• Flying Squid@lemmy.world
    link
    fedilink
    English
    arrow-up
    134
    arrow-down
    1
    ·
    3 months ago

    I don’t know how effective VPNs are over a public WiFi network, but I do know it stopped Spectrum from sending me “you are downloading copyrighted material, stop it” emails once I started using one. Fuck Spectrum, I don’t have them anymore, but that seems like a good enough reason to keep using one in certain circumstances.

    • Rivalarrival@lemmy.today
      link
      fedilink
      English
      arrow-up
      54
      arrow-down
      2
      ·
      3 months ago

      They need to advertise a legitimate use for their service.

      If they don’t have a threat from public wifi or other security concerns to remedy, then the only purpose for their service is to bypass region limits and block infringement notices. They would be considered complicit in such infringement.

      That their service also hinders efforts to stop pirates needs to be an “unintended” and “unavoidable” side effect.

      • medgremlin@midwest.social
        link
        fedilink
        English
        arrow-up
        15
        ·
        edit-2
        3 months ago

        I use Proton when I’m on my university’s campus because they switched to using EDUroam for the campus wifi. I used to be a Sys Admin at a different university a while back, and from what I know, EDUroam allows the IT department to monitor basically all of the traffic over the network. I don’t know exactly how deep that stuff goes, but if I was doing anything personal or sensitive like banking or whatever, I’d flip on the VPN on my personal computer. I also don’t have any personal accounts logged in on the school issued laptop because they have it loaded with institutional spyware. Once I graduate, I’ll blank the drive and reinstall the OS to have a decent Lenovo laptop on hand as a spare.

        Edit to add: I use Proton because it was the least shady service that I could get for a reasonable price as a student. It is also helpful for finding textbooks. :)

        • exu@feditown.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          They can’t decrypt HTTPS unless you installed a certificate controlled by them. The only thing they can know is which domains you visited, but not what you did on it.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        9
        ·
        3 months ago

        There are plenty of legitimate uses for their services, they just aren’t things that the vast majority of people actually need. For example:

        • access things in a LAN from a WAN - i.e. access a personal PC when you’re at a friend’s house, and your home LAN is behind CGNAT
        • get around local laws - e.g. my state requires ID checks for porn and social media, so getting a VPN one state over gets around that
        • prevent ISP from seeing the sites you visit - very valid privacy concern, especially since SNI exists to de-mask TLS packets

        There are also some sketchier needs, such as:

        • get different content on your streaming platform
        • hide sharing of illegal content (i.e. piracy)
        • perform illegal transactions (e.g. going on Tor to buy drugs or whatever on the black market)

        I think VPNs are trying to appeal to more than just the above needs, they’re trying to create needs to grow their marketshare. That isn’t something a reputable VPN should do, or at least that’s something that would make me hesitate to use a given VPN.

        • PriorityMotif@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          3 months ago

          If you want to give an anonymous video to the press or the police. If you don’t hide your ip then it isn’t anonymous and they’ll come question you.

        • danA
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          get around local laws

          That’s not a legitimate use; it’s an illegal use just like piracy is.

          especially since SNI exists to de-mask TLS packets

          ECH will finally fix this. https://blog.cloudflare.com/encrypted-client-hello/

          SNI is still better than what we used to have. Before SNI, every site that used TLS or SSL had to have a dedicated IP address.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            That’s not a legitimate use; it’s an illegal use just like piracy is.

            My understanding of the law (and yes, I read it) is that it’s not illegal. The law in my state is for service providers to authenticate the ID of any state resident, it’s not a requirement on the resident themselves. The service provider isn’t aware what state I’m a resident of, and state law doesn’t apply outside the state, so I don’t know what law would be violated here.

            SNI is still better than what we used to have.

            I absolutely agree, and I actually use SNI to route packets for my homelab. Without SNI, I would have to route after handling certificates, which would be annoying because I want TLS to work within my home network, and I mess w/ DNS records to point to my local IPs when inside my network. I could have everything routed through a central hub (so one dedicated machine that handles all TLS), but that’s a single point of failure, and I’m not too happy about that. Or I guess I’d have multiple IPs, and route based on which IP is being hit.

            I’ll have to check out ECH. Hopefully I can eat my cake and have it too.

        • uid0gid0@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          The only thing you need to say is “my ISP uses CGNAT” you can’t host anything or run games for your friends without a way to punch through the CGNAT layer. I mean you could use IPv6 if it weren’t still a joke in the US but here we are.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            Yup, CGNAT sucks. But STUN works fine for me, and most games support it, so it’s not a huge issue.

            I could pay extra for a public IP, but for the same price I can get a VPS and do other cool stuff, so I just went the WireGuard VPN route. Same end result with a little more latency, but also more flexibility. I host a few static sites directly on the VPS, with everything else going through the VPN, so that’s nice.

      • Flying Squid@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        edit-2
        3 months ago

        I’m not defending Proton. I don’t even use them.

        Edit: The region limits thing is nice though. It’s not why I got the VPN, but it’s nice to not have to pay to watch the Olympics and just watch it via the CBC or the BBC.

    • r00ty@kbin.life
      link
      fedilink
      arrow-up
      35
      ·
      3 months ago

      On public WiFi I just vpn into my home network. The issue with public WiFi is that it can be sniffed by anyone in range since there is generally no encryption.

      Although pretty much everything we do is over tls these days, and DoH helps protect against even dns sniffing. There’s still at least some risk to working in the clear over a public WiFi network. At least in information gathering, what bank you use, etc.

      But, there’s no real benefit in using a paid vpn over one you own unless you’re downloading illegal content, want to watch another Netflix region, or are in a country with heavy Internet monitoring/filtering.

        • obviouspornalt@lemmynsfw.com
          link
          fedilink
          English
          arrow-up
          11
          ·
          3 months ago

          He said “which bank”, which could be determined by the sniffing DNS requests, or seeing which IPs his computer is connecting to.

          Not a breach of his personal information (assuming the bank that he’s using and the client he’s using after putting everything in TLS properly).

            • r00ty@kbin.life
              link
              fedilink
              arrow-up
              7
              ·
              3 months ago

              But you can see the ip address, which will id the bank. They can derive other information by ip addresses or leaked data and there’s still things using unencrypted connections even today. I generally just connect to my home vpn so at least it’s inly my isp spying on me.

                • r00ty@kbin.life
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  3 months ago

                  I think this is one of the things that ech is meant to solve. But ech/esni is still not widespread on smaller sites yet I think.

        • OneMeaningManyNames@lemmy.ml
          link
          fedilink
          English
          arrow-up
          10
          ·
          3 months ago

          Possibly the domain is visible with a traffic monitoring tool. Everything else is between you and the bank via HTTPS. Having said that, whatever is not over https is visible to whoever sits on the same network as yourself.

          • blarth@thelemmy.club
            link
            fedilink
            English
            arrow-up
            6
            ·
            3 months ago

            Importantly, you probably don’t know what all is encrypted in every app you use on your phone, so it’s best practice to encrypt the transport.

    • MystikIncarnate@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 months ago

      All ISPs are legally obligated to forward that shit to you. The alerts are not from spectrum, they’re just relaying the information.

      Right now, copyright owners do not have legal permission to find out who you are directly without a court order. They would only seek that information if they were planning to file a lawsuit.

      Media companies know, from the Napster incident, that such actions can backfire stupendously. It’s rare that they even bother anymore. I can go into detail on why, but I’ll leave it out for brevity.

      So they send the notice to your ISP, who is legally obligated to match the information on the notice to the subscriber and forward the notice to you.

      For many, this goes to an ISP provided mailbox, which most people ignore the existence of it. Clearly spectrum operates differently.

      The notices are from copyright holders who have no idea who you are, and can’t determine that information unless they intend to sue you. So those can be, for the most part, ignored.

      It’s not your ISPs fault that you got those. They couldn’t give a shit less about what you do on their service, or what you download. They just want you to pay your bill every month and keep the gravy train rolling.

        • MystikIncarnate@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          Fair enough. I haven’t used spectrum, so I have no opinion. I’m not in the right country to subscribe to their service, so there’s that.

          Have a good day.

          • Flying Squid@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            Spectrum is a total shit ISP that does shady shit constantly, while being owned by a massive corporation run by a Trump supporter and unfortunately is the only option people have in a lot of places in the U.S.

            Anyway, good talk. You have a good day too!