiFi, but I've been to hotels were the service was so slow that the internet would just not work while using a VPN.

2. The article encourages ad blocking. The problem is that a lot of the web relies on ad revenue. Content doesn't just produce itself without funding. Yes, most content creators are finding alternate means of getting money, but we still need to keep in mind that this is an issue.

Therefore, while VPNs and Adblockers can help, I just don't see them as viable enough strategy to take down the ISPs. You are both slowing the user's ability to get content and the creator's ability to make it. Yes, the privacy focused community can use these tools, but everyone knew we liked privacy already. It isn't until the mainstream users speak up or do something that we can get stuff done.

[+] ebbv|9 years ago|reply
This article is really bad. On the one hand it says government is unreliable and therefore it's hopeless to regulate. Then it immediately argues we need to break the ISP monopolies (which is true.) But why are there monopolies? It is because the ISPs collude not because there is regulation stopping new ISPs. Google and Verizon both dipped their toes in and gave up on providing wired access to the home.

The only way to break the monopolies is with government regulation forcing them to share the lines, because running the lines is the very costly part that stops new ISPs from competing.

[+] Lagged2Death|9 years ago|reply
And it’s so damn lucrative that ISPs are crying, No fair! I want a piece of that too! Are they not entitled to pursue such an opportunity?

If they give me the broadband access for free then I might feel some sympathy for this line of argument. At 97% profit margins, not so much.

Funny how "entitlement" can be a positive thing when it describes a rich, powerful entity but a negative thing when it describes someone or something more ordinary.

[+] manor|9 years ago|reply
Classic libertarian fallacy: “every resource should be managed by markets and every problem solved by the marketplace”. Except, the Internet is not a commodity, it’s infrastructure: it’s not a car, it’s the road. For consumer fluff — sure, go the libertarian route (“shop around”), but for things that really matter, like infrastructure and healthcare, don’t look for trivial market-based solutions…
[+] pkulak|9 years ago|reply
Does anyone know of some kind of appliance I can sit in front of my router that will put all the traffic in my house through a VPN? I run OpenWRT, so I think it's possible to do it there, but I think it would be easier to make it it's own thing.

Whitelisting would be nice too. Netflix video traffic, for example, would be nice to not put through another hop.

[+] Overtonwindow|9 years ago|reply
Just getting a VPN is like a teacher telling a bullied student to "just ignore and move away". Sounds great in theory, but really doesn't work for everyone in the real world. Some day, when wireless solutions get really good, or the cable monopolies are broken, pro-privacy will be a selling point.
[+] hluska|9 years ago|reply
I enjoyed this article until I came to this paragraph:

> Other articles have argued that VPNs are not a solution to a policy problem, because you can’t necessarily trust a VPN provider, or some VPN providers don’t encrypt your data properly. That may be the case, but that’s an easily solvable problem. And there are no monopolies on VPNs. This is something that a market economy can solve in a year.

That's where the author lost me. Building a secure VPN is different than your run of the mill SAAS - it's a difficult security problem, and an incredibly complicated user problem.

On the security side, it isn't hard to make a mistake that will give motivated parties the hole they need to crack the VPN. On a business side, it's hard to know which companies have received lucrative deals (or national security letters) from three letter agencies. And from a communications side, it's damned near impossible to let the whole world know that VPN Provider A collects data for a three letter agency.

Sorry to say it folks, but this is an area where we either need wholesale political change, or technological change. I'm Canadian, so I can't help you with the first one and I'm not even remotely qualified to help with the second.

[+] haddr|9 years ago|reply
Couldn't disagree more with this article. VPN is a solution to a policy problem until policy makers forbid VPN to enforce their core idea in the first place. (e.g. see United Arab Emirates for some restrictions of VPN use)
[+] Exuma|9 years ago|reply
In my home, Comcast business uses IPv6. So far, no VPN supports this, and I haven't found proper answers on how to handle this?

I've heard I can just "disable IPv6" on my Mac, but I don't know the full implications of this. If anyone has any input I'd appreciate this, because then I would use a VPN all the time.

EDIT Sorry I meant to type VPN not VPS, stupid typo.

[+] fragmede|9 years ago|reply
If you're on Comcast business, there's no real implication on turning off IPv6.

Any sites you use that are exclusively available only via IPv6 will stop working, but due to slow adoption of IPv6, that list of exceptions is quite small. IPv6 adoption is big in China, but even then the major services themselves are available over IPv4. (Weibo.com doesn't even advertise an IPv6 AAAA DNS record, so the things I read about IPv6 adoption in China may be overstated.)

There are, of course, exceptions. There are a number of intentionally ipv6-only test sites like https://ipv6.google.com that won't work. Things like Google.com which are available over both IPv4 and IPv6 will degrade gracefully if you turn off IPv6 on your mac, and just connect over IPv4.

[+] dijit|9 years ago|reply
No VPS supports IPv6?

I can think of a few off the top of my head that do:

* Linode

* Vultr

* Tilaa

* DigitalOcean.

[+] jstanley|9 years ago|reply
I'll provide you with a VPN that supports IPv6. Email address in my profile.

EDIT: And the full implications of disabling IPv6 are approximately nothing.

[+] davb|9 years ago|reply
DiitalOcean supports IPv6.