Hacker News Reader

Comment by ignoramous | Hacker News Reader

> We encourage users in Kazakhstan affected by this change to research the use of virtual private network (VPN) software, or the Tor Browser, to access the Web

Mozilla should be careful suggesting the use of VPNs (without providing a disclaimer) since most of the well-marketed ones are, for all intents and purposes, MiTM blackboxes [0], owned by state-actors in some cases [1].

For people looking to make an informed decision, take a look at https://thatoneprivacysite.net/#detailed-vpn-comparison or setup one yourself https://github.com/trailofbits/algo

If folks do inadvertently flock to free VPNs, the situation would get way worse (tracking now not just limited to HTTPS, but everything above layer-2).

[0] https://news.ycombinator.com/item?id=19601503

[1] https://news.ycombinator.com/item?id=18525041

View on HN

LinusTechTips did a video on anonymous browsing with VPNs and TOR yesterday and I wish they had been more serious on this bit. The top/pinned comment when I viewed was along the lines of "What is a good free VPN, not a trial", and LTT themselves responded something like "None. Bandwidth costs money and you should be suspicious of a VPN that doesn't make money in a clear way." Still, I bet 99% of viewers won't see a comment response.

But even then, and I realize this gets a bit tinfoily, but as a thought experiment, is there a really good, reasonably trustless, way to vet a VPN?

For example I use PIA because of word of mouth and a few incidents in the past which show trustworthiness. But how can I really prove they're not secretly backed by China and I'm paying $5/mo for higher priority access to a Chinese VPN farm? Or at the very least that they are honest on any given day about not retaining log data.

I don't know if this is helpful, but I'll mention it because it works well for me.

I use a Digital Ocean droplet and local forwarding.

$ ssh -q -D [port] [droplet-hostname]

Then setup my browser to use a proxy at localhost on [port]. Works great. You can get a "droplet", in Digital Ocean Parlance (i.e., "VPS") for as little as $5/mo, which includes 1TB/mo of data transfer. I assume other options like Linode, Vultr, etc would work as well.

I actually did this for several years, with the added benefit that any number of my (trusted) friends could piggyback on it, given we weren't all using at once. There are dozens of great guides on this, DigitalOcean even hosts some of their own that you can practically copy paste blindly and be done.

I'll be honest though, haha, 10% of my VPN usage is legitimate stuff and 90% is just so I can feel safe streaming things illegally that are otherwise hard to purchase. So I switched over to a third party for the simplicity. If I wanted to do more than avoid an email from my ISP I would definitely go back to rolling my own. (I'm also grandfathered into PIA's older cheaper price tier which makes it easier).

>an email from my ISP

That's pretty funny. I am from Kazakhstan myself and our largest (pretty much monopolist) internet provider has been encouraging ""piracy"" for as long as I can remember.

About 10 years ago a bunch of local media companies (making money from selling badly translated Hollywood movies/video games/etc) lobbied a new law making operating all torrent trackers illegal, and banning access to everything they could find carpet bombing-style.

Well, the ban lasted for less than a week, and was lifted after some heavy lobbying by said provider, who was beginning to lose a share of their most valuable customers.

Here's another anecdote: in ~2012, when I was getting an FTTH connection, their representative used a popular torrent on my machine to measure the upload/download speeds through the freshly laid cable.

You're kidding; Kazakhstan has FTTH? I'm in America and still not even close...

Yeah. I pay $10/month for 100 Mb/s with very stable upload and download speeds. You can get 1 Gb/s for $50/mo.

I have been serving 10-20 TB each month with no complaints from my provider.

But you have to remember that we make something like 5-10 times less than Americans. 100 Mb/s is still very affordable though.

There is FTTH in more places than you might realize:

https://broadbandnow.com/Fiber

I live in Nashville and we have FTTH from both AT&T and Google as well as gigabit service from Comcast. I think the problem is the US is really, really big and we widely deployed cable which has been "good enough" (DOCSIS 3.x at 300, 500Mb/s or more) that there historically hasn't been much incentive for people to deploy really expensive fiber networks.

But it is certainly improving all the time. I think services like Starlink and fixed 5G are really driving carriers to start deploying more fiber to compete.

There is also sshuttle, which will forward all TCP traffic on your machine to anywhere you can ssh into and run a python script: https://github.com/sshuttle/sshuttle

It's very easy to use and setup, just do

  sshuttle -r username@12.34.56.789 0/0

That's it. All your TCP traffic is now going through your remote server. If you want DNS requests to go through as well, you can add the --dns option.

I've been using sshuttle for a while and it works great. But I've always had to exclude (-x) the host address from trying to route through the sshuttle itself and ending up in a loop:

sshuttle -r username@12.34.56.789 -x 12.34.56.789 0.0.0.0/0

> for as little as $5/mo, which includes 1TB/mo of data transfer.

There are even much cheaper virtual server offerings, as one probably doesn't need 1 GB of RAM and a dedicated IP for personal VPN or proxy.

Vultr is a bit cheaper than DO I believe.

An ssh proxy is great, but might as well just use OpenVPN if you’re hosting on DO or Vultr since I believe they both have prebuilt images you can deploy with a single click.

I use my VPS for several other things and because it already runs ssh, this was easier for me, so I've never looked into openvpn. I keep telling myself once wireguard is merged into the kernel I will really invest some time into getting up to speed on it.

Google cloud has a free tier giving you a very low spec VM for free. I dont know if it works for a http proxy, but it certainly could work.

We (PIA) are not backed by China. But you’re absolutely right - how do you vet trust in a VPN?

The true answer isn’t one the industry or you want to hear - you don’t. Audits don’t do much as they only prove something is true at a certain moment in time. There is still trust involved. Instead, it’s a responsibility of the VPN industry to migrate towards architectures that require lesser or zero trust.

We are working on it, and as always, I encourage anyone else in the industry (or outside of it) to reach out as this is something we should all work toward, because that’s what cypherpunks do!

You have to trust someone.. Mozilla is partnering with protonVPN.

And if I recall correctly, Mozilla is vetting them: https://blog.mozilla.org/futurereleases/2018/10/22/testing-n...

> You have to trust someone

Our technology that we have before us today is a wonderful gift. We can in fact create trust-less systems.

You're referring to blockchain I assume, I guess a trustless VPN would be more akin to Tor than a centralized VPN service.

> But how can I really prove they're not secretly backed by China and I'm paying $5/mo for higher priority access to a Chinese VPN farm

You can't. But you need to think of what your threat model is here. I tend to assume that FIVEYES is capable of intercepting all of my internet traffic going via a commercial VPN, but also ... that's kind of fine? My threat model is I don't want to fall victim to cyber-crime, and I want to remain relatively anonymous to large American corporations.

The problem with algo is you still have to pick a host country to put the server in, and then follow that countries laws.

Choosing a VPN that might be state-owned is still better than using your current Internet which is ACTUALLY state-owned.

Also if the state-owner is different from the state you live in, that's probably pretty good.

Especially, if the state has different interests :)

Great resources but why the hell would they make a comparison table paginated?

Reply on news.ycombinator.com