NBC: 'You Probably Don't Need to Rely on a VPN Anymore' (nbcnews.com) 166
NBC News writes:
VPNs, or virtual private networks, continue to be used by millions of people as a way of masking their internet activity by encrypting their location and web traffic. But on the modern internet, most people can safely ditch them, thanks to the widespread use of encryption that has made public internet connections far less of a security threat, cybersecurity experts say. "Most commercial VPNs are snake oil from a security standpoint," said Nicholas Weaver, a cybersecurity lecturer at the University of California, Berkeley. "They don't improve your security at all...."
Most browsers have quietly implemented an added layer of security in recent years that automatically encrypts internet traffic at most sites with a technology called HTTPS. Indicated by a tiny padlock by the URL, the presence of HTTPS means that worrisome scenario, in which a scammer or a hacker squats on a public Wi-Fi connection in order to watch people's internet habits, isn't feasible. It's not clear that the threat of a hacker at your coffee shop was ever that real to begin with, but it is certainly not a major danger now, Weaver said. "Remember, someone attacking you at the coffee shop needs to be basically at the coffee shop," he said. "I don't know of them ever being used outside of pranks. And those are all irrelevant now with most sites using HTTPS," he said in a text message.
There are still valid uses for VPNs. They're an invaluable tool for getting around certain types of censorship, though other options also exist, such as the Tor Browser, a free web browser that automatically reroutes users' traffic and is widely praised by cybersecurity experts. VPNs are also vital for businesses that need their employees to log in remotely to their internal network. And they're a popular and effective way to watch television shows and movies that are restricted to particular countries on streaming services. But like with antivirus software, the paid VPN industry is a booming global market despite its core mission no longer being necessary for many people.
Most VPNs market their products as a security tool. A Consumer Reports investigation published earlier this month found that 12 of the 16 biggest VPNs make hyperbolic claims or mislead customers about their security benefits. And many can make things worse, either by selling customers' browsing history to data brokers, or by having poor cybersecurity.
The article credits the Electronic Frontier Foundation for popularizing encryption through browser extensions and web site certificates starting in 2010. "In 2015, Google started prioritizing websites that enabled HTTPS in its search results. More and more websites started offering HTTPS connections, and now practically all sites that Google links to do so.
"Since late 2020, major browsers such as Brave, Chrome, Firefox, Safari and Edge all built HTTPS into their programs, making Electronic Frontier Foundation's browser extension no longer necessary for most people."
Most browsers have quietly implemented an added layer of security in recent years that automatically encrypts internet traffic at most sites with a technology called HTTPS. Indicated by a tiny padlock by the URL, the presence of HTTPS means that worrisome scenario, in which a scammer or a hacker squats on a public Wi-Fi connection in order to watch people's internet habits, isn't feasible. It's not clear that the threat of a hacker at your coffee shop was ever that real to begin with, but it is certainly not a major danger now, Weaver said. "Remember, someone attacking you at the coffee shop needs to be basically at the coffee shop," he said. "I don't know of them ever being used outside of pranks. And those are all irrelevant now with most sites using HTTPS," he said in a text message.
There are still valid uses for VPNs. They're an invaluable tool for getting around certain types of censorship, though other options also exist, such as the Tor Browser, a free web browser that automatically reroutes users' traffic and is widely praised by cybersecurity experts. VPNs are also vital for businesses that need their employees to log in remotely to their internal network. And they're a popular and effective way to watch television shows and movies that are restricted to particular countries on streaming services. But like with antivirus software, the paid VPN industry is a booming global market despite its core mission no longer being necessary for many people.
Most VPNs market their products as a security tool. A Consumer Reports investigation published earlier this month found that 12 of the 16 biggest VPNs make hyperbolic claims or mislead customers about their security benefits. And many can make things worse, either by selling customers' browsing history to data brokers, or by having poor cybersecurity.
The article credits the Electronic Frontier Foundation for popularizing encryption through browser extensions and web site certificates starting in 2010. "In 2015, Google started prioritizing websites that enabled HTTPS in its search results. More and more websites started offering HTTPS connections, and now practically all sites that Google links to do so.
"Since late 2020, major browsers such as Brave, Chrome, Firefox, Safari and Edge all built HTTPS into their programs, making Electronic Frontier Foundation's browser extension no longer necessary for most people."
VPNs are just for evading geo-restrictions (Score:5, Informative)
But these days the selling point of VPNs is mostly to access services that, for whatever bad reason, are made inaccessible from certain regions of the world. Including ordinary entertainment with country-specific licensing issues or adult entertainment.
Re:VPNs are just for evading geo-restrictions (Score:5, Informative)
VPN services are about anonymity not security. The "protect yourself at the coffee shop" scenario was false even before widespread encryption. You use a VPN service when you don't want anybody who knows your real identity to know what you're up to. Nothing about their protection of anonymity has changed.
VPNs for access to work and things like that are an entirely different ball game. Anyone who says they don't enhance security doesn't understand security worth a whit. Security is all about attack surface and defense in depth. If hacker has to breach the VPN before he can attempt to breach the interior resources the initial attack surface is tiny: the well hardened VPN. And that tiny attack surface is an extra layer of defense for the resources sitting behind it.
Re: (Score:2)
Re: (Score:3)
Work VPN is not something you buy from the likes of NordVPN or any of the other ones, probably owned by the same parent company, that get advertised constantly.
You either buy some box to put in the server room at your office or install some software on a computer with 2 network cards, and put that in your server room. This is a completely different market, and not what this article is about.
Re: (Score:2)
The "protect yourself at the coffee shop" scenario was false even before widespread encryption.
No, it was not. If you were on an unencrypted WiFi network before the rise of encrypted protocols then people could gather useful data from your communications just by sniffing. And even if you were connecting to an encrypted network, someone else could set up their own AP which spoofed the one you thought you were connecting to, and have access to your full unencrypted connection and all your packets. Before widespread encryption, a VPN absolutely would improve your security when connected to a coffeeshop
Re: VPNs are just for evading geo-restrictions (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
At least with Mullvad I can buy a prepaid number account with cash, that is not tied to any credit card, email address, phone number or anything. I can also buy a prepaid cash 4G SIM, a cheap 4G dongle, and a Raspberry Pi 4 or something, and there we go.
Re: (Score:2)
This was also a time before casual users had ever heard of the term VPN. It has always been non-news.
Re: VPNs are just for evading geo-restrictions (Score:2)
Re: (Score:2)
A lot of these companies have been caught performing verbose logging of users or VPN companies are fronts for malicious state actors. (so they can vacuum up users traffic logs)
THIS! VPNs are really good only for working around geo-blocking.
Re: (Score:2, Troll)
Evading geo restrictions qualifies as a form of circumvention of a technological barrier or protection measure that the licensed distrubutors have put on a copyrighted work, and depending on regional laws, can actually be illegal.
Fortunately for the vpn user, and contrary to the above assertion, there are enough entirely legal use cases for VPN usage that simply using a VPN usually does not provide probable cause for any investigation.
What is probably true, however, is that most of the legal use cases
Re:VPNs are just for evading geo-restrictions (Score:5, Interesting)
Re:VPNs are just for evading geo-restrictions (Score:5, Interesting)
Not explicitly, no.
But geo restrictions are a technological barrier put in place by the distributors of the copyrighted content to control its distribution, and evading those restrictions would most definitely qualify as circumvention of that measure. The DMCA in the USA, for example, outlaws such circumvention, and would ordinarily implicitly render evading geo restrictions illegal. However, this isn't an actual issue because geo restrictions are typically on a nation wide level, and national laws do not govern other countries. It would only come into play if *BOTH* of the involved nations had laws resembling the DMCA in this regard. The sheer difficulty of identifying such use, however, renders it impractical to try to enforce it on anything less than corporate levels.
But that doesn't mean it's legal to to it on an individual level, it just means that the expense of identifying and verifying such individual cases far outweighs what can reasonably be gained by stopping them.
Re: (Score:3)
The DMCA in the USA, for example, outlaws such circumvention, and would ordinarily implicitly render evading geo restrictions illegal.
No it does not in the slightest. The circumvention outlawed is exclusively messing with a content stream that is given to you. It in no way outlaws lying about who you are so that a different content stream is provided to you.
You can't break the encryption used for geoblocking, but you are legally within your right to pretend to be somewhere else. The two are very different things, and no one has ever been DMCA'd for changing the region code on their DVD player (for example) much less for using a VPN.
Re: (Score:2)
Correct. It's the content providers who are liable, for distributing content outside of their licensed region. This is why most of the content providers have at least rudimentary bare-minimum anti-VPN measures - but not so restrictive that it keeps paying customers from easily getting around them.
Re: (Score:2)
The list of such countries is available at https://en.wikipedia.org/wiki/... [wikipedia.org] It's nearly all nations of the world, many of which have signed the WIPO clauses of the Berne Convention.
what about hotel room proxies (Score:3)
Many public wifi have some sort of dns redirects and proxies. Can I really trust https to not be vulnerable to man in the middle attacks under those conditions? Even specifying the DNS by IP address rather than trusting the wifi dhcp to provide DNS doesn't assure that 8.8.8.8 or any common DNS isn't being redirected. It seems like the way around this surely requires so pre-established shared secret. Or am I wrong? Does https really provide some zero config zero knowledge way to avoid a man in the middle
Comment removed (Score:5, Interesting)
Re:what about hotel room proxies (Score:4, Interesting)
There are major DoH servers operated by Cloudflare and Google (you get to choose.)
This protects privacy.
Not really. It just puts my browsing habits in the hands of Cloudflare and Google. Google is all about monetizing the user. And Cloudflare isn't far behind. They might not be scraping browsing habits directly. But they are the ones that create the "Checking your browser" popup if you turn on ad blockers or block JavaScript from certain sites.
If you use a VPN, those browsing habits are harder to track. Since they no longer know who or where you are by your IP.
Re: (Score:2)
This.
Let me know when I can update my Bind9 config to provide my own DNS over HTTPS ...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The unique SSL connections for DNS over HTTPS make DNS lookups from behind a NAT uniquely identifiable. They should not be considered a security enhancement for most of us, though the lack of encryption of the traffic does permit more untargeted monitoring in a NAT based environment.
Re: (Score:2)
Checking your browser
Perhaps the difference won't mean much in the grand scheme of things, but Cloudflare does that because site owners configure it. The end-user isn't attempting to use Cloudflare, they probably don't even know it exists. Contrast that with Google services, where the user is intentionally accessing Google.
Again, it might not mean much, but we can't ignore the distinction. Cloudflare isn't something an end-user chooses to use. Blame the site owners who put their content behind it.
Re: (Score:2)
Because all of the implementations are set up to be routed through the software provider, not user configurable. And most of that at the browser level, so it has to be configured per-application. It seems that Windows 11 has DoH at the OS-level, but even there it only works with a list of hard-coded preselected DoH providers. If it were really in the name of security, then the push would be going in a completely different direction.
Re: (Score:2)
Most people are ignorant about computer security. (Score:2)
Re: Most people are ignorant about computer securi (Score:3, Informative)
> For people who think VPN and HTTPS solve the same problems
Most VPNs *are* TLS (SSL) connections. Precisely the same as https, which simply means making a TLS connection and then using it for http.
From a SECURITY standpoint, they are precisely the same thing.
If the "problem" you're wanting to solve is getting US pricing the EU or vice versa, sure. You can use a VPN service to "hide" your geographic region from service providers who don't give a shit and allow that.
Ps - you aren't hiding squat. Netflix e
Re: (Score:3)
It's even simpler than that. It would be easier and cheaper to use the customer's billing address than their IP address for geoblocking. That they don't is very telling.
Pro tip (Score:5, Funny)
Pro tip: When calling a professional "retarted", try to learn English well enough to make fewer screw ups than the number of words you use. When you use two words and screw it up four different ways, it doesn't have the same impact for *you* to call someone else "retarted".
Two words; four screw ups. That might be a Slashdot record.
Re: (Score:3)
Maybe he simply thinks the GP has returned to being a sweet pastry?
Re: (Score:2)
Re: (Score:3)
welcome to civilization: you probably don't understand all the intricacies of making bread and cheese, which are actually pretty straightforward, so you pay someone else to provide actual bread and cheese instead of eating dry grain and sucking on a cow's tit, and here's the news: you get to consume shit quality bread and cheese which is most likely even bad for your health.
btw, private vpn never have solved any "security" problem whatsoever, specially if you really had something to worry about, they basica
Re: (Score:2)
Problem is a lot of VPN advertising takes advantage of that lack of knowledge, and so an article has to be written to that same level. VPN providers have advertising that suggest they are required to protect your banking information when you access your bank, for example.
The only valid application of these third party vpn services is masknig your geography to get different streaming services than you would normally be allowed.
VPNs are valid for corporate use, mainly because non-VPN encapsulation isn't done
Re: Most people are ignorant about computer securi (Score:2)
The article is painful to read.
This is the case for 99% of all articles published by journalists on any topic whatsoever. If the reader actually knows the topic a journalist is (trying to) talk about, no matter what that topic is, the feeling of cringiness and the face-palming are exactly the same.
Reading these awful technical articles is always good for reminding us that journalists aren't conspiring, or even necessarily biased, when they write this or that. They're just complete laymen trying to talk about stuff that's way, way over th
The CONTENT of connection vs. the FACT of it (Score:5, Informative)
VPNs not only hide the content of your traffic, they also hide the very fact, that you're accessing a particular site from your immediate connectivity-provider.
That is important to a number of people, especially those fearing oppression by powerful entities (such as governments), which are capable of compelling the ISPs to divulge details about your traffic.
That is, they may not know your particular kinks, if you access Porhohub over HTTPS, but they will know, you visited Pornohub — and how many times. Using VPN hides that from the ISP — though, obviously, not from the VPN-provider...
Dozens of VPN companies are one guy (Score:2)
You're trading reducing the information available to your ISP and instead providing that information to the guy who runs more than 20 different VPN brands.
He may or may not be routing all the "different" VPNs through the exact same AWS servers.
He could make your own guesses as to why he's so interested in your "private" traffic.
Re:Dozens of VPN companies are one guy (Score:5, Informative)
You're trading reducing the information available to your ISP and instead providing that information to the guy who runs more than 20 different VPN brands.
The cops can get a warrant for my local ISP. They can't do that for a VPN located outside their jurisdiction.
Re:Dozens of VPN companies are one guy (Score:5, Interesting)
Imagine YOU were on the FBI cybersecurity task force, and because you're the rookie you have to work New Years, sitting there with nothing to do since everyone else is off. It's your job to figure out what the bad guys are doing online.
Would YOU perhaps pass the time by throwing another dozen Wordpress templates up, to advertise another dozen VPN brands in order to get all the criminals to send all their traffic to your monitoring servers? Knowing, of course, that with your VPN don't NEED a warrant for traffic that people *choose* to send you.
Yeah, so would I. If I were working for the FBI, I'd have about 300 different VPN brands by now, putting up a few more whenever I'm bored for an hour. Most of the "smart" bad guys would be using one or more of my VPNs, sending all their traffic right to me. No warrant needed when the bad guys sign up to send the info to you.
Re: (Score:2)
If I were working for the FBI, I'd have about 300 different VPN brands by now, putting up a few more whenever I'm bored for an hour.
And if they want to blow their cover to get me for downloading Matrix Resurrections then they will have 299. Probably not cost effective, but thanks to them I don't get nasty emails from the MPAA/RIAA anymore, so good job in any case!
Re:Dozens of VPN companies are one guy (Score:5, Funny)
Imagine YOU were on the FBI cybersecurity task force,
That sounds like the worst Choose your own adventure book ever.
Re: (Score:2)
Naw, man. They've got other Network Investigative Techniques [zdnet.com] (aka malware). Why create a VPN when you can create a honeypot?
New to this planet? (Score:2)
> If the FBI wanted to run a VPN, and assuming they kept the logs secured, so some state hacker couldn't snatch them
US government workers keep things secure? Secure against state-level attacks? Remember the IT folks working for the government for $50K are people who couldn't get a job in the private sector, which paays twice as much.
Re: (Score:2)
If the acts of 2 "rogue" FBI agents proves the whole FBI is "the worst evil in the world"; then do you agree that a few "rogue" police officers that murder unarmed suspects proves that police are evil and the group as a whole needs addressing?
Re: (Score:2)
Re: (Score:2)
No, I don't. And the marketing strategies are irrelevant to the topic.
But, yes, it is a choice of whom you trust...
Re: (Score:3)
I trust me.
Well, you made it easier to track you (Score:5, Informative)
I wrote the software that thousands of web sites use to track subscribers for fraud prevention. Meaning we tracked millions and millions of users. For example, if you log in from Arizona every evening around 7PM using Linux, then at 3AM somebody using Windows from Turkey claims to be, the system knows that's suspicious - it's probably not really you.
Coming from the perspective of having actually tracked millions of people for many years, let me ask you a question:
Does the IP of your VPS change every few minutes?
If not, here's the effect of what you've done. Instead of Google or Facebook or whatever having this record for you:
ID IP IncomeBracket Hobby1
9082 xyz.yy.z.w.z 12 Electronics
They instead of this record:
ID IP IncomeBracket Hobby1
9082 zyz.yy.z.zw 12 Electronics
You've changed the IP. That's all.
Well, changed the IP and probably made it more stable, ESPECIALLY if you use your VPS from your phone. Phones change IPs constantly. Routing the traffic from your phone through the VPS, you've switched from having your IP change every 60 or so to instead having a nice stable IP that lasts for months or years - far easier to track you that way.
Those of us with a reason to track appreciate that you've picked that nice stable IP, and stayed away from the messy residential ISP IPs that have so much turnover.
Re: (Score:2)
Re: (Score:2)
Phones change IPs constantly.
IncomeBracket and Hobby1 are estimated by the behaviors of what? Even if my behavior in IP1 and IP2 was the same, I'd express different facets at different times.
But man. You are amazingly certain that the databases use the IP address as the fingerprint.
Any sane heap would make multiple UIDs based on multiple fingerprints, with confidence pooling. Your own post describes why only a dumbfuck would rely on that alone, when many other fingerprints would make your "constantly changing IP" phone trivial to track
Lots folks using Windows (Score:4, Informative)
You are absolutely right that things like user agent can be used, and are. Along with lots of others things. Unfortunately most of them are strongly correlated. If you're using the iphone browser, you probably have the iphone fonts, you're running one of two popular iphone screen resolutions, etc. So while the list is long, it's largely a long list of ways to figure out it's an iphone. Or a Windows 10 box, with the Windows 10 fonts. That's why IP is very useful.
Re: Dozens of VPN companies are one guy (Score:3)
Ignoring that your VPS is brought and paid for with real money that ties it right back to you.
Even if you paid in shitcoin your real IP connects to your VPS and is one demand letter away from finding your real identity.
There's safety in numbers on one of the few reputable VPN brands like Mullvad or Proton.
Re: (Score:2)
Re: (Score:2)
There are also a lot of other great uses for them, like:
- Download torrents without having to worry about DMCA letters
- Evade IP bans so you can openly troll reddit
- Evade geoblocks so you can watch whatever you want on netflix
- Leak Hillary's emails to the public without having to worry about being disappeared
Re: The CONTENT of connection vs. the FACT of it (Score:2)
However the vpn provider does know about it and then you don't know anyway if your activities are known.
Obviously (Score:2)
This is so blatantly obvious that one wonders how it might be lost on NBC.
It would surprise me one bit to learn that NBC is publishing this "news" on behalf of the FBI, DOJ etc. to discourage VPN use.
Re:The CONTENT of connection vs. the FACT of it (Score:5, Insightful)
if you access Porhohub over HTTPS, but they will know, you visited Pornohub — and how many times. Using VPN hides that from the ISP — though, obviously, not from the VPN-provider...
Most importantly, it also hides it from the remote site. This is especially important if the remote site is a honeypot or some other site a government compromises. For instance, if you post something illegal in your country on social media. If you connect from local ISP to VPN to remote site, the remote site doesn't know where you originated from. Without a VPN, the remote site knows your local IP and then the government just needs to ask your local ISP who you are. With a VPN, they first have to gain access to the VPN records if they exist before jumping to the next step. This is where TOR or the classic movie trick of multiple relays becomes useful. If you have multiple relays between you and the remote site, the records of the remote site only points to the first relay. They then need to compromise that relay which only gives information on the second relay, etc... It makes it even harder if the intermediate relays are in different jurisdictions. In order to trace something back to the origin, you have to gain access to logs on every relay in the path (or some identifying information like billing information from one of the relays) in order to connect it back to the original person.
Re: (Score:3)
A VPN is just another tool in the tool box. and like any other tool it has its uses. The basic thing a that a VPN does is keep you from being "low hanging fruit." If you are using it on a public wifi it keeps the evil hacker at bay and lets you circumvent stupid ass restrictions, they have on them.
If you chose to use it for copy right restricted material then by dropping your exit point in another country it makes it almost impossible for the copy right police to peg you. Not impossible but very di
Re: (Score:2)
In the US they don't... (And only until you run for office or otherwise make publicly embarrassing you worthwhile.)
But pornography was just an example. "Hate speech" — already illegal in many otherwise reasonable places [wikipedia.org] — is another.
You need VPN to hide what you are doing (metadata) (Score:2)
You need VPN to hide metadata as well as possible from your connections.
Re: (Score:3)
Re:You need VPN to hide what you are doing (metada (Score:5, Informative)
The claim that it's a hoax is not supported by the facts.
Re: (Score:3)
If such "facts" exist, then where are they? Is this one of those things where "it will be revealed in two weeks" like all of the other alleged "facts"? I see a lot of meetings with Russians and a lot of Russian money (by their own admission). Your alleged "facts" will need to account for an awful lot of smoke.
I await your excuses for why you can't present anything.
Re: (Score:2)
The only debate is whether there is sufficient plausible deniability. I'm sure there was some effort to ensure that. There certainly wasn't any effort to counteract or call out propaganda that was not domestic in origin.
Herald LetsEncrypt (Score:2)
The internet being SSL-encrypted was due in one part to LetsEncrypt, and another part AES encryption becoming baked into CPUs.
Without either of those two things, it would still not be viable for the majority of sites to provide SSL.
Re: Herald LetsEncrypt (Score:2)
Re: (Score:2)
Startcom ended up being a real mess but was free and trusted for a while.
Piracy (Score:5, Insightful)
While I realize there are places outside the USA where geographic restrictions and censorship may come into play, here commercial VPN services are mostly used to avoid getting a copyright nastygram from your ISP when using P2P networks for pirating. For that use case, a VPN absolutely is still necessary, because the RIAA/MPAA and their lawyers absolutely have stepped up their game in sending out copyright violation notices.
Of course, I can’t see a major television network wanting to include that little bit of info in their article.
Re: (Score:2)
You certainly can't trust any VPN (Score:2)
That's one thing that's been certain for years.
VPN are good enough to evade IP geolocation. Beyond that... Well you know, being tracked, sold out, monetized or having your creds lost to hackers by your ISP or by your VPN? That's the agony of choice.
Translation (Score:4, Insightful)
Your use of VPNs to obfuscate your location is messing up our value to advertisers.
"In recent years"? (Score:2)
Maybe I'll be charitable and assume the writer meant "https by default" rather than https in general - which has been around next to forever (in internet years) [ietf.org]. But, still - I expect that most of those "millions of people" who use VPNs are not really doing it for security reasons; they're doing it to get a geofenced media.
Lord knows, anyone trusting a cheap VPN provider to provide "security" is not really thinking things through.
Re: (Score:2)
Yeah, if you're going to clarify why VPN is security snake-oil, don't add your own browser snake-oil. Https has been around since last millennium. About a thousand years in internet time.
Two things have changed.... ubiquitous SSL/TLS on web servers, and HTTPS by default in browsers: even if you deliberately choose http:/// [http] the browser will switch to https:/// [https] if it's available on the server.
It is not about only traffic encryption (Score:5, Interesting)
While one of the benefits of VPN is traffic encryption, it is also about some other things. Geolocation is a thing. If you are doing anything legally questionable, or even legal but intentional (like penetration testing a client), VPNs still make sense as it basically makes your traffic look like it is coming from some place else. It is annoying as fuck to me that I browse to a site, even with noscript and 4 other privacy add-ons, the site knows where I live based on my IP, and makes assumptions of the closest stores, and inventory when I browse for information. This is not helpful to me most of the time and if I actually want to buy something, I will sign in and you can get that info then. Even telling the browser to block all requests for access to location, doesn't stop sites from doing that.
I have a VM setup for all my "alternate" browsing that is where my VPN is installed. I do all my p2p, all my other things in that VM. I don't care as much if the home depot knows I am in my city and browsing storm doors. There are some things that I want to keep private however and those things I use that VM and VPN.
No need to whisper, police say (Score:2)
With the recent Advent of Technology that can replace ears, the police have just announced that it's no longer worthwhile to whisper when discussing illegal activities. You should now be shouting it out loud.
VPNs are useful....for some things. (Score:2)
VPNs are useful in the following scenarios:
When using a VPN, you are basically
Re: (Score:2)
Not just whether the coffee shop or their provider is evil, but whether they've been compromised. Someone can remotely compromise the shop's router and set up a proxy with a wildcard certificate that'll MiTM all SSL traffic without ever setting foot on the same continent. If the router is vulnerable at all, a botnet has undoubtedly already compromised it.
For cases where you're worried about the VPN provider tracking or intercepting information, it's feasible to get a low-end VM and run one of the turnkey VP
Comcast (Score:4, Insightful)
Re: (Score:3)
Re: (Score:3)
Yes, from the owners of COMCAST. If you use a VPN on their network, they cannot see what sites you are visiting. So they are loosing some $ because they cannot sell your info.
That makes a lot of sense. Especially as they apparently are allowed to sniff your traffic. In Europe that would be a criminal act without a court order. With encrypted connections they still see where you are going most of the time.
Security leaks (Score:2)
I don't give a fuck to the man-in-the-middle (Score:2)
I don't want the man on the end to know who I am.
Uses for VPNs in 2022 (Score:5, Insightful)
The NBC commentard seems to forget that the USoA is not the world.
+ The dominant ISP in these parts (and in many other countries is the same) is owned by the Govt. This ISP is known to spy on people (mostly PEPs, but you can never known when you are a target), including, but not limited to MitM attacks. A VPN is great in that situation.
+ Here, people do not have much money, and data plans here are costly and heavily capped, so they tend to try and get free WiFi, with the known risks (MitM attacks in particular). A VPN can help you a lot with that.
PS: the Govt. here runs one of the largest Free WiFi NWs, so even if you have an alternative ISP at home, when you are out and about, you are game for spying and MitM.
+ The dominant ISP here censors many sites disenting to the Govt. and the Govt. agency analogous to the FCC forces the other ISPs to censor the same sites too (I am certain this is true in many other parts). To evade that censorship, a VPN is a useful tool.
+ Also, most of the media here (by number of open RF tv channels, radio stations, as well as newspapers) is dominated by Govt. media, so, evading censorship and geting alernatives, is doubly important.
+ I guess this one is true all over the world, but ISPs thend to gather metadata about what you do online. If you are not OK with that, a VPN will mask your online habits supper well, the only thing your ISP will know about your browsing, is that you love a certain VPN.
Need more reasons to use a VPN in 2022?
Beyond pranks (Score:2)
"Remember, someone attacking you at the coffee shop needs to be basically at the coffee shop," he said. "I don't know of them ever being used outside of pranks
An industrial spy looking for a specific target would do that too.
Re: (Score:2)
Indeed. And that "coffee shop" may well be your home or company where the attacker got in via an insecure or wrongly configured router or the like.
"Powered by Admiral" (Score:2)
VPNs are definitely useful... (Score:2)
VPNs (even the big name commercial VPNs like Surfshark, NordVPN etc that every YouTuber seems to have sponsorship from these days for whatever reason) are definitely useful, just not for the things that people think they are (or that the VPN providers claim they are).
They are useful for:
1.To get around censorship and site blocking by ISPs or other entities between you and the place you want to visit
2.To make your connection look like its comming from a specific country or network in order to access things t
Re: (Score:2)
They are NOT useful for hiding credit card numbers, phone numbers, addresses or other private/personal information from attackers.
If the site you are visiting uses HTTPS then that's already hiding the information and the VPN is adding no extra security. If the site you are visiting isn't using HTTPS then any security the VPN may be providing will not protect that data.
Not quite accurate. First, sniffing for credit-card numbers and private information is typically done close to the client, on a compromised client or on a compromised server. For sniffing close to the client (access router, for example) a VPN from the client helps for the case that something is not encrypted. For the other two cases, it does not help, so it is not suitable as the only mechanisms. It does increase your security level for this use case though.
Also remember that your credit-card number, etc. m
so much wrong... (Score:3)
...in that article. browsers did not "add https". web servers kept migrating their sites to https. what some browsers did is alert the user when they were visiting http sites and in some cases, attempting to force https usage on sites when possible.
article doesn't even mention encrypted DNS, which is something that browsers DID add and can be useful for privacy reasons (although there are some concerns about the dns server now potentially invading your privacy as well
Re: (Score:2)
Yes, the article is embarrassingly bad but isn't NBC still owned by Comcast (ISP)? Seems like another corporate hack got into their news division; they have more competent staff that are capable of talking about basic internet technology.
Aren't ISPs still upset about VPNs preventing them from monitoring your internet usage? Comcast wasn't happy about DNS alternatives either.
Complete bullshit (Score:2)
VPNs serve several purposes. One is evading geo-restrictions i.e. artificial trade barriers. Another is preventing traffic analysis and for that encryption of individual data-streams does not help one bit. Then there is the securing of the last mile and not all traffic is encrypted. With a VPN you get at least an entry-point to the Internet that is not under control of an attacker. Well, hopefully.
This "advice" by NBC is both incompetent and may endanger you. I am a bit disappointed to see Nick Weaver in t
as usual they miss the point of a VPN for most (Score:2)
VPNs are a fad (Score:2)
Vpns came into vogue for two reasons: trying to get around streaming service regional restrictions, and privacy paranoia. If you use secure websites, they really do nothing for your security or privacy. I'm hopeful that people become less privacy-obsessed now.
Re: (Score:2)
So much mos-information and stupidity... (Score:2)
Sponsered Content (Score:2)
Re: (Score:2)
Run your own VPN and this bonus attack vector magically disappears!
Won't that just make you easier to track?
Re: there are other use cases (Score:2)
My use case is government mandated spying. Or the avoiding thereof.
My government (with extremely dubious legality and they seem to drop cases that challenges it) demanded that all communications be logged and provided to the government without a warrant at any time the government asks.
You can bet your bottom dollar they ask for * once a week and archive it forever.
So I use a VPN. All the criminals that run the country can see is that I use a VPN. Nothing more. Because fuck them, that's why.