Who Owns, Operates, and Develops Your VPN Matters

VPN companies often overpackage their offerings and overcharge -- this truism doesn't apply when shopping for VPNs.

If I was the US government, I'd push Google Play to offer compromised updates of Signal silently to a few people I was interested in. Even among the highly-technical, who is going to be inspecting binaries installed on a phone regularly?

Does Signal even have reproducible builds? How do I know the code matches the binary?

I'd make my own messenger.... but I don't have the money for that at all.

I wish these risks could be split up and handled separately - Suppose I run a private dark network for me and my friends, and then the GUI for chatting over it runs in a sandbox where it can only message servers that I control, using public/private keys that I control.

Conflating a million lines of Java GUI code with "Noise is a simple and secure protocol" seems like a big attack surface.

For those of us that are technical but unschooled, what resources would you recommend we learn from?

But that was long ago. Now, HTTPS is the norm. The only use cases for consumer VPNs today seem to be (1) "pretend I'm in a different geography so I can stream that show I wanted to see" and (2) "torrent with slightly greater impunity".

I live in Seattle and Mullvad VPN seems to have bought approximately all of the ad space on public transit over the past couple months. Their messaging is all about "freeing the internet" and fighting the power. It's deeply silly and, I worry, probably quite good at attracting new customers who have no need for (or understanding of) VPNs whatsoever.

Worse, some of these are tied to foreign nation state intelligence, who are now analyzing your data when before they couldn't because they didnt have a relationship with your ISP. Domestically, I wouldnt be surprised if all of this data from US owned VPNs is shipped to the NSA or other groups and analyzed. After the Snowden reveals its hard to really see this stuff as conspiracy anymore.

Weird technical issues happen because a lot of services don't keep vpn's in mind. I saw a lot of people were having issues connecting to multiplayer game servers. The vpn provider broke something, maybe it was on a blacklisted IP, maybe increased latency, maybe the IP is in the wrong region and people are connecting to a NA server but are in LATAM, etc.

I really dont know the use case for a vpn, not to mention advertising snooping happens on the application level anyway. Its javascript running on my browser and html5 and heaven knows what else analyzing me for ads, not "what IP did you connect from."

Lastly, there are privacy tools like onion and running a browser with no js active. These vpn types dont do that. They're actually not getting the privacy and security they want because tor is slow and a no-js firefox is unfun. So this weird cargo cult of VPNs has appeared, similar to stuff like "disable UAC" and other "computer enthusiast" knowledge you see in gamer or low information forums. Its the blind leading the blind here and these capitalist opportunists absolutely are taking advantage of that. "I'm safe I have a vpn," is a normal thing to say even though its almost entirely wrong.

The only practical use case I can think of is torrents where the legal and political will to subpoena a vpn provider is low, so its this weird loophole where you can torrent but your ISP will never be informed. For now I suppose until the IP holders think the legal fees are worth it or get a law passed to sidestep subpeonas.

In my estimation the main reason people use VPNs is for pr*n and piracy and they may not want to just flat out admit it.

I always assumed that was like head shops selling water pipes for "tobacco smoking"

A fig leaf, to keep their business respectable and the credit card processors off their backs.

VPNs work. I never got another single nasty letter from Suddenstink.

A few months back, I sat down for a week with a free trial of an obscure webapp, downloaded all of their data and formatted it into json via the javascript console, and pirated by first webapp. Since it's not making xhr calls constantly, it's even snappier than the official one. I'm inventing new piracy methodology. Some of us are more dedicated than the rest of you.

If you think they sell millions of subscriptions to "prevent identity theft" I have a bridge to sell you.

Your friends and relatives aren't going to tell you that they are using it for p0rn, online dating, to buy taboo things online, etc. That's the main use case for VPN software and that's why people are buying it. Doesn't matter if it works the perception that it works is more than enough.

[1]

UNIVERSAL-->SECURE CONNECTION

https://youtube.com/v/zXyG_HncULU

It's the technical users whose myriad VPN use cases rather baffle me which in most cases eventually achieve little to none other than some sort of feeling of satisfaction or maybe placebo.

You mean the one owned by an Israeli billionaire? Hopefully they don’t find a way to make your monitor remotely explode.

(I read somewhere a while back that they don't refresh their IPs (unlike some other VPNs?) but I have no special insight into this.)

As for our long term goals, take a look at our owner's directive: https://mullvad.net/en/blog/ownership-and-future-mullvad-vpn

We want to make online mass surveillance and censorship ineffective. Mullvad is political action through entrepreneurship. We're reinvesting a lot of our profit into open-source software and hardware projects that benefit both Mullvad and the wider community.

I really don't want us to "corner the entire market" because that would make us a single point of failure. I would like to think that our hard work help push the market to keep improving.

Whomever is responsible for your exit nodes actually gives you this functionality.

If it's tailscale itself then they use mullvad nodes as exit nodes which I welcome very much.

Stop trusting companies. They only care about 3 month profits.

Also, relying on its VPN for illegal activities is incredibly foolish since they log your IP and probably have your payment info.

Where do you get residential proxies? I ask because I'm always reminded of https://sponsor.ajay.app/emails/.

And it's not even illegal, not even shady. I see nothing wrong with getting paid to help big companies compete with/destroy each other.

As a bonus you help rid the world of Cloudflare. Cloudflare serves more captchas to ISPs with more proxies. When every ISP is captcha'd, every user will hate Cloudflare.

It's not a get rich quick scheme - there's low demand for proxying at that kind of price.

I'm not going to shill specific companies, so just Google 'get paid to share mobile data' or something.

> Bright Data is the World’s Largest Residential Proxy IP Network providing companies the ability to emulate a real user in any country, city or carrier (ASN) in the world. [...] Bright Data has an SDK (software development kit) that is implemented into applications. Bright SDK provides an attractive alternative to advertisements by providing the app user with the choice to opt-in to Bright Data’s network instead. For every user that opts-in to the Bright Data network, Bright Data pays a monthly fee to the application vendor, who passes that value on to the user by not displaying ads.

I haven't heard of any of the VPN providers doing this, but it wouldn't really surprise me.

There are however a fair number of commercial proxies that do exactly that, sometimes via consumer malware. I know several startup founders who have used them as a way to scrape lots of data and not get banned. Usually the interface they provide to the customer is just a normal SaaS “pay us money and give us a list of URLs and we will give you the page content”, and the interface they provide to the end user is a game or marginally useful utility, and nobody but the company realizes they’re doing something dodgy.