ISPs generally don't claim to protect your privacy at all [0]. So it would be foolish to trust them to do something they never claimed they would do. VPNs generally do claim they will protect your privacy so at least trusting them makes some amount of sense.

Going from "trusting" an entity that explicitly requires you to consent to spying when you sign up to trusting one which explicitly promises to protect your privacy when you sign up does seem like it would "help privacy" in most cases.

[0] https://www.privacypolicies.com/blog/isp-tracking-you/

A major difference between your ISP and a VPN is that your ISP is generally an established company based in the same jurisdiction as you are. So, if they do something terrible, in theory at least, they can be brought to court. A non-trivial number of VPNs that claim to protect your privacy, however, are based all around the world with unclear corporate structures. If they do something terrible, you likely have no recourse at all. How much faith you want to put in a promise made by such a company is up to you - but I would push back on the idea that simply making a promise really provides much value by itself.

> based in the same jurisdiction as you are

Why would I trust an entity that often has the legal backing to harvest my data and provide it to the government whenever they "deem" it necessary? The same government that has direct means of control over me? Whether it's the US, China, Germany, I think I'd rather put my chances with some private company that at least has financial and maybe ethical motivations (depending on the company) to protect my privacy. An ISP will only go as far as the law requires to protect it and who knows what backdoor deals are made with governments to subvert those same laws.

There is no realistic/helpful/useful legal process to sue over a breach of privacy. So my ISP being in my jurisdiction doesn't do me any good at all.

ISPs don't emphasize privacy in their marketing, but some large ISPs claim they protect it [0], although their claims are pretty dubious[0][1].

I think your logic holds up, but it's not quite as definitive as you say. VPNs are not the straightforward privacy upgrade that HTTPS is. (I don't think you were trying to imply otherwise.)

I think the picture improves if you choose more carefully. Choosing an established VPN that has a no-log policy and has been audited seems much better, because now multiple companies are putting their reputation on the line. On the other hand, I think a relatively unknown company that's reselling someone else's VPN and hoping to cash in on the "VPN = privacy" is only a slight upgrade over a major ISP.

[0]: https://www.latimes.com/business/story/2021-11-12/column-int... [1]: https://www.ftc.gov/system/files/documents/reports/look-what...

> VPNs don’t help privacy at all

Or course they do, I'm so tired of seeing posts like this when really what you mean is that it's not perfect privacy and therefore you don't like it.

> Or course they do

Let me compare an ISP spying vs a VPN spying:

1. You make DNS request about example.com. Your ISP sees this. Your ISP can see what websites you "might" visit.

2. You connect to 1.2.3.4. Your ISP sees this. Your ISP can see what websites you "did" visit.

3. You request some data and receive some data. Your ISP sees the size of the data. If it's not encrypted, it can also see the content. Your ISP can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents.

Okay so not using a VPN gives effectively zero privacy. Let's look at a VPN:

1. You connect to a VPN (and let's assume your connection doesn't "leak" insomuch as now _all_ network traffic goes through the VPN). Your ISP can see this.

2. You make DNS request about example.com. Your VPN sees this and your ISP can see a network packet. Your VPN can see what websites you "might" visit, your ISP can't.

2. You connect to 1.2.3.4. Your VPN sees this. Your VPN can see what websites you "did" visit. Your ISP still sees traffic to the VPN.

3. You request some data and receive some data. Your VPN sees the size of the data, and your ISP only sees the aggregate-size of data across all of your sessions. If it's not encrypted, your VPN can also see the content but your ISP should still only see aggregate size. Your VPN can see (at least) the size of objects that you requested -- which is enough to fingerprint many specific contents. Your ISP will have a tough time fingerprinting content from specific websites.

4. Your ISP can note that you have a high amount of traffic, possibly note that the traffic is going to a known VPN destination, and that your "normal" traffic is now gone.

Now, your VPN can see all the stuff that your ISP used to see. In addition, your ISP can now determine that you might be doing something illegal, suspicious, or at the very least "enterprise grade" and demand more money.

Have you really gained more privacy?

Your isp is legally resident in the country most likely to want to spy on you. There are also very few isps per country, so it's less work for the attacker to cover everyone they care about.

There are vast numbers of vpns, so total coverage is impossible. They are also very likely to be in a different legal jurisdiction so it's non trivial to do.

So, yes, you have, by making yourself a harder target despite having the same amount of centralisation on your part

Same with most VPN providers. Just expands the search from "ask ISP" to "ask ISP, they tell government its a VPN company, ask VPN company".

Now, sure, they could "just" delete logs, but their government can "just" tell them not to, or even tell them to live send the logs to them directly.

So it's really "which country's government you trust".

There's quite a few VPNs who have been asked to keep logs by the authorities but the VPN providers contest it in court, and since their jurisdiction laws don't need them to, the courts side with the VPN providers.

Mullad, OVPN are a couple.

What are your opinions on those? Not every country has laws like USA/India, which give the government free reign by citing certain Acts.

Adding that in general a country's law (data protection/privacy in this context) usually targets its own citizens; traffic related to foreign citizens (as in the case of VPNs) would for sure have a lower degree of protection.

my country has between 3 and 20 isp's per city. of a country of 7 million.

I assume they are just resellers, buying bulk data from a big carrier. Is that the case?

IDK about simplyinfinity, but here in NZ, the last mile of internet infrastructure (the fibre from homes to the exchange) is owned by regulated companies which must lease access to them at set rates or lower, and mustn't act as ISPs.

As such, we have dozens of ISPs with their own backend infrastructure, all sharing the same last-mile, and most available nation-wide.

That said, they're all going to be buying transit from a big backbone ISP to get overseas connectivity.

VPN and ISP are similar in term of middlemen, but there is an important difference downstream of said middlemen.

With your ISP, you appear on the internet as a residential IP that provides your approximate location and most likely doesn't change very often. The requests you make can be easily correlated by PRISM or any other middleman, or by any CDN running the websites you visit.

With a VPN, your exit IP is unrelated to your geographic location, changes very often, and hopefully it is shared among many more users.

Also you could use double VPN config from different VPN providers in separate geo locations with openDNS thrown in one of them. then it would be much harder to correlate your traffic out of the mix. its not about perfect secrecy its about becoming hard enough target.

GeoIP services are trash. My current IP on most GeoIP services gives a location >900 miles away. My last IP had a location in another country. I don't think I've ever had a GeoIP lookup resolve within 100 miles for any IP I've had.

> GeoIP services are trash.

GeoIP is only necessary when seeing a new IP. But once the IP starts to build a reputation, then the specific location can be determined. It's especially true if you buy something online.

My single data point observation is that it gets my city correct nearly 100% of the time and sometimes is able to resolve to a nearby suburb.

My several datapoints is wildly inconsistent and has never been within several hundred miles.

My office: suburb of Chicago My home: downtown Atlanta My friend's house: just outside Phoenix The McDonald's free WiFi: Chicago A church's WiFi: Some random location in Arkansas.

I'm in North Texas.

Just a few examples I've remembered since making a point to test while I'm out.

Based on that analysis, I say clearly yes! Privacy is about choosing who to share with, be it a specific group or no-one. Being able to share with a VPN of my choice (who, if reputable, shouldn't further disseminate my information) is likely a privacy gain compared to being forced to share with my ISP (many of whom would gladly sell my data).

Being able to choose to reveal data to Mullvad over Comcast or Verizon seems like a clear win to me.

Yea i really don't get these people. Frustratingly. Perfect is the enemy of good here. Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it.

At the very least i rob Comcast of my data. Which is my goal, after all. Not full privacy.

> Yes, full privacy is the goal, but i know certain actors are spying on me. If i can bypass them, i can at least attempt to improve it.

The problem is that it doesn’t actually change anything while giving a false sense of security.

Your VPN’s ‘improved’ privacy is just as worthless as the privacy you get with just your ISP. If something requires privacy, neither can be used, and if it doesn’t then why should it matter which one you use ?

Privacy is an on/off thing. Either you have it or you don’t. There is no in-between.

One wonders if you consider your bedroom to be private despite the fact that a peeping tom can still look through the window.

My VPN provider (Mullvad) doesn't have my full name, address, and social security number. They could build a profile off my account number, sure, so I have to trust that they're not. If they actually aren't, fantastic, I win. If they actually are, I still win, because they have less data to build a profile on me from. I know for certain that my ISP is selling my data, so I'm certainly no worse off.

On top of that, I get the benefit of not being tracked everywhere on the web. Or if they are tracking me, they have bogus data. And I can set my exit server to a jurisdiction with more user-friendly privacy laws.

Mullvad is just the first link in the chain of untrusted systems between you and whatever server you’re connecting to.

Also, what better place to tap traffic than the connection of a VPN provider.

> Also, what better place to tap traffic than the connection of a VPN provider.

Well, per my previous post, my ISP is definitely a better place. Hell, you don't even need to tap them. They'll just sell you the data, along with other PII. (Setting aside Mullvad' multi-hop support, which would require taps in multiple jurisdictions).

I think the point you're trying to make is that this isn't resilient to the NSA monitoring my traffic. I had hoped it was clear from my message that there's another level of privacy I'm concerned with related to intrusive private entities. I'm not expecting the GDPR or similar privacy laws to stop the NSA either, but they serve a useful purpose.

I guess I'm banking on Meta and Google not tapping Mullvad. Or even the RIAA or MPAA, for that matter. Because my ISP will very willingly give those entities data. And as long as unencrypted SNI is the norm, my ISP knows more than I want it to know about my browsing behavior. Not to mention the stuff that isn't HTTPS. Sure, Verizon knows I've established a connection an encrypted tunnel and how much bandwidth I routed through it, but that's a level of metadata I'm not concerned with.

So, yeah, Mullvad could be logging every packet through their tunnel. They could even assemble a profile based on my account and sell it to all the data brokers and advertising networks. They still don't have my SSN. Even if all of that happened, then I'm still no worse a situation than if I didn't use them because my ISP is doing those things. At worst, I'll be out 5€ for the month.

If you don’t trust your ISP, then why not simply switch to another one ? I literally have dozens of ISP’s to choose from at my address. Last time I checked there were 13 ISP’s offering fiber service alone, if you’re willing to settle for DSL or cable there a lot more options. And that is with me living in ‘socialist’ Europe. I can only dream of how many options people in ‘free market’ USA must have.

I have two viable options, ignoring 5G and satellite services. The one I'm on is the lesser of two evils. And I've largely neutralized the primary concern I have with the ISP I'm on.

Where would you like to move the goal posts now?

> I can only dream of how many options people in ‘free market’ USA must have.

I think you answered your own question.

> And that is with me living in ‘socialist’ Europe. I can only dream of how many options people in ‘free market’ USA must have.

I can feel the sarcasm dripping from this sentence.

This is quite a concrete illustration of the concept of the perfect being the enemy of the good. Thank you.

No... It's a demonstration of adherence the axiom "Don't let perfect be the enemy of good" being misapplied.

The "Good" (VPN) is exactly as imperfect as it's complete abscence. There has been no improvement whatsoever. Literally, as far as Privacy is concerned, nothing short of "No one actor has the capability to sit on a full stream of traffic", will suffice.

Either you're MITM'd or you aren't. Use malicious postmen if it makes it easier.

If you have the same guy come, and all of your mail goes through him, he can reconstruct all conversational state.

Now imagine you get a different malicious postman at random every day. He eacesdrops on every packet, but he's not privy to which of his fellows is scheduled to get the next packet. Therefore, it's not practicable to MITM in any practical way. This all goes out the window when someone controls the malicious postman scheduler, of course, because then they can figure out a map of who to go to to reconstruct your conversation.

The above is the concept behind Tor, and why the only effective counter to it is to run a hell of a lot of entry/exit nodes so you can conceivably time correlate given enough consecutive probe points are hit.

Russia has the ability to drop a nuke in the region you currently live in, so there's no such thing as safety and therefore why do you have locks on your doors?

i find this extremely doubtful. I see the point of your statement, but i'm willing to bet 99% of all the already built nuclear devices wouldn't work today. There's no way that they're all stored in such a way that the delicate mechanisms are protected from the environment and oxidization, moisture ingress, insects, heat and cold expansion and contraction.

That a nation could make a new device is arguable, that a nation could make a device that could be delivered without flying planes over another country is less arguable. Even nukes as they stand would only pose significant threats to certain parts of a country (there was a map floating around the web a few days back of areas of the US most susceptible to the - pardon the pun - fallout from a tactical strike.)

Especially when you consider that what they're really saying is that a VPN won't hide you from a state level actor.

Yeah, of course not, that's not nearly the only reason to use a VPN.

As others have mentioned you gained privacy from your government that has easy access to whatever information your ISP has but not towards a VPN provider.

But the information you leak towards your ISP or VPN isn't the only variable. With a VPN you leak less information to the services you interact with (e.g. your IP is hidden) which undoubtedly increases privacy.

> Now, your VPN can see all the stuff that your ISP used to see.

> Have you really gained more privacy?

Absolutely, 100%, unambiguously, yes; my ISP openly says that they monetize my data, my VPN says they don't. I'm very happy to gamble that the VPN is telling the truth when faced with the expectation that the ISP is telling the truth.

My VPN was unable to give the British government any logs or IPs relating to someone who emailed a series of bomb threats using them.

As terrible as that is, yeah I feel pretty safe pirating movies using it.

But you're right that blindly trusting a VPN without doing any research might be worse than blindly trusting your ISP.

VPNs entire business revolves around not giving up your data, that's why you pay them. ISP business revolves around protecting their monopoly which means making the government happy. Massively different incentives which means they will act differently. If VPN leaks data and people find out they're done. If ISP does nothing changes for them.

> your ISP can now determine that you might be doing something illegal, suspicious

and my neighbours can determine I might be doing something illegal when I close my curtains, sure.

> Have you really gained more privacy?

No, but you have lost less privacy.

The amount of loss of privacy you incur when some particular item of personal information about you is revealed to another party often depends on how much other information that party has about you.

If the ISP is legally protected from any inquiry or transparency into what they do with the data and is systematically incompetent about protecting it and the vpn exists in a country with good privacy laws, then yeah.

You increased the number of choices you can make regarding your privacy.

Of course they do? They are a tool that routes traffic through a third party. That can be anywhere from terrible to fantastic for privacy, with everything in between. There's nothing "of course" about it.

One of the main use cases today for VPNs is to pirate movies or access geo-blocked content. That and dodgy hotel wifi.

The adversary is netflix or a IP rights enforcement company, and the user doesn't care what their ISP or a state could observe.

For what they are used for, they are fine. If you are worried about state or megacorp spying, the solution is less technical and more political.

No as a rule.

They just replace your ISP with a VPN company. Which is the two is more shady is something you have to figure out, keeping in mind that a subsection of the internet just stops working or turns the aggressiveness of their anti-bot protections up to the maximum on a VPN.

While traveling I've used my own VPN hosted at home to provide additional security.

It allows me to trust only my ISP instead of every ISP in various coffee shops.

I would reverse that assertion under the one condition that you don't use a VPN provider from your own country. In Australia at least, ISPs are legally required to maintain logs of everything you access for several years. By choosing to trust a VPN provider outside of Australia, you defacto have better privacy than you otherwise would have.

Does the VPN company have a business presence in Australia? If so, then maybe you haven't gained as much as you think...

Absolutely true. The VPN provider's servers and business must be outside of your country.

https://www.ivpn.net/ see "Do you really need a VPN?" - not affiliated with them, but tell me any other VPN-service that is actually this upfront... most are marketing the hell out of their apparent magic effects...

since we're on the topic: how is it still a thing that vpn services are actively pitching content-block/copyright circumvention? Seems weird to pitch something as shady this loud and publicly? Reminds me of how weird I find it that trackers and illegal hosting sites have twitter accounts...

I'd say they're still a net win, generally. The ISP vs VPN service tracking who does cancel out (if you ignore privacy claims of VPN providers, vs ISPs generally not guaranteeing that at all), but for every other service I might consume, when I'm on VPN I'm no longer connecting from a unique IP that can have other identifying information tagged to it.

To add to that: in Sweden (which is generally pretty ok in regards to privacy and rights) ISPs are required to store traffic for 6 months, while VPN providers are not.

Wasn't this struck down by the EU recently?

>VPNs don’t help privacy at all.

1. They keep your data safe from your ISP. 2. They keep your IP hidden to the sites you browse.

Those two clearly "help" privacy.

They also expose your data to the VPN operator. That's a negative on privacy. Whether it's a net negative or positive depends on the VPN operator and ISP involved.

The VPN provider could be you hosted somewhere using bitcoin.

I think the only good reasons to use VPNs are for torrenting and accessing movies only available in other countries. For any privacy reasons its best to use Tor.

In Germany (according to TTDSG) an ISP does not have to claim that. They need explicit permission to track you. It is pretty much as the post does not have to claim that they open your envelopes.

> VPNs don’t help privacy at all.

> For some, that may be good, but for most others it’s a wash.

That sounds less like "VPNs don’t help privacy at all" and more like "VPNs are helpful some of the time".

I believe it is harder for my government to get my data from a foreign VPN service than from my local oligopoly ISP that is already effectively an arm of the government.

It is not just about your ISP though. Your IP is getting sent to whatever website you are connecting to. People won't always trust that website.

VPNs help against geolocation and geofencing though.

VPNs don't anonymize, they just route you through an anonymizing service. Lol.

They help in public WiFi.

Public wifi, assuming you don't send any personal info to "sign in" to the public wifi is more anonymous than a vpn that has your name/address/etc.

Modern TLS is enough to prevent others from eavesdropping everything except domain names when on public WiFi. Domain names are sent in clear text if your client supports SNI.

A trail of DNS names is more than enough to know what somebody is up to.

You could use DoH, which you should do anyway. No reason to leak DNS lookups to anyone.

DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain text. Some day ECH (formerly, eSNI) should help with that.

I thought TLSv1.3 already encrypted the SNI?

No. ESNI is an later-created extension to TLS 1.3

It does

ESNI is not implemented yet on any website. And there is no software support except beta versions of Chrome/Edge and you have to manually toggle flags in dev mode.

All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.

you'll always be leaking it to whoever you are sending your query to.

So I can pay $10/mo for a VPN for use when I'm on public wifi, or I can run WireGuard on my Raspberry Pi at home and get one for free

It might be cheaper but still not free. Cost of electricity + time to maintain + Raspberry Pi itself. Not to mention that you don't get the variety of servers (for geo-location or more diverse networks not tracked to you by websites themselves).

Well the Raspberry Pi is already on 24/7 running a few other services for my home network. But even then, the energy consumption per month costs pennies. I update the device once a quarter and it takes me 5 minutes. These costs are so negligible as to have no impact on my decision making process.

Not sure what services you’ve looked at, but it definitely doesn’t cost $10/month.

Your personal solution seems pretty good though.

Unless you are a network security expert, aren't you greatly increasing your risk by running that WireGuard server?

Why would you? Nobody can connect to it without your private key. Or is there something I am not aware of? Genuine question, as I am running wireguard in a few places and thought it was secure by default.

WireGuard is pretty minimalist and has great defaults, AFAIK if you manage to set it up you're good.

Unless your credentials leak, of course, but a security expert would have that same risk.

You do not need to be a "network security expert" to safely run a WireGuard server