[Dr Van Nostrand]

Who do you use and do they suck or not?

[Pete Svarrior]

I run a couple of my own OpenVPN servers, mostly for circumventing weird access restrictions, and to act as a gateway to my own stuff that I don't necessarily want open to all of the Internet. My mobile phone provider won't let me access p̶o̶r̶n̶ cybersecurity research papers, wtf?

I guess the main question is what you want a VPN for. If you just want a bunch of proxy servers to easily access Netflix from another country, then it really doesn't matter who you're using (there are better ways of accomplishing the same goal, but meh, it'll work, so why not?). However, if you're one of the people who bought into the YT advertising talking about how PenisVPN will protect your privacy because they have no logs™ and use military-grade encryption, then you're probably wasting your money, and likely making yourself more at risk of compromise, not less. There might be other use cases, and your mileage may vary.

tl;dr: you probably don't want a VPN, but if you do, it honestly doesn't matter who you choose.

[Dr Van Nostrand]

Setting up my own server might not be a bad idea. I have pretty badass broadband with lots of bandwidth and speed.

I'm expecting Santa Claus to buy me a bunch of new computer gear this Christmas.

My Girlfriend plays World of Tanks on the European servers. But I think using a VPN to be present in Europe will add the same amount of ping time as as crossing the ocean with regular internet.

[Pete Svarrior]

But I think using a VPN to be present in Europe will add the same amount of ping time as as crossing the ocean with regular internet.

Usually more. It would make your route less direct, in most cases.

[xasop]

I've been playing with tinc. My main reason for using it is that it is the only VPN that will run on every OS I use, but it's also a lot easier to set up than OpenVPN. Also, it's a mesh VPN, which means that once you connect to any node in the network, it will automatically route traffic along the most efficient route it can.

[Dr Van Nostrand]

However, if you're one of the people who bought into the YT advertising talking about how PenisVPN will protect your privacy because they have no logs™ and use military-grade encryption, then you're probably wasting your money, and likely making yourself more at risk of compromise, not less. There might be other use cases, and your mileage may vary.

tl;dr: you probably don't want a VPN, but if you do, it honestly doesn't matter who you choose.

This is something I've also wondered about. Even a amateur geolocator can tell you're on a VPN. There are all kinds of fingerprints from the originating computer and application layer in a deep packet analysis. Can a civilian VPN really hide all that shit?

[xasop]

This is something I've also wondered about. Even a amateur geolocator can tell you're on a VPN. There are all kinds of fingerprints from the originating computer and application layer in a deep packet analysis. Can a civilian VPN really hide all that shit?

Using a VPN as a proxy to the public Internet can't hide anything except network addresses — and even then, some application protocols may provide ways to elicit this information from the client. Whether a VPN will be sufficient for your requirements, or be able to form part of a solution that is, depends on what your requirements actually are.

[Pete Svarrior]

This is something I've also wondered about. Even a amateur geolocator can tell you're on a VPN. There are all kinds of fingerprints from the originating computer and application layer in a deep packet analysis. Can a civilian VPN really hide all that shit?

The short answer is "basically, no". Most commercial VPN advertising relies on being Technically Correct™, just enough that you couldn't easily sue them, but any practical implications are overstated to the point of being meaningless.

There are scenarios in which using one can lead to improving privacy. For example, if you're accessing an unencrypted website (http:// rather than https://), the information you send and receive is easily visible. So, let's say you're sat in a cafe using their public wifi and you sent a PM to someone on a forum. If I'm sat in the same cafe, I can easily intercept that message as you read it. A VPN would do two things here:

• It would provide a layer of encryption at an early stage, so I couldn't trivially see this information.
• It would reroute all your traffic to the VPN's IP address, so I couldn't even see what sites you're visiting.

If the website is already using transport layer encryption, then only the second point stands (since your data would already be encrypted without a VPN). If the attacker is not a nerd in your local cafe, but rather a nation-state actor, a police department, etc, then neither point stands (since these actors will be able to monitor traffic from the VPN end if they really want to).

Another thing worth mentioning is that VPNs are vulnerable to timing attacks. I might not know that you accessed our forum via some VPN, but I will know that you accessed a VPN, and that the VPN accessed our forum at the same time. With enough data points, a committed attacker can easily determine your traffic. Plus browser fingerprinting, plus xasop's point on application-level workarounds, etc. etc.

So, is FjordVPN useful from a privacy standpoint? Eh. My personal opinion is "no". Terms like "military-grade encryption" are just an insidious way of saying "the same encryption that literally everyone on the Internet is using" (I think they want you to imagine burly men in tanks protecting your e-mails or whatever, and I guess it's working since pretty much every company is using this term), and the change in IP address alone won't stop someone from tracking you for so, so many reasons.

Privacy aside, it might be useful if you want to access Netflix in other countries (until Netflix bans that specific node, at which point your VPN provider will spin up a new one, which Netflix will then ban, at which point your VPN provider will...), or for me to access Trump's newest CALL TO ARMS (this is a thing that happened - our general enquiries e-mail received a message from the Trump campaign asking to become an OFFICIAL TRUMP TEXT MEMBER SUPPORTER, but they outright reject connections from outside the USA). Same goes for US local newspapers, which decided that banning Europe is preferable to following their data protection standards.

In short: the ads are telling you that you need a VPN, but fail to explain (truthfully, at least) what problem it would solve. My suggestion would be to identify a problem first, and look at what solutions there might be to it. If a commercial VPN happens to be the answer - that's chill. For me, that was my mobile provider being weird, but even then I decided that I'd rather run my own server than trust a corporation.

[Dr Van Nostrand]

ok, so yes, I want to hide my IP address as much as I can but not because I'm trying to hide the fact that I'm looking at porn. Everybody knows I look at porn, everybody's grossed out and we've all moved on.

I am thinking about buying or renting some old IP addresses and setting up my own proxy server (a lot of issues with that plan but doable.)

Anyway, I was doing some tinkering with different browsers and what the webhost sees. I launched test attacks ... I mean connections to a website on my webhost and looked at Cpanel reports to see what IPs were recorded.

Firefox on Windows 8 - webhost recorded the IP address and the location of the modem at my desk
Firefox on Windows 8 from within a virtual Linux Kali client - webhost recorded the IP, the location of the modem at my desk and that I was on a Windows 8 machine with a virtual Linux Kali client
Tor browser on Windows 8 - webhost got a random IP everytime and nothing about my system.

So if you just want to hide your IP from pornsters, Tor seems the way to go.

While I was doing this I noticed that one of my other sites was getting a weird traffic pattern. It's a one page information site, no ecommerce. A rotating IP address is sending a GET (HTTP 1.0) to one specific site. Every few minutes, the IP would change by one and present a different operating system.
WTF, for days, they have been using different IP addresses and different operating systems trying to connect!

Of course, the traffic is from Russia.

WHY IS THIS HAPPENING TO ME!  WHY CAN"T THEY JUST LEAVE ME ALONE!?!?

[xasop]

Of course, the traffic is from Russia.

WHY IS THIS HAPPENING TO ME!  WHY CAN"T THEY JUST LEAVE ME ALONE!?!?

Russians sending out dodgy requests to random web servers? Must be a Tuesday.

[Dr Van Nostrand]

Of course, the traffic is from Russia.

WHY IS THIS HAPPENING TO ME!  WHY CAN"T THEY JUST LEAVE ME ALONE!?!?

Russians sending out dodgy requests to random web servers? Must be a Tuesday.

Those bastards!

Holidays are coming so I'll have some time off. I may set up a honey pot with a hole that's shaped like a pussy. When they stick their dick in it, steel teeth will bite their dick off and it will fall into a basket of dicks that I will sell on eBay.

[Pete Svarrior]

ok, so yes, I want to hide my IP address as much as I can but not because I'm trying to hide the fact that I'm looking at porn.

The "why" makes a big difference here. Tor will be great for some applications, and terrible for others.

[Dr David Thork]

If you want to watch pron, you can just change your DNS settings and circumvent your ISP.
If you don't want to be tracked by Facebook, Google and other advertisers ... some kind of adblock.

I'm not really sure why you would want to use a VPN unless you want to commit a crime?
A VPN will put you in a different tax domicile and you can pay less tax on purchases, but that's evasion, not avoidance.
A VPN will put you a few nodes from the source which might stop you being identified for the horse pron you enjoy but that's illegal too.
A VPN will give you access to football games or movies that are cheaper in other regions ... but that's a form of theft.
A VPN will make it harder to identify that you are downloading things without paying for licenses etc but also theft
A VPN will allow you to circumvent bans on particular websites. ¯\_(ツ)_/¯

If someone is using a VPN, they are probably up to no good.

[Pete Svarrior]

If you want to watch pron, you can just change your DNS settings and circumvent your ISP.

This is absolutely horseshit advice that you shouldn't follow, unless you want to actively compromise your privacy by providing yourself a sense of false security.

If you don't want to be tracked by Facebook, Google and other advertisers ... some kind of adblock.

This is also terrible advice, written by someone who doesn't understand how tracking works. Use an ad blocker to no longer see ads. An ad blocker does not, however, enhance your privacy - it diminishes it ever so slightly.

I'm not really sure why you would want to use a VPN unless you want to commit a crime?

[...]

If someone is using a VPN, they are probably up to no good.

This is almost correct (let's not split hairs, it's at least not as horseshit as your previous two points), although it ignores the crux of the matter. Many if not most everyday users use commercial VPNs because they saw an ad on YouTube about how it will protect them from EVIL HAX0RZ. This is dumb, but being dumb is not a crime yet.

tl;dr: I strongly recommend you do not follow Thork's technical advice.

[Dr David Thork]

VPNs are mainstream. And my advice would always be not to swim with the crowd. If you are going from site to site via Tor nodes or some popular VPN ... you are painting a target on your back. You are suddenly way more interesting than someone using adblock or cloudflare.

VPNs do not deliver any of the promises they make. You aren't anonymous, you can be tracked ... and you did that to yourself at the expense of slower page load times and performance issues.

tl;dr: I strongly recommend you do not follow Pete's technical advice.

VPNs are gay and will increasing attract the interest of HMRC, IRS etc as they start to wonder why all their sales tax / VAT is disappearing online and why QATAR has the 7th biggest economy on the earth.

[Pete Svarrior]

I don't think any further comment is necessary. Thork provided an excellent exposé on why he's wrong, without even understanding the position he's arguing against.

Back on topic: Unless you tell us what use case you're trying to use a VPS for, there's not much we can do.

[Dr Van Nostrand]

If someone is using a VPN, they are probably up to no good.

Ok, So here's the deal. I'm getting a new computer and I'm looking to harden the network defenses. The workstation (not an Apple) will be more about video editing and digital publishing but I do enjoy some light recreational cybercrime (hacktivism, scambaiting, no bitcoin, etc...) I'm looking to anonymize the IP address, plug ports, monitor traffic yada yada. So Thork was kind of right.

Part of the problem is that I share a normal household network with people and peripherals that want a normal internet experience.

VPNs are gay and will increasing attract the interest of HMRC, IRS etc.

Yes, they are gay. And they could just as easily give away the donkey porn they are supposed to protect by getting breached themselves. But even Cloud flare had a leak so we take our chances with anyone. I'm not as worried about attracting attention from the government by using a VPN. In America, it's like a gun permit, no big deal.

They offer the minimal protection of the front door of my house. Someone could break it down with no problem but it does keep out stray dogs and lost elderly women suffering from dementia who wander up.

I'm thinking maybe the whole house needs to be behind some kind of firewall proxy server thing. I saw an ad for some of Michael Jackson's old IP addresses from Neverland Ranch.

BTW Doesn't it bother any of you that the admins can geolocate you, read your OS, possibly access your files and camera, start an online romance with some friend or family from your contact list, marry into your family and seriously own you?

[Pete Svarrior]

Ok, So here's the deal. I'm getting a new computer and I'm looking to harden the network defenses. The workstation (not an Apple) will be more about video editing and digital publishing but I do enjoy some light recreational cybercrime (hacktivism, scambaiting, no bitcoin, etc...) I'm looking to anonymize the IP address, plug ports, monitor traffic yada yada.

If you're comfortable getting your hands a little dirty with VMs (sorry, no idea what your background and experience is - I'm happy to adjust to any level if you let me know) I'd recommend playing with Whonix. In a nutshell, you run 2 VMs: one acting as a Linux box that routes all network traffic through the other - a gateway that routes all Internet traffic through Tor. This is a pretty strong setup for most de-anonymising attacks, it doesn't cost any money, and the set up is relatively simple once you know how the different parts work with one another. If you use it diligently, it means that your Naughty™ stuff goes through the VMs while keeping the rest of your home/family using the Internet as normal.

This is almost certainly overkill for your requirements, but honestly a bit overkill might be good for peace of mind. If you'd like, you can always shoot me a DM. I used to train people on these tools, so I should be able to answer most basic questions.

[xasop]

In a nutshell, you run 2 VMs: one acting as a Linux box that routes all network traffic through the other - a gateway that routes all Internet traffic through Tor.

Is there a good reason to use two VMs instead of just using network namespaces to isolate the client and gateway on one Linux system?

[Pete Svarrior]

Is there a good reason to use two VMs instead of just using network namespaces to isolate the client and gateway on one Linux system?

I don't know about "good", but the reasoning is that if you manage to compromise the client/workstation (or otherwise leak any information about the client), you still have very little information about its network setup - all you'll see is a local network with one other machine on it. The gateway is not meant to be used interactively by the user, which arguably mitigates some routes of compromise.