Are you worried about parts of the TLS handshake being intercepted, or something? Because even then that's non-sensitive information like public keys and cipher lists and stuff, no? Or are we worried about side-channel attacks, or weak ciphers being chosen?

Just curious about your reasoning for why TLS alone isn't sufficient.

He's probably worried about those places looking at the sites he connects to, data sizes and other kinds of metadata.

But also, there are plenty of sites around with broken TLS that can be intercepted by a man in the middle.

Speaking of which, can anyone recommend a good VPN provider?

TorrentFreak has a regular round-up of VPNs:

http://torrentfreak.com/which-vpn-services-take-your-anonymi...

The comments are probably as useful as the main content.

Personally I use AirVPN. They're not expensive, the client is open source, and performance seems good enough for casual use.

I'm not sure I'd trust any of the usual VPNs if I needed Snowden-level security. But I don't, so casual use is fine.

I've used blackVPN and IPredator in the past. Running openvpn on your own box is pretty easy too (if you've ever set up something like a HTTPS server.)

PIA has never done me wrong, it's cheap, they support a ton of VPN protocols and OSes, multiple simultaneous clients (up to 5?), and at least one of the guys who runs it is a HN regular.

More in this thread: https://news.ycombinator.com/item?id=6345520

Not affiliated in any way, just a happy customer.

Run your own for a few bucks a month! Here's a guide to setting OpenVPN up on an Ubuntu machine:

https://www.digitalocean.com/community/tutorials/how-to-set-...