VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

I mean, by this logic I have no reason to use Cloudflare's DNS server more than my ISP's, because, 'hey, technically Cloudflare could be lying about their logs.'

Yeah, my VPN provider could be lying to me and logging a whole bunch of extra data under the table. But I know my ISP is logging that data. I have every reason to trust a paid VPN provider more than my ISP because my VPN provider is basing their business model on me trusting them, not on being a monopoly.

Not to mention that VPNs also help at least a bit with anonymizing IP addresses. The trust model I have with directly exposing my IP to a website is "I hope nobody I visit on the Internet is logging this."

If I'm wrong and my VPN is logging everything, I'll still be in a better position than I was with my ISP, because at least I won't be broadcasting my current physical location to every single website I visit.

>you have no reason to trust your VPN provider more than your ISP.

A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP.

Would I trust some random unknown VPN provider more than Comcast? Maybe.

I would trust the Russian mob before I would trust Comcast

Well, as in anything human it is a matter of incentives. Comcast probably has an incentive for logging and selling your data to advertisers, whereas the Russian mob probably has other, more pressing things to worry about.

I follow the same logic by setting up my own VPS in a rented $big_provider VPN. VPS companies are succulent targets that surely attract many eyes, whereas I doubt any non-state actor has the capacity of capturing and filtering the traffic of the millions of random VPNs that $big_provider has.

You usually have a choice of between 1 and 3 ISPs but you can choose from hundreds of VPN services or setup your own on any cloud server. So there is a very good chance you could find someone more trustworthy. Your VPN can exist outside of your legal jurisdiction which could make a huge difference legally.

But unless you work at the VPN provider you don't have enough information to make that choice. You can't tell from the outside whether the VPN provider is logging or not.

It is a social consideration. Would you trust the government and jurisdiction of Holland or would you rather use DNS services offered by Turkey?

To answer this question, location is pretty much key.

If in the Netherlands: probably Turkey. If anywhere else: probably the Netherlands.

Although it is hard to think about a scenario in which the only available choice is between the Netherlands and Turkey.

The idea is hedging against the closest guy with a stick.

For many ISPs, I think we have sufficient grounds for trusting the ISP less than a decent VPN provider.

Its better than no solution, and you aren't limited to using one VPN. A dozen VPN providers each with 8% of your browsing history is still bad, but far preferable to an ISP with 100%.

Is it? I would guess that people already split their traffic between a home workstation connected through a local ISP, a mobile phone connected through a national carrier ISP, and a work computer that is connected with a (third) enterprise ISP. The concerns that linger in the comments here, are about the dangers of exposing even a slice of your metadata can be disastrous.

Therefore, going from three to eight ISPs is arguably worse as your exposed to nearly 3x the risk of exposure.

The more information any one entity has about any individual, the more accurate a profile they can create. The more thinly spread your metadata is, the harder it is for any one corporation to create a profile. Clearly there is no perfect solution, it depends on what sort of privacy risks you are trying to mitigate.

I wonder when someone is going to take on the task of figuring out how to encrypt SNI