←back to thread

Who Owns, Operates, and Develops Your VPN Matters

(www.opentech.fund)
201 points sdsantos | 1 comments | 03 Sep 25 16:51 UTC | HN request time: 0s | source
Show context
fujigawa ◴[03 Sep 25 17:28 UTC] No.45118394[source]▶
Commercial VPNs will go down as one of the greatest money-making schemes of the last decade. Outside of a few specific use cases their sales often rely on leveraging non-technical users' fear of what they don't fully understand.

I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identity theft", or my personal favorite: "to protect my bank accounts".

Not a single person has said "I pay to route my traffic through an unknown intermediary to obscure its origin" or "I installed new root certificates to increase my security."

replies(16): >>45118443 #>>45118486 #>>45118558 #>>45118644 #>>45118672 #>>45118693 #>>45119064 #>>45119252 #>>45119261 #>>45119717 #>>45119817 #>>45119936 #>>45120136 #>>45120782 #>>45124630 #>>45126517 #
davepeck ◴[03 Sep 25 17:45 UTC] No.45118558[source]▶
Long ago, in the era of Firesheep and exploding prevalence of coffee-shop Wi-Fi, consumer VPN services were definitely valuable.

But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity".

I live in Seattle and Mullvad VPN seems to have bought approximately all of the ad space on public transit over the past couple months. Their messaging is all about "freeing the internet" and fighting the power. It's deeply silly and, I worry, probably quite good at attracting new customers who have no need for (or understanding of) VPNs whatsoever.

replies(11): >>45118660 #>>45118872 #>>45119025 #>>45119060 #>>45119163 #>>45119222 #>>45119386 #>>45119763 #>>45120306 #>>45124719 #>>45126754 #
kfreds ◴[03 Sep 25 20:54 UTC] No.45120306[source]▶
The way I see it there's four use cases:

- protecting your privacy from your local ISP, WiFi, school, government etc

- protecting your privacy from some forms of online tracking

- circumventing censorship

- circumventing geographical restrictions

If you combine masking of your IP address with a web browser that protects you from various types of browser-based fingerprinting, you are more in control of your privacy online. You get to decide, to a greater extent, who you share very personal information with. That doesn't seem very silly.

(disclosure: I'm one of the deeply silly cofounders of Mullvad)

replies(5): >>45120417 #>>45120779 #>>45121058 #>>45126683 #>>45127892 #
1. dongcarl ◴[03 Sep 25 21:06 UTC] No.45120417[source]▶
Yup, when you're not using a VPN, even with encrypted DNS and HTTPS, you're still sending hostnames (e.g. wikileaks.org) over plaintext in TLS SNI for every HTTPS connection. I believe most firewall appliances now even prefer to use SNI for deep-packet-inspection since it's so reliable.