News for hackers. Stuff that matters.
Re:Random Valid US Address by bigiain on Sunday September 06, 2015 @07:46PM (#10179530)
If you need to trust the provider, you're probably hosed already. (Depending,of course, on who your adversary is. Random untrustworthy VPN services are probably OK if you're just trying to protect against corporate network snooping or WiFi Pineapples at Starbucks. I'd be a little less sure about whether they'd protect you against a determined MPAA rights holder lawyer. If your adversary is a nation state, you need better advice about opsec than you'll get from a random like me on a website...)
Re:Random Valid US Address by mirimir on Sunday September 06, 2015 @08:24PM (#10179615)
I write a lot about this issue! Compartmentalization is a key aspect of good OPSEC. Trust partitioning, for example.

Consider Tor. Each circuit involves three relays aka ORs aka nodes: entry guard, middle relay and exit relay. An adversary could deanonymize a user by combining information obtained from the three relays used by one of their circuits to some honeypot.

One cannot trust any particular Tor relay to refrain from logging and cooperating with adversaries. However, the Tor design mitigates those risks by using three relays in a chain. An adversary would need logs from all three relays in a circuit.

One can also use nested chains of VPN services. That's far less anonymous than Tor, for many reasons. Tor creates circuits more-or-less randomly, and by default they change at ten-minute intervals. VPN chains, conversely, are typically static. But the bandwidth is much greater.

And then one can use Tor via VPN chains, and route VPNs through Tor. Also, although routing Tor through Tor doesn't work well or do much good, one can proxy through remote desktops on VPS. Latency sucks, but you get used to it.