As title. Italy is decided to pass a law that basically creates a chinese-type firewall in the country. The question is simple: even if I’m not doing anything illegal, my VPN provider will have to know what am I doing to report it in case it’s illegal, or face jail.
So how could my traffic remain private in this scenario?
Can a VPN provider with no logs policy be held accountable of anything? Can it actually know what I’m doing?
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 3.11K Posts
- 77.9K Comments
- Modlog
Yes. Pay anonymously and change accounts every few months.
If possible, share your VPN creds with others, such as installing it as a whole-house VPN for you and a neighbor. The more mixing, the better.
For sure.
Yes
Depends on your definition of “what”, and the server you’re talking to, and what DNS you’re using, and your VPN provider, and maybe the phase of the moon.
So, pretty much the best-case scenario is when the site works via https, and the server supports “encrypted client hello” (ech), and your browser has ech enabled. In this case your VPN provider can see that you’ve sent something to the IP (one IP can host multiple websites with different domains).
Https and no ech = can see IP, can see the domain.
Http = can see everything (thankfully, quite rare now).
Some VPN providers may as well use their own DNS, then they can see what domains you’ve talked to regardless of ech (afaik, since domain lookup should happen before client hello, since you’re basically looking up whom to “greet”)
Some providers are Facebook with fake mustache and will shamelessly try to mitm you
The only vpn company id ever trust would be mulvad.
They’re towards the top, but there’s a handful of others that demonstrate they are doing good work
Can you give an example?
IVPN, AirVPN, cryptostorm
Why?
The post office knows who you are sending letters to. They have to know because they have to deliver it. They do not know the content of the letter. They also dont know if the letter will be passed along by the receiver to a different destination.
Your ISP knows you are sending traffic to a VPN but not where they are sending it to. The VPN knows where you are sending traffic to but not the content of that traffic. So if you browse a website that only serves pirated content, then they knows you are consuming pirated media but not which media.
If the law requires the VPN to report any and all traffic to blacklisted sights then a “no logs policy” would breach that law.
However to make this law work, Italy would have to ban all VPNs and http proxy services outside of Italy. Italy would have to force pretty mutch the whole world to follow this law for it to work.
What happens if you run a tiny server on AWS in the USA to proxy your private traffic. Unless AWS USA is watching all traffic to see if it complies with Italian law there is no way to enforce it.
To add to this, the Oracle Cloud free teir is totally capable of running a VPN- only probpem is they have credit card KYC.
When you visit sites with https then the traffic is encrypted. They still see what sites you are visiting.
If it truly keeps no logs, then it cannot tell what you are doing. But otherwise, a VPN provider can indeed tell what you’re doing because you are only shifting the trust from your internet service provider to your VPN provider. I would highly recommend something like IVPN or Mullvad and only pay for it in Monero. That way, even if logs are kept, you are just a number account to them and they do not have a name for you.
I’m curious how hard it would be for a typical user to chain VPNs together so that my traffic went sequentially through VPNs. In theory it seems like VPN #1 would know that it was connected to my home and VPN #2, so it couldn’t tell where data was originating. VPN #2 could see the site that was being accessed and VPN #1, but not me.
I have no idea if it actually works this way in practice through.
What you are describing is the tor network.
Now, if you are going to a hidden service and not out to the standard internet, it does this process twice and so you get six hops in between yourself and the hidden service instead of the three to the standard internet.
New to me that https is broken
You can read more about this learning about X.509.
Its the PKI thats broken, namely the root stores. Has been unreliable for many, many years. This is why packages are signed.
So you are basically saying that root CAs are unreliable or compromised?
The great thing is, that you can decide on your own which CAs you trust. Also please proof that those are actively malicious.
And no. That is not the reason that packages are signed, i am guessing you mean packages like on linux, packages contained in the installation repository. The reason is, that you build another chain of trust. Why would i trust a CA which issues certificates for domains with code distribution. That’s not their job.
Yes, there is countless examples of root CAs containing compromised CAs. Also the private keys live on the server, hot. That’s why we sign with release keys that are not stored on the publishing infr
Then pls proof that? Link to a recent article maybe?
https://www.theregister.com/2024/07/31/digicert_certificates_extension/
This incidence with digicert is not about a compromised CA it is about a flaw in their validation system. That is not what you claimed. Such flaws happen from time to time, lets encrypt had an issue a while back too.
DigiCert isn’t the only one. There’s a bunch of others. Just google “Mozilla CA removed” or “google CA removed”
Here’s a couple more examples, but this sort of thing happens all the time, because X.509 is just a terrible design that breaks https
https://bugzilla.mozilla.org/show_bug.cgi?id=1567114
https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else
Not exactly. They are pointing out that HTTPS assumes all is well if it sees a certificate from any “trusted” certificate authority. Browsers typically trust dozens of CAs (nearly 80 for Firefox) from jurisdictions all over the world. Anyone with sufficient access to any of them can forge a certificate. That access might come from a hack, a rogue employee, government pressure, a bug, improperly handled backups, or various other means. It can happen, has happened, and will happen again.
HTTPS is kind of mostly good enough for general use, since exploits are not so common as to make it useless, but if a government sees it as an obstacle, all bets are off. It is not comparable to a trustworthy VPN hosted outside of the government’s reach.
Also, HTTPS doesn’t cover all traffic like a properly configured VPN does. Even where it is used and not compromised, it’s not difficult for a well positioned snooper (like an internet provider that has to answer to government) to follow your traffic on the net and deduce what you’re doing.
Great thing, that you can remove them and only trust those you trust.
Pls explain what https is not covered? The SNI on tbe first visit? A VPN just moves the “exit point” of your traffic. Now the Datacentef and VPN provider sees what you ISP saw.
No. I never said otherwise. But they cannot spy on the traffic. And since the SNI is not encrypted anyway they do not even nerd to “follow the traffic”. But what sites you are visiting and what you are doing on them are 2 different things.
Lol OK. Every US company has to legally provide their private keys (or a subordinate CA) to the US government if asked, due to NSL laws. We have examples of the US doing this historically, only because some companies broke the law and spoke out publicly.
So go ahead and remove all CAs issued from US companies. Verisign, cloudflare, akamai, Microsoft, Amazon, etc.
Now 80% of the Internet is broke.
And? If you cannot trust then you should not use them when you want to do something that is private and should not get looked on.
And if there were signs of misuse of the trust, then they would get removed.
It is actually really easy to monitor thanks to CT.
HTTPS doesn’t stop them from knowing what you visited. It just stops them from knowing what you did while you were there. VVPN provider can still see that you visited Google, but they cannot see what you asked for Google to do for you.
Yes. Not claimed otherwise. OC claimed that they see what you are doing which is wrong.
don’t have to break TLS to know what site you are accessing. The SNI of the cert does that.
The specific url however is protected by TLS.
They see what sites you are visiting yes but they do not see what you are doing on them. They do not see the content of the traffic. Huge difference.
Huge difference depending on who is judging you
When you get judged based on what website you are visiting it is very likely that you are already the bad guy by using a vpn.
An account with your IP address
That doesn’t really make a difference if no traffic history is saved. If there are no logs of traffic saved, there’s noting that can be tied to the account.
This citizen has an account with this VPN provider is not “nothing”.
It is nothing of significance WRT prosecution or any kind of legal action. It is nothing useful.
Let’s say, I don’t know, a government builds a great firewall and forbit people from trying to circumvent it.
Yes, any VPN provider will see what’s in your traffic, no way around that…ever…no matter who you choose
however not all VPN providers will keep a record of your traffic, so it may only exists briefly in their servers as it passes through and then it’s gone. This is how companies like mullvad operate. Even if the cops come with a warrant, there will be no evidence because nothing is saved.
Aren’t there a few VPN providers that don’t even install writable storage in their servers? I can’t remember which, but I’m sure there’s at least one that boots their machines off of read-only media and only installation hard drives in the servers used for storing login credentials.
Mullvad is the one!
Yeah it’s been kind of legally proven that Mullvad keeps no logs too, they were raided by police last year and they came away with nothing.
From the article:
Yes there are, your data still resides in their servers as it passes through them though. But like I said, as soon as it has been processed there is no log of it so it is only present briefly and not in a persistent manner.
Yes, there is a way around it, just use https.
Doesn’t that just hide the specific content? They still know where the content is coming from?
And not everything done online, especially things that can get you in trouble with authorities (like torrenting copyrighted material) can be done through https.
Basically everything online can be done encrypted. bittorrent has had support for encryption for years. There are other challenges like hiding from DPI and the thing that you broadcast your torrent IP but the content can be securely emcrypted.