Hacker News Reader

Comment by fivre | Hacker News Reader

I trust VPN services for the one thing they're good and useful for: hopping over geo-fences for content.

You should not have any expectation of privacy or security from consumer VPN services (if you want that, obtain Tor Browser or Tails as your needs require). They provide a means to choose roughly where your client traffic comes from, and that's it. The rest is marketing bullshit.

They're probably sufficient for low-key deflection of DMCA notices if you're torrenting shit--rightsholder enforcement companies aren't exactly able to undertake nation-state level investigations for what they do.

View on HN

Why would I assure myself that Tor is safe either? Do we know for a fact that government agencies don't control the majority of the egress points?

> Do we know for a fact

This always has been and always will be the security rabbit hole. (Well, one of them.)

How do you define "know for a fact"? Even if you personally know a person managing an egress node, how do you know they aren't operating on behalf of someone else?

Saw an article a while back (years) saying NSA/FBI is able to track TOR connections and won’t say how even if it means they’d forfeit some cases.. anyone remember this?

Edit to add: Also, it’s public knowledge that TOR is funded by the DoD, it seems extremely feasible that they privately control a sizable chunk of nodes. Based on what I know of American 3 letter agencies, I don’t think one could resist designing a “secure” system only they can listen in on.

I consider TOR a very secure messaging channel between you, the other party, and the American government (metadata only, but that’s really not too big of a limitation in this case).

Most Tor nodes are actually in Germany. You can see a map of them https://tormap.void.gr/

The design of the system is resilient to some nodes being under hostile control, too.

Well then aren’t I glad the US intelligence agencies don’t have a history of collaborating across national boundaries!

Some nodes can be under hostile control, but as the number increases the likelihood increases that they can link entry to exit based on timings. I consider it quite likely that the us govt can say “hey Germany/UK/Fance/etc., we have this batch of exit times, do any of your nodes correspond on entry?” or vice virce.

If your threat model is that the whole world is out to get you and will stop at nothing to find you, it is very much the case that you are going to lose. Tor raises the cost of surveillance, but is not magic.

As an aside, the five eyes countries collaborate much more closely with one another than they do with France or Germany (or that was the case when I read about this after the Snowden leaks.)

Safe from what? Always assume that an exit node is compromised. Never run unencrypted and unauthenticated traffic over it. There used to be these password sniffing experiments run over exit nodes, which always caught surprisingly many logins. Don't do it.

That doesn't mean traffic can be deanonymized. Tor as a whole isn't compromised in any meaningful sense even if the exit nodes are. Large parts of the original white paper concerns this.

Is the rest marketing bullshit because of insurmountable technical challenges or is it because you have to __trust__ the VPN service? I.e. if I were to somehow think up a business model that included some novel level of transparency, could I provide a VPN service that could honestly claim to provide privacy and security to its users?

I also use my AWS free tier EC2 + wireguard for hopping over geo-fences. It is free, and my traffic is encrypted from my device to the remote EC2 server.

I’ve tried that but all the content providers seemed to know I was using a VPN. Any tips?

Weird... I did the test, and clearly I cannot watch shows on European TV website, and when I select one of my European server, then I can watch the shows. Something must be off with your setting.

It depends on the service. Not everyone does it, but many services ban the Amazon, Azure, Google, DO, and many other AS sources simply because they won't originate "normal user" traffic.

Correct, I just checked Netflix, and it is still the US Netflix, even when I hopped from a Paris AWS server. But all french TV website are working like if I was in France.

Approximately: IP addresses are allocated to a network operator by the IANA via an ASN. Most large streaming services block non-residential ASNs at this point. Sometimes they miss one here and there. Your best bet is with smaller providers that operate using a less recognizable ASN. At this point even many non-streaming services block traffic from EC2, Azure, and other cloud providers just to cut down on bots.

Yeah I tried AWS and Digital Ocean and they were blocked by Netflix which is really what I care about. A commercial VPN I use actually works for Netflix but only in 2 specific regions.

https://lowendbox.com/ has always been a good place to find geofence hopping friendly VPS which can serve as a VPN. Not affiliated, I just use it and recommend.

Reply on news.ycombinator.com