Hacker News Reader

Comment by whobutsb | Hacker News Reader

What is the HN community going to do to protect their privacy from ISPs? VPNs? Tor? Disconnect? Looking for thoughts and ideas.

View on HN

This article is about rescinding a set of rules that hasn't even taken effect yet. Almost nothing will have changed as a matter of practice. Some fence sitting providers may decide it's okay to sell your information now, and it may be harder to get these rules in place in the future.

I'm looking to drop a pfsense router in front of my network so I don't have to deal with VPN on a per-device level. Other than that, selecting a top tier VPN is also on my to-do list. HN recommendations for VPNs would be helpful here!

getcloak.com is the Dropbox of VPNs. The most polished service out there.

Private Internet Access is supposed to be one of the better ones that doesn't save logs. I've had it on a machine for months and it hasn't ever disconnected. YMMV.

I can vouch for PIA working well. Speeds are quite good and connection is rock solid. 2+ years with it. The main problem with it I suppose is that it is based in the U.S.

But most of their connection locations are not.

I spent a lot of time researching VPNs and trying to find one I felt like I could trust. Unfortunately, if you're being truly paranoid (which I feel everyone whose considering a VPN should be) there's nobody out there you can trust.

If you feel you can trust a datacenter, the most trustworthy approach would be running your own OpenVPN instance in another country.

Although if you don't want to go through the hassle and do decide to put some amount of trust in a VPN service, I have found That One Privacy Site [0] to be a great resource for researching VPNs.

[0] https://thatoneprivacysite.net/vpn-section/

Anyone have any experience with flashrouters - https://www.flashrouters.com? While I think you still need a VPN like PIA, IPVanish, ExpressVPN etc, it appears they offer help with device by device VPN connectivity and some plug and play pre-configuration for VPN router?

I recently purchased a subscription to NordVPN in light of this new legislation. They claim not to keep any logs, and I've found their servers to be quick with low latency. A speed-test right now shows 41mb/sec down and 15ms ping. They also don't throttle specific kinds of traffic, like torrents.

No affiliation, just a happy customer.

"6. Yes, we allow P2P traffic. We have optimized a number of our servers specifically for file-sharing; ensuring other servers, which are meant for streaming and other purposes, have uninterrupted speeds. In any case, we do not engage in bandwidth throttling for P2P users."

- https://torrentfreak.com/vpn-services-anonymous-review-2017-...

The whole "we don't keep logs" statement is snake oil.

Picking a US server at random, (US20) it seems to be hosted here[0]

In what appears to be their NJ datacenter located at:

DuPont Fabros, 101 Possumtown Road, Piscataway, NJ 08854

Per their own privacy policy available here[1], they mention the following

  > Internet Protocol (IP) Addresses
  
  > DigitalFyre uses your unique network address and SessionID
  > to help diagnose potential problems with equipment, to help
  > tailor content to match your preferred interests and to
  > otherwise administer the Site.

So while NordVPN (and frankly, any VPN service that colocates or rents servers) may claim not to keep logs, their service provider most certainly does. Even though your ingress traffic is encrypted, it would still be trivial to match it to egress flows based off packet counts, sizes, and flow durations.

  [0] https://www.digitalfyre.com
  [1] https://www.digitalfyre.com/privacy-policy/

Great point. Do you know of any VPNs that dodge this with reasonable ping times in the US?

Honestly, I never understood the interest people had in companies providing VPN for personal use. The way I always saw it is if I was traveling and needed VPN while on public/unencrypted Wi-Fi, I would just VPN back to my home. Of course this means I trust my ISP not to do anything nefarious.

This topic has the opportunity to become a huge discussion, so for the sake of brevity I'll summarize with my personal, opinionated solutions for various use cases.

  1. You don't trust your ISP
  1.1 Switch ISPs (not always practical)
  1.2 Setup a VPN on a $2.50/mo or $5/mo VPS (this could incur bandwidth costs
      if you're pushing multiple TB per month across the VPS. Note you're still
      at the mercy of the VPS and their colo, but no different than today with
      a VPN provider.)
  2. You don't trust the public network you're on
  2.1 VPN back to your home. This would be free.
  2.2 See 1.2
  3. You don't trust the site operator of the site you're visiting
  3.1 Use Tails linux and Tor

I can't think of any other use cases.

> 1.1 Switch ISPs (not always practical)

That's the use case. For many Americans there is literally no viable option here.

Take Albuquerque for example: if you want a solid 20mbit connection or better, your only option is Xfinity (Comcast).

Don't even get me started on mobile data.

My privacy setup for a while (which I have relaxed somewhat) included:

- Ubuntu on my desktop and laptop

- CyanogenMod on Android [0]

- VPN to a non-14 eyes country [1]

- uBlock Origin, PrivacyBadger, Disconnect

- Null-routed most CDNs (e.g. Google APIs)

- Gaff tape over device's cameras if I couldn't physically disable them

Now obviously those measures go far beyond protecting you from just ISPs, but it was designed to take into consideration every method ISPs, big tech (Google, Facebook), and governments could track you.

[0] https://en.wikipedia.org/wiki/CyanogenMod [1] https://en.wikipedia.org/wiki/UKUSA_Agreement

Doesn't null routing CDNs cause problems? It would make more sense to run your own caching proxy so you rarely make the request to the CDNs and they can't track you. Although doesn't your browser do that already? It's not like you request jquery on every page linking to it via google cdn. You only do it once and then it's cached.

Reply on news.ycombinator.com