9 ms·

I always ask this on the VPN threads here, and don't feel like I get a solid answer (I'm not particularly well-versed on the topic so I'm genuinely curious and

• wincy 9y ago
  Speed, in terms of bandwidth and latency. I consistently get slower speeds using a VPN. Granted, I'm using Google Fiber so I have symmetric gigabit, but there is a downside to it, depending on your use case.
  • bearbearbear 9y ago
    Was there any point to this comment other than humblebragging about your fiber connection?
    • nirvdrum 9y ago
      It's a legitimate point to consider. I've set up my home router with Tomato by Shibby, which allows routing all traffic over a VPN link. I was finding the router couldn't keep up with a 50 Mbps link. Granted, these routers aren't designed with that use case in mind. But, running a VPN link all the time on mobile devices kills battery very quickly, so setting up the link on the router is preferable. Consequently, I don't route all traffic over the VPN, which is suboptimal.
      • pnutjam 9y ago
        I put a 2nd router behind my regular router and switch the gateway, on devices I want to use the VPN, to this 2nd router. Benefits: 1. allow devices to use non-vpn friendly sites 2. Keeps everyone on the same subnet so the VPN is not in the way for local file transfers. 3. main router not overburdened by VPN software
        • nirvdrum 9y ago
          Tomato allows selective routing, both by destination and by device, so that's helpful. Your setup definitely avoids some of the overhead mine has. But, really, I'd just like the little ARM processor in my R7000 to be able to keep up so I can saturate my link. I'm not familiar with ARM's ISA all that much, but it seems an AES-NI equivalent would be really nice to have.
        • bearbearbear 9y ago
          There's no catching him, he's behind 80 proxies.
  • marmaduke 9y ago
    Did you try HMA? I had amazing speed with them.
    • wincy 9y ago
      No, I was using PIA, I might try them out though, thanks.
      • Pigo 9y ago
        PIA is cool because it works seemlessly with your phone as well. It used to be you had to have some special access to get it to work with a provider like Verizon, but it works flawlessly now.
    • pimeys 9y ago
      Tried them out yesterday and they give about 10% of my Internet speed on any server. So my 400 Mpbs connection slowed down to 40 Mbps, which is a pretty rough drop. And I haven't been able to find an OpenVPN connection that could handle more than that 40 Mbps.
  • isatty 9y ago
    I'm in the same boat as well. I'm not in the US but I do have symmetric gigabit as well. I've been using EC2/DO boxes to setup VPNs for me, but they hardly ever come close to my home speed. This is usually due to the ec2/do instances being the cheapest or second cheapest with bad CPUs and overcrowding.
    • voltagex_ 9y ago
      You're also only guaranteed gigabit speeds on the higher tier instances. I'd be interested in what you get using iperf3 between EC2 and your home connection.
• robertpateii 9y ago
  VPNs protect you from snooping by 3rd parties on the way to Bob's site, such as your ISP, anyone on your network, or anyone on any of the intervening nodes between you and Bob's. If you don't want Bob to identify you then yeah you need more than just VPN such as ad blockers, disabling cookies, and more.
  • fulafel 9y ago
    Depends on what you mean by VPN but the let-me-bittorrent ones don't get you confidentiality (or integrity) to web sites you visit, past your immediate ISP.
• icebraining 9y ago
  Your VPN provider might not log. Or it might log and sell your internet activity. Of course, the same is true of your ISP, so you have to see who you trust more.
• gvb 9y ago
  So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all? The downside in a nutshell: "Researchers recently tested 300 free VPN apps on Google Play and found that nearly 40 percent installed malware or malvertising on users’ machines." "Bob" very likely doesn't know you even exist and doesn't care. The downside of VPNs is that many VPN hosting companies are even less trustworthy than "Bob" and do care who you are. An unscrupulous VPN provider can MitM your connections, harvest anything you give the VPN's app privilege to see (probably a lot), etc. Step one of security is to understand the threat you want to defend against and make sure your defense against that is (a) adequate, (b) appropriate, and (c) not compromising you in other ways.
  • baldfat 9y ago
    Another downside: Recently the Federal Government sent out a malware to certain persona of interest. That malware played a higher pitch sound than can be heard by the human ear. They were able to track that person and identify them because they heard the sound on the computer's microphone. TOR or VPN can stop this.
    • koolba 9y ago
      > That malware played a higher pitch sound than can be heard by the human ear. That should be "... can not be heard ..." right? Also, do you have a link with more details.
      • wccrawford 9y ago
        No, it's right as-is.
        • koolba 9y ago
          Ah I think I read the "higher" as "high" and misunderstood it.
          • jstanley 9y ago
• erikb 9y ago
  Think of SSH as the secure networking swiss pocket knife but that it is free for everybody to use, learn and script with. Now think how someone could make money out of it. They can't. So they start creating an alternative, that is so complex and hard to understand, that no person alone can manage it, and even the best solutions are unreliable, expensive and corporate. This is something you can sell and argue well that you need a shitload of engineers to maintain. This is VPN. What should you use if you're smart enough to come to HN for reading? SSH of course.
  • mi_lk 9y ago
    Do you mean you can use SSH for anonymous browsing? I genuinely don’t know how that works out, isn’t that just transfer the risk to the server you ssh into, so you end up having to trust the server? Do you have some links for reference?
    • jsjohnst 9y ago
      SSH has a Socks compliant proxy built in. That said, you are right, you are basically shifting responsibility to the SSH server you are connecting to so you have to trust it the same way you would a VPN provider. As such, it’s essentially the exact same and so GP was clearly misguided.
      • deleted 9y ago
        [deleted]
      • kibwen 9y ago
        Though this can provide an extra level of defense against MITM, if you trust your personal connection to the internet less than the server's connection to the internet.
      • erikb 9y ago
        You can provide the ssh server yourself. Which is not so hard. And security is something different than avoiding tracking. Avoiding tracking is very simply done by not using a centralized proxy which is maintained by someone else (like in VPN). When you are really under attack it's very different and in that case you couldn't trust VPN either. Even the VPN client would be a danger.
• bearbearbear 9y ago
  Verifiably VPN providers lie when they say they don't log: https://betanews.com/2017/10/09/purevpn-logs-fbi/ https://betanews.com/2017/10/09/purevpn-logs-fbi/ Whether it's through negligence or ignorance or intentional lying, it's nearly impossible to not log user activity in some way. And really, think about this: Even if you try really hard not to log, as a provider you're competing with thousands of forensic scientists who do nothing all day but figure out how to associate activity with the people who committed that activity. And once a federal agency has identified your VPN traffic, every single thing you've done through that VPN provider is all wrapped up in one neat bundle for them to peruse.
• SmirkingRevenge 9y ago
  You will sometimes face hassle authenticating with certain sites. Your VPN will trigger two-factor auth verification, or sometimes trigger an account lock-out or force password resets, etc.
• saosebastiao 9y ago
  I've been using one pretty consistently ever since the legislation passed allowing ISPs to sell your browsing history. I generally don't have any problems with it, but that isn't to say it is not problematic: * Connection issues are really annoying. At home it is manageable, but reconnecting to a different wifi network with a phone introduces a delay that sometimes lasts minutes before it becomes functional again * Some websites make you enter captchas in order to use them, probably due to VPN abuse by malicious users. Others outright block traffic to any detectable VPN traffic. * It is slower in general, but the worst case slowness seems much worse and more common. Unavoidable really, you're introducing another potential point of failure. * Useful LAN functions (like *.local domains) become non-functional
  • spccdt 9y ago
    Do you happen to have a link to the legislation you mention?
    • vlod 9y ago
      Googling this gives you lots of links: "isp sell browsing history" Here's arstechnica: https://arstechnica.com/information-technology/2017/03/how-isps-can-sell-your-web-history-and-how-to-stop-them/ https://arstechnica.com/information-technology/2017/03/how-i...
    • 0xfeba 9y ago
      https://www.cnbc.com/2017/03/28/congress-clears-way-for-isps-to-sell-browsing-history.html https://www.cnbc.com/2017/03/28/congress-clears-way-for-isps... Congress removed FCC regs. that would have prevented it. ISPs have been claiming both the regulation is unneeded but that they won't sell your data.
  • derefr 9y ago
    > Useful LAN functions (like .local domains) become non-functional Is that true if you 1. disable the "force all DNS traffic over VPN" setting, but then 2. have a local resolver (e.g. dnsmasq) that resolves LAN domains but forwards all other traffic to a DNS server on an IP that will end up routed through the VPN?
• jstanley 9y ago
  Not really an answer to any of the questions you asked, but I'll provide my perspective. I don't use a VPN to hide my identity from the websites I'm connecting to. I use a VPN to hide the websites I'm connecting to from my ISP. Residential ISPs in the UK are supposed to log a bunch of internet stuff (not clear exactly what), which is then made available warrant-free to over 40 government departments, including for purposes obviously unrelated to "national security" (not that that would make it OK), e.g. HMRC and the Food Standards Agency https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 Additionally, I use a DigitalOcean VM and run OpenVPN myself, I don't get a service from a VPN company.
  • Sean1708 9y ago
    > I use a DigitalOcean VM and run OpenVPN I've been looking to do the same recently, do you use Digital Ocean Droplets? If so, how have you found the experience?
    • taw20171030 9y ago
      Not the OP and I don't use DO specifically, but I've found using a VPS provider to be a more or less painless VPN experience. Providers like DO, OVH, and Vultr have scripts for easy one-click OpenVPN setup, or you can roll your own if you don't trust their scripts (though if that's the case maybe you don't trust the VPS provider at all...) That said, always verify that the tunnel is operating correctly before assuming it is and taking off. I've found on more than one instance that the OpenVPN client was misconfigured and seemed to connect, yet my IP was still being reported as my ISP's.
      • unethical_ban 9y ago
        I did notice the Vultr OpenVPN deploy has license restrictions of two clients.
        • morganvachon 9y ago
          I think that's an OpenVPN restriction, not a Vultr specific restriction. You have to pay for a commercial license if you want multiple connections with OpenVPN.
• mattmanser 9y ago
  So I know of normal people using VPNs in the the UK for some or all of the reasons below: 1. They're blocking lots of torrent websites, using a VPN circumvents this 2. They're sending out letters to people saying "you're torrenting, stop". VPN stops this 3. Some ISPs throttle traffic to certain services and streaming sites, VPNs circumvent this
• gwbas1c 9y ago
  Think about it this way: What if your VPN operates in another country? It becomes an international issue if Bob wants your VPN to tell them who you are. On the other hand, if your VPN operates in another country, some websites within your country may block you due to content licensing issues.
  • mirimir 9y ago
    My favorite formula, in constructing nested VPN chains: 1) First VPN, that only my ISP and second VPN see: I choose one that's popular where I live, and commonly used for torrenting, and I have a torrent client up 24/7. 2) Second VPN, that only the first and third VPNs know about: I choose one that does business from a jurisdiction that isn't very friendly with my government and its friends. 3) Third VPN ... 4) Final exit VPN, that only the previous VPN and websites see: I choose one that doesn't attract too much attention. For Mirimir, that's IVPN, because I'm already so associated with it.
    • icelancer 9y ago
      What is your favorite way to create VPN chains in Windows/Linux/OSX?
      • mirimir 9y ago
        I mostly use VirtualBox, or VMware in Windows. pfSense VMs make great VPN gateways. VPN and pf setup are pretty easy with their webGUI. Debian VMs also make great VPN gateways, but setup is harder, and their disk footprint is greater. I've thought about doing it all in one OS, with iptables or pf to control routing. It'd be lots lighter, but more fragile.
        • mirimir 9y ago
          Another option, if you want more security against exploits, is Qubes. But the hardware requirements are far more restrictive, and the learning curve is steeper.
• sliverstorm 9y ago
  Chief on my mind would be the issue of trust. Your traffic is coming out of the VPN node unencrypted. They could snoop you, MITM you, basically anything. So, who do you trust more? Your ISP or a mysterious VPN service probably in Russia that you learned about yesterday? I figure my ISP is quite likely to sell my data and do other unfriendly things. But I figure they are quite unlikely to attack my traffic and do other illegal things.
• regulation_d 9y ago
  Is Bob a cop? Does he have probable cause that you were involved in criminal activity. I don't think you can just handwave "call my ISP with a warrant".
• mirimir 9y ago
  Sure, adversaries could pressure VPN providers for logs, account information, help tracing traffic, etc. So you pick VPN services that have been in business for several years, are well known and recommended in relevant communities, and have no history of giving up their customers. There's a recent relevant thread on Wilders: https://www.wilderssecurity.com/threads/purevpn-keeping-logs.397160/ https://www.wilderssecurity.com/threads/purevpn-keeping-logs... Even so, it's prudent to assume that your VPN provider logs, works with your adversaries, etc. Just like the Tor project assumes that any particular relay may be malicious. So Tor clients create three-relay circuits, to distribute the risk. And one can do the same with VPN services. I'm currently working through a nested VPN chain, using servers from multiple providers. I use pfSense VMs as VPN gateways, and workstation VMs. It's also easy to add Whonix to the mix, so I can use Tor through nested VPN chains.
• Spooky23 9y ago
  You're assuming that private parties have the ability to get warrants or subpoenas to get information from your ISP. They do not. If "Bob" wants to know who you are when you visit his website, he doesn't have any options to get that information. If "Bob" thinks you are violating his copyright rights, he can file a DMCA complaint against you. If "Bob" doesn't want people from Iceland to access his site, he can try to filter based on IP range. VPNs do three things: 1. obscure your identity 2. obscure your location 3. prevent local inspection of your network traffic. How effective that "obscurity" is depends on who wants to know and why.
• maccard 9y ago
  For me it’s not bob I don’t trust, it’s my ISP.
• lr4444lr 9y ago
  It seems in the latter case, even with a malicious VPN, it's one additional (maybe trivial step) to associate me. But it's still better than just using your own ISP. Isn't that why people use VPNs to avoid DMCA letters from their ISP If the VPN is malicious or self-hosted. If the servers and the company headquarters are located in a country not part of the "14 Eyes", and most importantly, host a lot of other traffic that is not you, there is obfuscation, legal barriers, and plausible deniability that you did not do what "they" are claiming you did.
• paulmd 9y ago
  VPNs aren't a defense against subpoenas or warrants, they're a defense against ISPs scraping your connections and selling them to advertisers. No advertiser is going to come after your VPN provider asking for logs, and even if they did your VPN provider is going to tell them to get fucked anyway. Again, unless the advertiser in question happens to be the federal government and they have a subpoena or a warrant, no VPN provider is going to give you logs to help you associate a user, I have no idea why you would even think that. If you don't want traffic from users on the VPN you are free to block them (Netflix does this) but nobody is going to give logs over to a random webmaster to help deanonymize users. If you want to remove the VPN provider from the question entirely (many of them are on the shady side), you can use Algo to automatically deploy a Digital Ocean droplet or Linode instance to relay your connections for you. However this doesn't fundamentally change anything - if someone comes after you with a warrant or a subpoena, then Digital Ocean/Linode is going to give you up. https://github.com/trailofbits/algo https://github.com/trailofbits/algo This is not exactly a difficult concept to understand so if you have asked this question repeatedly and still aren't satisfied with the answer, perhaps you should look inward.
  • chii 9y ago
    > they're a defense against ISPs scraping your connections and selling them to advertisers. isn't SSL supposed to do that? At most an ISP ought to only be able to sniff the domain.
  • thephyber 9y ago
    > VPNs aren't a defense against subpoenas or warrants, they're a defense against ISPs scraping your connections and selling them to advertisers. Some VPNs imply this when they claim they don't keep logs on their users.
  • EpicEng 9y ago
    >VPNs aren't a defense against subpoenas or warrants They absolutely are for a huge number of people. Why do you think so many VPN's advertise the fact that they don't keep logs? I imagine far (_far_) more people use VPN services as a way to evade copyright holders than as a mechanism to avoid marketers (most people don't give two craps about the latter issue.) BTW, was the snarky bit at the end really necessary?
• ApolloFortyNine 9y ago
  >b) they really don't store logs and have no idea which one of its thousands of users logged into his website with that IP. >It seems in the latter case, even with a malicious VPN, it's one additional (maybe trivial step) to associate me. But it's still better than just using your own ISP. Isn't that why people use VPNs to avoid DMCA letters from their ISP? I'm not sure how you made this jump. If the provider doesn't have logs, Bob can't find you. The end.
  • daxorid 9y ago
    No-log providers can still very likely be compelled to start logging by a combination of the All Writs Act and NSLs.
  • pqdbr 9y ago
    I also couldn't understand his reasoning here, and I'm surprised you're the only one that pointed this out in this thread.
• imaginenore 9y ago
  > Then he calls the VPN company, and asks them to associate the IP and specific browser sessions with me. That's when a good VPN provider will tell you to piss off. Plus I doubt many VPNs that actually do logging will have the fingerprint data.
• jk2323 9y ago
  1. VPN Overview https://thatoneprivacysite.net/ https://thatoneprivacysite.net/ 2. oVPN.to is probably a good idea, as long as you are not based in China 3. Pay anonymously for the VPN. If it need to be really secure, only access VPN via TOR.
• tomjen3 9y ago
  Such a VPN that did keep logs would lose their entire business model if it broke that they kept logs - even if they kept logs (and why should they? That might always leak and kill their business) why should they help a third-party to them?
• js2 9y ago
  > If I go to Bob's website while logged in with a VPN, and Bob wants to find me, he first sees that he's getting tons of hits from this IP because thousands of users are sharing this same VPN. So then he uses some kind of fingerprint to figure out my unique user sessions. Every TCP connection is uniquely represented by (src ip, src port, dst ip, dst port). Bob can provide all four of these, and a timestamp, to the VPN provider. The VPN provider can then resolve that to a specific user if they are logging connections.
  • chii 9y ago
    in which case, if you can't trust 1 VPN, can't you jerry-rig a better VPN by daisy chaining several together, so that each VPN will have to be asked to sort through traffic?
    • b3lvedere 9y ago
      Isn't that what TOR is all about?
• freddybobs 9y ago
  There are lots of problems you see in practice which are not discussed often.... * Inability to send mail though a mail program * Daily disconnections of VPN service * Captchas and other verification/friction when using services (eg youtube, amazon etc) * Some services may believe you are in a different country incorrectly, meaning you have to force them to use the right location, or be happy with it being wrong * Some services will not work at all (for example purchasing through apple) * Paid streaming services – like netflix, hbo go and amazon streaming will likely not work at all * You may not be able to port tunnel traffic inside the VPN And of course you have to trust the provider. For example PureVPN claims 'no logs' but it seems that isn't the case... https://betanews.com/2017/10/09/purevpn-logs-fbi/#comments https://betanews.com/2017/10/09/purevpn-logs-fbi/#comments There is a lot of friction in using a VPN. Which makes the idea, often proposed by technical people that if you are worried about privacy - 'just get a VPN' either naive or disingenuous. That said even with the friction it is worth the cost and hassle IMHO. In practice you have to have a way to flip on and off VPN on some machines/devices. There is more discussion on this here... http://www.toytheory.com/?p=295 http://www.toytheory.com/?p=295 (edit: fix formatting)
• SophosQ 9y ago
  If you roll your own VPN on AWS or the like, don't you lose the benefit of sharing the VPN with thousands of users I believe there is the alternate option of setting up your own VPN . Instead of using AWS, you could set it up on an additional router or on your PC/pi wherein you'd lose the advantage of anonymity amongst other users but your information is still encrypted to be acceptably safe.