VPN vs your ISP

If Tor, I2P, and all other darknets were exterminated and you had to choose between using a VPN or trusting your ISP, which would you choose? And if you choose to use a VPN, which one? Things that matter: >should support OpenVPN or, preferably, Wireguard >should use "military-grade encryption" (AES-256 for data transfer, RSA-4096 for handshake) >should have a killswitch (or you can just setup a killswitch yourself using iptables which is probably better than a VPN's built-in killswitch) >should have their own DNS servers >should protect from IPv6 leaks >should own most if not all of their servers or at least support multihop (because now you have to trust not only your VPN provider, but your VPN's hosting providers) >should not require any personal information to register (not that it matters anyway since they already have your IP address and they can just request your ISP for all your information, but I don't want to give them my phone number) Things to know about VPNs: >they don't add security since most websites already use HTTPS. The only part of the connection that is encrypted is from you to the VPN. >they don't make you anonymous since there are many other ways to track you besides your IP address. >your VPN can see everything you do online and while many VPNs have a no-logging policy, there is no way to verify that and many VPN providers have lied about their no-logging policies. While some VPNs have undergone a third-party audit that "verified" their no-logging policy, those audits only measure a short amount of time and it's possible the VPN changed their policies or they just deleted all of their logs and stopped logging during the audit just to make it look like their no-logging policy was true. https://web.archive.org/web/20220629212316/https://restoreprivacy.com/ipvanish-provides-logs-to-authorities/ https://web.archive.org/web/20220727044708/https://restoreprivacy.com/vpn-logs-lies/ >VPNs are vulnerable to traffic analysis >If you're going to login to accounts tied to PII (personally identifying information) you should NOT use a VPN. There's no reason to use one if you're just going to give out your real name. Nobody does this. Things VPNs are useful for: >torrenting (if the VPN allows it and doesn't share your activity with your ISP) >unblocking websites (if the website doesn't block your VPN, which almost all of them do) >hiding traffic from your ISP (if your VPN isn't lying about their no-logs policy and isn't sharing all your data with your ISP) >hiding your IP address (which doesn't matter since websites can still find your location using a geolocation API and a dozen other ways, and they can also track you based on your fingerprint) So to clarify, if Tor or any other darknets were not an option and you had to choose between a VPN or trusting your ISP? Would you use a VPN and if so, which one would you use?

right now i use mullvad. they've been pretty good but i wish their split tunneling let you exclude sites too rather than just apps. some of my trackers don't let you log in if you're on a VPN i know i can just download the openvpn config and do it myself but im fuarrrking lazy

assuming Riseup VPN still existed, I'd use that since I don't have to pay anything or give any info to use it. Otherwise I'd rather just go with the ISP since I can just use public WiFi to somewhat anonymize myself. and it would be an excuse to get out of the house more often

>>63043 Mullvad doesn't own most of their servers. Not only are you trusting them, but all of their VPN server providers. >>63045 >assuming Riseup VPN still existed, I'd use that since I don't have to pay anything or give any info to use it. Doesn't matter. They can still see your real IP address which not only reveals your location but also your ISP. They can then share your browsing traffic with your ISP if they wanted to and also request more information about those who use the IP address. They don't need to ask for your personal information to acquire it. The question is, can you trust them not to do all of that? Or can you not trust anything as long as it's possible for them to do soykaf?

>>63041 Aside from Mullvad, maybe Njalla's VPN service. I believe reading some time back that they use their own hardware, and the service is run by a former Pirate Bay owner. Safe to say it would fit my needs (torrenting Linux ISO's) nicely. >>63045 >assuming Riseup VPN still existed RiseupVPN still exists, it's just there's only a Snap pack/Debian Stable package. If you're referring to their now-gone OpenVPN config, I agree that it is like kicking dead whales down the beach. >>63047 >Doesn't matter. They can still see your real IP address which not only reveals your location but also your ISP. They can then share your browsing traffic with your ISP if they wanted to Very fair point. Riseup may actually be worse given that they are both primarily funded by donations and chronically underfunded. Hence they may be more susceptible to pressure from outside sources.

>your VPN can see everything you do online Not exactly. If you're using a protocol that's encrypted, your VPN will only see that you're sending encrypted data, and possibly be able to determine what protocol you're using. Maybe attempt a mitm attack on it, but modern secure protocols will alert you to these attempts. A moot point anyway as your ISP could also do this, if your threat model requires you to be paranoid about it. >If you're going to login to accounts tied to PII (personally identifying information) you should NOT use a VPN. There's no reason to use one if you're just going to give out your real name. Nobody does this. Sometimes your threat model is just that you don't want random people getting your IP. Competitive gamers, for example, sometimes use it for DDoS mitigation since if someone sends them an IP grabber, it will get the VPN IP so if they're DDoSed, they just have to switch to another VPN location. Some people also use them for getting around geolocked content on streaming services. >which doesn't matter since websites can still find your location using a geolocation API and a dozen other ways, and they can also track you based on your fingerprint) Block geolocation services and use anti-fingerprinting and anti-tracking services if that's within your threat model. It's not something that can't be mitigated and it's not really an issue of VPN or no VPN but rather anti-tracking addons or no anti-tracking addons. Some people use VPNs for activity that doesn't involved a web browser (ssh, ftp, bitmessage, cryptocurrency) where geotracking isn't a concern and fingerprinting is less effective (if you make reasonable choices).

>>63047 > The question is, can you trust them not to do all of that? Or can you not trust anything as long as it's possible for them to do soykaf? Ehh, considering they haven't sold my asses to the RIAA for all the music I've torrented over the last decade using their services, I sincerely doubt they'd give a soykaf about my encrypted email or the all of two news sites I look at (really all I use the internet for nowadays)

>>63041 >Things VPNs are useful for >hiding traffic from your ISP No. VPNs cannot hide this as they are vulnerable to traffic analysis. Your ISP can still see the websites you visit by analyzing the size and timing of the encrypted VPN data stream. This works most of the time and even if they don't know what you're doing, they still know that you're visiting Lainchan. You are all better off not using a VPN at all and just trusting your ISP. That's how bad VPNs are. Mullvad, IVPN, and ProtonVPN are all honeypots (or completely useless at best). Sources: http://whonix.org/wiki/Whonix_versus_VPNs#VPNs_do_not_even_hide_visited_websites_from_your_Internet_Service_Provider http://whonix.org/wiki/Fingerprint#Website_Traffic_Fingerprinting

>>63061 >torrent thing with vpn off >get c&d letter >torrent thing with vpn on >don't get c&d letter post disregarded

>>63061 Website traffic fingerprinting can be mitigated by sending dummy traffic. It's also significantly less effective in practice than it is in research - in research, they typically limit the websites and VPN configurations they're considering. In reality, there are many more websites (and non-website traffic) than they account for, so the number of false positives in practice is unknowable. Caching, browser configuration (someone who blocks certain 3rd party scripts is going to have different traffic than someone who doesn't, for a quick example), website content (static vs somewhat dynamic vs highly dynamic), and VPN configuration, also negatively impact the use of it in practice. If you do not use a VPN, your ISP knows what sites you're browsing for certain and with no extra effort. If you use a VPN, your ISP has to go through the extra effort of trying to figure it out and will end up only with a guess. It does make me curious to if any VPNs support something like WTF-PAD?

>>63061 Timing analysis is a thing, I don't think your ISP is capable nor inclined to do it.

Specifically regarding torrenting: 1. Use a seedbox. Extra steps but totally worth it. 2. If you're very patient, use i2p for torrents. 3. If you DGAF about horrible quality, just use your developer console or scraper of choice to get it from one of the millions of putlocker/123movies clones out there. Regarding browsing: I'd probably hide a device in (redacted location) since i trust their network, and use that as a second location. As a webmaster: In an idyllic not-entirely-unrealistic world, we'd all use TLS, OCSP Must-Staple, encrypted DNS, ECH, and TLS record padding so the only reliable info leakage when web browsing would be source/dest IP addresses. Everything short of ECH is possible now. Then you wouldn't be leaking quite as much info to your VPN provider. Run enough sites/services on the same IP + port and you give people some plausible deniability when they connect to you.

ISPs are almost certainly not running timing attacks to attempt to determine which websites you are browsing. IMO, its far more likely they are: 1.) Mining their own DNS servers Logs 2.) Passively intercepting and mining unecrypted (most) DNS requests 3.) Preventing you from changing DNS on your router (thanks ATT) to enforce this. 4.) and Maybe, trying to use IP to determine host which is increasingly ruined by hosting models and CDNs. I don't believe that ISPs are running stateful timing attacks at scale to mine data, it can't be economically worth it to do so. Why do all that when they can just take the DNS setting off the router they rent you, and most DNS is unencrypted anyway? A VPN will prevent all of this, and tie move your metadata away from your legal identity and address.