Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is there any other real world usecases for VPN nowadays other than:

1. Getting access to geolocked data

2. Torrenting "Linux ISOs"

?



In Germany (and probably in the UK too), you now have to be very careful about what you write online. There is actually a section 188 that makes insulting, defaming, or slandering people in political life a criminal offense. You can now face heavy fines for minor insults (“idiot”) or even have your home searched. A VPN can be useful here.


If anyone wants some background info on the "idiot" comment:

A Bavarian man captioned an image of Robert Habeck (the vice chancellor of Germany at the time) with "Schwachkopf Professional" - "Professional Idiot". It was styled after the Schwarzkopf ad campaign. For this, Habeck filed a criminal complaint "to stop hate crime" against the man and the man's apartment was searched by the police and a tablet confiscated. Oh, and he was arrested over it as well. [0]

(The man was also accused of posting some nazi imagery earlier in the year, but the order to search his house seems to be related only to the insult. [1])

Imagine if you could be arrested for calling your (vice) president an idiot.

[0] https://www.dw.com/en/germany-greens-habeck-presses-charges-...

[1] https://www.tagesspiegel.de/politik/falschaussage-im-fall-sc... (it's in German)


You don't treasure your freedom of speech until you lose it.


> Imagine if you could be arrested for calling your (vice) president an idiot.

You must not set foot in the USA, India, China, et cetera, then.

Imagine you say? Getting arrested might be the least of your worries in today's world if you decide to call a president (or the immediate underling) an idiot in many countries :D


What idiot signed that bullshit into law?


That law has existed since 1951 and is based on an executive order from 1931 by Hindenburg.


This is actually not uncommon in most of the world. American 1A is actually an extremely novel concept most other countries still haven't caught up on.


American 1A is as strong as it's proving to be right now and increasingly proving to be stronger and stronger by the day, since January this year!

Many other countries have protections like that, "on paper" (!!!) - but the point is in how it is used or misused, or rather completely ignored - directly or indirectly, like in the USA currently and many other countries in the world.


Novel in what sense? Are you familiar with the hisory of free speech in e.g. the UK, Sweden, and France?


The UK, where the government has literally smashed printing presses in the newspaper age when magazines were thought to be publishing embarrassing news about the Crown? Where the government's legal authority to do so is still intact? That UK?


3. Avoiding government-mandated record keeping by ISPs in a country like the UK, where all ISPs have to keep a year of your browsing history and it can be accessed warrant free by 17 different agencies(including DEFRA, the agriculture agency).

And yes, I'm aware that you're most likely trading one surveilence for another - but honestly at this point I'd much rather trust my paid VPN provider with my browsing data than my ISP and ultimately the government.


Given that most of the web has TLS and you can easily do DNS over TLS - that's very very high level metadata, where I personally just don't see much ROI vs to giving that metadata to random company with no regulations whatsoever.


Many TLS deployments still leak the hostname in plain text as part of SNI


> but honestly at this point I'd much rather trust my paid VPN provider with my browsing data than my ISP and ultimately the government.

Your ISP will need to comply with local laws and regulations, and you'll have some recourse if broken. A third-party VPN operating in an overseas jurisdiction could be doing anything with your data.


Unless it's selling the data back to my own government, I'd rather a foreign commercial VPN provider have that information rather than my own domestic ISP or my own domestic government.

My government can do parallel construction, can send teams of armed gunmen to my house, and otherwise find far more methods to persecute me than the intelligence services of Russia or China can.

Being innocent of any kind of crime does not necessarily remove one from the crosshairs of law enforcement organizations, particularly the FBI, who have an extensive, well-documented history of violating citizens' constitutional rights, conducting partisan witch hunts against political opponents, being a lawless menace to civil rights activists, anti-war activists, gay rights activists, both pro-abortion and anti-abortion activists, and is probably busy right now planning on being a menace to trans inclusivity activists.

There is no such thing as a friendly government, but I'd much rather have my data in the hands of a government 10,000 miles away than in the hands of my own government. My own government hunts, injures, stalks, harasses, socially ostracizes, and even kills my fellow citizens far more than any foreign government ever has.


> Your ISP will need to comply with local laws and regulations,

I think you've managed to exactly describe the problem with them, and yet you phrase it as a positive.


The original use for a VPN - getting access to private resources - is still very much in play.

I don't just mean being able to access some private web interface you have on a private server in your at home, I mean connecting a satellite office to the main corporate office.

But for all of these consumer marketed VPNs, I think your list has 90%+ covered...


Interesting that we use the same word to describe both technologies, but semantically and technically they are very different.

Perhaps we use the same word to describe them because initially they did use the same technologies, but they have branched out ever since? Maybe IPSec would be a common tech used. But the algorithms are not the same anymore since they serve different purposes (Personal privacy vs corporate/sysadmin security)

In the corporate world VPNs were usually a lower level abstraction security mechanism or a redundant security mechanism to either complement application layer_security, or to hot-patch modern security unto legacy LAN systems. VPN encryption is usually provided by the local router. Common algorithms are IPSec/IKev2.

In the personal privacy world, we are talking about a proxy that hides identification such as IP addresses, and pools connections to provide privacy. The actual encryption is not the main security mechanism even, as it only covers the transit between consumer to proxy, leaving (a potentially longer transit) between the proxy to the actual destination.

In terms of purpose and architecture it's closer to bitcoin tumblers, or Tor or Freenet, or money laundering placement. The fact that they call it VPNs seems to me more of a marketing scheme or political play to avoid association with all of the above, than an actual technical or academical description. If someone were to analyse these technologies, I'm sure a neutral or critical approach would avoid uncritically calling them VPNs in the same way that research is published not about Viagra, but on Sildenafil.


> Interesting that we use the same word to describe both technologies, but semantically and technically they are very different.

That's where my head was at. When i hear my colleagues talk about a VPN, i'm thinking about an IPSEC tunnel and an afternoon of swearing at ios on some outdated ASA. When I hear regular people talking about a VPN, my mind immediately goes to "oh, so you want to watch rick and morty on netflix and don't know anybody hosting a jellyfin/plex server".

When do we coin a new term? Or do we? Does "vpn" turn into a word like "truck" where it's only the context that tells you if we're talking about a 2 axle pickup truck in a home depot parking lot or something pulling a 40ft container unit?


How do authoritarian regimes differentiate business and consumer network traffic, for the purpose of inspection and decryption, censorship of specific content, or blocking of specific protocols? This also overlaps with net neutrality and dump pipes vs. content-centric metering.


Company VPN most likely goes to set IP address associated with a business. And this is most likely a rather static thing. So tracking data going there is most likely legitimate. And well on other side they can make whatever comes out from business IP a problem for business.


As you've written, the proxy services are called VPN because they used the same technology, e.g. OpenVPN.

"Crypto" in the 90s meant secret keys and message encryption, nowadays it's the term for the numerous ponzi scheme "investments"...


A ton of ISPs use deep packet inspection for various kinds of filtering (and other shenanigans). When they get it wrong it manifests to the user as certain websites or access patterns being inaccessible and the ISPs customer support agreeing that you should have access and being able to do fuck all to fix it. A VPN in the middle usually solves the issue.


Wait, I think an ISP cannot inspect the content of packets that are encrypted, say, with HTTPs. In order to inspect TLS encrypted packets you need access to the end-device, controlling the end-router is not sufficient since you would not have access to the device certificates.

If you can prove that an ISP can inspect packets, it would be major news.


You don't need fully broken encryption to gain useful information. Knowing how much data is transferred, to which servers, and when (especially with details like how various endpoints will inadvertently chunk up HTTPS requests based on the details about the content or how interactive sessions will have certain back-and-forth transmit patterns) is sufficent to generate a traffic "fingerprint" which you can correlate to other users, to automated traces crawling those same servers, and otherwise get a very good sense of what a user is up to online even above and beyond just knowing which IP is being queried.

Toss that into any sort of "anomaly detection" or other such nonsense, and it's easy to create rare edge cases at an ISP level.

It's somewhat analogous to how you can sometimes "reverse" hashes like SHA256. E.g., suppose the thing you're hashing is an IPV4 address. There are only 4 billion of those, so a pre-image attack just iterating through all of them and checking the forward direction of the hash is extremely effective. TLS makes that a little more complicated since the content itself is actually hidden, but time and space side-channels give you a lot of stochastic information. You might not be able to deduce somebody's bank password, but you can probably figure out where in the bank's login flow they are and approximately what they did once they logged in.


It may have been fixed since, but I saw a decent talk about this (defcon, IIRC) using Tinder as an example.

Using timing, amounts of data, and what was being connected to, you could recreate what someone was looking at and swiping direction. (left/right sent different amounts of data)


ip addresses are not encrypted, they are part of the header, not the body. The mailman needs to know the address.


Yes. What I'm saying is that the pattern of data entering the mailbox lets you infer more about the contents than just the sender, especially when you can pattern match against known behavior for that sender.


They may not need the contents, seeing you're connecting to a netflix IP and having a lot of data transfer may be a good reason to throttle, for example.


Are you confusing DPI with MITM or something?

DPI does not require any decryption of payload. Even cheap consumer devices can perform DPI on encrypted traffic. ISPs absolutely use DPI as a part of standard practice, and have been for decades. It is a basic network traffic management tool.


* Russia

* Kazakhstan

* China

* Belarus

* Iran

* Mayanmar

- list of countries that are known or suspected to MITM traffic, including SSL


how so they supposedly do it?


SSL certificates have a centralized hierarchy. Many browsers trust a long list of root certificate authorities from multiple countries.

https://cyberscoop.com/russia-tls-security-certificate-autho...

https://jpgamboa.com/china-ssl-authority-revoked-by-browsers...


Do some countries force the browser companies to add their root cert, despite abuse?


I imagine so. I understand that Opera GX, for example, provides a specialized version to Russian IPs that locks down the search engines that can be used.


There are always rumours. And some countries simply openly require computers sold in their country to have their root cert.


Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses.

Now it only sounds weird when a country exherts their national sovereignity because the US doesn't need to perform any additional steps to install any of their Certs, they have hundreds of them by design.


> Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses.

Yeah. I don't think the US explicitly requires it but they don't have to, there are more than enough US-based entities with root certificates who they could send a National Security Letter to if they ever wanted one. (Also the US FKPI root certificate is at least shipped by some vendors, although it seems to be disabled by default)


is there oss that will scour and identify iffy certs on a box?


One attempt I know of: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a... There might be others.


Accessing services from the UK without handing over your personal ID to a service that will inevitably get hacked.

This happened to discord literally a few days ago.


"Hacked" will be "left the data on a public S3 bucket until someone noticed" or similar.


Underrated comment. And why do we need to justify privacy? Justify our non-privacy!


Australian ISPs are legally required to retain metadata for two years.

That's one of the best reasons to use a VPN if you're in Australia. Give up as little as possible.

I have found, however, lots of sites block or Captcha-restrict IP addresses that are (somehow determined as) non-residential, and Netflix restricts its content as well.


Won't TOR browser block metadata collection?


Probably, yes. TOR can be problematic for other reasons, primarily that it can be significantly slower than 'clear' internet or VPN-internet.

It's all a game of who do you trust most / least versus convenience in the end.


> Getting access to geolocked data

I use VPNs when I'm trying to ferret out the scope of an outage. I have VPN servers on local ISP which moves me around different routing. I use a commercial service to move me further out and to other countries.


So you are doing a manual version of what uptime monitors do.


Sort of. I suppose the difference is that I don't need to know in advance where the fault is. ex: An upstream, 3rd party service provider appears offline.


3. Creating multiple accounts with platforms to break their ToS without getting chainbanned.

4. Perform DDoS

5. brute force passwords

6. try out leaked passwords

7. exploit vulns.

8. CSAM

9. Phish

10. Spam

11. Evade taxes with crypto

12. Sell drugs

13. Terrorism

Lots of malicious uses for VPNs, or was your question about legitimate usecases? In which case:

14. Sending emails about cryptography

15. Pornography

16. activism

17. Journalism/Whistleblowing

18. Military

Although some of the legitimate/ilegitimate categories might be subjective, which is precisely why it's a grey legal area at all.


One others seem to have missed 3. ad blocking on your phone away from home. Almost all VPNs have a block ads / known malicious traffic function. This can be done with just a DNS but often mobile carriers will block using your own DNS.


3. When you know/suspect your ISP is more shady than the VPN you're using. This applies particularly when you're doing something your government doesn't like.

VPNs don't increase privacy, they just change who has the opportunity to spy on your traffic. Sometimes, it's much better if it's some foreign random ISP instead of your local government, who can send law enforcement agents where you live.


It's probably more that a lot of people have been convinced that they need a VPN, but they don't. There are use cases, like I trust Mullvad more than I trust some random hotels WiFi. When traveling it can provide a slightly higher base layer of trust.

If you live in a country that restricts your internet access, which to be fair is most these days, a VPN can help. Most of us just don't care about those restrictions or they are more easily circumvented using a 3rd. party DNS. Also if you're in country like Iran or Russia, you really need to trust your VPN provider and strange corporate structures and staff sharing really isn't helping in that respect.

For the average person, no you don't need a VPN. You might need one for a few days or week per year, if you travel and need to access your bank or corporate infrastructure (in that case your employer most likely have their own VPN). VPNs are a niche business, but online influencers have convinced a lot of people that they need a VPN for everything, which simply isn't the case for the vast majority of us.


> I trust Mullvad more than I trust some random hotels WiFi

For what exactly? All sites are HTTPS now anyway, so the only thing you're leaking is the hostnames / IPs you visit. I don't exactly see how the whole "hotel WIFI" thing is relevant at all, except as a dishonest marketing strategy by VPN salesmen


...and the IPs you connect from, which tend to correlate with where you live, work, and so on.


You connect to hotel WIFI from home and work?


I plead the fifth.


3. Not revealing your IP/location with every outgoing web request.


Another one is getting around content filters / service-specific throttling (think college dorms and campuses, hotels, public hotspots etc).


3. Hosting websites with DDNS (though the abuse from that caused Mullvad and IVPN to drop port forwarding)

4. Though it hurts anonymity, and is relatively rare: I2P or Hyphanet, because some websites block known P2P nodes[1]. Important if your bank or work is being a jerk about it.

5. As ThatMedicIsASpy notes, ISP issues: some routers soil the bed from P2P, some ISP's throttle P2P traffic regardless of legality, etc.

[1] https://old.reddit.com/r/i2p/comments/tc3bhs/is_anybody_else...


Those two are pretty big already to be honest. I guess a third one would be avoiding eavesdropping on public wi-fis.


With TLS being everywhere, and just few clicks away from having DNS over TLS, I really don't get eavesdropping on public wifi prop value.


1. example.com is not on the HSTS preload list

2. Because you normally visit example.com using an incognito window, your browser hasn't cached the redirect to SSL, or the address bar suggestion, and you haven't bookmarked the site.

3. You key in example.com, the browser connects over http, and the evil wifi MITMs your unencrypted connection - removing the redirect to SSL and messing with the page however the evildoer wants.

Obviously a VPN provider can also do this, but you might hope they're less likely to.


"Obviously a VPN provider can also do this, but you might hope they're less likely to."

So you have identified some marginal privacy issue, and have identified that a VPN doesn't solve it, but rather that it moves the risk to a third party actor you subjectively feel is better. Well I feel that, subjectively, introducing a third party generally decreases security.

I believe that not all privacy and security considerations can or should be solved technically, but rather we have extra-technical mechanisms like law and social norms that provide some protection on the edge cases. For example, an employee cannot lookup information for personal reasons on a system they are entrusted to in a professional capacity. I'm no expert, but you probably have first laws that prohibit that, second corporate policy that prohibits that, and thirdly social pressure that prohibits that to some extent. Are they perfect? Not necessarily which is why for the most part we rely on technical encryption and security mechanisms.

But at some point these examples become so contrived and the medicine becomes the poison, so you enter into territory that is pretty standard in other industries, what's to stop a waiter from spitting into a cup? There's no spit filter in place of McDonalds, there's other mechanisms protecting us.

On a similar note, logic and debate is not the only way to convey this phenomenon, so here's some more artistic retort to privacy schizophrenia.

https://www.youtube.com/watch?v=jf9I04Oa-hU


Using a VPN means you have to trust one company instead of every wifi you connect to, and also makes that an entity that's an expert at privacy instead of working off a half-forgotten router in the back.

How is any of this "medicine becoming the poison" or "schizophrenic"?


No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination.

Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors.

It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption.

Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client.

VPNs to protect corporate networks is sensible. Consumer VPNs are a different thing entirely and they do not provide increased security at best, decrease security at worst, and usually cater to schizoid threat models, where the threat actor is the state, rather than more realistic threat scenarios.


> No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination.

As long as the VPN is up, the worst the wifi can do is cut you off. It can't alter your connections.

It's far fewer trust points.

> Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors.

When I use a VPN for protection, the server is in the US too.

And if it's for netflix I'm going to some major country, not dubious-land.

(Also I'd say datacenter and internet core routers are less likely to attack some random person's traffic, but that's not core to my argument.)

> It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption.

For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet.

> Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client.

Until you type in a URL and HSTS isn't set.


>For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet.

WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that.

I don't deny that a third layer adds security in that scenario, as 3 layers is more than 2 layers. But you necessarily weaken some other stretch in a zero-sum fashion, as mentioned. I'll concede that the server can be in your own country if you so choose to. But these datacenters are not necessarily controlled by the VPN provider, and they may be highly heterogeneous, in addition there will be many routers in the VPN DC to destination stretch that can still be hacked. Although again I'll grant that endpoint routers are probably weaker targets than ISP routers.


> WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that.

If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Not that you need to do that, you could ARP spoof. Or the router could be hacked.

And you don't have to break HTTPS to have a good chance of attacking someone. There's enough HTTP around.

So it's easy to fall through both of those layers.


If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy.

Is it that easy? I'm not sure if you are a genius hacker or just somewhat misinformed.

My understanding was that observing the initial connection is a requirement for the typical exploit. The attack itself is considerably more complex. Additionally WPA2 is a sort of envelope protocol, the actual encryption cipher can vary and so will the attacks.

I'm not an expert, but I looked into this stuff 7 years ago when I was broke, and I apt installed aircrack-ng from a starbucks so I could try siphoning off my neighbour's wifi, I wasn't able to. Skill Issue sure, but it wasn't as trivial as "just observing a device connecting".

I personally don't see much HTTP, I think a more reasonable attack would be hoping that the user clicks on "continue anyway" whenever a TLS error pops up.

On another note, this would relate to local attackers only right? If a router has been pwned remotely, it wouldn't matter whether the last mile is a twisted pair or air.


https://textbook.cs161.org/network/wpa.html

> In the WPA2 handshake, everything except the GTK is sent unencrypted. Recall that the PTK is derived with the two nonces, the PSK, and the MAC addresses of both the access point and the client. This means that an on-path attacker who eavesdrops on the entire handshake can learn the nonces and the MAC addresses. If the attacker is part of the WiFi network (i.e. they know the WiFi password and generated the PSK), then they know everything necessary to derive the PTK. This attacker can decrypt all messages and eavesdrop on communications, and encrypt and inject messages.

No genius hacker, no misinformation. WPA2 in the normal password mode does not protect clients from each other. It's not part of the design.

https://wiki.wireshark.org/HowToDecrypt802.11

Here's a page about how you can use wireshark to decrypt WPA2 if you capture the handshake, but you can't do it on WPA3. (Also it's not hard to force new handshakes.)

> I'm not an expert, but I looked into this stuff 7 years ago when I was broke, and I apt installed aircrack-ng from a starbucks so I could try siphoning off my neighbour's wifi, I wasn't able to. Skill Issue sure, but it wasn't as trivial as "just observing a device connecting".

Trying to get a password is a completely different thing from trying to attack someone else on the same network as you. You did not fulfill the "If you're on a WPA2 network" part of the sentence.

There was a password-finding attack called KRACK that came out in 2017 but it's fussy and there are ways to defend against it. And you can still brute force WPS sometimes but I guess their device didn't allow it.

> On another note, this would relate to local attackers only right? If a router has been pwned remotely, it wouldn't matter whether the last mile is a twisted pair or air.

Yes, "someone sharing the network" and "hacked router" are two different ways you could be attacked.


> If an attacker knows the WPA2 password, they can intercept traffic.

Oh yes, of course, this is not unlike the capacity of computers in my LAN being able to see my packets, for example if my roommate was a hacker, they would be able to intercept packets while on their way to the router.

Now an interesting thing I've seen in public networks like say Starbucks or McDonalds, they usually don't rely on WPA2 password default security mechanism. I'm not sure what mechanism they use, but they have me log through a browser first.


It's like your roommate being able to splice into your cable without touching it, which seems to me silly to allow, but basically yeah.

WPA3 uses a better calculation where listening in doesn't tell you the key.


I'm not 100% sure, but I don't think splicing the cable is necessary, you can capture broadcast packets and advertise as having a local ip address and capture the packets, whether in a LAN (a residence connected to the same router as the target.) or a WAN (Reading your neighbour's packets).

At least from a blue team perspective that's what I assume can happen. The power lines outside my home have the network cables all spliced together anyways, it's not like you'd have to make a new connection.


You connect to an access point, and your browser/OS tries to open one of http://detectportal.firefox.com/canonical.html, http://www.msftconnecttest.com/connecttest.txt, http://connectivitycheck.gstatic.com/generate_204, https://captive.apple.com/hotspot-detect.html and loads/displays whatever unencrypted web page is served.

Getting someone to open an unencrypted webpage is almost trivial. It's often one of the only web pages you can open on a device.


The problem isn't getting you to open a page, it's putting that page behind a known legitimate URL.


Will Chromium generate a "Your connection is not private" warning in this scenario, that the user has to click through to proceed? And the user would have to type example.com in the browser bar; https://example.com would also trigger a warning, correct?


VPN unifies all destination IPs to server.ip.addr.ess. IP reverse lookups tells some stories if you are to be so paranoid


Additionally, if ConsumerVPNs provide encryption, don't they provide encryption from the stretch between the consumer to the proxy? The stretch between the proxy to the destination would not have additional encryption, and there is no reason to believe that the second transit would be shorter.


TLS doesn't hide which websites (hostnames) you visit


It does if you do DNS over TLS or HTTPS, although I guess that information would still be knowable to your DNS provider if they terminate your TLS behind the scenes


Not quite. In order to make TLS certs work on a per-site basis, requests sent over HTTPS also include a virtual host indicator in cleartext that shows the hostname of the site you’re trying to connect to, so if the IP on the other end is hosting multiple domains it can find the right cert. For this reason some people feel that DNS over TLS is pretty pointless as a privacy measure.


SNI leakage is what encrypted client hello (ECH) tries to solve: https://blog.cloudflare.com/announcing-encrypted-client-hell...

It's still not perfect since you're still leaking information about the privacy set implied by the outer ClientHello, but this possibly isn't much worse than the destination IP address you're leaking anyway.


I think this is only true if SNI is disabled. Otherwise you really only get the IP of SRC and DEST.


SNI relies on the client specifying the host name in the unencrypted ClientHello message that initiates a TLS handshake. Encrypted Client Hello involves extra configuration that most websites don't implement.


Which is more likely, your barista collecting this data for nefarious purposes, or your ISP?


Or that dude in the black hoodie in the corner who always seems to be camped at whatever cafe you and your cow orkers are using as your startup "office"?


I VPN into my home network for added privacy in public wifis, and to access private services.


I work from home and use a VPN service to get a bunch of IP:s I can easily switch between.

Recently a SaaS supplier blocked my IP because I was logging in programmatically every thirty seconds to collect data on batch processing in a customer project, basically two HTTP requests to get an access key and then the data, and I was lazy so I just put those in a script and dumped the second response to a log file and put that in a scheduler. Turned out that another customer of the SaaS supplier somehow could see the traffic on my customer's SaaS instance and panicked because in their mind it was obviously the russians attacking or something, and when they brought this to the supplier they also panicked.

So to keep doing this I had to move over to checking whether the previous access key was still valid and reuse it if so, as well as moving my 'location' to another country. Apparently this is fine but logging in two times a minute is not. It also happens that I need to do research on network services and cloud environments, where having the ability to just hit a couple of terminal incantations to switch 'where' I am helps out quite a bit sometimes.


> another customer of the SaaS supplier somehow could see the traffic on my customer's SaaS instance

Is this common?


I'm not sure, but it definitely shouldn't be.

It was surprising in a way I don't hesitate to call bad, but this supplier is an enterprise style organisation so of course they've only ranted at me and don't plan to alter their infrastructure.


ISPs bad routing and peering


Protection from IP tracking, especially if your ISP doesn't do CGNAT. Of course there's a trade-off here between

a) your ISP (who knows your billing information) knowing which sites you visit, and any site you visit can correlate internet activity back to your household

b) your VPN provider knowing all the sites you visit


CGNAT won't save you in a world where everything is fingerprinted to within an inch of it's life.


But a VPN, commercial or self-hosed, also won't stop fingerprinting. It changes your apparent IP address, but the rest of the characteristics of your device and browser stay the same.


3. Watching porn without your ISP knowing you are into furry sharks wearing banana costumes


Free wifi hotspots

Nowadays most traffic is tls encrypted, but there are still metadata that can be collected.


>but there are still metadata that can be collected.

That logic is questionable given how poorly "spying on public wifi users" scales. You either need to put a bunch of eavesdropping radios in a bunch of public places or somehow convince a bunch of small businesses to use your "free wifi" solution. Even if you do have access, it's hard to monetize the data, given that nearly every device does MAC randomization (so you can't track across different SSIDs) and iOS/windows rotates mac addresses for open/public networks. OTOH setting up metadata capture on a commercial VPN service is pretty straightforward, because you control all the servers.


Doesn't pretty much every Starbucks location in the United States use a nationwide provider?

Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet.

If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment.


>Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet.

Fingerprinting is overrated given that every iPhone 17 is identical to any other iPhone 17. If you leave system settings at stock, which most people do, there's very little to fingerprint.

>Doesn't pretty much every Starbucks location in the United States use a nationwide provider?

True, although mobile data is cheap and plentiful enough that I rarely bother using wifi at cafes or fast food places. The only time I use public wifi is if I'm staying long term, which basically only encompasses trains, airports, and hotels. Those are diverse enough that it's tough to build a complete profile.

>If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment.

I don't think I ever saw a place that was that guarded about their wifi. The closest I've seen is hotels requiring your room/last name, which would allow them to identify you, but at the same time I'm not sure how much information they can glean, other than that I'm logging into gmail or airbnb. Persistent monitoring that ISPs can do is far more useful.


> Those are diverse enough that it's tough to build a complete profile.

Debatable; i promise you that somebody out there is willing to buy the info and will attempt to combine it with $otherInfo such that it becomes valuable enough for somebody else to buy. Lots of adtech/survalence-tech operates with thin margins at _massive scale_.

> I don't think I ever saw a place that was that guarded about their wifi.

It's rare; i'd run into it only a few times a year. Typically PoS systems and WiFi are not integrated. I also haven't really been paying attention since LTE is good now :).


Testing your app/website when it has different behaviour depending on locale


Real, but pretty minimal usage.


Way too many services in Mexico only work from Mexican IPs, from paying your electricity or internet bills to topping up highway toll accounts and even ordering food from a supermarket


Access sites the government has blocked in your state/country


I would put that in the "geolocked data" category


Sharing corporate info with your employees and not everyone else. You know, the "go to work" thing some people do.


Just because something is called with the same name, doesn't mean it's the same thing. Especially if the naming is done on a product by a company that wants to sell the product, and especially if the name is not a protected trademark.

Express VPN, NordVPN and Surfshark belong to another category of software than the VPNs used by companies.

Some differences are:

1- One is used by consumers, the other is used by businesses.

2- One protects communications to a client-controlled Local area network. The other protects communications with third party services.

3- One provides encryption, the other provides anonymization.


1- If we both use a hammer, and you use it for business while I use it for DIY, the tool is still the same thing.

2- The hammer doesn't care where the nail is; local carpentry or third-party furniture still require the same tool.

3- Both sides of the VPN are encrypted to each other, and anonymous to anyone else. No difference that I can see.


I don't think it's a great metaphor.

First, a hammer is a build (compile time) tool, while VPN is a runtime tech. Closer to a nail if you will.

Additionally, millions of products use hammers, while there's two product categories that use VPNs.

The product distribution of VPN products is bimodal, there's no inbetweens it's either a privacy oriented consumer VPN, or it's a security oriented corporate product.

Regarding the specific technology, there is no technical definition of what a VPN is, it's not an industry term, it's a marketing term. Similar to "Web", it's not HTTP, it's not TCP. This is in stark contrast to Internet (as in Internet Protocol).

Related technologies are IPSec, IKev2, WireGuard, but VPN is one of those trademarkless industry buzzword terms that companies are can latch onto for free and participate of a commodity market.

On an unrelated note, this is not unlike the term AI, which can somehow apply to fake images and conversational software. And coincidentally, modern AI is also bimodal, it's either text or syntethic images, the common ancestor might have been that the textual product originally was also synthetic generated text, but with agents and text as thought (in a Sappir-Whorf fashion) have since greatly diverged.


Accessing "the internet" while visiting your family in China/Russia/Iran/Thailand/...


I use a VPN for 3 main reasons:

1) I need to come out of a particular country for some systems access. If I'm travelling it's easier than having IT team change permissions.

2) I use dedicated IPs for some systems.

3) Testing websites where I want to appear local to a particular country.


Why torrentingn Linux isos?


It's the classic "legal" use for torrenting, as many Linux orgs send users to torrents for updates.

If someone also accidentally downloads a TB of movies and music on the way to the latest Mint upgrade, oops.


My vpn bypasses the paywall on the public xfinitywifi hotspots making internet essentially free because I would likely being paying for Mullvad regardless.


I mean the EU has completely given up on free speech so if you want to say anything you better be hiding who you are.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: