5 ms·

I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.

by mat_b 9mo ago

fragmede 9mo ago
Yeah free VPN is totally a problem, but there's TLS so at least those users aren't getting their bank account information stolen.
- Egor3f 9mo ago
  TLS works when app is installed somewhere else, but not in browser itself. Browser actually handles TLS termination.
- bsaul 9mo ago
  Does tls means certificate pinning ? Can't a vpn alter dns queries to return a proxy website to your bank, using a forged certificate ?
  - bandrami 9mo ago
    Only if you've added a signing certificate the VPN controls to your CA chain. But at that point they don't have to do anything as complicated as you described.
  - notpushkin 9mo ago
    TLS means “there’s a certificate”. Yeah, if a VPN/proxy can forge a certificate that the user’s browser would trust, it’s an issue. But considering those are browser extensions, I think they can just inspect any traffic they want on the client side (if they can get such broad permissions approved, which is probably not too hard).
- deleted 9mo ago
  [deleted]
Joker_vD 9mo ago
For the same reason you trust your ISP? It handles all your internet traffic; and depending on where you live, probably has government-mandated back doors, or is willing to cooperate with arbitrary requests from law-enforcement agencies. That's why TLS exists, after all. All Internet traffic is wiretapped.
- Dylan16807 9mo ago
  I'd be significantly more suspicious by default of ISPs that charge no money. > That's why TLS exists, after all. That protects you if you're using standard methods to connect. Installed software gets to bypass it.
  - Joker_vD 9mo ago
    And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh). But it's cumbersome.
    - silverwind 9mo ago
      You should run VPN on your gateway instead.
  - psychoslave 9mo ago
    Well, if someone want to cover a large set of psychological profile, they can always have a full range of virtual brands, going from freemium+ to luxurious-esthetics. Maybe some
- nrhrjrjrjtntbt 9mo ago
  TLS doesnt hide IP addresses
- bluepuma77 9mo ago
  > I don't understand why so many people are using [Cloudflare]. > "Let us handle all your internet traffic.. you can trust us.. []" TLS does not help, when most Internet traffic is passed through a single entity, which by default will use an edge TLS certificate and re-encrypt all data passing through, so will have decrypted plain text visibility to all data transmitted.
SamDc73 9mo ago
A lot of people from poor countries where they can't access a lot of websites/services and also can't pay for a VPN use these "free" VPNs but other than that I would never trust anything other than Mullvad/IVPN/ProtonVPN
lodovic 9mo ago
The use case is people that are urged to view something that is blocked (torrent / adult / gambling). They want it now, and they don't want to get involved with some shady company that slaps on a 2 year contract and keeps extending indefinitely. These people instead find "free vpn" in the web store and decide to give it a try. VPNs are just one example. How many chrome extensions do you have that you don't use all the time, like adblockers, cookie consent form handlers or dark mode?
- mat_b 9mo ago
  Me personally? I'm using Firefox with EFF privacy badger. No others.
akimbostrawman 9mo ago
ISPs are so heavily regulated that the will give any federal or government agency free access to future and past internet connection information that are directly tied to your real identity. Meanwhile reputable VPN provider like mullvad offer there service without KYC and leave feds empty handed when they knock on there doors. https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.

by mat_b 9mo ago

I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.

fragmede 9mo ago

Yeah free VPN is totally a problem, but there's TLS so at least those users aren't getting their bank account information stolen.

Egor3f 9mo ago
TLS works when app is installed somewhere else, but not in browser itself. Browser actually handles TLS termination.
bsaul 9mo ago
Does tls means certificate pinning ? Can't a vpn alter dns queries to return a proxy website to your bank, using a forged certificate ?
- bandrami 9mo ago
  Only if you've added a signing certificate the VPN controls to your CA chain. But at that point they don't have to do anything as complicated as you described.
- notpushkin 9mo ago
  TLS means “there’s a certificate”. Yeah, if a VPN/proxy can forge a certificate that the user’s browser would trust, it’s an issue. But considering those are browser extensions, I think they can just inspect any traffic they want on the client side (if they can get such broad permissions approved, which is probably not too hard).
deleted 9mo ago
[deleted]

Joker_vD 9mo ago

For the same reason you trust your ISP? It handles all your internet traffic; and depending on where you live, probably has government-mandated back doors, or is willing to cooperate with arbitrary requests from law-enforcement agencies. That's why TLS exists, after all. All Internet traffic is wiretapped.

Dylan16807 9mo ago
I'd be significantly more suspicious by default of ISPs that charge no money. > That's why TLS exists, after all. That protects you if you're using standard methods to connect. Installed software gets to bypass it.
- Joker_vD 9mo ago
  And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh). But it's cumbersome.
  - silverwind 9mo ago
    You should run VPN on your gateway instead.
- psychoslave 9mo ago
  Well, if someone want to cover a large set of psychological profile, they can always have a full range of virtual brands, going from freemium+ to luxurious-esthetics. Maybe some
nrhrjrjrjtntbt 9mo ago
TLS doesnt hide IP addresses
bluepuma77 9mo ago
> I don't understand why so many people are using [Cloudflare]. > "Let us handle all your internet traffic.. you can trust us.. []" TLS does not help, when most Internet traffic is passed through a single entity, which by default will use an edge TLS certificate and re-encrypt all data passing through, so will have decrypted plain text visibility to all data transmitted.

SamDc73 9mo ago

A lot of people from poor countries where they can't access a lot of websites/services and also can't pay for a VPN use these "free" VPNs but other than that I would never trust anything other than Mullvad/IVPN/ProtonVPN

lodovic 9mo ago

The use case is people that are urged to view something that is blocked (torrent / adult / gambling). They want it now, and they don't want to get involved with some shady company that slaps on a 2 year contract and keeps extending indefinitely. These people instead find "free vpn" in the web store and decide to give it a try. VPNs are just one example. How many chrome extensions do you have that you don't use all the time, like adblockers, cookie consent form handlers or dark mode?

mat_b 9mo ago
Me personally? I'm using Firefox with EFF privacy badger. No others.

akimbostrawman 9mo ago

ISPs are so heavily regulated that the will give any federal or government agency free access to future and past internet connection information that are directly tied to your real identity. Meanwhile reputable VPN provider like mullvad offer there service without KYC and leave feds empty handed when they knock on there doors. https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...