Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is.
Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.
how will they prove it in a year?
and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?
In other words, would you be alright if the VPN built a profile of your VPN identity? The corollary, I think, asks if you're interested in a VPN to separate your activities, or to thoroughly diffuse them for actual information loss.
There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start:
- What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities?
- Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic.
- What's their privacy policy look like? Do they make public commitments to destroy logs? Are their claims on-their-face absurd? There's no such thing as a VPN that does zero logging at all, so if someone is claiming perfect anonymity, I distrust them from the get-go.
- Have they had data breaches in the past (for example, NordVPN)?
- Are there any high-profile cases of them refusing to provide logs to someone?
- What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts.
- Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims.
- Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches?
That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."
As usual, I think the reaction of PIA's corporate restructuring is a lot of hot air over nothing. Typical of most hot air, it is released to draw attention to the source and not convey any real concern.
That said, if you really need a third-party VPN, FoxyProxy's branded VPN service available through https://getfoxyproxy.org is probably pretty good odds. I've never used personally so I can't vouch all the way, but it's supporting an open-source project by someone who seems to really care about his users and has put more than a decade into supporting a great extension, so that puts it far ahead of most of 'em from the get-go.
What is "regular internet browsing"?
It's not just a speed problem. Within the Tor community I personally still see a lot of people saying that behaviors like these are selfish because they take up too many volunteer resources. Maybe it's a little unfair of me, maybe those people are misinformed -- but I interpret that as meaning that the community doesn't think Tor can scale to meet those demands.
With either a 3rd-party or a self-hosted VPN, you can reroute literally all of your network traffic from all of your devices without giving it any thought, and the only time you'll really need to get off is if you're accessing a blocked website or doing something that demands very low latency.
In regards to your specific list, that's above average internet user, in which case I think a better solution is diversifying your network connection methods. Trying to use one tool for that entire range of traffic centralizes it needlessly, and you'll get more effective privacy by avoiding that.
Furthermore, if you want more speed out of tor I'd argue step one is running a node and contributing and/or donating at least.
Also at most some latency. /pedantism
The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection -- then you at least know that it's $LOCAL_TELCO sniffing the packets.
Tor is excellent and it has uses, but I've had to explain to many people over the years that day-to-day browsing like checking email, checking bank accounts, etc., is far less safe through Tor than through a direct connection (at least for people in the US -- if you're using Tor for its intended purpose of thwarting oppressive regimes, crossing your fingers on the exit node lottery is probably preferable).
>The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection
I think this is simply wrong, and lacks any threat model at all. Why do you care that encrypted bits can be sniffed by an exit node? The node can't even determine the 2nd hop, much less the origin.
The point is that users should be cautious about what they do over Tor because exit nodes can eavesdrop on (and potentially manipulate) the conversation.
The onion mechanism isn't relevant here. It prevents peers from identifying each other within the onion, but it doesn't do anything to prevent the exit node from accessing the raw packets involved in the conversation -- indeed, the exit node must access those packets to proxy them. It's true that some of the traffic will be protected via HTTPS, but even encrypted packets can be made useful in various ways.
The reality is that you're introducing a random computer into your network path and that you're trusting that computer to proxy your connection without a) eavesdropping; or b) modifying contents. The prevalence of HTTPS may or may not be sufficient mitigation for some, but any analysis of the propriety of Tor to access non-onion sites is fundamentally incomplete if it doesn't acknowledge, contemplate, and address the implications of inviting a random computer to MITM the connection (as the Tor FAQ has done for at least the last 10 years: https://2019.www.torproject.org/docs/faq.html.en#CanExitNode...).
No, they can't. Unless you don't use TLS...which is addressed in the FAQ you linked. Who is it that can break TLS that you're concerned about? Again, without threat modeling this is all lacking a lot of context and purpose.
TLS will probably defeat script kiddies that are just after the "thrill" of voyeurism, but more advanced operators will make use of the attack surface you're offering them, even if they aren't ever able to decrypt the payloads (not necessarily a guarantee). There's lots of room to analyze and manipulate encrypted HTTPS traffic in interesting ways (SNI, non-secure cookies probably good starting points).
TLS depends on correct configuration on both the client and server-side to be effective (and an interested proxy could try to modify the handshake to downgrade the connection's security). Whole versions of SSL/TLS have been deprecated after fundamental flaws were discovered; things like Heartbleed, POODLE, and Debian's low-entropy key debacle were all real things that made TLS much less secure than expected. An exit node operator that knew about these flaws prior to disclosure could've been having a heyday while users just said "Welp if I use HTTPS Everywhere it'll be fine".
Even without bugs, when TLS is ostensibly working completely properly, the trust model is frequently hijacked. See the CACert wiki [0] for a list of several dozen well-known attacks on CAs, many of which allowed imposters -- on multiple occasions state-level actors -- to issue fake certificates for specific domains, which a malicious exit node could inject.
The incontrovertible point is that using exit nodes exposes some prime attack surface to literally anyone, and yes, that's still attack surface, even if you're 1000% sure that your encryption is so super-duper strong that literally no one will ever be able to break it.
The exposure is real, the risk is real even if not necessarily always immediate, and it needs to be considered along with the other factors. Any risk analysis that involves accessing clearnet resources via Tor exit nodes should contemplate this.
The risks you're detailing are likely insignificant for 99% of users right now. Using TOR doesn't imply a specific threat model, and that notion weakens tor security and anonymity as a whole.
I can't personally understand buying in to such a service for a timespan measured in years.
If things sour over the course of that time, I’m probably only out a few bucks over the annual payment price.
It seemed pretty clear to me.
Ostensibly the "paid" portion of the criteria is a proxy for incentive to not do shady things like show ads or distribute malware.
There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens.
I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing.
I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards.
In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).