35
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 16 May 2024
35 points (100.0% liked)
Technology
37211 readers
479 users here now
Rumors, happenings, and innovations in the technology sphere. If it's technological news or discussion of technology, it probably belongs here.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
What sort of protection are you after? Your VPN should encrypt your data to make it more difficult to snoop on your activity. I wouldn't trust any random WiFi hot-spot just because you got a VPN encrypting your traffic though.
Before answering your first question (I'm actually not sure how to answer! I'll have to think about it ๐ค)--my laptop has wifi, which transmits and receives radio waves to/from my router; my router is connected to a cable (broadband cable? I guess? Not DSL at any rate), which is connected to the internet (and there's also a MODEM in there somewhere too). My laptop doesn't have the ability to connect by mobile data which uses, I guess?, cell phone towers, but my smartphone can use both. So they're two different systems is I guess what I'm getting at, and I was never clear on how or if a VPN provided any sort of basic privacy if it was only using cell towers. This is a potentially really dumb question (the head injury doesn't help ๐ค), but remember, William Gibson used to think that computers were powered by these gleaming magical crystals (or so he claims), before he looked inside one and discovered that it was basically just a floppy plastic record spinning around really fast.
The first step in security is to answer who you're defending against. Someone stealing your phone? A cop with a STINGRAY device? All the security decisions you make are based on your initial threat model.
Generally, home internet, wifi, and cellular data are considered safe against passers-by (assuming your wifi password is strong). However, they are also assumed to be eavesdropped on by your ISP and government. Details of your internet traffic can then also be revealed by your ISP to other people during legal action, such as if you're being investigated for piracy.
There are ways to further protect your internet traffic from being snooped on, even from your ISP and government, by using things like HTTPS, DNS over HTTPS, and of course, VPNs.
โHTTPS ๐
โVPNs ๐
I thought DNS over HTTPS (DoH!) was not recommended for some reason . . . My VPN provider claims to be using its own DNS servers.
Please note that the comment you're replying to is leaving out a crucial piece of information: if your VPN provider is legally allowed to operate where you live, your government or law enforcement can get your data from them just as easily as they can get it from your ISP.
(Sorry for repeating myself but security is an important topic so I'd rather correct incomplete or misleading information in multiple comments than have someone miss the crucial part because they read only one sub-thread)
Definitely! If your VPN keeps logs, is in a surveillance-friendly jurisdiction, etc, then details of your internet traffic can be revealed by your VPN. I recommend Mullvad, paid with cash, for the most security. It can also help to pick VPN servers outside of the most egregious jurisdictions, like picking EU servers over US or HK servers.
Then I'll repeat my comment from your earlier comment.
There's no reason to make tracking easy for somebody just because it's physically possible. Just because somebody can break into your house through your windows, doesn't mean you shouldn't lock your doors.
Data hygiene is important, when you know your retail ISP will definitely sell your net flow, it's a strict net benefit to use a VPN to prevent them from making money off of you if nothing else
Sure, if you know that your ISP abuses your data, go ahead and do something. Though I would recommend changing ISPs before you give even more money to some other company who may or may not do the exact same thing to your data. I'm specifically not talking about TOR or some VPN that you host on your own. I'm talking about companies like NordVPN and Surfshark.
The analogy of locking your door doesn't quite fit. Locking your door doesn't cost you 10 dollars per month and doesn't require you to hand your keys to the guy who sold you the lock.
You have more faith in your local ISP than I do. And I'm happy that you know for certain they are not selling your data. You must live in a very strong regulatory framework
Oh I most certainly don't have much faith in my local ISP. But I have even less faith in some VPN startup funded by venture capitalists who may or may not be cutting corners on security to save a few bucks on their ends even if they're not actively malicious. At least my local ISP has been around for decades and is closely monitored by both a government agency and independent customer protection groups.
And yes, I do live in a place with a very strong regulatory framework. Our ISPs are bound by the EU GDPR and our highest federal court has confirmed multiple times that even saving connection metadata without a case-specific court order is illegal. Sure, they could break those laws but a commercial VPN provider can do just the same with the difference that not as many people would notice.
I feel like one straw man in your arguments, is we keep mentioning mullvad in the comments, but you always compare it to the scummy VPNs like NordVPN.
Mullvad is also based in the EU, and the gdpr applies. They go out of their way to know as little about you as possible, if you pay with crypto or cash, they have no way to identify you as a person.
I checked and there is only a single comment that mentions Mullvad (other than yours that I'm replying to right now) that's visible on my instance with no specific explanation why it's better than other offers other than that you can pay with cash. If I've missed something, I promise you that it's not in bad faith, it's just that this distinction didn't come through clearly.
I hadn't heard about Mullvad before today and a quick look at their website made it look not very different from the fear-mongering you see with the others. Only after your comment I noticed the Why Mullvad VPN link at the very bottom that explains what they do differently. I'm still skeptical about some of the claims and especially of audits that they themselves requested but I'm happy to see that there are providers that seem to be more trustworthy than the ones that are constantly shoved down our throats and I'm definitely happy to have learned something new.
May I suggest that you write a top level comment that explains in detail why Mullvad is better than other services so OP (and others who stumble over this thread) has an easier time finding it?
Edit: minor typos and grammar
https://www.privacyguides.org/en/vpn/#mullvad
You came out so strongly, and forcefully against VPNs, I'd assumed you've already done your research to know they're all terrible horrible things
But I cannot explain the benefit of VPNs any better than privacy guides, and they do an excellent job, and compare different options. So they're definitely the place to go when you're looking at which VPN providers are credible
I came into this discussion from the technical perspective (of which I've done plenty of research, both in university and in my job) that commercial VPNs don't do what most ads want you to think they do. Your ISP sees a lot less than they want you to think, VPNs use just the same encryption algorithms as everyone else and while public WiFi isn't great security-wise it's not as if anyone will read your bank password the second you connect. I still stand by those claims.
Then, the discussion drifted towards who you'd rather trust with the things that aren't encrypted (mostly DNS and connection metadata. Someone has claimed that many messengers are unencrypted but I think they have confused a lack of user-to-user encryption with user-to-server encryption), your ISP or some VPN provider. That's the point where we diverged: as I had no need for a VPN myself (because of the reasons mentioned above), I had not researched individual VPN providers and was not aware that Mullvad apparently has a strong track record. For that I apologize. Still, in a thread that started out with someone not knowing if they need a VPN at all and most discussion has been very general, I would not assume that anyone who comments is familiar with a specific provider without them being named explicitly. Also, I've stated in at least three places that I was explicitly talking about VPN providers like NordVPN and Surfshark that are prominently (mis-)advertised. Those I still would not trust further than I can throw them.
But I guess that's online discussions. We've talked about two different things and took a while to notice. I'm thankful for the correction and I hope you can understand where I came from.
DoH is meant to hide your internet activity from your ISP/cell-provider since DNS is otherwise unencrypted. If you trust your VPN, then you can trust unencrypted DNS.
Definitely not a stupid question! Networking infrastructure is complex. I've been working in IT for years and still find myself scratching my head at times going, "Wait, how does the OSI model work again?"
Connecting to a VPN on your phone while using mobile data basically means the cell phone tower handling your data only sees encrypted data. Whoever your VPN provider is will see your traffic instead of the cell tower.
However, in modern times it's fair to be wary of backdoors and exploits that can compromise your device and render the VPN encryption moot. There's not much that regular people can really do to mitigate that possibility other than not use a phone.
If you're interested in learning more networking fundamentals, I'd recommend starting with the OSI model and its layers.
A handy mnemonic I whipped up with ChatGPT last year for better remembering the order of the layers:
Precise Data Navigation Takes Some Planning Ahead