Hacker News Reader

Comment by pier25 | Hacker News Reader

Because ISPs can't read your traffic

But now the VPN provider can just track you and sell all your browsing history instead of the ISP, so how is this better?

It's not. There's no way to verify the VPN provider is not keeping logs and tracking you.

This is the principle-agent problem, generally.

Audits and reputation may help.

Because you have much more choice for VPN providers than for ISPs. And you can change VPN periodically, far more easily than changing ISP. Also, you can use nested chains of VPNs, much like Tor, to distribute trust. So adversaries must compromise multiple providers, quickly enough that logs will be available.

Edit: Also, you can pick VPN providers outside your adversary's sphere of influence. That's standard advice for users in China, for example.

Also, you can pay for a VPN without revealing your identity. Not so with ISPs. I use a VPN, for instance, to mask my Tor usage from my ISP. (I'm an American using the Internet in the United States.)

True. But the VPN provider effectively knows who you are, because they see your IP address. Or rather, a resourceful adversary can get your IP address from the VPN provider, and then get your identity from your ISP.

If you chain VPNs, however, it certainly makes sense to lease the second/indirect VPN anonymously.

I don't think IP alone will not be sufficient, for ex i am sure my ISP extensibly NATs the network and shares the same IP for many users. So much so that Google keeps asking for captcha every couple of days

Maybe. But then logs would reveal who had some IP when.

And now both of your vpn owners have your data connected to your ips. You do have more choice but if both of them sell the data, it doesn't make any difference.

Right, you still need to trust someone.

If it really matters, you use nested VPN chains. Three deep is my standard, and I've managed six. Latency can be a couple seconds, but hey.

What's the advantage of 6 nested VPNs over VPN + Tor?

Consider CMU's exploit of the "relay early" bug. They identified users and onion servers through compromised entry guards. So with one VPN, the adversary knows the VPN exit IP. If they have authority vs the VPN provider, they get your identity. But if you're using nested VPNs, they need to go after the next VPN provider. Six is probably overkill. Maybe three is too. But it works well enough, so why not?

If you need multiple residential IPs, use Hola's Luminati. If you don't trust them (a wise move), do so illegitimately.

https://news.ycombinator.com/item?id=13676600

You can also tunnel to Tor through domain fronting.

https://trac.torproject.org/projects/tor/wiki/doc/AChildsGar...

https://www.fireeye.com/blog/threat-research/2017/03/apt29_d...

    > But now the VPN provider can
    > just track you

Find one based in a less offensive jurisdiction?

I've lived places where my only ISP choice was Comcast. I trust them as little as the worst VPNs, and having a choice of VPN lets you choose one which is trustworthy and in a convenient jurisdiction. That matters some in the States (no NSL to Canada, for instance) and a great deal in China or other countries.

Yes, but every website you visit can potentially ID you with cookies or browser finger prints.

Well, you compartmentalize in multiple VMs. Using different VPNs, Tor, and nested chains of them.

Things are getting very inconvenient at that point, all to avoid being snooped on by the people who are supposed to be representing us.

What a sorry state of affairs.

Yes, it is unfortunate. But hey, you gotta deal with what's so.

There is a learning curve, and extra steps in configuring a working environment. But once the host and VMs are configured, uptime is no worse than with typical LANs.

Reply on news.ycombinator.com