Microsoft bakes a VPN into Edge and turns it on
adguard-vpn.com
adguard-vpn.com
Unless your credentials leak, of course, but a security expert would have that same risk.
Your personal solution seems pretty good though.
All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.
Or course they do, I'm so tired of seeing posts like this when really what you mean is that it's not perfect privacy and therefore you don't like it.
They just replace your ISP with a VPN company. Which is the two is more shady is something you have to figure out, keeping in mind that a subsection of the internet just stops working or turns the aggressiveness of their anti-bot protections up to the maximum on a VPN.
Let me compare an ISP spying vs a VPN spying:
1. You make DNS request about example.com. Your ISP sees this. Your ISP can see what websites you "might" visit.
2. You connect to 1.2.3.4. Your ISP sees this. Your ISP can see what websites you "did" visit.
3. You request some data and receive some data. Your ISP sees the size of the data. If it's not encrypted, it can also see the content. Your ISP can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents.
Okay so not using a VPN gives effectively zero privacy. Let's look at a VPN:
1. You connect to a VPN (and let's assume your connection doesn't "leak" insomuch as now _all_ network traffic goes through the VPN). Your ISP can see this.
2. You make DNS request about example.com. Your VPN sees this and your ISP can see a network packet. Your VPN can see what websites you "might" visit, your ISP can't.
2. You connect to 1.2.3.4. Your VPN sees this. Your VPN can see what websites you "did" visit. Your ISP still sees traffic to the VPN.
3. You request some data and receive some data. Your VPN sees the size of the data, and your ISP only sees the aggregate-size of data across all of your sessions. If it's not encrypted, your VPN can also see the content but your ISP should still only see aggregate size. Your VPN can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents. Your ISP will have a tough time fingerprinting content from specific websites.
4. Your ISP can note that you have a high amount of traffic, possibly note that the traffic is going to a known VPN destination, and that your "normal" traffic is now gone.
Now, your VPN can see all the stuff that your ISP used to see. In addition, your ISP can now determine that you might be doing something illegal, suspicious, or at the very least "enterprise grade" and demand more money.
Have you really gained more privacy?
There are vast numbers of vpns, so total coverage is impossible. They are also very likely to be in a different legal jurisdiction so it's non trivial to do.
So, yes, you have, by making yourself a harder target despite having the same amount of centralisation on your part
Now, sure, they could "just" delete logs, but their government can "just" tell them not to, or even tell them to live send the logs to them directly.
So it's really "which country's government you trust".
Mullad, OVPN are a couple.
What are your opinions on those? Not every country has laws like USA/India, which give the government free reign by citing certain Acts.
As such, we have dozens of ISPs with their own backend infrastructure, all sharing the same last-mile, and most available nation-wide.
That said, they're all going to be buying transit from a big backbone ISP to get overseas connectivity.
But the information you leak towards your ISP or VPN isn't the only variable. With a VPN you leak less information to the services you interact with (e.g. your IP is hidden) which undoubtedly increases privacy.
Being able to choose to reveal data to Mullvad over Comcast or Verizon seems like a clear win to me.
At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.
The problem is that it doesn’t actually change anything while giving a false sense of security.
Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ?
Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.
The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice.
Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier.
If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state.
Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation.
The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.
That a nation could make a new device is arguable, that a nation could make a device that could be delivered without flying planes over another country is less arguable. Even nukes as they stand would only pose significant threats to certain parts of a country (there was a map floating around the web a few days back of areas of the US most susceptible to the - pardon the pun - fallout from a tactical strike.)
Yeah, of course not, that's not nearly the only reason to use a VPN.
On top of that, I get the benefit of not being tracked everywhere on the web. Or if they are tracking me, they have bogus data. And I can set my exit server to a jurisdiction with more user-friendly privacy laws.
Also, what better place to tap traffic than the connection of a VPN provider.
Well, per my previous post, my ISP is definitely a better place. Hell, you don't even need to tap them. They'll just sell you the data, along with other PII. (Setting aside Mullvad' multi-hop support, which would require taps in multiple jurisdictions).
I think the point you're trying to make is that this isn't resilient to the NSA monitoring my traffic. I had hoped it was clear from my message that there's another level of privacy I'm concerned with related to intrusive private entities. I'm not expecting the GDPR or similar privacy laws to stop the NSA either, but they serve a useful purpose.
I guess I'm banking on Meta and Google not tapping Mullvad. Or even the RIAA or MPAA, for that matter. Because my ISP will very willingly give those entities data. And as long as unencrypted SNI is the norm, my ISP knows more than I want it to know about my browsing behavior. Not to mention the stuff that isn't HTTPS. Sure, Verizon knows I've established a connection an encrypted tunnel and how much bandwidth I routed through it, but that's a level of metadata I'm not concerned with.
So, yeah, Mullvad could be logging every packet through their tunnel. They could even assemble a profile based on my account and sell it to all the data brokers and advertising networks. They still don't have my SSN. Even if all of that happened, then I'm still no worse a situation than if I didn't use them because my ISP is doing those things. At worst, I'll be out 5€ for the month.
I can feel the sarcasm dripping from this sentence.
Where would you like to move the goal posts now?
I think you answered your own question.
With your ISP, you appear on the internet as a residential IP that provides your approximate location and most likely doesn't change very often. The requests you make can be easily correlated by PRISM or any other middleman, or by any CDN running the websites you visit.
With a VPN, your exit IP is unrelated to your geographic location, changes very often, and hopefully it is shared among many more users.
GeoIP is only necessary when seeing a new IP. But once the IP starts to build a reputation, then the specific location can be determined. It's especially true if you buy something online.
My office: suburb of Chicago My home: downtown Atlanta My friend's house: just outside Phoenix The McDonald's free WiFi: Chicago A church's WiFi: Some random location in Arkansas.
I'm in North Texas.
Just a few examples I've remembered since making a point to test while I'm out.
> Have you really gained more privacy?
Absolutely, 100%, unambiguously, yes; my ISP openly says that they monetize my data, my VPN says they don't. I'm very happy to gamble that the VPN is telling the truth when faced with the expectation that the ISP is telling the truth.
As terrible as that is, yeah I feel pretty safe pirating movies using it.
But you're right that blindly trusting a VPN without doing any research might be worse than blindly trusting your ISP.
and my neighbours can determine I might be doing something illegal when I close my curtains, sure.
No, but you have lost less privacy.
The amount of loss of privacy you incur when some particular item of personal information about you is revealed to another party often depends on how much other information that party has about you.
The adversary is netflix or a IP rights enforcement company, and the user doesn't care what their ISP or a state could observe.
For what they are used for, they are fine. If you are worried about state or megacorp spying, the solution is less technical and more political.
Going from "trusting" an entity that explicitly requires you to consent to spying when you sign up to trusting one which explicitly promises to protect your privacy when you sign up does seem like it would "help privacy" in most cases.
Why would I trust an entity that often has the legal backing to harvest my data and provide it to the government whenever they "deem" it necessary? The same government that has direct means of control over me? Whether it's the US, China, Germany, I think I'd rather put my chances with some private company that at least has financial and maybe ethical motivations (depending on the company) to protect my privacy. An ISP will only go as far as the law requires to protect it and who knows what backdoor deals are made with governments to subvert those same laws.
There is no realistic/helpful/useful legal process to sue over a breach of privacy. So my ISP being in my jurisdiction doesn't do me any good at all.
I think your logic holds up, but it's not quite as definitive as you say. VPNs are not the straightforward privacy upgrade that HTTPS is. (I don't think you were trying to imply otherwise.)
I think the picture improves if you choose more carefully. Choosing an established VPN that has a no-log policy and has been audited seems much better, because now multiple companies are putting their reputation on the line. On the other hand, I think a relatively unknown company that's reselling someone else's VPN and hoping to cash in on the "VPN = privacy" is only a slight upgrade over a major ISP.
[0]: https://www.latimes.com/business/story/2021-11-12/column-int... [1]: https://www.ftc.gov/system/files/documents/reports/look-what...
1. They keep your data safe from your ISP. 2. They keep your IP hidden to the sites you browse.
Those two clearly "help" privacy.
It allows me to trust only my ISP instead of every ISP in various coffee shops.
> For some, that may be good, but for most others it’s a wash.
That sounds less like "VPNs don’t help privacy at all" and more like "VPNs are helpful some of the time".
since we're on the topic: how is it still a thing that vpn services are actively pitching content-block/copyright circumvention? Seems weird to pitch something as shady this loud and publicly? Reminds me of how weird I find it that trackers and illegal hosting sites have twitter accounts...
Even if they had the best intentions, it's pretty easy to botch these things which erode your privacy even more.
If you're not paying for the (specific) service, you are the product.
But in this case, Microsoft is looking for any competitive advantage against Google. They won't win on targeting, and they still make more money selling software than ads. So this does seem like an easy win for them.
Well in the case where they are spending a lot of money to implement and operate a feature that nobody asked for and which has obvious privacy downsides, it does seem worthwhile to examine their motives. It’s not like we’re responding to the announcement for the next model of the Microsoft ergonomic keyboard with “hmmm, what are they up to?”
What is the obvious privacy downside of selectively enabling a Cloudflare VPN when browsing on public Wifi or unsecured sites (which is when it enables)? That Cloudflare can see what sites you visit?
On public Wifi and unsecured sites, anyone could potentially see and modify the data anyway.
This is like finding out Microsoft decided all internet traffic on windows should be proxied through their servers. Could there be a benefit? Yes. Does it raise serious questions? Most definitely.
It's not. According to the article, it only funnels insecure traffic through the Cloudflare VPN (eg, to a site with an invalid certificate). And this doesn't prevent you from using your own VPN as well.
If you're connecting to a site over HTTP, and the packet takes 10 hops to get there, that's 10 machines that can see who you're connecting to and what data you're sending. Including, in all likelihood, a major CDN like Cloudflare. Also including anyone on the same public Wifi network. This data was never kept private to begin with.
If you're connecting over HTTPS with a valid certificate, the VPN isn't used. Even if it were though, they couldn't see your data. It's encrypted.
This is absolute BS they're implementing this.
The thing is that it would need to be smart enough to prevent pattern recognition, e.g., it cannot just be random data because your specific searches and string of searches or actions will stand out quite obviously.
Yes, it would place a severe tax on the internet and a few things could be done to minimize that, but I currently do not see any other better option.
I could see it implemented where your activities online are merged with and threaded into those of related or similar communities, e.g., be it family and friends, the YC community, or a combination of different groups. The effect would come from the proximity to similar but not exact activities. To use a common example, if your legal free speech activities could make you a target, those online activities are muddled and polluted by being merged with other people's legal free speech activities, and your activities would be merged with those of others.
Consider it a kind of mutual compromise of society in order to provide protection/obfuscation in numbers ... the zebra in a herd, if you will. They can't arrest/target everyone if everyone has activity data that looks like they defy the ruling powers.
this is a terrible and dangerous idea. Nobody cares about the accuracy of the data they collect on you. Stuffing your dossier with random things won't cause anyone to throw it away just because there might be errors in it. Instead all of that data, random/accurate or not, will be used against you all the same.
Your clever browser extension might have been responsible for browsing to a bunch of fast food websites, but your health insurance provider won't care. They'll just see that in your internet history and quietly raise your health insurance premiums anyway.
If your legal free speech activities make you a target, adding more free speech activities to your permanent record just means you'll also now be targeted for those activities on top of your own.
You can't know what will prejudice someone else against you. You might not be gay, or Muslim, or a heavy drinker, or an Andrew Yang supporter, but your browser extension pulls in the wrong data that gets you flagged as being one and it could cost you your job, get you denied housing, etc.
You might not be looking into getting an abortion, but anti-abortion activists who buy up the data of anyone who appears to be trying to get one, or looking for support after getting one, will still see you listed and you will still get harassed by them or dragged into a texas court room.
You might not be rich, but data brokers and consumer reputation services will see that you've been interested in expensive vacation spots and online stores will start charging you more than your neighbors for the same items on the assumption that you are.
If you want to try to hide in the crowd look into a VPN or TOR (although be aware device/browser fingerprinting can still get your traffic associated with you). Just please understand that giving others more ammo to use against you isn't helping yourself or anyone else. Adding more and more data to your internet history just increases your risks substantially because no matter if you deserve it or not your life will be impacted in countless ways by the data you surrender and none of that data, "pollution" or genuine, ever goes away.
You would confuse models currently shooting fish in a barrel.
You would still pick the cheapest insurer (probably one that does not look at your data).
You can live without anyone abusing your privacy in this way.
having a wife and kids helps with this. or any shared wifi with a guaranteed shitstream for your tunnel to wade through
Like sending usage information to the browser developer.
Like downloading code (experiments) for specific users which can essentially do anything.
Are you debugging your browser 100% of the time and fully analyzing all communications that there is nothing leaked. Is anyone?
Except they can't be. Native apps don't offer the same freedoms that the web does. And so, we keep stacking technologies on top of web browsers to alleviate the problem. It's a bad situation, and both Google and Apple are gruesomely complicit in making this situation worse.
> Can you please give a concrete example of what Apple should do, in your opinion, to expand their API targets?
Stop browser lockdown. Allow sideloading. You know, the basics of computing that we had figured out since the mid-90s or when we sued Microsoft.
We don't know that. Maybe Microsoft could maintain their own browser engine if Google hadn't provided one on permissive open-source licensing terms that met their needs.
MS can afford it financially. The desire to put in the effort to is not there.
This is why Apple really came out of the blue with Steve Jobs' razor focus on quality above all. Microsoft's goal is never to be 'best in class'. Because they don't need to be. People will buy it anyway.
The solution (to me) is simple - fix native app distribution. Make platform targets operate the same as they used to, and give people control over their computer again. The only ones preventing us from a platform-agnostic utopia is Apple and Google, both of whom profit off the artificial difficulty of distributing applications.
So, here we are. Google is poisoning the web while Apple refuses to swallow their pride. Everyone is hurting, and nobody stands to gain anything but the shareholders. A hopeless situation, but let's not pretend like everything here is morally grey.
Are people now using Edge because of this change?
Users, trusting the ad company that provides them free email, search, video, photos etc. will action on the suggestion and install Chrome.
More users gives google the market power to dictate web standards
Just use Firefox. It works just as well as Chrome (*), but it's based on a completely different engine which was built from the ground up.
(*) On desktop at least (on Android I still use a Chromium fork for now)
>It works just as well as Chrome () Not on anything* I use, it doesn't, so "No....thank you".
Tbf, I do keep trying ff, but...clunky, jeepers! 'Fraid I'll hang on until my Brave jumps it's particular shark and then maybe I'll hop over to something else, but for now, and as long as I can still use UblockO, Brave it is.
Even Opera is looking interesting again....
What browsers have you been daily-driving to come to that conclusion?
That's a really unfair(and untrue) statement. Brave also removes some code they find privacy violating, built in a best in class adblocker, built a full cross-device sync system that works perfectly, some UI tweaks and enhancements, built Tor connectivity in, etc. Probably a lot more that I'm leaving out.
I am def not a fan of crypto or BATs or whatever they were pushing, but you can use it fine ignoring all of that.
Normally this might just be a platitude of the sort, "Go check it for yourself." But in this case that's not what I'm saying. Brave is going to be used by large numbers of tech focused users with a privacy/security bent. And they are also competing against Google who will make sure even the slightest slip by Brave is promoted across the entirety of the web.
That code is scrutinized heavily. That the worst you can find about Brave is people making false statements about crypto stuff (it is entirely optional and opt-in with 0 coercion or dark patterns to push you there) speaks incredibly highly as to the current state of the Browser. Might that change in the future, as you seem to be suggesting? Yip! And when it does there will be a new Brave. But for now they continue to stay on an excellent path forward.
If they still don't work, they're doing some messed up stuff on those sites.
People like to shit on advertising, but much of the internet exists today because of advertising. Do you think Youtube could exist at that scale without ads? I don't think so, personally. At least, not without another way to monetize.
Brave is the only player providing an alternative monetization strategy. Crypto or not, to me, that is by far the most interesting thing a browser has done in a long, long time.
I think I overestimate the amount of broken sites due to the adblocker messing them up, not Firefox.
What chromium fork is on android and actually better than Firefox for android? I use Firefox for the best possible experience on android and would like to be aware of another option.
From my (anecdotal) experience, Bromite is faster than Firefox on my phone, but your mileage may vary.
I was originally using Firefox due to its uBlock Origin support, but Bromite has ad-blocking built-in (unfortunately it's not quite up to par with uBO but it works well enough).
I would suggest that you try both and see which one you prefer.
I want to but in Firefox developer tools there is no option for developer tools to follow new tabs.
Apparently this has been an open bug with Firefox for a while.
But it is what keeps me from using Firefox vs Chromium's full time
The problem with this approach is that it’s impossible to get a safe binary that isn’t downloaded from “libfree.cxcc.gg” or whatever. The other option being to build from source, which is an absolute nightmare for Chromium.
Signatures available from whom?
The point being that a web browser is a very special case of software that has to absolutely 100% trustworthy from a reputable commercial entity (that is, someone that can be sued). The only other thing with that level of trust is your operating system.
Do you not trust kernel.org? Or the GPG signatures of the commits?
What about Mozilla?
As for "someone that can be sued", have you read any of the EULAs of the commercial entities that you think are "reputable" and "100% trustworthy"? You can't sue them.
Similarly, do you trust all of the CAs that have certificates in your OS or browser trust store?
Those were the days.
Any Browser can be a reality.
Others like me would. And resource-constrained devices. An eco-system of low-tech sites could emerge with a label signaling them as simple and virtuous.
Dillo
Links
NetSurf
I'm sure people said the same thing when Edge was in beta. "How is Microsoft Chrome(2)?"
(And I think Edge is worse than being Chrome(2).)
Is that a practical sustainable long-term business practice though? Firefox was only able to be free because Google was paying Mozilla. Browsers are some complex software and software developers wanna get paid. I know that the in's and outs of history of browser software has conditioned us to expecting browsers for free but that doesn't reflect the reality of developing the software.
Surely there's space in the browser market for a model akin more to how Wikipedia operates.
Donations by corporations, and edited by powerhungry users (ryulong) and bots?
The Internet being global makes this challenging, and almost all countries (including so-called democracies) wanting to drink as much authoritarian juice as they can get away with does mean that there is plenty of risk here as well. But letting one or a few giant megacorporations entirely dicate the primary intrastructure for information interchange is so much worse.
I know it makes a lot of money for Microsoft but the fact they chose to keep the quality so low really looks bad.
Only thing I have to pull out Chrome for is corporate intranet.
Clueless shareholders on the 59th floor of JP Morgan who don't even use Edge see "oooh VPN, me like buzzwords" and upvote the stock.
Does this mean they will also have the ability to collect corporate data from the browser in companies like mine?
In theory anyway, I pick my ISP. If this was "support for using a VPN" instead of "we're injecting OUR VPN" I would feel a lot better.
I'm aware Im using my ISP. Even someone who doesn't know much about computers knows their traffic is going somewhere. They might not know the repercussions of that, but if this is just transparently on in the background, effectively a keylogger, a user might never know this is happening.
I give my ISP money. Back to the choice option. Some ISPs are bad and are trying to nickel and dime you to maximize profits. Some ISPs are actually good (I'm not swiss so I don't know for sure, but Init7 looks amazing https://www.init7.net/en/support/faq/privatsphaere/). I don't have to question with my ISP "how are they profiting off of me" because I give them money every month. They might be, but they don't intrinsically NEED to be scraping my data. I am not sure how Microsoft benefits from giving me a free VPN unless they are scraping my data.
I can use a VPN to bypass my ISP monitoring if they do monitor. I have no idea how Microsoft's stuff is set up here. If the end result is that it gets routed through their VPN after my VPN, or instead of my VPN, or even through their stuff at all, but with stamped metadata, then there's not necessarily a great way to get around it other than "don't use Edge"
In general, yes, your ISP isn't your friend. But an ISP is something I asked for, have a use for, and need. A Microsoft stealth VPN is none of those things.
Aside from that, this isn’t possible for HSTS sites.
Even more, for self-signed certificate on chrome, there is no button to continue for example. Check https://self-signed.badssl.com/
handelsbanken.se danskebank.se unicredit.it fideuram.it sella.it
unicredit.it is not on the list, but unicredit.ba and unicredit.ro are. (Lines 7331 and 7332) It does send HSTS headers.
danskebank.se and sella.it are not in the file, nor are the base strings, but both sites do send HSTS headers.
fideuram.it is not on the list, and does not send HSTS headers, so they don't seem particularly interested in security. They also haven't set an A record for the root domain, so visiting `fideuram.it` returns NXDOMAIN. Only `www.fideuram.it` exists.
I once wrote them a long email about what two-factor is actually supposed to be and why it exists, and got a reply basically saying "lol ok, our security is great ok?"
I've since switched away from them for a bank which does 'two-factor' by sending codes via SMS, but only when its algorithm decides that it needs to. That's not very often.
Tech support comes in many forms. The owner of the website, a friend who knows about computers, someone else in the workplace, the vendor they purchased their laptop from.
Isn't it possible for the user to disable HSTS. A simple web search produces detailed instructions, from a CA.
https://sectigostore.com/blog/how-to-disable-hsts-in-chrome-...
Also, what does "HSTS sites" mean. Does it mean (a) "official" HSTS via HTTP header alone, (b) "unofficial" HSTS via preload list (see RFC 6797 section 12.3), i.e., the list maintained by Google, hardcoded into a browser, or (c) both. The "unofficial" approach only seems feasible for a limited number of domainnames and unworkable for every domainname in existence.
In tests I have done on Chrome (YMMV), executing "Clear site data" via Developer Tools, or including
Clear-Site-Data: *
Besides being generally annoying, HSTS allows for setting "supercookies" that persist even in "Incognito" mode
https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...
The RFC for HSTS even admits how it can be used for web tracking. Not too concerning for the advertising company sponsoring the RFC.
14.9. Creative Manipulation of HSTS Policy Store
Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains).
I use a loopback-bound forward proxy to enforce zero tolerance for HTTP across all programs, not just the web browser. Everything is sent via HTTPS. The proxy is configured to to check certificates, and deny connections, according to rules I set. I use a text-only browser for noncommercial, recreational web use so I need a forward proxy, if for nothing other than to deal with the spread of TLS. But I also use it for a whole laundry list of tasks.
Maybe it is just me, but HSTS, like much of Google's rhetoric, comes across as unfriendly if not hostile to proxies, regardless of who is running them. Consider this line from the RFC
"The rationale behind this is that if there is a "man in the middle" (MITM) -- whether a legitimately deployed proxy or an illegitimate entity -- it could cause various mischief (see also Appendix A ("Design Decision Notes") item 3, as well as Section 14.6 ("Bootstrap MITM Vulnerability"));"
"Mischief." Does that include inspecting one's own HTTP traffic on one's own network. How about blocking certain methods of tracking, data collection and advertising. Apparently it includes disabling HSTS.
Let's be honest. Google is an undisputed king of "mischief". The stakes for Google mischief are much higher and there have been too many fines to count. Consider the latest. How many people deploying their own proxies get fined $4B. (Arguably, an issue of "control" was at the heart of that decision.)
https://www.theregister.com/2022/09/14/european_court_fines_...
If the proxy is "legitimately deployed" then why not stay out of the network operator's way. Let them have control. Give the option to cede control to Google instead of making it a default.
I use HSTS for commercial, nonrecreational web use, when I have to use a "modern" browser. That is a small fraction of total web use for me.
Here, try this link in Chrome: https://untrusted-root.badssl.com/. When you click Advanced, it tells you "the website sent scrambled credentials that Chrome cannot process". And beyond that there's just no button to bypass it. You can't visit the site. (Sure, there's probably a chrome://flags or --disable-web-security way to bypass this, but that's well beyond the average user's comfort zone, as well it should be.)
EDIT: It turns out there is a "visit this website anyway" option in Safari, but it is not a button, it's a link which you only notice when you click "Show details" button and read the warning.
[1]: https://twitter.com/cyb3rops/status/1561995926666985472?s=20...
I tried on a blank profile to make sure there were no strange settings.
Not sure how that matches.
The user mistake is just clicking "advanced" then "proceed". I know all my family members would do that without questioning.
It works. It's fine. No, it does not need ssl. What, someone is going to hack a floppy driver for a computer, which doesn't even have a built in network stack?!
No, I am not going to do work on it, any work, at all.
Millions of such sites exist, are fine, are safe.
This genuinely happens a lot in the 2020s.
More likely sites get cloned, improve their SEO over the original, and distribute malware.
Sceptical of that claim, can you provide a few documented cases?
Particularly for low-volume sites like the parent post.
Depending on what the drivers are for, you may be a prime candidate for MitM. People already go to your site to download software they're going to run in the most privileged mode. This is a perfect candidate for a type of watering hole attack.
Considering you're providing those for 90s machines, you could be the last resort website for a few interesting industry computers with no security restrictions around them.
Doing that MitM is technically very easy, but in practice pretty hard. You'd have to have an adversary on your network path watching for connections to this particular esoteric low-volume site hosting drivers for machines from the 80s and 90s.
That is extremely unlikely.
I have a much easier way to target that content: Just put up a new site hosting the same content with malware attached. No need for MitM shenanigans.
Security isn't about absolutes, it is about risk managment and being aware of the likelihood and consequence of the risks is important.
You're at a coffee shop or library using their WiFi. Your computer sends a plaintext HTTP message. The attacker just needs to be able to see that message and get a response back to you before the real site does, and the real site is a lot further away than the guy sitting at the table next to you (or the hacked router, if he doesn't want to be there in person). Then they can feed your browser whatever they want.
A login form to phish you, perhaps?
They can even start replying, then go off and fetch from the actual site before finishing the response, if it helps to incorporate the real data.
And update all links to not go back to the HTTP site...
And troubleshoot weird issues (TLS errors are generally not helpful)...
And maintain that setup for years...
Not an insurmountable effort for sure, but if you estimate 30 min for the total additional effort of adding HTTPS to a site then I have a bridge to sell you.
There is nothing wrong with your website. However, you shouldn't be surprised when modern browsers stop working with it. Progress doesn't come free.
I always chuckle at this site does not need SSL post from n-gate.
PS: Use the URL directly in browser because the site doesn't like traffic from HN.
Or just fix your browser settings to not send cross-domain Referer headers.
Frankly, even sadly, they are also entirely forgettable and don’t add enough value to hold back the modern web.
Without HTTPS, the content can be replaced entirely. Last time it was JavaScript that DDOS'd github. If you don't want to serve content over HTTPS, then you don't care what your users receive. Just delete the site and they all get 404's instead, since you already admit that you don't care either way.
If it makes you feel any better, HTTP without HTTPS was a mistake we all made together. It should never have happened.
Given that http predates SSL 1.0 by a few years, somewhat inevitable.
>are safe
No, they are not.
>No, I am not going to do work on it, any work, at all.
If you are too lazy to do it securely maybe you just shouldn't do it at all.
HTTPS everywhere by default can't come fast enough. There is no excuse at all to not have HTTPS support today and browsers should deny access to these lazy and careless sites by default. Anyone who can't spend the 5m to set it up for their website can go kick rocks as far as I'm concerned.
HTTPS can introduce all scenarios for not being able to connect.
I'm not hosting any secret data, but I do want to be able to post from anywhere.
Literally to this day one can read things like the NSA manual for using their software that enables real-time absolute surveillance of Skype: "User's Guide For PRISM Skype Collection." [2] The idea of any degree of privacy from any tech company hosted in America is a lie. The main difference with China is that we lie about our surveillance state, and force companies to lie about it, while China openly advertises theirs.
[1] - https://en.wikipedia.org/wiki/PRISM
[2] - https://www.aclu.org/sites/default/files/field_document/Guid...
but this just reminded me of the failed FB phone and the failed microsoft phone...
Looking at the ones I use daily... headphones, TV soundbar, Xbox controllers, TV remote. None of those provide an interesting attack vector.
My iPhone isn't really going to be connecting to random stuff and leaking data, so I don't really see the risk here. Maybe I'm missing something?
Incorrect -- BT scanners and loggers have been LONG tracking your things avail...
and the fact that Apple doesnt allow you to "turn off" it merely pauses..
both wifi and BT...
they use prox sensors for BT for airtags, wifi etc and ALL OF THAT data in mined like mad.
Any Apple person that says otherwise is lying to you.
How would they do the same for bluetooth? Broadcasting "Dans iPhone" doesn't tell you much.
they have so many correlation engines for device location, that it will soon be impossible to be "off grid", if its not already.
how the heck do you think there are fn leaks from over a decade ago of "text messages received by the government reveal that person X who is on the shit-list was quoted as saying [BULLSHIT] sources close to CNN have stated.."]
ASIDE: Famous story from ~20 years ago was talking about the CIA handlers at CNN... and the revolving door of in-q-tel emps from fb moving back and forth within the security team (one of which had to be walked out of the building for [things])
you dont need "dan's phone" they have had eschelon for DECADES and were able to literally do 6-degrees ppl tracking since the 1990s...
WTH do you think they named it "starlink" instead of sky-net...
And when they built the first part, they were advertising the wonderful things the rural folks in africa's greater continent will benefit, then after a few years they showed that the system will primarily service the dense populations of the coasts of places like the USA and AUS -- which is where a big portion of the five-eyes service.
IMEI and such is a bitch..
iOS is the biggest location tracking platform ever...
Remember when the founder of Android (from Danger) was let go from google with a ~200MM$ golden parachute at $90MM to gtfo?
Story time. Someone I know once got laid thanks to Facebook not encrypting their sessions
My university was still using basic ass unencrypted WiFi with some kind of terrible dns-hijack sign in to “auth”. This of course meant that everyone put their shiny MacBooks on essentially public wifi and logged in to social media in the clear in class.
Some enterprising chaps made a browser extension that made it trivial to snoop any open sessions and impersonate that session in a new tab.
Someone I know would do this during lecture and post to people’s social media as them saying they should pay attention in lecture. Possibly some other scandalous things were said. The hilarity that led from that stranger doing so led to the beautiful nerdy girl sitting behind this person noticing and daring them to post more. That became hanging out, parties, and as far as I know they got married and have kids now.
Literal people exist that wouldn’t otherwise because Facebook didn’t have HTTPS
Firesheep was super big for a while, yeah. I used it to show a few coffee shops that yes, really, WiFi with a password of "password" was measurably better for their customers than no password: https://en.wikipedia.org/wiki/Firesheep
In many cases you can even determine which protocols and general content they are consuming from that IP based on traffic shaping/fingerprinting. The burst of traffic your browser sends when loading a particular site is quite exploitable. There's plenty of software already available that makes use of this.
I suspect this is the corporate motivation. The increased state surveillance and control is a side effect.
EDIT: clarified "US" government, though I don't necessarily intend to suggest other governments are the worry.
the reason microsoft is doing that is because google is forcing their hand with Floc implemented in the browser.
you wont be in ads next year unless you can slurp more traffic than the NSA. and only google can do that today, thanks to chrome + android. apple is a close second.
Good:
* Better privacy from the intrusive ad motivated JS shit hole the internet has become.
* Faster internet for those on slow connections
* Protection from ISP MITM. Many countries now have mandatory data collection laws that ISPs have to follow.
* Better than a lot of shady 3rd party commercial VPN providers.
* Is opt-in (for now)
* Potential to reduce Google's dominance
Bad:
* Obvious MITM choke point, as you mentioned
* Potential control / monitoring by two large corporations
* Business goals usually override users.
Are you sure?
>a VPN baked into Edge appears to be turned on by default, but only for certain use cases.
Though, I do believe that for connections from public WiFi it's somewhat of an improvement. It establishes a minimal security baseline of: "ok, we'll sell your data and let FBI snoop on you, but we won't inject trojans in your downloads and then hijack your webcam to create ransom-porn (though the FBI/??? might)".
However, there analogy is not 100% on point.
Out of the perspective of a PRISM Premium Partner this makes perfect sense.
I think the other side of this is if you have FBI attention, do you really want to look more suspicious? Whatever fight you try with them you will not win.
If Edge is using DoH, you're out of luck.
You are hearing it from a third party exactly because they couldn't construct any explanation minimally realistic that sounded good.
Partnership with cloudflare, selectively enables when you are connected to untrusted networks like public wifi.
Pretty much the only downside is that they turn it on by default... which is always tricky when most of your target audience is not computer savvy in the least.
How to give people security features that they have to figure out themselves when they can barely open the browser .. a dilemma for the ages.
For the most part, product features like this are shipped for boring and completely non-nefarious reasons. It's just hard to believe that if you've never worked on one.
Windows is an appliance (an interface) for amazon shopping and watching netflix.
The MS telemetry has proven that 99.999% of consumers do not tweak default settings or dig under the hood.
The 1-2 million now former "windows power users" are just too small population to be economically feasible to deal with.
For MS it does not matter to lose those few to other tweakable OSs.
Instead MS's product department is dreaming of scooping the remaining billions of cash-laden consumers. Presumably this is what the telemetry tells them.
Cash is good, consuming is good, keeps the economy running, making shareholders happy.
Because of microsoft history. Including recent history.
Also:
> Brave, Mozilla, and Vivadi have said they intend to continue supporting Manifest v2 extensions for an indeterminate amount of time.
But the thing they offer from Mullvad is no better than a traditional VPN (because it is a traditional VPN). And even more limited because it only works in the browser.
And indeed the circumvention of Pihole is a big problem.
OK, that's actually a pretty decent idea. It's not going to be always-on, but it's providing security specifically for things like coffeeshops/libraries and for sites that don't provide their own security. In other words, it's "backup security", not rerouting all of your "normal" secure traffic at work/home.
This mainly protects sites you visit from having JavaScript injected into them by networks when there aren't any other protections, and the VPN is run by Cloudflare so it will be performant, so I don't really see any problems here? Seems like a positive development actually.
How does this protect from having JavaScript injected? Why couldn't the VPN do that?
How does this address the fact that the operators of the VPN can certainly modify any content they access over http on your behalf?
"Microsoft" and "security" also don't go together in my head.
It uses lowest common denominator tactics. This VPN strategy is precisely for the lowest common denominator.
I don't understand how something can feel like snake oil when you haven't researched your own questions. I can sow doubt on anything; is it always justified?
Simply shrieking "SPOF!!! SPOF!!!" lacks naunce after a while.
I've concerns with proposals such as this similar to what others are voicing on this thread. But if one considers the proposal in light of the present status quo for the typical person, then it's probably a net improvement.
So the content is safe but the sites you visit are still exposed unlike with a vpn.
This is exactly my point. People are desperate for there to be no flaws in TLS, so much so they ignore MITM attacks.
However, you are using a Microsoft client and/or a Microsoft OS to do this - and of course, if they want to, Edge or even Windows itself can report on the input and output of any operation you make, regardless of any network security. Similarly, WhatsApp or Signal or iMessage or Android/iOS could send a copy of the plain text of any messages you send or receive to home base despite them being E2E encrypted on the wire. You always have to trust the device and client software you are using to access the internet.
So, if you personally don't trust Microsoft not to snoop on your traffic with Google, using Edge or Windows is completely wrong.
It’s definitely not impossible, MITM attacks work for TLS and this is exactly how cloudflare work (it MITMs TLS sites by terminating the tunnel and recreating.). TLS is only secure if you have pinned certs.
Otherwise, TLS is completely impervious to MITM attacks as a protocol.
Of course, various implementations of TLS may also have exploitable vulnerabilities.
https://web.archive.org/web/20220609160341/https://developer...
And when Cloudflare released their new SOPs for Warp, they did so in a blog post titled "More features, still private" - https://blog.cloudflare.com/geoexit-improving-warp-user-expe... as referenced in https://developers.cloudflare.com/warp-client/known-issues-a...
Microsoft's initial announcement for the feature touted that IP addresses would be masked, and one imagines that they did their diligence with Cloudflare and are enforcing the strong practices that WARP has now rolled out more broadly.
But it's worth noting that you're routing through a company to whom the words "still private" encompassed leaking client IP address information to Cloudflare's hosting customers as recently as two months ago.
"Technically, WARP is a VPN.... We built WARP because we’ve had those conversations with our loved ones too and they’ve not gone well. So we knew that we had to start with turning the weaknesses of other VPN solutions into strengths. Under the covers, WARP acts as a VPN. But now in the 1.1.1.1 App, if users decide to enable WARP, instead of just DNS queries being secured and optimized, all Internet traffic is secured and optimized. In other words, WARP is the VPN for people who don't know what V.P.N. stands for."
I don’t have a dog in this fight, but it was especially odd in this context to claim that this misconception was entirely driven from outside of Cloudflare when the URL is sitting right there.
Not much you can do about them having decrypted traffic for sites that use them.
Yes, that’s the huge chunk I’m talking about, and when you use them as your VPN they can effortlessly trace that decrypted traffic to you.
Other options of securing DNS included "just" encrypting traffic to DNS server. But no, they decided to centralize sending DNS records via HTTPS
Most Internet traffic today between A and B is decrypted by C because of this.
HTTPS and transport security isn’t a broken idea.
Standardized content security has been tried in many contexts and has typically been even less secure unless it’s for long lived opaque media, like S/MIME for emails. Structured data like XML security has been abysmal.
Ally bank recently did this and many others have intermittent issues due to flagging, etc.
>try to connect to ally
>vpn not allowed - try connecting through on of our authorized vpn partners: microsoft, nordvpn!, etc.
AFAIK Cloudflare isn't a data thief (yet). If (when) they decide to be, they will have access to quite a lot at the rate they are going. At this point, how can we trust that any public company won't eventually monetize user data?
They're in the business of competing with AWS and are pretty damn good at it, too.
Completely blocking a VPN is often too blunt an instrument, but even the best alternatives are unfriendly to legitimate traffic. The most user-friendly thing you can do is to rely on bonus security controls, like asking for two factor authentication for everything. No, you will not be able to log into anything from a new device, even, without the two factor. A very understandable tradeoff for a bank, but we'll end up seeing that for any account protecting anything of relatively low value.
If your second factor is tied to, say, a phone, it's not going to be fun to wait to replace it if it's lost. But in a world where most traffic is coming from a VPN, there aren't many good alternatives.
All JavaScript scripts are blanked by Squid ICAP clients.
WireGuard to a VPS for DNS resolver/nameserver.
Run a mean transparent Squid proxy, Snort/Zeek/Suricata and whitelist bastion dns forwarder.
No problem. No spam. No headache.
Some ISPs also needlessly block certain sites (ex. Verizon blocks nyaa.si)
For better or worse Microsoft (or other corps) have not done that in recent memory afaik. They might do equally dodgy stuff in other aspects, but they don't tamper with the integrity of your connection (they might sniff it a bit).
Sure, the first guy could be a liar, but I know that the second guy is a thief.
I don't care about geo-blocking - my only threat model is to keep a scumbag ISP at bay.
Edit: I should add that keeping sites I browse from knowing my IP is also part of my threat model.
Everyone I know who has a VPN subscription simply uses it to prevent DMCA letters from their ISP when torrenting.
VPN providers with a "no logs" policy simply shrug these off.
ok I'll bite, let's hear it
Server-side control has been making software piracy less and less viable, video games sorta included. And a lot of mainstream games have found ways to make money without charging to buy the game upfront.
Yeah, to me, a VPN is only a way around geo restrictions.
FWIW, it is not bad performance-wise.
But for a windows domain environment Edge makes sense.
- Comes builtin, no need to patch browsers separately and worry about outdated Google Chrome installs in a 1000+ computer fleet.
- Integrates with Office 365 that the company already use/pay for.
- Can be managed with policy over Office 365 or Intune
- Has IE Enterprise Mode for the old apps that need IE11
For Teams, the alternative is this:
- Pay for Zoom AND Slack AND Office 365 AND have IT personell manage all 3
- Pay for Gsuite and use... hangouts?
or
- Just pay for Office 365 and get email, fileshare, office suite and chat/fileshare/video tool all in one that works "fine" and can be managed all in admin.microsoft.com (that goes into 500 different portals that all change each month but I digress...)
Oh, and you can use whatever browser, even if its not the default. I use Firefox but Edge is the default one.
You're already sending data to MS anyway
(I use Firefox, but if I were to use a chromium browser it wouldn't be Edge or Chrome...)
I don't know them, so I don't trust them.
e.g MS doesn't want to steal money from my card
also "ungoogled Chromium" - The process is Chrome is Googled Chromium.
Chromium was a thing before Google-Chrome..
Edit: My mistake: Chrome and Chromium were release the same time.
I'd rather write my own browser from scratch
I've had this discussion with other people too, just because you don't want to doesn't mean you can't. So your point of suspecting something nefarious is moot for me until you can back it up.
Using Edge doesn't change much, meanwhile using ungoogled Chromium means that I have to trust additional actors
Additionally MS inserting e.g "backdoor" into Edge could cost them a lot of in PR damages meanwhile what if ungoogled chromium inserted some kind of "backdoor"?
I don't even know people who maintain it, so I wouldn't even be able to break their windows or throw eggs at them
I hear your point on this, it's pretty hard to put your faith in a browser that updates regularly and not just for schema reasons. But you seem okay with Edge..
> Using Edge doesn't change much, meanwhile using ungoogled Chromium means that I have to trust additional actors
This is where I'm confused.
> Additionally MS inserting e.g "backdoor" into Edge could cost them a lot of in PR damages
I'm not an M$ hater, they've been incredible. dotNet core is a gift. GoPilot is a good use of whatever we're doing here. But why do you think if they could work a 'backdoor' (without leaks from employees) would actually matter. Their fine would be minimal.. See FB
I think we've come full circle. I'm defending your point that Edge might be just another 'Okay' browser.
Because I'm already on Windows, thus I already trust Microsoft
>I'm not an M$ hater, they've been incredible. dotNet core is a gift. GoPilot is a good use of whatever we're doing here. But why do you think if they could work a 'backdoor' (without leaks from employees) would actually matter. Their fine would be minimal.. See FB
On the other hand take a look at Intel - they had security issues and not even intentional and there was a lot of dmg to their brand due to all those CPU related vulns in last years
no it wasn't.
They were both launched the same period, but chromium was the 'trimmed' down open source version.
You can download Chromium[0], but people tend to be referring to the project called "Ungoogled Chromium"[1] to remove any calls to Google domains, eg. safe browsing, which are still present in Chromium.
0: https://www.chromium.org/getting-involved/download-chromium/
Please compare the severity and extent of
https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Privacy...
with
https://en.wikipedia.org/wiki/Criticism_of_Apple_Inc.
Depending on how you weigh the issues MSFT is far from equivalent on privacy
In general it feels like Apple has won the trust of the public, partially through good products, partially through good marketing.
[1]: https://mspoweruser.com/macos-big-sur-has-its-own-telemetry-...
Windows 10 is a privacy disaster compared to previous versions of Windows. They track every single app and website you open, what files you have on your PC, and much more.
... while the browser is watching you [1].
> Microsoft isn’t that bad
Yes it is. That bad.
There is a good reason why Trident is alive and kicking, people just don't know about it. But it's the reason for more than 98% of exploits, because shitty software of Microsoft still uses Trident to render MSHTML based documents (office etc).
The same will be true for a traffic-observing webview2, for decades to come. And it will never be removed again, because of Microsoft's development philosophy.
Naturally I've attracted trolls doing everything in their power to grief and ruin it for other players. This has lead me to reluctantly implement moderation tools such as IP bans and proxy detection.
I'm currently using a couple of services where I can supply an IP and get a risk score back but I'm worried about false positives. I'm afraid this initiative, while great for privacy, will make my defense measures futile.
What should I do? I just want to run a game with as few intrusive barriers as possible. I have no interest in collecting any private data from users whatsoever.
I have implemented measures where you can't chat until you've finished the tutorial, 5 minutes decay on stuff built/painted outside plots and upkeep on claimed plots but it's not enough. The trolls are extremely dedicated and devote their life to ruining my game.
The world is not a graffiti free-for-all because there are barriers: the government (police) is able to apprehend individuals, link that physical individual to an identity (which it issued at birth), and effectively implement consequences to that identity/individual.
If you want your site to not be a graffiti free-for-all, you will need a durable way to identify actual people. Twitter, for example, essentially requires a phone number to use their site. Phone numbers are fairly difficult to get anonymously. Therefore, Twitter has a useful link between their users and a physical individual. Other services use other things.
The government should implement cryptographic certificate based identities to citizens. Ideally there would be a way to "sign" something that says you are a real citizen without revealing which citizen you are, but is durably unique (subsequent signings identify you as the same citizen).
Facebook, Google, etc. are effectively filling this function right now but they leave much to be desired.
This is a truly interesting and groundbreaking idea that would solve all my problems. Do you know if there are any initiatives like that or is it science-fiction?
How to implement? Also not sure. I am not an expert in this field. "Anonymous credentials" seems like the closest thing maybe. Basically you need to somehow prove you have a valid signed certificate without disclosing the public key.
https://crypto.stackexchange.com/questions/83412/how-to-achi... https://crypto.stackexchange.com/questions/52189/zero-knowle...
Since you seem open to putting up barriers...in the process of looking into this I discovered Idena and checked it out a little. You could required verified Idena something or other, just as an example. I'm sure there are scores of these types of things being built, most or all of which will fail to gain traction.
Same with carrier grade NAT, IP stopped being good way to block things long time ago. About the only use is "this IP is DoSing me now, block it for few hours".
There are few other methods, all of them intrusive on privacy. Generating fingerprint of browser and blocking based on that might work for the clueless users but dedicated ones will go around it. Making using one of the popular SSO logins is one option (at least banning-wise) but that's a lot of work
I wonder how long until Microsoft starts blocking sites on their VPN for "your protection".
I don't think they need a VPN for this.
Lots of people are computer savvy but want to use a computer to do something else not under the umbrella of hobbyist sysadmin work.
I don't see the downside here, again, considering the multi-millions average users Windows/Edge has. If you are savvy enough to roll your own VPN using algo from Trail of Bits, then do that. If you are able to weigh the pros and cons of VPNs from having one or not, or which one to use, you are ahead of 99.99% of the people this will help.
traceroute news.ycombinator.com 1 24 ms 24 ms 25 ms 10.0.0.1
2 32 ms 25 ms 24 ms x.x.x.x
3 28 ms 28 ms 27 ms core-router-b-nlc.netwise.co.uk [185.17.175.246]
4 29 ms 25 ms 25 ms core-router-hex.netwise.co.uk [185.17.175.240]
5 29 ms 25 ms 26 ms te0-7-0-17.505.rcr21.b015534-1.lon01.atlas.cogentco.com [216.168.64.16]
6 27 ms 25 ms 25 ms be2186.ccr22.lon01.atlas.cogentco.com [154.54.61.70]
7 27 ms 25 ms 28 ms be2870.ccr41.lon13.atlas.cogentco.com [154.54.58.173]
8 94 ms 93 ms 94 ms be2317.ccr41.jfk02.atlas.cogentco.com [154.54.30.185]
9 103 ms 100 ms 100 ms be2806.ccr41.dca01.atlas.cogentco.com [154.54.40.106]
10 118 ms 117 ms 117 ms be2112.ccr41.atl01.atlas.cogentco.com [154.54.7.158]
11 130 ms 130 ms 134 ms be2687.ccr41.iah01.atlas.cogentco.com [154.54.28.70]
12 147 ms 146 ms 181 ms be2927.ccr21.elp01.atlas.cogentco.com [154.54.29.222]
13 155 ms 155 ms 156 ms be2930.ccr32.phx01.atlas.cogentco.com [154.54.42.77]
14 172 ms 348 ms 192 ms be2941.rcr52.san01.atlas.cogentco.com [154.54.41.33]
15 198 ms 202 ms 205 ms te0-0-2-0.rcr12.san03.atlas.cogentco.com [154.54.82.70]
16 209 ms 165 ms 165 ms te0-0-2-3.nr11.b006590-1.san03.atlas.cogentco.com [154.24.18.194]
17 166 ms 171 ms 203 ms 38.96.10.250
18 165 ms 162 ms 162 ms news.ycombinator.com [209.216.230.240]but hops from 9 to 30 are "blank" like this: 30 * * *
the last non-blank hop is this: 8 M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.921 ms GIGLINX-INC.bar1.SanDiego1.Level3.net (4.16.105.98) 60.600 ms M5-HOSTING.bar1.SanDiego1.Level3.net (4.16.110.170) 69.882 ms
I'm not an expert on internet routing but it seems to me a bit disconcerting how much of web traffic is already routed through cloudflare servers. This centralization scares me.
Its a great product, and ublock origin make it by far the best on the market for internet not only for me, across any devices ever made, period.
So this weekend I'll make an effort to switch from Chrome.
Here's something to use if the UI makes you really upset.
Also you will probably miss translation: https://addons.mozilla.org/en-US/firefox/addon/traduzir-pagi...
Obviously there are potential loopholes – apparently a lot of VPN services are planning to continue operating services with Indian residents with servers not physically hosted in India without logs.
Apple with its Private Relay and now Microsoft with Edge Browser VPN – don't provide VPN with exit nodes hosted in foreign jurisdictions. I'm curious to know if they will cooperate with requirements to collect/retain logs as well.
Now why didn't they call it Microsoft Secure Network! And MSN in short.
And next they should start a VPN'ed messaging service, they can name it "MSN Messenger".
These days that probably wont even manage the tracking requests being sent from the machine a month.
Microsoft: "Sorry $site_owner, We (some unaccountable ML model) detected that you have violated some rule (we will not tell you which) and as a result, your website can no longer be accessed.
This decision is final and permanent."
There are other ways to protect user privacy without conveniently putting yourself in charge. They pulled the same move with UEFI and secure boot
Microsoft needs to be investigated and fined.
Imagine Facebook data collection, but without being able to ignore it. That's where we're headed. Watch for Google to release a "security" product that does something similar.
IMO Apple, Microsoft, and (eventually) Google are going to use their platform dominance to usurp Facebook's ad business. That's why Facebook is making a big bet on VR. It's not that they see VR as a naturally popular platform. It's simply one of the last platforms that could be popular (for the near future), isn't already dominated by a major player, and has network effects that make it a critical mass platform similar to how Facebook works. If they can buy their way in, they own the whole market.
This kind of thing should get these companies obliterated by regulators. It's shameless, blatant, anti-competitive behavior where they're using their dominance in one market to gain an extremely unfair advantage in another.
The goal is to move the entire ad market away from the open web and into closed platforms like OSes and browsers.
I think this is mainly an form of advertisement move to compel more users to use edge/not switch away from it. Reason: By now many non-technical people think a VPN is necessary (or at least recommendable) for "safety". Through how a VPN actually helps/works most non-technical people do not understand at all. For Microsoft providing a VPN which by default is only enabled on public WiFi and similar isn't too expensive.
They also need to compete with Apples Privacy Relay feature.
So putting bias aside it seems a good thing.
But there are some gotchas:
1. a VPN is not per-se privacy protecting, it is only that if the VPN provider legally binding agrees to not sell out the users data.
2. a major browser which tries to force itself on all windows users providing a VPN for free hurt the VPN market due to the unfair competitive advantage this VPN has.
3. It could normalize for many people that VPNs do not necessary have a feature to avoid geo-blocking => make it easier for legislation targeting such features to pass
4. also more centralization for cloudflair
Through if you ignore all this from a pure "common peoples security" perspective (i.e. not state actor attacks) this is an neat improvement. There are still to many things which allow attacks due to not using HTTPS and for non state-level attackers the best attack vector are public hotspots and similar where this VPN automatically is enabled. E.g. common security problem is HTTP(not s) redirect links in e.g. mails, which an attacker could trivially rewrite to point you to their site which automatically proxies the site you originally wanted to go to. Worst offender I saw was a FIN-tec site using emailing http(not s) redirect links containing the auth token for the initial account setup...
Just be mindful of any feature and who it benefits. These companies aren't charities.
I least try to do this while we travel and are out of network range. How do people feel about this?
takes 10 seconds to setup and I can use my home IP from anywhere on earth
Even MSFT isn’t going to pay the network bill for everyone forever
Split decision if this is a true good faith thing for consumers. Time will tell. I can easily see where it’s a great thing on one hand but also a terrible one too. This is where a company’s integrity comes in.
But do not forget that Opera 7 was release TWENTY YEARS AGO. Things are a bit different now. Think eternal september.
These days with widespread HTTPS, the only way to do this is to bake it into the browser itself.
And of course, this was back when you could trust Opera to do what they said they were (or weren't) doing.
It's not even that it served a minified version, too. It basically did all layout server-side, so the client got something more akin to a PDF of the webpage optimized for its screen size. It also compressed images.
It seems using a VPN from your browser vendor does not increase your risk. I don’t think a VPN would have any information that your browser did not.
I oftentimes see people using Chrome (not Chromium) while logged into a profile. Are you telling me that either those people are actually a minority, or that Chrome doesn't phone home?
I can observe who my browser/OS talk to (beyond the sites I already visit) – but what happens inside a VPN provider is impossible to tell.
Proxies are generally unencrypted and a new connection is usually made per-request.
VPN's are inherently encrypted and maintain a single connection.
They're totally different technologies. So hope that answers your question.
The usual difference is that they operate at application layer (proxy) or ethernet/IP (VPN). Which would make this a proxy, not a VPN.
OK? And what happens after that? After you go over your 1 GB cap? You're cut off from the internet?
* GET bank.example.com/accounts
* GET bank.example.com/accounts/1
vpn disconnect
* GET bank.example.com/accounts/1/details <- 403 new IP, who dis?
Let’s see how fast EU can move and regulate the traffic access. For instance, demanding that the servers should be accessible only to the local governments.
The AOL-like hell that the Microsoft Network was in the 90s makes its return in its Neo-Internet Explorer dystopian nightmare.
The only time I use Edge is when something Microsoft opens it, then I have to close it.
for CANARY users which is a completely normal thing. This kind of sensationalism really hurts everyone.
From a personal perspective, goog and microsoft are basically equivalent and I don't want either of their browsers.
I, personally, am quite against using a Google browser (or derivative), but for my gaming PC where I only launch the browser once in a blue moon, I just can't be bothered to download anything else since Edge works. On my work PC I use Firefox, and am quite happy with it.
Can the user configure various geolocations?
The plan is to sell the corporates VPN enabled services. The corporate will buy it without hesitation too if it comes bundled with Office 365.
Some people want to use the Adobe suite on user upgradable hardware.
If you come out of your bubble you'll see there's plenty of reasons to still use Windows (typing this in Firefox running on Fedora, FWIW).
This is why people tolerate Windows in 2022.
I'm not saying I like it, I was just trying to answer your question :)