Why I just hand my browsing data over to my ISP (and so should you)
Why I let random websites have my unique location-specific identifier (and so should you)
That’s not how that works
How does it work?
Didn’t watch the video, but… Traffic is often already encrypted with TLS or other encryption & you don’t have to use the ISP for DNS. This would cover a lot of the data you would be discussing. Instead if using these advertized commercial VPNs you are giving the data to those corporations instead which is hardly better in many cases—luckily most of your traffic is encrypted with TLS & you don’t have to use them for DNS …which takes us back to the previous statement for concerns.
There’s still value in VPNs for a several online activities (censorship, piracy, activism, etc.) & threat models to certain folks, but assuming the ISP is the bogeyman in most common scenarios for non-niche use cases is incorrect—but it isn’t how these commercial VPNs are selling themselves. If the ISPs possess the ability to break TLS encryption we’d have bigger issues to worry about & VPNs wouldn’t help. I would assume the video goes in this route but chooses the clickbait title for views.
If possible, I don’t want my ISP to know, trade, and sell as little data about me as possible.
T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs
I know VPNs often exaggerate or outright lie, but they still benefit me in ways I consider valuable.
If it’s all encrypted & they don’t have the DNS requests, all they can see is that you sent X bytes to some IP which isn’t very helpful. Who’s to say these VPNs aren’t selling their data back to the ISPs anyhow?
Encryption doesn’t mean perfectly hidden. Metadata isn’t encrypted for HTTPS iirc. And the ISP knows who your sending traffic to since they are routing you there and are usually your DNS. When connected to a good and trusted VPN, all that is hidden, your DNS can’t give away your location, and the only server you contact is the VPN
What metadata? The headers are as encrypted as the payload. That there was a key exchange between you & a server isn’t too useful.
“Usually” is a strong word for DNS as well since all OSs let you change it & the megacorporations like Google & Cloudflare have already compelled a lot of folks to use their DNS ta resolve faster since the ISP ones are slow (& the smarter, curious folks used that as a launching point to find other provider or self-host). Some platforms have even been shipping DNS-over-HTTPS to get around some of these issues (since the payload & headers are encrypted under TLS).
3rd Party Audits
By who? Who is auditing the auditors? That’s not to say audits aren’t good, but when the code is proprietary, a lot of trust is required. I would prefer banking on solid, open tech which the TLS standard is. There is still use cases for VPNs, but outside like streaming piracy, you might be better served by the Tor network.
You are handing your data over to the VPN. However, with https only and encrypted DNS there is a lot less data to hand over
Why would you hand your browsing data to the VPN company? It’s just moving the problem.
Market competition still exists for them, so they actually have a reason to live up to their promises still
Do ISP’s monitor or sell or pass on your data? Yes.
Do VPN’s? Depends on the VPN. Find one that doesn’t and can back that up with 3rd party audits and legal encounters.
So can a good VPN protect your privacy? No, not by themselves. A VPN is part of an overall toolkit to be as private as you personally would like to be. It can help protect your privacy, that’s all.
It’s really that simple.
Clickbait YouTuber is clickbait…
https://www.privacyguides.org/en/basics/vpn-overview/
Should I use a VPN?¶
Yes, almost certainly. A VPN has many advantages, including:
- Hiding your traffic from only your Internet Service Provider.
- Hiding your downloads (such as torrents) from your ISP and anti-piracy organizations.
- Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.
- Allowing you to bypass geo-restrictions on certain content.
VPNs can provide some of the same benefits Tor provides, such as hiding your IP from the websites you visit and geographically shifting your network traffic, and good VPN providers will not cooperate with e.g. legal authorities from oppressive regimes, especially if you choose a VPN provider outside your own jurisdiction.
VPNs cannot encrypt data outside the connection between your device and the VPN server. VPN providers can also see and modify your traffic the same way your ISP could, so there is still a level of trust you are placing in them. And there is no way to verify a VPN provider’s “no logging” policies in any way.
On a personal note, the common argument is VPN providers could be recording your traffic. But if you know for certain your ISP is recording your traffic and selling your data, which is most commercial ISPs in the West, then a VPN provider is a strict improvement. They may not be, but they’re not guaranteed to be. And your ISP is guaranteed to be.
I would encourage people to watch the video and form a conclusion based on that. The title is quite clickbaity (which you would expect from YouTube) and at least half of the video is solely a critique of NordVPN, often followed up with “but Mullvad is better”. He does make some worthwhile points but they are not universally applicable. Every country has different governments and laws; do not blindly trust the word of Americans because they likely do not know shit about your specific situation. For example, nothing in his video addressed Australia’s mandatory data collection and retention laws, or the multiple high profile data breaches that have occurred here in recent years.
half of the video is solely a critique of NordVPN
I don’t know how good or bad NordVPN is. I have never used it. But I never will. EVER.
You know why?
Because they paid so many interesting Youtubers to shill their stupid VPN service, ruined so many otherwise interesting Youtube videos and wasted so much of my time that I swore I would never give them a single dollar of my money.
I can’t stand advertisement and advertisers, and NordVPN has been truly heavy-handed. They’re not the only ones: Brilliant comes to mind too. They can all fuck off. They’ve achieved the exact opposite of what their ads was supposed to achieve with me: I’ll never patronize them.
uBlock Origin + SponsorBlock + third party mobile client is the solution.
Actually I use Freetube with sponsorblock on the desktop and Newpipe with sponsorblock on Android. So I mostly don’t see shitty sponsors anymore.
But my Formuler TV box - which runs Android - has some weird crashing problem with the default Newpipe player, so I have to use an external player (MX Player) which doesn’t have sponsorblock, sadly.
So whenever I want to watch Youtube videos on my TV, I have to eat some NordVPN shilling - at least a little bit, just time for me to grab the remote and skip it - and I’m too cheap to replace the TV box.
You could try Smart Tube which has built in adblock and sponsorblock and see if that works better on your android tv box
SmartTube works very well. The problem is, it requires a Youtube account to have subscriptions, playlists and the like. That’s a hard no for me.
Fair enough, completely understandable
Shout out for Smart Tube, the best YT app on smart boxes/android TVs, never had any issues
many ISPs over here offer a ~5-10% discount on monthly bills if you agree to have your traffic analysed for marketing purposes. the last time I signed a contract I had to explicitly opt out of that. the ISP providing internet to all of my landlord’s flats offers a similar deal when signing a contract, and 1. I’m willing to bet that my landlord has opted in, and 2. I have no way of opting out of that for my flat. I think I’ll stick with a VPN for the foreseeable future.
With a VPN you are just shifting the attack surface
from the ISP likely to analyze my traffic to a VPN provider who didn’t provide any data after being raided by the police because they didn’t store any
I would still not trust them as you have no control over what happens server side.
That is just as true of your ISP, who when raided by the police will happily send it all over in a jiffy.
Exactly, its not a matter of trust. You can’t verify VPN providers more than you can verify ISPs.
The best option is to use https and encrypted DNS.
What was the reason?
VPNs are centralized entities that can monitor traffic in bulk
My ISP, who I pay $100/mo for internet, tells me straight up that it monetizes my browsing data. I pay $5 a month to a VPN that ‘promises’ it doesn’t do that. Safer bet is the VPN. Even if they (VPN) sell my data, I prefer to spite the ISP anyway.
$100/mo?!
Yup. Small town USA. 1Gig down 25Megs up.
I see. Sure. There’s a risk of course.
But VPN companies are not legally obligated to collect and save your Internet usage data like your ISP is.
So select a provider that doesn’t, like Mullvad.Your Internet traffic is encrypted. As for DNS it is a little harder but you can setup encrypted DNS as well.
Your Internet traffic being encrypted is totally up to the site receiving your traffic or to the app on your phone sending it. And you still leave your metadata at your ISP, along with DNS.
Sure you can always set up your own DNSSEC but the effort compared to just clicking “connect” in that VPN app is not even compareable.I can be private and anonymous without VPN - but a normal user? Just use VPN dude.
A VPN is not a replacement for https and encrypted DNS.
As far as your data goes it is encrypted via https.
Yeah… ok. Have a good day buddy
Have all the sites you visit rolled out ech so far? 'Cause otherwise it’s enough for your ISP to notice you visiting fcriiff* to draw certain conclusions.
* a reference to Cory Doctorow’s “Radicalized”. Mb anything your government doesn’t want you to do, be it torrents, LGBT stuff, abortion clinics, etc.
(The NSA think they’re slick)
Firstly, using a VPN ultimately consists in trusting the company providing the VPN service that it won’t be fucking around with your privacy. Considering that all your traffic goes through it, that’s a lot of trust to place in one company. And I generally don’t trust any tech company to resist the lure of selling your data for profit for very long in 2024 - even those that profess to be privacy-friendly.
Secondly, modern corporate surveillance doesn’t rely on IP addresses anymore. So if you think a VPN protects your privacy, it really doesn’t. All it does is tell Google et al. which VPN provider you’re a customer of - i.e. you’re giving them even more data that they don’t need to have.
That’s why I don’t even bother with a VPN. I only use one to evade geo-blocking every once in a while.