Are we too reliant on VPN?

de0u

lcalamar Don't you have something better to do?

More seriously, it is great when this forum is a reliable source of high-quality information. But that is threatened if there is a substantial fraction of unsupported opinion, because unsupported opinions vary widely in terms of factuality.

5YearsOfGraphene

banjo45673

Almost all VPNs are run by state actors. Nearly all VPNs track and report all activity, or just sell/trade your data. Many also have minimal security on that data. So a dissident in China is not necessarily protected by using a foreign VPN as the Chinese state may still steal or negotiate for that data.

The only VPN I know of that allows truly anonymous payment is Mullvad. That's payment in methods like cash or crypto with no names attached. Beyond that, Mullvad has shown itself to be highly dedicated to privacy and very active in maximizing it. A dissident using a VPN like say NordVPN has likely done nothing to protect themselves. You'd be shocked how many VPNs are run by companies in Israel, not to mention Silicon Valley and Washington DC area. These companies are typically rather transparent fronts for states.

As to the original question, there is an alternative to VPNs to some degree, and that's mesh networking. The current technology does allow for a global mesh network to supersede the internet of today that was designed for surveillance using central choke points called ISPs. So while a mesh network may allow much greater anonymity, you need to convince more people to use one. Some great advances have been made in recent years in reducing cost and complexity, with some devices working right out of the box. No expertise required. Beyond that, technically any wireless router can be used to connect to other wireless routers to create a mesh network. So in theory we are only a few software updates away from a global mesh network that fixes the censorship problem of the internet today. But for now, existing mesh networking may serve your purposes.

Phead

5YearsOfGraphene Almost all VPNs are run by state actors. Nearly all VPNs track and report all activity, or just sell/trade your data. Many also have minimal security on that data.

Can you provide any evidence for this claim?

Gnah, @rbb was faster ... by 12 hours xD

banjo45673

5YearsOfGraphene

You mean that anyone can do this "mesh networking" just by connecting any wireless router to another wireless router?

So with a solid and reliable VPN such as Mullvad, theoretically, adversaries would not be able to find out one's original IP address?

mmobder

banjo45673 Do you think that we are too reliant on VPNs?

There is a also a combination of using both VPN and TOR, VPN for apps/services that rejects TOR, and TOR for the rest. Unfortunately, as not all apps allow to set proxy (it's great Cromite does), so some of apps drops to VPN by default as well (with a help of rethinkdns). Thanks to rethinkdns, one can use multiple VPN providers and distribute apps among them if required.

5YearsOfGraphene

Delaney

SIMs can be legally obtained anonymously in many countries. While the activity of the SIM may be tracked, if no personal identity is associated with it, that may be sufficient to mitigate the threat. I personally find no advantage in having a name tied to my SIM, so buy anonymously by default.

rbb

"Almost all VPNs are run by state actors. Nearly all VPNs track and report all activity, or just sell/trade your data..."

Could you please elaborate on that statement?

twistero

Tor is a good idea, but it has its limitations. There are practical attacks that may reveal the true IP address of users or hidden services, which when combined with subpoena power can identify people.

SIM cards can be obtained anonymously in some countries, but using a cellular device at all leaves a trail of your IMEI number. A determined adversary with subpoena powers, when they have your IP address, will obtain logs from the network operator that identifies your device IMEI as well as your approximate location. (That's why burner phones are a thing. I assume GrapheneOS compatible devices are generally too expensive to be burners.)

If your goal is to access the Internet without being located or identified, perhaps old-school war-driving is the answer. A setup that randomizes MAC addresses, uses a high-gain antenna to access public WiFi networks at a distance, out of sight of security cameras, and never returning to the same spot might work. On second thought, if your adversary is sufficiently determined, they can look up all license plates and facial recognitions within a few blocks of the public WiFi spots you have visited in the past and cross-reference them, so change vehicles often, and don't ever get your face on camera. As you can see, it gets impractical quickly.

banjo45673

twistero

Agree TOR has its limitations and I don't think it would be the best choice if one's main goal was to conceal physical location.

Agree that SIM cards leave a trail of info including IMEI number. But first the adversary would have to identify WHICH carrier one was using to access certain apps and websites and in order for that they would have to somehow bypass the VPN to find out one's original IP. With the original IP, only then can they know which carrier and can subpoena that carrier for logs which would show location and device IMEI.

Therefore, goes back to the original question of us being almost only relying on the VPN for this setup.

I like your thinking, randomized MAC addresses should already be integrated into graphene (correct me if I am wrong). High-gain antenna to access public Wifi sounds like a good idea and your thought of them going through security cameras and license plates is valid imo. But again, they would first have to know the original IP address in order for them to be able to find out which public wifi one was connected to. But theortecially, they wouldn't be able to get this original IP address if one was using a good VPN such as Mullvad for instance (which also has DAITA and Multi-hop to prevent AI analysis). In theory, all they would able to see is that a certain user accessed a certain app/website on this day and time with a Mullvad IP address. And theoretically that should lead them to a dead-end.

Goes back the original thought: Is there any way that adversaries can bypass the VPN and reveal the original IP address of the sim card or wifi and thus revealing the physical location of the user?

Eumenia

banjo45673 A) airplane mode on, VPN on, wifi connected to portable router with anonymous sim card

What is the advantage of a portable router with a anonymous sim compared to having the sim inside the phone itself?

banjo45673 So we have to rely solely on the VPN to be strong enough and actually keep no logs and data.

I would recommend to use a VPN that lets you sign up with no data and pay with crypto.
Then throw away the account after your subscription period and create a new one.
Best for this seems to be IVPN, because they sell 1 week subscriptions.
Seconds best would be Mullvad but the shortest they sell is 1 month

banjo45673

Eumenia

The advantage of using an anonymous sim with a portable router is that some routers allow the changing of IMEI.

And even if IMEI cannot be changed, portable routers can be disposed of after use as IMEI number might be identified by the carrier. Therefore, don't need to keep replacing pixel phones for graphene. Also, this way you can use pixel with graphene on airplane mode only connected with wifi to the portable router (which gets replaced every so often).

banjo45673

Eumenia

Yes, agree that is good opsec and a good way to use VPNs. Mullvad also allows pay by cash which is even MORE anonymous than crypto as crypto can still be traced and analyzed with chain analysis on the blockchain easily (even when using Monero).

twistero

banjo45673 Goes back the original thought: Is there any way that adversaries can bypass the VPN and reveal the original IP address of the sim card or wifi and thus revealing the physical location of the user?

By making your device leak its information. For example, in many P2P protocols (such as WebRTC), clients collect their own IP addresses and transmit them to the other party, so they can try to establish a direct connection. The adversary can put such requests in a webpage you use, and collect your information.
By exploiting your phone, via 0-days or otherwise. There have been several iOS zero-click exploits in the news, where the victim is pwned simply by receiving an iMessage or Whatsapp message. The attacker can then obtain anything they want from the phone, such as IP addresses, IMSI of the SIM card, or location. Similar 0-days may exist for any other OS you use.

By breaking into the VPN provider's infrastructure and wiretapping there. By social engineering you into exposing yourself. Etc etc...

Eumenia

banjo45673 Yes, agree that is good opsec and a good way to use VPNs. Mullvad also allows pay by cash which is even MORE anonymous than crypto as crypto can still be traced and analyzed with chain analysis on the blockchain easily (even when using Monero).

Cash can also be tracked by its serial number.
If you get cash from an ATM it can log the serial numbers and then compare them after you spend it.

I think getting Bitcoin Cash tokens, is the most straightforward and also anonymous way to pay

Olaolaho

banjo45673 as crypto can still be traced and analyzed with chain analysis on the blockchain easily (even when using Monero).

Do you have any proof of that? Regarding monero and chain analysis.. Be very kind to add a source or article where this had happened with monero

banjo45673

twistero

But if we are running GOS, 0-days should be safe and theoretically they wouldn't know the phone and sim that is being used if VPN was always on. They could only see the VPN's IP address which should be a dead end for them already. Even if they subpoeaned the apps and websites to give information, they would only be able to provide the IP address used.

Eumenia

twistero Goes back the original thought: Is there any way that adversaries can bypass the VPN and reveal the original IP address of the sim card or wifi and thus revealing the physical location of the user?

By making your device leak its information. For example, in many P2P protocols (such as WebRTC), clients collect their own IP addresses and transmit them to the other party, so they can try to establish a direct connection. The adversary can put such requests in a webpage you use, and collect your information.

Normally VPN Kills witches should block such connections.
The only exception to the killswitch should be local network stuff like KDE Connect.

banjo45673

Olaolaho

No proof but personal experience and hard to find a source or article that claims otherwise. What I mean was that monero is not 100% foolproof (nothing ever is). IMO, Monero IS the best option when it comes to anonymity in crypto but it has its limitations and I do love the project and what it is doing.

Blockchain and monero is a whole other topic that we shouldn't be diving into but basically it really depends on HOW and WHERE you acquire monero. For instance, many I have spoken to thinks that if one bought monero with any stablecoin in a decentralized exchange that it is "untraceable" but that is just not the case. An adversary with enough resources can trace it back to the stablecoin that was used to purchase monero and therefore can trace how one obtained the stablecoin to begin with. A better method would perhaps be buying stablecoin with cold hard cash and transferrred into an anonymous new wallet, then transferring the stablecoin to a decentralized exchange and purchasing monero. But as I said, an adversary with enough resources can use advance chain analyses and eventually find out how the monero was purchased (albeit might take some time, anywhere from 1-4 weeks).

If you are inclined to try it yourself, you could try it out buy buying some monero and transferring it around and then hire a reputable chain analysis company and see if they can trace it back to where the monero came from.

Again, I am an avid supporter and fan of monero and I do think that it is currently the BEST crypto for anonymity. But in my comment earlier I was stating that cold hard cash (not obtained from an ATM) is probably still the best for anonymity.

Sevv

Olaolaho

I used to have a video of how Chainalysis tracks monero, however the link no longer works. Some of the factors that help obfuscate even the tracking is changing the fee you use and using a vpn.

Delaney

banjo45673 But if we are running GOS, 0-days should be safe

That's a dangerous assumption

banjo45673 Even if they subpoeaned the apps and websites to give information, they would only be able to provide the IP address used.

No. They could also provide device or browser identifiers unique to your phone, regardless of your VPN configuration. They could also provide information about when the connections were made and correlate it with what devices make connections at that same time, regardless of VPN configuration. The fact you're using a VPN is a potential identifier in itself.

You're putting a lot on emphasis on the belief that the IP address is the only variable that matters. It's not.

banjo45673

I could be wrong as there may have been significant upgrades to monero as of late that I am unaware of. But my personal preferred payment method for anonymity would still be cold hard cash that is not from an ATM (my logic being why risk it with crypto if there is even a 1% chance?)

lackofhumor

banjo45673 An adversary with enough resources can trace it back to the stablecoin that was used to purchase monero and therefore can trace how one obtained the stablecoin to begin with.

I'll go a little bit off-topic.

Let's start saying that stablecoins are not the only option to obtain monero.
After you buy monero you just need another jump (monero to monero) to conceal your traces.
Two jumps for the paranoic, even if I would say it might be already an overkill.

Blocks are encrypted differently for every transaction between peers, reason why you are not able to obtain a wallet balance (info you can obtain easily in other cryptovalues) looking at the blockchain.

I am not aware of any advance chain analysis that could give up your identity which does not involve asking the exchange for info about you.
Please, if you can find back the source where you got these information would be a very nice read.

banjo45673 So tails is similar to a VPN?

Tails is a whole OS (based on Debian), which is meant to be used through TOR only (with some exceptions, like getting the time from the Fedora Servers).
The topic is huge really, and TOR and VPNs work very differently one from the other.

If we have to try to be very short and not technical:
VPNs (at least commercial ones) are usually meant to be used system wide and requires less effort for the user to force a program to go through it.
TOR tries to conceal your identity the best it can, and you usually use it as a proxy and as such you might have leaks
Tails tries the best it can to enforce TOR system wide (and so preventing leaks), and that's why @secrec said that the way Tails uses TOR resemble an "anonymity VPN".

That said, depending on your threat model you can have differences.
For the average Joe, as both of them:

Hide to your ISP where are you going
Can hide your DNS requests (if set properly)
Can use quantum encryption

Consider also that with both of them, your ISP and target are aware if you are using TOR/VPNs and might behave differently accordingly.

With TOR you trust nodes on the network not being rogue.
With VPN you trust your provider not being rouge.

Tails is also looking into shipping a VPN browser (source).

secrec

DeletedUser550 I don't use a VPN, I use Tails.

Just to put something into perspective..... Tails uses TOR, configured to do the same job in the same manner as an "anonymity VPN".

banjo45673

secrec

So tails is similar to a VPN?

banjo45673

Delaney

Good and insightful points about the browser identifiers unique to the phone and what connections were made with what devices at a given time. But, in this threat model, device would be anonymous (they don't know who is using it). Is there a way they could find out physical location with this information and how?

« Previous Page Next Page »