Re:Mozilla VPN
by r3trohack3r on Thursday June 18, 2020 @08:38PM
(#23569782)
HTTPS protects content. Content requires a warrant in the united states.
The bulk metadata programs, as far as we know, only collect metadata. Which two IP addresses communicated, the routes they took, the size of the payloads, etc. are all "metadata".
HTTPS, AFAIK, does not solve this.
Re:Mozilla VPN
by ccktlmazeltov on Friday June 19, 2020 @12:35PM
(#23576062)
Using a VPN adds indirection but can give you a sense of false security as well.
Metadata is obviously the least important data to analyze, but for example a VPN does not hide the size of payloads. TLS 1.3 do addresses that and let's you randomly pad messages but I don't think anybody use that.
You can use HTTPS with a VPN. With HSTS and certificate transparency, a modern browser will not let you get compromised by a HTTPS MITM.
I also trust many VPN providers more than my ISP, which actively engages in MITM like compressing images to be a lower resolution on HTTP pages on 4G networks.
If you do use a VPN to mask your traffic, there are two questions to ask yourself:
1. who are you masking your traffic from?
2. can you trust the VPN network more?
In general, you cannot trust a VPN network more, and HTTPS is the solution as it provides end-to-end encryption with some important caveats (web PKI)
Running your own VPN is not a good solution either, because who owns the servers where your VPN is running?