Well, you're funneling your traffic through a single entity in almost all cases, right? So I view it more as, who do I distrust more? My ISP or a VPN?

I don't use a VPN provider, but it's tempting as I don't trust my ISP at all.

One very explicit reason to not trust your ISP with your internet traffic is that since 2017 [1], they are allowed by Congress to sell your internet history.

As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2].

[1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is.

I've always assumed VPN providers sell whatever data they can too.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing history.

I also remember that Comcast did (and might still do) inject code onto websites to display a “pop-up” indicating that you’re reaching or have reached your datacap. It would even pop up on Steam because most of Steam is really just a webview. I’m not sure exactly how they did/do that.

Again, I’m not a network or security expert, so I’m not really sure of how TLS protects your internet history, which I take to mean a list of websites you visit and when.

You're correct - TLS / SSL operate above the IP layer, so they know which servers you're talking to, when and approximately how much, and if they can see your DNS requests it makes it that much easier to know which sites that maps to. TLS stops them from seeing the actual data you're sending them (like passwords), which pages you're viewing, and it also prevents them from manipulating the data (unless they've subverted the PKI, like if your company laptop has a certificate installed that trusts your company VPN, you company VPN can do a Man-in-the-middle attack to subvert TLS).

By looking at side-channel data it was possible to correlate the page being viewed on SSL, IIRC researchers could calculate the page viewed about 70% of the time.

I misremembered, it was about 90% -- https://scirate.com/arxiv/1403.0297.

That’s what the parent said: they can still see “hostnames and IP addresses.”

But, for most people, that means that the ISP will just see:

• google.com

• facebook.com

• reddit.com

• somebignewspaper.example.com

Etc.

And there’s really nothing much too valuable about that. They won’t even be able to figure out if you’re shopping for something (unlike every other nosy channel provider), because most shopping traffic today just looks like Google + Amazon.

Please don't underestimate the value of metadata.

While it's true that the big platforms dominate web use today, don't forget that the concept of metadata includes when you actively surf on the information superhighway. That's valuable information for advertisers.

So is every DNS lookup related to the API backends of specific apps you use. And every random website outside the massive platforms.

These might reveal tons of information about you. Like:

Are you doing research on politics (and which flavor)? Do you worry about health? When do you access online banking? Which banks? Any tax filing software? Invoicing apps? Do you use shitty payday loans? Are you looking for dates? Are you gay? Which games do you play? Which car dealerships do you consider? Do you gamble? And of course, any particularly.. specific porn sites? Do you access banking, travel/flight booking, investment, shitcoin trading, adult or gambling sites in a specific pattern that might indicate mania or other mental health issues?

With metadata alone, your ISP has a thick dossier on your habits, with stuff therapists don't know about their clients.

I see. As someone who has practically zero knowledge of networking, I had misconstrued hostnames for something else, which I’m now too embarrassed to mention.

Very educational response though. Thank you.

I believe you are both saying the same thing, you called it websites/domains he called it hostnames.

... and request sizes, relative times, and time of day. It would be foolish to not assume that the complete history of your sessions can be inferred from how this data clusters, everything but the actual text of your messages.

Of course the people that find this problem worthwhile to solve then go on to work for or found surveillance companies, rather than publishing proof of concepts to security lists.

We also already know the type of molds the surveillance companies are trying to fit us in, from their own marketing materials (eg https://www.experianintact.com/content/uk/documents/productS...). Do you really think there isn't enough metadata being leaked to bucket people into these categories?

And yeah, IP proxying is a hack. But it's seemingly the best we can do to mitigate the utterly broken HTTPS/JS protocol stack.

There are other straightforward advantages too, like having location targeting miss the mark which breaks up the coherency of their manipulation. I've got zero intrinsic interest in local/news events for elsewhere.

TLS has optional padding. In TLS 1.3 clever design means the padding is "free" (each byte of padding adds exactly one byte of data transmitted) so if you would like the sizes transmitted to be misleading you can choose how much.

We can't solve for you the question of how much to use. If you want a snooper to not know if you retrieved file A of 14583 bytes or file B of 14621 bytes maybe a very small amount of padding will get the job done. If file B was 800 Mb that's a lot more padding you're asking for.

Sure, but that doesn't really address how clients/websites use it right now, or even scale up to solving the fundamental problem (the best you can do is hide bits by padding requests/responses to a discrete set of lengths).

If you're responding to my characterization of HTTPS/JS as "broken", I'm referring to the fact it needs to make a connection to a well-known centralized-authority server every time it wants to retrieve a resource, leaving you at the mercy of your transit (and the server itself, which is obviously another major source of surveillance). Whereas something based on ideas like content-centric networking (eg Freenet) allows a user agent to retrieve those resources from peers or broadcasts, perhaps even over virtual constant-bitrate links.

If the NSA revelations have shown anything, it is that meta data is very valuable.

I am guessing #1 is mot wanting your internet provider (eg. AT&T) knowing what you are doing, then Netflix, Torrents, getting better deals on tickets and such, maybe activities of questionable legality?

Personally, I don't like the idea of my mobile provider profiting off knowing which applications I am using and what sites I visit.

I don't understand being unhappy with your ISP knowing these things, but being fine with your VPN provider knowing them.

Because it's easy to change a VPN provider if you don't like their actions, but most of us are stuck with an ISP and have no control over what they do with our data?

What exactly can they be doing with your data other than selling a list of which DNS queries you make and which IP addresses you connect to? (Which the VPN provider can also do.)

Send me your browsing history and your location history and we can continue this conversation.

I'm currently sitting on a plane. gogo wifi can read all my email if they so chose (and pass to a government). I'll use a VPN.

Any major email provider at this point should have SSL enabled when you check your email.

Shame they're (still) spoofing certs.

https://slate.com/technology/2015/01/gogo-creates-fake-ssl-t...

https://www.zdnet.com/article/gogo-in-flight-wi-fi-serving-s...

https://arstechnica.com/tech-policy/2014/04/at-feds-request-...

The browser (as should your email client) appears to have rejected those certs.

ok, so they have been rejected. Now what? I still would like to read my email... which is where VPN's come in handy.

I have had this situation in-flight a few times. I just used wireguard to a server I have. If I didn't already have that set up, I would have used an SSH+SOCKS tunnel to route around the damage. No need to send all my traffic to some shady VPN provider.

If you're running your own VPN, fine.

If you're using something like NordVPN, you're just swapping one shady outfit for another. Worse, in many cases.

Might be better to just wait until you land.

They can do active attacks on you, as most people don't actively attempt to ban and absolutely block unencrypted connections (and there are also sometimes attacks on SSL stacks anyway); and like... SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type".

(Also, if I see you making requests to some websites I can correlate it to others, just on hostname, which I would get from SNI/TLS, not DNS: like, you go to news.ycombinator.com followed by some other websites that are currently on the front page of Hacker News, I can now guess with high likelihood you are clicking on specific website links you just saw.)

As for "the VPN provider can also do that", that is like saying "what can a random stranger do with your secrets that someone you know well can't?", which is "true" sure, but not really interesting: being able to choose the company on whom you rely for security is extremely useful: I don't really have choice over my ISP, but I have choice over my VPN, and so you can't really say "these VPNs are shadier than my ISP" unless you can show the best of all VPNs is shadier than my ISP.

Meanwhile, for many people, your "ISP" on a given day might be "the local coffee shop" or "an airport" or "your brother's friend Bob": people talk about "ISP" as if it always means "AT&T", but I see even extremely technical people who "should know better" happily using WiFi provided by conferences, which is just crazy to me... you are way more likely to get messed with in some scary way by people close enough to you for it to matter than by some random entity.

> SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type".

A VPN won't protect you from these sidechannel attacks.

Not by default, but it could. Send a monolithic stream of 1500 byte packets with some padding to obfuscate transfer rates and you can really disrupt that kind of thing.

Where did location history come into this? (IP addresses are generally not correlated to location at much more than city level.)

My point is simply that using a VPN provider doesn't change the fact that an actor has access to your DNS queries and which IPs you connect to (and where you connect from). It just changes that actor from your ISP to a VPN provider, and most VPN providers seem a hell of a lot more shady than any ISP I've dealt with.

FTC believes location data is being sold alongside browsing history.

Many of us live in countries where our ISP is owned by a hostile government that regularly blocks social media and other parts of the web on a whim.

On the cellphone side, most carriers will sell your identity and real time location to websites that your visit. https://news.ycombinator.com/item?id=15477286

I'd like to see some evidence for "most carriers" and for "to websites that you visit".

The ISP knows who you are and where you live; the VPN provider only knows your source IP address and information gleaned from your payment method (which in many cases can be "not much", as VPN providers support pseudo-anonymous payments).

I can use a VPN provider outside the jurisdiction of my own country.

If you're doing something illegal in your own country, that seems like a good idea. If you're not, that would seem to achieve nothing other than making it much more difficult to enforce any action against the VPN provider for selling your private data.

If my VPN provider trades user data, the service will quickly deteriorate and it won't be a VPN provider for long. But even if that is the case it wouldn't be my primary concern.

I don't even live in a country were I have to fear much at all from malicious authorities, but they wouldn't even blink before trading privacy for perceived security.

I might change my opinion if there were actual consequences for sharing user data. I believe it when I see it.

Otherwise I just like privacy, information is power and I don't like to share with the state.

In the US at least, there still remain a few tatters of laws that control how law enforcement and intelligence agencies can surveil you.

But there are zero controls on US agencies hoovering up data indiscriminately outside US borders.

It is much easier to change VPN provider than your ISP.

What does that have to do with them knowing what websites you visit?

The implication is that if they're doing shady shit, you can easily switch, in contrast to ISPs.

On the other hand you will have lesser knowledge of what shady things your VPN provider does.

Well your ISP knows more about you than your VPN necessarily does. Your ISP probably has your credit card on file, with your real name, and they have your precise street address too. The VPN may have none of that, except your IP address. If somebody were to purchase your history from your VPN, they would have to also purchase the IP->name/address/etc mapping from your ISP and JOIN the two. That seems marginally better than a one stop shop.

(Of course, some people give their VPN their credit card info, so the above rationale doesn't apply for them.)

I feel like the only good reasons to use a VPN are if you're torrenting or if you want access to sites from different countries (foreign Netflix libraries, streams from state-run media channels, etc). Most VPNs worth a damn aren't going to sell you out just for torrenting movies/music/games while your ISP will.

Because they're required to reply to subpoenas?

Well then youre an idiot

Classy

Because for certain types of things, like pirating movies, it's good enough.

It seems a bit strange to me that you'd want to hide your movie pirating from your ISP but are happy for your VPN provider to know about it.

Any (large?) ISP will report your torrenting and/or terminate your internet usage if you torrent anything they deem copyrightable. Both Comcast and Spectrum do this, at least.

Edit, to add: No VPNs do this.

>Edit, to add: No VPNs do this.

counter-example: https://forum.goldenfrog.com/t/no-longer-feeling-private-aft...

If you read the last message in the thread, they no longer log IP. At the time the user originally posted his complaint, they did.

They don't. What you're describing would take them out of common carrier status and make their business unworkable. What they do is respond to notices from copyright holders.

https://arstechnica.com/tech-policy/2011/07/major-isps-agree...

Agreed - I was oversimplifying. A better way to put it would be to say that ISPs automatically participate in the reporting of alleged copyright infringement, as well as mete out punishment for alleged infringement when they decide it is appropriate, whereas (most?) VPNs do not.

Edit: spelling

My friend's VPN emailed him saying Comcast asked them for his info because he torrented something and the copyright holder contacted Comcast. The VPN provider didn't give Comcast any info.

Your friend may need a new VPN company. If they were able to identify him then they are probably logging too much information.

OK, I was not aware of this. I have been known to occasionally torrent things (not just Linux distros!) and having done this semi-regularly while living in four different countries I'm yet to hear anything from any ISP about it, but I am sure there are places where it's taken more seriously.

> No VPNs do this

I got a nastygram from the hosting provider I used.

> No VPNs do this.

Yet.

Who said anything about being happy about a VPN provider knowing anything?

It's about choosing between the lesser of two evils.

I think it is more of a matter of hiding your local ip address from other torrent users.

What's the purpose of that? Genuine question, I'm trying to understand the threat model of another torrent user seeing the IP address that is currently allocated to your router. Is this related to those letters that people sometimes get sent threatening legal action for torrenting?

quite simply evading copyright strikes or legal filings. I don't know which providers still disconnect your internet after 3 strikes. But I am guessing that's the "threat" here.

"I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers."

Agreed - especially when it is so very, very cheap and easy to fire up a handful of VMs - around the world - and run your endpoints any way you like.

By far my preferred technology is 'sshuttle'[1] which allows you to use any host, anywhere, running ssh as a VPN endpoint. That cuts the setup time for your VMs down to almost zero.

[1] https://github.com/sshuttle

You can fire up VMs, but then issue becomes the VM provider, which definitely has their own logs. Doing torrents through a VPN you setup on a VM provider usually gets the automated emails being forwarded to you.

Regardless of anonymity or privacy, my ISP almost certainly deprioritizes some traffic (video), so a VPN at least ensures I can use my full bandwidth for whatever I want to access on the Internet.

I use one when I have to connect to a public access point, or really any network that's not owned by someone I know and trust. It's not a perfect privacy/security plan -- you're right that I can't completely trust the VPN provider either -- it's just better than the alternative.

Try Warp from Cloudflare. Does the same thing but easier to trust versus some outfit like NordVPN

> Funneling all your Internet access through a single entity

You don't have to funnel it all, only data crossing hostile networks like free wifi hotspots (The only real use-case for VPNs in the first place). Alongside this is choice of geolocation so you can watch things like HBO even when in Europe.

>Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me,

You're already doing that with DNS servers. At least VPN providers make the claim that they'll protect you.

Sigh - just because one has a VPN, doesn't mean it has to be used all the time.

My NAS device, uses a VPN - my other machines do not.

My laptop, uses a VPN when I am travelling and using wifi from unknown sources (i.e. coffee shops, airports, etc.)