WingNews

lemoncookiechip|4 years ago

It's far from a waste of money. They help with things such as skipping geoblocking, able to deceive ISPs that send mail warning users about pirated content, can in some cases help with gaming ping, allow users to trick sites that rely on IP logging and many other applications besides cybersecurity and privacy.

The main issue is that they all seem to advertise themselves as these privacy and cybersecurity services first, while ignoring all the other added benefits.

saurik|4 years ago

Meanwhile, a lot of users really can't trust their ISP: your "ISP" might be coffee shop, or someone renting on AirBNB, or your friend (as you are at their home or office). If you are in any of these circumstances, I would probably first recommend "tether off your phone or something", but if you are finding yourself needing or merely wanting to use someone else's internet connection (maybe for speed or because you don't have a good cell signal), it totally makes sense to use a VPN.

(Also: I don't think anyone has mentioned this yet, as maybe it is somehow "gauche" to do so, but one of the top reasons people use VPNs around the world is because they want to browse porn and they don't want people around them to know. At some point, the people in the apartment next door to me figured out my wi-fi password and seemingly felt the correct solution to this issue was to use me for their porn browsing, but it was then all the more awkward when I figured out why my network was slow and knew all of the porn sites they were browsing. Most people seem more OK with the idea of paying a company like ExpressVPN--even if they are legitimately run by "spies"--to be their dedicated porn access point than hoping that someone else more locally won't find out what sites they are browsing.)

filmgirlcw|4 years ago

Totally agree. The geoblocking is the most common reason a lot of people use VPNs, even if that isn’t always how they are directly marketed. A friend’s mom asked me a few weeks ago for VPN recommendations so she could watch British TV easier. She’s 70. Her concern isn’t about safer browsing stuff but watching GBB more easily.

*Disclosure: ExpressVPN has sponsored my podcast in the past (tho I don’t handle ad sales fwiw) and I’ve always chosen to do the “this is how I watch X service in X country” use case in ad reads, b/c that’s the value in it for me vs rolling my own Wireguard/Tailscale setup (I actually have Tailscale setup for my home network).

elagost|4 years ago

Browser fingerprinting works much better than checking IPs. With multiple devices being behind the same IP, it's necessary to distinguish between users.

I'm not saying VPNs are worthless - I'm on one right now for work. Commercial VPNs, for most people who purchase them, are completely worthless.

And I very much doubt that tunneling your connection through a VPN can improve ping.

warent|4 years ago

And no wonder! All of those things you listed as benefits sound shady and illegitimate to people who aren't very tech savvy or have a poor understanding of their rights to a free web. Notice you're using words like "Trick" and "deceive" good luck selling that!

LorenPechtel|4 years ago

This. I'm an occasional customer of ExpressVPN because they're pretty good about getting past the Great Firewall. When we go visit her family I want access to the same things I have in the US. It's not going to be any real protection if the government is after you.

babayega2|4 years ago

True. I use VPN to get behind the geoblocking on my banking app which is prohibited to work in my African country. Also viewing movies banned in my country.

jon-wood|4 years ago

It is in fairness not a winning business strategy to go out and advertise with “we make breaching copyright easier”.

baron_harkonnen|4 years ago

> you replace trusting your ISP with trusting a different group of unknown people with similar motivations

I've always seen this argument but it's never made sense to me.

For starters I absolutely don't trust my ISP. I know they are collecting, storing, likely selling my data and that they are 100% going to comply with any government requests from my government (I don't even trust that they would only respond to legal requests).

Years ago I used to use AirVPN. They claimed:

> AirVPN started as a project of a very small group of activists, hacktivists, hackers in 2010, with the invaluable (and totally free) help of two fantastic lawyers and a financing from a company interested in the project and operated by the very same people.

Maybe they're lying but at least there's some chance they actually care about privacy.

But even if they don't care about privacy at all and are lying, at the very least they are based in Italy and have their servers spread throughout Europe. Additionally you can pay via crypto (which gives you more anonymous payment options than your ISP). Simply being in another country then the one I live in makes it much harder for my government to arbitrarily request my data.

Yes if I want to do highly illegal activity that is going to get my government interested in me I absolutely don't think that would be enough. But if I want privacy from routine surveillance this seems like a fantastically better option that 100% giving up.

elagost|4 years ago

Use an alternative DNS server, Firefox/Brave/Ungoogled Chromium, uBlock Origin, and disable JavaScript everywhere you can possibly help it. As far as reclaiming some privacy from routine surveillance, this is probably better advice than "Pay Unknown Company X $9/mo to maybe be slightly better than your ISP in terms of privacy".

Seirdy|4 years ago

It is far easier for a bad actor to compromise or start a commercial VPN provider than it is to do the same for an ISP.

If you want online anonymity, use Tor. And torrent with a seedbox.

samstave|4 years ago

>*are collecting, storing, likely selling my data and that they are 100% going to comply with any government requests from my government (I don't even trust that they would only respond to legal requests).*

https://en.wikipedia.org/wiki/Carnivore_(software)

And this was the very very crude version, what is happening today is obviously light years ahead of what Carnivore was...

We really need a "*Moore's Law For Surveillance Capabilities Multiplying by X Every N Period*"

dannyw|4 years ago

Plus, you can chain through a couple VPNs. Both VPNs have to be compromised for you to lose privacy.

addingnumbers|4 years ago

> At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations.

When one party with auditors says they will protect your privacy, and the other openly spells out in their stated policies that they will run roughshod over your privacy, cataloging and trading your data as much, as long, and as insecurely as they like...

You don't have to trust the former party a lot to recognize the lesser evil.

young_unixer|4 years ago

> At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook.

My ISP is required by law to be an informant for government agencies, so the VPN can only be equal or better than my ISP.

garyrob|4 years ago

Honest question: it's still a consensus that they do have value in situations such as airport Wi-Fi, correct?

Separately from that, I still do wonder whether, if you subscribe to a VPN that has well-examined security practices and whose reputation depends on such practices, whether it still may have value over relying on the security over a local ISP which may not have as much expertise or reputation investment with respect to security.

I'm not arguing, just trying to understand the issue better.

elagost|4 years ago

Argument is the spice of life! An argument doesn't have to be angry. But nonetheless I appreciate your earnest kindness.

It's less of an issue when every site you connect to uses https, and every app you use employs ssl/tls for its connections. That is common practice these days. Getting man-in-the-middle'd on airport Wi-Fi is less feasible these days than it was 10 years ago. The attacker would have to also install a certificate on the user's device. I welcome corrections if I'm wrong.

VPNs aren't obligated to tell you the truth. They don't have to have good security or even honor what they say on the front page. People trust marketing, not actual policy or actions - just look at Apple. Still waiting on "HMA" VPN to go out of business because they handed over users to the FBI. They're still around and claim No Logs just like everyone else, just like ProtonMail did until this month.

https://arstechnica.com/information-technology/2021/09/priva... https://hacker10.com/internet-anonymity/hma-vpn-user-arreste... https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...

gizdan|4 years ago

> Honest question: it's still a consensus that they do have value in situations such as airport Wi-Fi, correct?

No. I don't think this was ever a consensus. When is the last time you've used a (sensitive) website that is not run over HTTPS? Unless the CAs (or the certs) are compromised, you have no reason to use a VPN when on public Wi-Fi, because it is encrypted with this so-called "military grade encryption" that VPN providers love to mention.

Edit: forgot to add, if the CAs or the certs are compromised, VPNs won't help anyway.

marderfarker2|4 years ago

Most public wifi block all the ports necessary for VPN except 80 and 443. Even then DPI will stop most VPN protocol right in its track.

I’ve never had reliable VPN working over public wifi/mobile network, unless I roll my own custom protocol that masquerades as HTTP traffic.

fortuna86|4 years ago

> Honest question: it's still a consensus that they do have value in situations such as airport Wi-Fi, correct?

No, with SSL and https now the default for 90%+ of the web, you can be sure no one is casually listening in.

karaterobot|4 years ago

> At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook.

You're starting with the (completely correct) observation that any VPN is not guaranteed to be secure, confidential, or private, and then making an argument as though it were the case that every reputable VPN is equivalent to every untrustworthy ISP. I think that's why your argument doesn't make sense to me: I don't think there's an equal chance that a VPN provider with a good reputation is going to sell me out as my ISP.

It's axiomatic in risk management that there is no way to completely remove all risk. Running a proxy and Tor is not a guarantee of security any more than running the world's shadiest VPN is, though it's obviously more secure by far. But, it's a question of what the acceptable level of risk is, and what the marginal cost to reduce that risk is. For many people, a $5-10 (non-shady) VPN is a perfectly reasonable step to take.

Raed667|4 years ago

What if you want a VPN to unlock location based content?

hannob|4 years ago

Circumventing geoblocking is legit, but don't tell people that VPNs are about "security".

trutannus|4 years ago

Essentially the only valid use of a VPN. That, or masking your location from other users online.

I find YouTube in my country is just filled with content being pushed because it's local to my country. Some VPN exit points have less local content pushing, which gives me more options. Eastern European content is really good, but also completely missing from American YouTube suggestions.

cm2187|4 years ago

Also create a fuse between DMCA requests and your sole broadband provider if you do any torrenting.

elagost|4 years ago

Then either do without (because, come on, nobody's gonna die if they can't watch reality TV), buy it on disc, or pirate it? Netflix is blocking IP ranges so hard that residential space is getting caught in the blast radius. It's a cat and mouse game that you'll only win by refusing to play. https://torrentfreak.com/netflix-intensifies-vpn-ban-and-tar...

babypuncher|4 years ago

I'm convinced that you can get most of the privacy "benefits" of a VPN with an encrypted DNS, which a pihole can be configured to provide for your whole home network.

Your ISP could still figure out which sites you are visiting by what IP addresses your traffic gets pointed to, but I'd be willing to wager that the bulk of their data collection for the purpose of advertising comes from logging DNS requests, since it is far easier to do and captures 99.99% of their customers habits.

This won't do anything to protect your IP from being sniffed out by media companies when seeding copyrighted torrents, but that has never been a major concern in my house. This is probably also meaningless if you are being targeted for surveillance.

lol123456789|4 years ago

idk mullvad seems pretty alright

z3c0|4 years ago

It is - they know their market and they serve them well. One of the few VPNs that actually don't log traffic.

That said, I've had websites flat-out refuse me because of using Mullvad (not just because it's a VPN, but a supposedly "disreputable" VPN). Meaning blackhats love it. Meaning it works.

fnord77|4 years ago

Tor is practically unusable in 2021. Tor is blocked or is very difficult to use for a growing number of sites. Google is the big one (whether one should use google at all is a different story).

Plus ISPs can detect tor use by its customers just from packet patterns. I don't want to be flagged as a tor user by either my ISP or the sites I visit.

The only other option is to set up your own ISP either in a colo rack or on a cloud VM. That's going to cost $50-$100 month plus your time fiddling with it and any network overages

dijit|4 years ago

I think there’s been good criticism of your arguments so far and I don’t want to pile on; but I see _a value_ in commercial VPN companies.

I, a tech savvy person, have no issue creating an SSH proxy server in any country in seconds.

But I also make online video games, and the US sanction system means I must block people from accessing our services; even if they have a copy of the game.

They did nothing wrong, my company isn’t even US based: we just used a cloud provider and all of those are US based.

So, I encourage those users to use a vpn if one is available to them.

dkersten|4 years ago

> If you think you want a VPN for "privacy", use Tor Browser.

What about Tor over VPN, so that your ISP can't see that you're using Tor? That is, the VPN hides your usage of Tor from your ISP and Tor hides your browsing from the VPN (and since many VPN services even advertise Tor support, its not like it would be suspicious, plus you can pay for many VPN's with cryptocurrency while I definitely can't hide my identity or location from my ISP).

guerrilla|4 years ago

> It's been clear for a long time that every single commercial VPN service is a waste of money.

This is nonsense. It depends entirely on your goals. It's important to me that my ISP doesn't know what I'm doing while I couldn't care less if my VPN provider does. I also need to circumvent geoblocking from time to time.

cool_scatter|4 years ago

> At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations.

I'm not sure what country you live in, but in the US, all the big ISPs might as well be run by the government, at least when talking about privacy. Private VPN companies are far more trustworthy, all else being equal.

0xdeadb00f|4 years ago

> Private VPN companies are far more trustworthy, all else being equal.

How? I don't see how being a VPN company as opposed to an ISP makes a difference in regards government seizure or request of logs.

ftobin|4 years ago

I believe Mozilla's contract with Cloudflare to provide Firefox Private Network provides great value, and I've been happy with it service for quite some time. Mozilla and Cloudflare are both well known organizations, and Mozilla acting as a buyer's agent is a good position to be in.

wintermutestwin|4 years ago

These are the reasons why I use a VPN provider:

1. my threat model is not my government. It seems that the TLAs have thoroughly pwned our privacy for a long time now. (please note that I am in no way advocating for this mass surveillance, but I don't see that I have much choice in the matter)

2. My threat model includes my ISP. I am forced to use a scummy ISP who would openly steal my data if I let them. Same with my mobile provider.

3. My threat model includes the data thieves who have obvious business models built around selling my stolen data to the highest bidder.

4. My threat model includes black hats and script kiddies.

5. Do I trust my VPN provider? Eh. A little. For now. The thing is, I trust them more than #s 2,3,4 above. What other choice do I have?

bsdnoob|4 years ago

I wouldn't say commercial VPNs are waste, It depends for what purpose do you want to use the VPN. Privacy? Yeah maybe not the best for that but these are extremely useful to bypass geoblocking of content. Moreover, many ISP do not like you downloading content via torrent. How do you propose we solve it? User experience with Tor is not always the best as well. Tor network does not have lots of bandwidth, It is okay for browsing but the moment you want to download something using Tor you'd notice that its actually very slow. I'd bet my money that using Tor would attract lot more attention by your ISP than using a regular VPN.

angelzen|4 years ago

To make it slightly more expensive for the adtech industry to spy on all my internet traffic. I have little illusions that any tech measure whatsoever can thwart government entities.

iforgetti|4 years ago

It depends on your risk model.

We use a commercial VPN at our company because it provides a mechanism for traffic encryption for employees who might be connecting from insecure networks. Sure most sites use HTTPS but there is still some unencrypted traffic like CDN or similar.

It’s not a cure all or some privacy guarantee, it’s just that for us, the risk of our employees browser history being stolen by that VPN for some nefarious purpose is just less than the risk of information leaking via insecure network.

can16358p|4 years ago

The main reason that I use (and many around here) VPNs is to access sites blocked by the government. And these blocked sites even included Wikipedia until recently.

h_anna_h|4 years ago

Mind you, tor had basically the same issue a while ago https://archive.is/4FMxm

ashtonkem|4 years ago

The utility in a VPN is in travelling, not at home. I’m not sure if I trust ProtonVPN more than I trust my ISP, but I sure as hell trust them more than I trust the little hotel I stayed at in Brooklyn.

Long term I’ll probably just solve this by setting up a VPN server at home, so I can tunnel through to my local services and protect myself from wifi endpoints I use on the go.

jrootabega|4 years ago

Having an easily-replaceable IP address is also of some value in case someone tries to DOS you in IRC/game chat/etc.

WastingMyTime89|4 years ago

> Why do we even give these companies the time of day?

My understanding is that most people use a VPN to either watch the foreign catalogs of streaming services or insert a third party in a foreign country to make themselves less tempting targets for random enforcement of copyright laws.

Obviously they don't advertise like this because these activities are illegal.

missinfo|4 years ago

Tor is too slow and often blocked by sites. And how do you know if an exit node is a honeypot or not?

Mullvad VPN seems like the best choice.

mintplant|4 years ago

> At worst, it's a government agency honeypot

Kevin Poulsen's book Kingpin, about the takedown of CardersMarket, describes how the FBI ran a VPN service as a honeypot for quite a while as part of the operation, logging everything that passed through it. As you say, it could be anyone on the other end of that connection.

nitrohorse|4 years ago

https://www.doineedavpn.com enumerates legitimate use cases well I think.

> This site was conceived and built by IVPN to challenge aggressive marketing practices in the VPN industry.

Semaphor|4 years ago

> Hide geographic location

> VPNs do not effectively solve this issue. Most modern browsers can detect the geographic location of a device based on data from GPS, available Wi-Fi networks and GSM/CDMA cell IDs and will submit this information to websites requesting it.

Did I miss something? Even the ad-tech browser will ask the user before sharing that?

qw3rty01|4 years ago

> If you think you want a VPN for "privacy", use Tor Browser

so replace a vpn, which might be logging your traffic, for a service which absolutely is logging your traffic?

Tor is an anonymity service, not a privacy service.

joconde|4 years ago

What traffic does it log exactly, and who logs it? As I understand Tor:

- the exit node knows the second-to-last node, the cleartext data and the destination,

- each intermediate node knows the previous and next nodes,

- the entry node knows the sender and the second node.

And using HTTPS prevents the exit node from knowing the cleartext data.

This doesn't enable any individual node to know who sent what to whom, assuming that the whole path isn't entirely controlled by one person.

hammock|4 years ago

>If you think you want a VPN for "privacy", use Tor Browser.

Isn't using Tor browser trusting a group of unknown people as well (nodes)? I hear all the time theories that Tor is a giant honeypot

elagost|4 years ago

Diversification. Theoretically most of the nodes are owned by different people, and every connection will randomize your node list route between them, making it difficult to track, unless most of the nodes were owned by one organization. With VPNs, all of your connections are through servers owned by one company, identified by an account ID.

acchow|4 years ago

> If you want a VPN for any other reason that "normal people" think they want a VPN

As far as I can see, normal people are asking for VPNs to access Netflix catalogs of other countries.

caymanjim|4 years ago

Tor is almost certainly a government honeypot, but if you're just trying to hide from Google and other ad companies, it'll help. Except that it's cripplingly slow.

unknown|4 years ago

[deleted]

deelowe|4 years ago

What assurances do we have that most tor end points aren't compromised as well?

unknown|4 years ago

[deleted]

dangerface|4 years ago

You are right that most people are just signing up with the same credit card and details as their isp and even if they claim they don't keep logs the vpn needs to link the use of their service to your details for billing just like your isp.

That said if you live in the UK the government logs your internet history to be used against you at their convenience. Using a vpn like mullvad.net that you can buy with bitcoin and no details prevents the government logging my history, thats worth the £5 a month.

zelphirkalt|4 years ago

Accounts can be completely decoupled from the payer. As long as the account is paid for, it should work. If there are no speed or time limits imposed, then why worry about who is using the VPN? If you allow a reasonable number of connections to the account at any given time, the rest shouldn't matter.

neom|4 years ago

I'm not sure I totally agree, sure I don't know every single employee, but I use Nord because I like and respect Tom Okman[1]

[1] https://en.wikipedia.org/wiki/Tom_Okman

(no title)

discuss