Are we too reliant on VPN?

Revliss

It's better to think of a VPN as a private LAN by encryption, it adds security for device to device access. For example you have a server, a phone and a laptop. If you want to SSH into your server, access files from your phone or control your phone from your laptop, it's better to secure those connection through your own VPN.

banjo45673

Delaney

Good and insightful points about the browser identifiers unique to the phone and what connections were made with what devices at a given time. But, in this threat model, device would be anonymous (they don't know who is using it). Is there a way they could find out physical location with this information and how?

banjo45673

secrec

So tails is similar to a VPN?

secrec

banjo45673 No

lackofhumor

banjo45673 An adversary with enough resources can trace it back to the stablecoin that was used to purchase monero and therefore can trace how one obtained the stablecoin to begin with.

I'll go a little bit off-topic.

Let's start saying that stablecoins are not the only option to obtain monero.
After you buy monero you just need another jump (monero to monero) to conceal your traces.
Two jumps for the paranoic, even if I would say it might be already an overkill.

Blocks are encrypted differently for every transaction between peers, reason why you are not able to obtain a wallet balance (info you can obtain easily in other cryptovalues) looking at the blockchain.

I am not aware of any advance chain analysis that could give up your identity which does not involve asking the exchange for info about you.
Please, if you can find back the source where you got these information would be a very nice read.

banjo45673 So tails is similar to a VPN?

Tails is a whole OS (based on Debian), which is meant to be used through TOR only (with some exceptions, like getting the time from the Fedora Servers).
The topic is huge really, and TOR and VPNs work very differently one from the other.

If we have to try to be very short and not technical:
VPNs (at least commercial ones) are usually meant to be used system wide and requires less effort for the user to force a program to go through it.
TOR tries to conceal your identity the best it can, and you usually use it as a proxy and as such you might have leaks
Tails tries the best it can to enforce TOR system wide (and so preventing leaks), and that's why @secrec said that the way Tails uses TOR resemble an "anonymity VPN".

That said, depending on your threat model you can have differences.
For the average Joe, as both of them:

Hide to your ISP where are you going
Can hide your DNS requests (if set properly)
Can use quantum encryption

Consider also that with both of them, your ISP and target are aware if you are using TOR/VPNs and might behave differently accordingly.

With TOR you trust nodes on the network not being rogue.
With VPN you trust your provider not being rouge.

Tails is also looking into shipping a VPN browser (source).

Eumenia

twistero Goes back the original thought: Is there any way that adversaries can bypass the VPN and reveal the original IP address of the sim card or wifi and thus revealing the physical location of the user?

By making your device leak its information. For example, in many P2P protocols (such as WebRTC), clients collect their own IP addresses and transmit them to the other party, so they can try to establish a direct connection. The adversary can put such requests in a webpage you use, and collect your information.

Normally VPN Kills witches should block such connections.
The only exception to the killswitch should be local network stuff like KDE Connect.

banjo45673

lackofhumor

Good writeup and detailed info.

Regarding monero, identity might not be tracked unless it is linked it to a KYC exchange but many people do end up making that mistake and buy monero from KYC exchanges. But what I meant was that with chain analysis it might be able to track to the original coin that was used to purchase the monero.

For VPN/TOR, I find that a reliable VPN with killswitch perhaps is better than TOR since TOR might have leaks.

And the threat model would be preventing an adversary from locating someone's physical location by getting the logs of websites/apps that was accessed during a certain time.

Olaolaho

banjo45673 Regarding monero, identity might not be tracked unless it is linked it to a KYC exchange but many people do end up making that mistake and buy monero from KYC exchanges. But what I meant was that with chain analysis it might be able to track to the original coin that was used to purchase the monero.

Please stop saying that withouth anything to back it up.. Till today there is zero proof that any chain analysis is able to track it even more like above explained if you transfered it to a other monero account so if you can not back it up not drop it more.. Might be able grrr

gMan

banjo45673

banjo45673 For VPN/TOR, I find that a reliable VPN with killswitch perhaps is better than TOR since TOR might have leaks.

neither is reliable in my opinion if, by 'reliable', you mean trustworthy - personally i don't trust Tor and there's reasons for this, such as occasional curiously long delays in fixing critical vulnerabilities

on the other hand, the VPN market is a bonafide nIGhtMarE - the vast majority of VPN's are garbage that are owned by just a few shady companies - at the moment there are literally only 2 that i'm aware of that are worth considering, they being Azire and Mullvad

the former is the only VPN i'm aware of that owns and physically secures all their servers, while Mullvad owns only those in Sweden, though Mullvad is probably the better choice for the average user

lackofhumor

banjo45673 For VPN/TOR, I find that a reliable VPN with killswitch perhaps is better than TOR since TOR might have leaks.

Both of them have pros and cons.
If you like the concept of Tails and you don't need portability, you can setup Whonix to continue to use TOR as main "VPN" (It's wrong to say that, it's just to continue the Tails-uses-TOR-as-VPN concept).

Of course it's a little bit impractical bringing with you two VM all the time.

Sevv I used to have a video of how Chainalysis tracks monero

I will just drop this in favour of Monero and this (even if I couldn't read because it's paywalled) against it.
I didn't read the latter, so I cannot say how effective the Maximum Weighted Matching-Based Approach is.
The lack of any further publication after the study hints me it's not very effective, but this might be just speculation.

That said, I will not continue this crusade lol

banjo45673

gMan

How user friendly is Azire and how can one pay for their services?

Eumenia

gMan only 2 that i'm aware of that are worth considering, they being Azire and Mullvad

Azure doesn't has a Linux client and I have never heard of it.
But Mullvad is very solid

Sevv

Olaolaho

I used to have a video of how Chainalysis tracks monero, however the link no longer works. Some of the factors that help obfuscate even the tracking is changing the fee you use and using a vpn.

Sevv

lackofhumor

It's most certainly not full proof. That's why using a vpn and changing the fee are mitigating factors.

banjo45673

lackofhumor

Agreed, lets just drop the topic on Monero. My opinion was always that Monero is the best privacy crypto as of now and I do love the project immensely. Whether advanced chain analysis works on monero, one has to personally experience it with capable adversaries to truly know.

So VPN with anonymous sim card still seems to be the most practical and best way to conceal physical location.

banjo45673

Sevv

Yes to this message. Actually, in this thread I was never arguing against Monero (as I love the project) but I was also just saying that it isn't foolproof and we were originally talking about how to pay VPN providers and I said cold hard cash seems more foolproof than monero.

gMan

banjo45673

banjo45673 How user friendly is Azire and how can one pay for their services?

assuming you're referring to Android or a Windows box, i would think Azire is about as easy to use as any other VPN - for Linux there is no app, but it's easy enough to use via Wireguard and Network Manager

regarding payment, i just had another look at that and it appears that, since their partnership with Malwarebytes, they have dropped the crypto and cash options - this could certainly be a show-stopper for some folks and even though i didn't use those methods, this has me a little irritated

if Azire doesn't do it for you, i'd recommend Mulvad

banjo45673

gMan

Yeah seems Mullvad is the better choice here. Do you know which servers Mullvad owns?

What are your thoughts on iVPN?

Meatheadmarty

They can buy VPN susbscriptions and manipulate packets inside the server to figure out things about users. They have some ways to trace back users but not sure how they are doing it. It could be based on real time netflows. Data has a specific shape and data stream 1 from user 1 doesn't look like data stream 2 from user 2. It's probably done by manipulating packets inside the VPN servers that are not controlled by state actors. Not sure if Tor breaks the chain, like vpn to tor. People just using tails have been unmasked because of netflow data at the ISP level.

gMan

Meatheadmarty i wonder if you might be referring to these special packets that operators, such as an ISP, can attach to traffic in order to determine what site a user is visiting through an encrypted tunnel? i forget what these packets/technique is called

i also wondered if this can be done with Tor

Matthai

Don't be naive, people. Several VPN companies (especially free ones), are affiliated with China.

This is quite interesting, because in China companies need government licence to operate VPN and ordinary people sa generally not allowed to use VPN in China. Also there is strong suspicion that those companies are government affiliated.

However, several VPN companies are also affiliated with Israel.

Kape Technologies was formerly known as Crossrider.

They dealt in malware and Google’s security research team has been incredibly alarmed by their ecosystem of thousands of companies, broken down into various segments (Software, Distribution, Injection, and Ads).

Nowadays, Kape Technologies is a conglomerate of multiple “privacy-first” software companies... Their first VPN acquisition was Cyberghost for €9.1M back in 2017, followed by Private Internet Access for $127M and Zenmate for €4.8M in 2018. Then came the Express VPN in 2021 for $936M, giving Kape a massive foothold in the VPN marketplace.

Also, they do not only own the VPNs, they also own VPN affiliate marketing platforms, and the VPN review websites.

And the owner of the Kape Technologies is known for connections with the Israeli military intelligence sphere and was able to procure himself a real-life cyber spy from the famed Unit 8200.

Also, do not forget that people that served in 8200 are in an active reserve list - typically until the age of 40. And have to spend up to three weeks a year going back to 8200, refreshing their skills.

Now... let's think of the situation, that you have a Russian or Chinese ex-spy that is now working on Google/Apple... or their own IT startup, and is on reserve and needs to go back to their unit once a year. Would you trust the product they are developing?

Well, of course you will. And your government will not ban that companies, as they did not ban Kaspersky!

gMan

Matthai Several VPN companies (especially free ones), are affiliated with China.

this is why i recommend the only 2 i know of (Azire, Mullvad) that a) own and physically secure their servers (only some for Mullvad) and b) aren't owned by one of the garbage companies

[mod note: removed link to website with lots of conspiracy theory articles and other content that's not allowed or is inappropriate for this forum]

i would particularly point out Naomi's video...

The DARK side of VPNs

It turns out that an overwhelming number of VPNs are actively harvesting and selling your data, capturing passwords / credentials / movements from your web activities, and doing all sorts of awful things.

VPNs can be super useful: to help you watch the Netflix catalogue of another country, avoid government surveillance and censorship under oppressive regimes, hide your IP address from websites, stay safe on public wifi, and stop your ISP from spying on your internet activities.

But it REALLY depends on which VPN you're using.

In this video we're going to explore which VPN companies own which review sites, which VPN permissions demand far too much access to your machine, which code has appalling security, and the giant red flags in a lot of this code that scream data collection.

« Previous Page Next Page »