Theory of all VPNs being honeypots and why

So it's been speculated before that all/most VPN providers are honeypots for the guberment, to provide an illusion of privacy in the wake of the Snowden leaks. However, I think it's possible VPNs actually enhance data collection even compared to a populace that was completely ignorant of government spying on internet activity. Since in a connection packet don't all take the same route, they more or less get routed individually and won't all take the same path. You're in a conundrum as the entity trying to capture as much traffic possible while still being somewhat efficient. If you put all of your collection points on backbone junctions, you'll need a bunch of processing power on those spots, but more importantly you'll miss out on traffic that doesn't go onto a backbone network. And if you try to put your capture points on the "outskirts" you massively increase the amount you need. Now if you can convince privacy conscious people to use VPNs (which will likely include everyone you actually want to monitor) you can funnel all of their traffic through the back bone and go with option 1 and not even after worry about the outskirts. Plus since VPN providers are always located in massive data centers, it's easy to capture the in and outbound traffic, since if the VPN/Proxy server were close enough to the user they could access it without the use of major backbone networks, you'd only be capturing the traffic between the server and the Internet, not any, or much, of the traffic between the user in the server, making it very difficult to identify them. Two tangentially related topics. I'll never understand why SOCKS proxies with TLS never took off. You'd basically get all the same benefits of a VPN, but with better performance and ephemeral keys so that way you'd have backwards and forwards secrecy, seems very odd use OpenVPN with a static key and worse performance. Also with how few junctions there are with leaving and entering the US, you can bet every single packet that goes in and out of the country is being inspected and stored if it's of interest (people like Bill Benny have claimed this as well) and I think it's suspicious that all these VPN providers setup shop outside of the US were when their employees log into the servers in the US, those packers will be guaranteed to be intercepted by the feds.

My VPN provider is safe. They said themselves that they keep no logs, and they operate outside 5 eyes.

>>15060 Just make sure they said that on the internet and not on TV or in a magazine or something, because Al Gore designed the Internet so that it'd be impossible to lie on it.

the vast majority of people don't use VPNs, and anyone who cares enough doesn't consider their VPN provider 'safe'. Even if your VPN isn't a honeypot, it's trivial for an attacker to correlate traffic to/from the VPN. in short, it's just a waste of time and money for gubbermint to run that many honeypots, when they can de-anonymize more people for cheaper using their direct ISP wiretaps.

>>15062 Also, some other things >worrying about "outskirts" sure I mean the NSA probably can't see your voIP calls to your bud on the other side of town. But the ISP also has an incentive to do some amount of tracking for all users, which the NSA could then requisition. Everything else? No, not worth it, your stuff will pass through a backbone and the majority of the time the route will be the same for every packet. >why not SOCKS? Shadowsocks is pretty popular in China. SOCKS in general has some pretty major downsides compared to VPN though, because of DNS leakage and stuff like it. I'm pretty sure OpenVPN does have forward secrecy by default. In any case though, NSA is probably at most 30 years out from quantum computers capable of breaking all current public-key crypto.

Tor is better anyway. And free. Why do people VPNs when Tor exists?

>>15069 top text torrenting bottom text

>>15070 you can use i2p for torrenting it's insanely slow but only because no one uses it

>>15071 It's also overkill. Nobody gives a crap if you torrent as long as you have a VPN.

>>15069 tor only supports tcp. everything else (udp, icmp, etc.) leaks

>Now if you can convince privacy conscious people to use VPNs (which will likely include everyone you actually want to monitor) This is kind of were the theory falls apart. Most VPN users aren't people governmental agencies want to track. A good 80% are people who use it for torrenting, netflix, and other region locked content. Some are privacy conscious, but it isn't government tracking level. Anyone doing anything illegal most likely knows VPN's are moot.

>>15059 shadowsocks with custom ciphers are widely used on china. they even bypass aggressive DPI on a daily basis so your average western VPN is soykafty compared to the average chinadev who makes their own vpn and socks server themselves (even modifying header/packets/XOR/NOR etc themselves).

>>15060 Just like CryptoAG, I can trust them completely. >>15059 I'm not sure I would assume that its a deliberate thing but its no doubt helpful for them. I expect that every single VPN provider has a blackbox fitting either on or near their servers knowingly or unknowingly that is just harvesting data for direct analysis where possible and traffic analysis where they can't get onto the server itself.

>>15060 >outside 5 eyes. =inside 14 eyes. an attempt was made

The government has a thing called a subpoena which is a fancy legal way of saying "If you don't give me this information you will go to jail." There was a lulzsec hacker got caught because he used hidemyass which is a american vpn company. In less you have a vpn that will say fuarrrk off to a government ( or a friend willing to go to jail for you. ) The US doesn't really need a massive spying system to de-anonymize vpn users.

>>15102 In theory if they don't keep logs there isn't much information to give, but you probably shouldn't rely on that.

>>15059 Everything operates on a threat model. If you really want to stop your ISP from seeing what you do, and you don't trust them either selling your data to advertisers, or cooperating your countries LEAs, then you use a VPN to shift the trust to another fundamentally untrustworthy source, only this time you hope the effects of that are to shove your internet activity into another jurisdiction entirely. VPNs are definitely not used by the vast majority of normans to skirt spying. It's for netflix, and torrenting.

>>15102 This is a reasonable thing to remember, but VPN companies will push against LEO because it is in their profit motive to do so, phone companies have done the same and all these tech companies that have helped privacy have behaved similarly, for a subpoena they might not provide all that much client information but it is a valid concern which is why you expect your private information to be subject to subpoenas then you shouldn't register VPN accounts with your identifiable personal information. But even if the VPN company holds no records I assume depending on the jurisdiction they can be forced to listen on a specific client like phone companies can be forced to tap specific clients etc. etc. I'm a fugitive currently and I use VPN for daily browsing but also have abandoned most accounts I previously used, but I assume my traffic fingerprint can still be tracked by a capable actor, I doubt my threat model includes such but it will be interesting to see. Regardless the VPN means that the threat will have to do cross-jurisdiction cooperation around agencies on the other side of the planet (not USA or EU, FBI-Europol cooperation isn't too bad but a local European agency still is unlikely to be able to even subpoena an American company) to manage a subpoena to get at my originating network and I don't think I'm valued that much paperwork and manhours, but will be interesting to see... Also an alternative to a commercial VPN service is to install your own VPN on some commercial VPS service.

>>15091 Know any guides on how to learn how to do that?

>>15145 regardless of the vpn, we're still watching you

>>15072 >as long as you have a VPN who cares if you torrent without a vpn?

I'm really hoping Nym takes off. Tor, I2P, Loki, etc. don't explicitly have global adversaries as part of their threat model.

>>15428 Is it yet another coinscam? Because if so, the only real project with work still ongoing and a similar model I know of would be Gnunet.

>>15427 i've torrented tbs of stuff and my isp has never given me a notice.

https://www.youtube.com/watch?v=vi3SOqUTAm4&t=7s /thread

>>15427 I've torrented without an ISP ONCE and got a letter in the mail to stop or my ISP would drop service. So I would always use something to hide that traffic.

>>15521 People should tell where or what ISP it was so other people know.

>>15427 If you torrent popular new movies or shows, you will frequently get an instant copyright notice from your ISP. >>15454 if you torrent 20 year old anime or whatever (or anything on a private tracker) nobody will notice or care. Also if you connect to DHT, your IP will be logged by services like iknowwhatyoudownload.com >>15059 Everybody already knows VPNs are not effective against a global passive adversary. It does however hide your activity from your ISP which mines your internet usage for ads and possibly local law enforcement. It also aids in hiding your identity from servers you connect to. Your IP will not be in thousands of random logs to get breached or subpoenaed.

>>15531 A VPN also protects your traffic from eavesdropping if you are on unencrypted wifi.

>>15532 That was a lot more meaningful back in the 90s and early 00s, when it wasn't the norm to have everything using TLS.

>>15533 It still helps prevent the wifi provider from knowing what site you're visiting.

>>15063 >NSA is probably at most 30 years out from quantum computers capable of breaking all current public-key crypto. How can any of us speculate or estimate the time it'll take for NSA to crack crypto? Considering the general public isn't aware of their capabilities at the moment, let alone able to estimate the speed of research until quantum breakthroughs that enable cryptobreaking.

>>15406 And yes we know. Everybody has the liberty to spy one another.

>>15654 I follow public-sector research pretty closely, usually what I do is assume that the NSA is about a decade ahead (which is a MASSIVE lead in the tech world). I don't think quantum computers capable of cracking RSA-1024 are coming any time soon in public research.

I don't think VPNs are necessarily a malicious honeypot so much as just a catchy marketing brand. They're made for accessing a private network remotely but marketed nowadays mainly for 'hiding your IP address'. I think they first found popularity outside of corporate use for playing games that only worked across local networks? There's so many VPN providers these days that I don't think it reasonable to assume they're all under the control of one actor. If the protocols themselves are backdoored why would SOCKS5 with TLS be safe from that? I feel like VPN has just exploded as a brand because its utility in making piracy cases harder to prosecute ergo saving us all a lot of trouble with foreign multinationals and their copyright claims.

>>15059 They never share to third-party companies but have you ever thought there's only like 6+something big internet companies and that they are either a first-party sub-company of the few big companies and that means they can directly share to that company being a first-party participant of the sub-company they own that is your VPN provider. >I'll never understand why SOCKS proxies with TLS never took off. In China, where security is oppressive enough that people claim your router literally receives all kinds of automated spams etc. and that your equipment watches for your activities is where it took off. They even had to slice their packets or do some obscurity to bypass DPI or similar systems. Maybe you don't know because you're programmed to think "tor just werks" when and you shouldn't use it it doesn't even work in china and you'd get a knock from your door in matter of minutes if it does and then explain why "you just wanted to watch youtube" and have your social score deducted or maybe have your P cancelled.

>>15533 DNS is not TLS. >>15531 I think it's the opposite but I've not tried. It's probably that DHT is harder for them to so they bluff claimed it is where they do it so you use the other which lets their API work although in theory if the other party is using all types of trackerless+tracker systems they would probably be the snitch themselves (so in theory if there's a way to block those who use both it might bypass the API).

>>15701 There is literally a "make Tor work in China" button on the launch dialog two clicks away. obf4 or meek bridges it uses iirc. Also, you probably mean a shadowsocks, which is not a remote TLS SOCKS, it's a remote tunnel that makes a local proxy (local within one computer or unspooked local network) for ease of interoperability with soykaf like browsers. Tor and i2p daemons work similarly, they open a local proxy port for applications to connect.

>>15069 maybe it goes without saying, but maybe it's worth repeating. aside from torrents, another common use case for vpns is when gaming. some don't like to bareback gaming servers. maybe another player takes something they said in chat the wrong way or there are allegations of cheating. script kiddies might try to send packets and dos over trivial matters. speed of connection is more important then a higher degree of privacy in that case.

>>15059 If LEO can't see what you're doing for whatever reason (VPN through a VPN, then TLS w/PFS underneath) the best they can get is metadata like session times, duration, and traffic volume, which they would have to tie back to the source... it would be pretty loose, or not enough to act on, and that's not even taking into account what lain said about being a valuable enough target, or inter-agency cooperation.

>in a connection packet don't all take the same route, they more or less get routed individually and won't all take the same path I'd just like to interject for a moment, while this is technically possible in practice it doesn't happen. Even with ECMP, packets within a TCP connection will pretty much always follow the same route by design. The reason is that out of order packets is absolutely terrible for performance. If your route does change in the middle of a transfer (e.g. due to a router going down) you will notice because your speed will drop immediately and you will get huge latency with many retransmissions.

>>15703 DNS over https is taking off, I recently looked at some malware that used cloudflare's dns https to mask its dns requests. And since the returned IP address was just some part of cloudflare, it was about as effective as domain fronting. super neat imo