Hacker News Reader

More on how luminati and other "residential ip" providers work here: https://medium.com/@xianghangmi/resident-evil-understanding-...

Wow, very interesting read. Thanks for bringing this to light.

Looks like Luminati is also explicitly getting developers to put a luminati proxy client into their apps and have users opt into using that instead of getting fed advertisements.

https://luminati.io/faq

Between your link, and the luminati faq's, I definitely have more questions then when I started looking at these articles.

Luminati didn't start off like that. They started by burying what they were doing in a "free" vpn.

I asked, and they are only interested in partners with 100k active users a month. They REALLY REALLY wanted to talk to me over skype. Right, like a legitimate company with that many users is going to use luminati.

The use case of luminati is almost entirely grey/black hat. Their history is laughably sketchy. Unless anybody knows of any apps that use the SDK and ask for permission, I suspect that FAQ page is just for show. Again you have to be a big player to even use it, it's not a stretch to believe they don't "enforce" the consent rule.

Wow, that's a good read.

+1 on ssh + vps. People will say it isn't as anonymous as the shared vpn's and while that is somewhat true, it is still more than sufficient to remove your home IP from logs. Short of scary letters and warrants to the VPS provider, people won't really know who you are. You can also automate the rebuilding of proxy nodes to get new IP's, as most VPS providers have an API for automated rebuilds.

Exactly this.

For non-state actors my "data" is gone. You'd need a warrant to get data from my VPS provider, so for most of the common threats I'm pretty anonymous to non-state actors.

Maybe you don't want your employer to see everything you search? Interestingly for programmers the ssh-tunnel is perfectly explainable, especially if you do most of your browsing in the clearnet, and only some over your ssh-tunnel.

If your threat model includes state actors (doing something illegal hmmmm?) then I would recommend doing something a bit different, but for what most people are using services like Nord for ssh + vps should be fine.

EDIT: If yall are torrenting then just get a 10$/mo seedbox, you'll thank me later.

Are there any high quality VPS providers that have a way to sign up and pay anonymously with Monero (or similar), manage via tor browser, etc?

This here is assuming you don't have a nation state actively trying to track you down. Otherwise see [0]

One option is to use basically any provider + prepaid visa cards. Just access the website over tor or a VPN you semi trust. Sure it's technically traceable but not without a lot of trouble.

Keep in mind that once the VPS provider is issued a subpoena they still have access to your connecting computer's IP. They then have to issue a subpoena to your ISP for your account information. The only way to hide your IP is to use a proxy or a vpn... Oh wait, yeah that's the issue. See [0]

I personally just recommend using whatever you'd like, Vultr, DO, scaleway, etc. Feralhosting isn't anonymous but they uh... don't care what you really use it for cough torrents cough.

[0] If you're REALLY trying to be fully anonymous then you'll need to put on your blackhat. I would start with planting a raspberry pi in a business, library, coffeeshop, etc. You can use that IP as a starting point. You won't want to use only that one IP most likely, so you're going to need more proxies/servers, most common method is botnets. This really isn't worth the trouble to 99.9999% of people.

Edit: I guess I'm estimating there are ~7,000 people in the world who it's worth the trouble to do.... Actually that might be accurate, cool! :D

I've tried using prepaid cards with VPS providers and only found one that still took them (as of a couple years ago). Most won't take gift cards (prepaid visa) any more.

Hmm I was wondering if that was the case nowadays.

Honestly I don't think the extra step is worth it since the VPS will still know your origin IP in the event of a subpoena anyway.

You could try https://privacy.com but ironically I doubt it'll help much in terms of privacy. (I use privacy for convenience, as it essentially mitigates your card numbers being leaked - they're locked to the vender and you can impose spending limits)

Unfortunately I doubt there's many people who want 100% privacy that you'd want as customers if you're a VPS provider. I know Vultr accepts crypto but you have to prove your identity first (still great if you're a crypto advocate as privacy isn't the only benefit).

Otherwise you're stuck with resellers and grey-market providers. You could try "bulletproof" hosts from various uh-greyhat-forums but trusting those is very mehhhhh.

If I were taking such measures, I would just park near a coffee shop and use their wifi, using hardware I paid cash for and periodically changing my MAC address.

VPS providers can log connections and you won't really know how long they retain the data until it matters.

Wouldn't Tor hide your ip from the VPS provider even if they're subpoena'd?

EDIT: I realized this question might be confusing in this context. I'm not talking about torrenting large files (which you wouldn't want to do over Tor). I'm just wondering if it's possible to run a VPS with 100% anonymity.

IIRC can't an SSH tunnel leak your browsing through DNS leaks, or am I misunderstanding? I thought you usually want to use an actual VPN protocol like Wireguard.

socks4 leaks DNS requests, socks5 can tunnel them as well.

Stick with the big players, PIA, airvpn. I trust those two.

At the end of the day they're mostly just fancy OpenVPN profiles. The entire space is fishy AF IMO.

I'm thankful that linustechtips seems to evaluate their VPN sponsors at least. I believe they dropped tunnelbear in favor of PIA because of similar concerns.

Tunnelbear was acquired and all sponsorship dropped, he actually mentioned it on one of the derbauer overclocking posts from Computex this past week.

PIA has cross pollination with IP blocks owned by Micfo subsidiaries as well. They're all like 2 degrees away from each other.

Oxylabs and Luminati are competitors. They don’t own them.