[gentoo-user] About to have fiber internet and need VPN info

[gentoo-user] About to have fiber internet and need VPN info

[Dale]

Howdy,

Fiber internet is right around the corner.  Some neighbors are already
connected and they working their way to my area.  Once I get connected,
I also want to use a VPN but only for some programs.  Example, I want
Ktorrent and a couple Firefox profiles to use VPNs but at least one
Firefox profile I want to remain outside of VPN.  I watched a few videos
but want to be sure I understand this right.  If I want software to use
a VPN, I put the IP address of the VPN into the proxy settings of the
program and that makes it use the VPN.  If I want it to not use the VPN,
I leave the settings as they are now.  Am I understanding this correctly? 

Also, the package I'm getting is 500Mbs/sec.  What speeds should I
really expect?  If memory serves me right, that is about 50MBs/sec, note
the size of the B.  By the way, that is about 50 times faster than what
I have now.  Also, up and down is the same.  Current up stream is a lot
smaller.  Basically, I can upload files as fast as I download them.  Now
I can upload videos or something. 

I'm looking at Surfshark and NordVPN.  Both seem to be good and at a
decent price.  Anyone used one or both of these?

Just trying to make sure I'm on the right path. 

Thanks.

Dale

:-)  :-) 

P. S.  Seamonkey is still not fetching emails automatically, I'm waiting
on a upgrade to see if it gets fixed then.  If not, revive old thread
and bring out the hammer.  ;-) 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Federico J. Denkena]

Hey,
NordVPN and Surfshark aren't really considered good VPNs. I'd instead suggest you take a look at Mullvad and IVPN (maybe ProtonVPN too if your threat
model doesn't include governments or any kind of law enforcement). A VPN tunnel basically routes all traffic directed at it to the VPN server, so
you'd probably have to employ something like split tunneling t keep traffic seperate (guide:
https://mullvad.net/en/help/split-tunneling-with-linux-advanced/) (basic guide: https://mullvad.net/en/help/split-tunneling-with-the-mullvad-app/).
And you'll need to always keep in mind that a VPN is a low-level protection. It's enough for protecting yourself against spammers, script kiddies or
similar but it can't keep you private in the face of any high-level threats. Don't place too much trust in VPNs.

Regards, 
F. Denkena

Am Samstag, dem 16.07.2022 um 05:57 -0500 schrieb Dale:
> Howdy,
> 
> Fiber internet is right around the corner.  Some neighbors are already
> connected and they working their way to my area.  Once I get connected,
> I also want to use a VPN but only for some programs.  Example, I want
> Ktorrent and a couple Firefox profiles to use VPNs but at least one
> Firefox profile I want to remain outside of VPN.  I watched a few videos
> but want to be sure I understand this right.  If I want software to use
> a VPN, I put the IP address of the VPN into the proxy settings of the
> program and that makes it use the VPN.  If I want it to not use the VPN,
> I leave the settings as they are now.  Am I understanding this correctly? 
> 
> Also, the package I'm getting is 500Mbs/sec.  What speeds should I
> really expect?  If memory serves me right, that is about 50MBs/sec, note
> the size of the B.  By the way, that is about 50 times faster than what
> I have now.  Also, up and down is the same.  Current up stream is a lot
> smaller.  Basically, I can upload files as fast as I download them.  Now
> I can upload videos or something. 
> 
> I'm looking at Surfshark and NordVPN.  Both seem to be good and at a
> decent price.  Anyone used one or both of these?
> 
> Just trying to make sure I'm on the right path. 
> 
> Thanks.
> 
> Dale
> 
> :-)  :-) 
> 
> P. S.  Seamonkey is still not fetching emails automatically, I'm waiting
> on a upgrade to see if it gets fixed then.  If not, revive old thread
> and bring out the hammer.  ;-) 
> 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 1394 bytes --]

>
> And you'll need to always keep in mind that a VPN is a low-level
> protection. It's enough for protecting yourself against spammers, script
> kiddies or
> similar but it can't keep you private in the face of any high-level
> threats. Don't place too much trust in VPNs.
>

I'm not an expert, but AFAIK VPNs don't offer any particular benefit with
regards to spam or script kiddies.

A VPN will;
- Hide your internet activity from your ISP
- Make your internet activity available to your VPN provider
- Make your internet activity available to your VPN provider's ISP

Without a VPN, your ISP could sell the details used to sign up for the
account (eg. name, phone number, email address) along with your internet
activity. With a VPN, the VPN provider could sell similar information,
however, there is typically an explicit claim that they won't do this,
whereas your ISP has probably buried information on what they do with your
information and metadata in Terms and Conditions documents. Your VPN
provider's ISP will be able to monitor your internet activity but it will
be mixed with the activity of the VPN provider's other customers, and they
won't have any of your sign up information.

I've heard some VPNs let you pay pseudo anonymously with crypto currency
(albeit with a cryptographically verifiable public ledger!), to prevent
direct matching of internet activity to an identity.

[-- Attachment #2: Type: text/html, Size: 1685 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Saturday, 16 July 2022 11:57:25 BST Dale wrote:

> Basically, I can upload files as fast as I download them.  Now I can upload
> videos or something. 

...or run a web server!

-- 
Regards,
Peter.

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Peter Humphrey wrote:
> On Saturday, 16 July 2022 11:57:25 BST Dale wrote:
>
>> Basically, I can upload files as fast as I download them.  Now I can upload
>> videos or something. 
> ...or run a web server!
>


That's way above anything I'd want to tackle.  Heck, this VPN thing is a
bit confusing.  I've never seen it used before so sort of lost with it. 
Maybe once installed it will make sense. 

Dale

:-)  :-) 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 907 bytes --]

On Sun, Jul 17, 2022 at 2:41 AM Dale <rdalek1967@gmail.com> wrote:

> Peter Humphrey wrote:
> > On Saturday, 16 July 2022 11:57:25 BST Dale wrote:
> >
> >> Basically, I can upload files as fast as I download them.  Now I can
> upload
> >> videos or something.
> > ...or run a web server!
> >
>
>
> That's way above anything I'd want to tackle.  Heck, this VPN thing is a
> bit confusing.  I've never seen it used before so sort of lost with it.
> Maybe once installed it will make sense.
>

That prompts the question - why do you want a VPN? (what do you think it
will do for you?)

If it's to get around geo-blocking, it's probably a good option if there's
no legal implications. If it's for something else it's probably worth
digging a bit deeper. If it's to try to avoid legal responsibility (eg. to
download copyrighted content), don't do anything you're not prepared to pay
the fine / do the time for.

[-- Attachment #2: Type: text/html, Size: 1349 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[thelma]

On 7/16/22 10:41, Dale wrote:
> Peter Humphrey wrote:
>> On Saturday, 16 July 2022 11:57:25 BST Dale wrote:
>>
>>> Basically, I can upload files as fast as I download them.  Now I can upload
>>> videos or something.
>> ...or run a web server!
>>
> 
> 
> That's way above anything I'd want to tackle.  Heck, this VPN thing is a
> bit confusing.  I've never seen it used before so sort of lost with it.
> Maybe once installed it will make sense.
> 
> Dale
> 
> :-)  :-)

Check out this post I made some time ago:
https://forums.gentoo.org/viewtopic-p-8028944.html#8028944

It might give you better understanding what it does, and how it is implemented.

OpenVPN is just encrypted communication between two networks over public internet (your ISP can not snoop on what you are doing).

Re: [gentoo-user] About to have fiber internet and need VPN info

[Mark Knecht]

[-- Attachment #1: Type: text/plain, Size: 978 bytes --]

On Sat, Jul 16, 2022 at 3:57 AM Dale <rdalek1967@gmail.com> wrote:
>
<SNIP>
> Also, the package I'm getting is 500Mbs/sec.  What speeds should I
> really expect?  If memory serves me right, that is about 50MBs/sec, note
> the size of the B.  By the way, that is about 50 times faster than what
> I have now.  Also, up and down is the same.  Current up stream is a lot
> smaller.  Basically, I can upload files as fast as I download them.  Now
> I can upload videos or something.

You will almost certainly get your 500Mb pretty much right away - or
within a day or two. I get 475Mb on my comcast cable connection
but it's rate limited at the other end. They sell and upgrade which
I don't need. At these speeds it's more about bytes/month than
bytes/second so make sure you know how much data you can move
without incurring any extra charges.

As for upload I'm limited at about 13Mb/S. I can upload lots of
data to a Google drive for backups but I have to do it slowly

- Mark

[-- Attachment #2: Type: text/html, Size: 1294 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

[-- Attachment #1: Type: text/plain, Size: 1998 bytes --]

Mark Knecht wrote:
>
>
> On Sat, Jul 16, 2022 at 3:57 AM Dale <rdalek1967@gmail.com
> <mailto:rdalek1967@gmail.com>> wrote:
> >
> <SNIP>
> > Also, the package I'm getting is 500Mbs/sec.  What speeds should I
> > really expect?  If memory serves me right, that is about 50MBs/sec, note
> > the size of the B.  By the way, that is about 50 times faster than what
> > I have now.  Also, up and down is the same.  Current up stream is a lot
> > smaller.  Basically, I can upload files as fast as I download them.  Now
> > I can upload videos or something.
>
> You will almost certainly get your 500Mb pretty much right away - or 
> within a day or two. I get 475Mb on my comcast cable connection
> but it's rate limited at the other end. They sell and upgrade which
> I don't need. At these speeds it's more about bytes/month than 
> bytes/second so make sure you know how much data you can move
> without incurring any extra charges. 
>
> As for upload I'm limited at about 13Mb/S. I can upload lots of
> data to a Google drive for backups but I have to do it slowly
>
> - Mark


If I understand this correctly, they are stating bits but most data
speeds are commonly in bytes.  I read once where one should divide by 8
or 9 to get the true speed in common use.  Internet folks use the larger
number because it makes it look bigger.  If I'm correct, and allowing a
little for overhead, I'll see about 50MBs/sec in common use terms.  In
other words, using none salesman terms. 

From what they state, there is no limits.  I may be a bit of a heavy
user at first but at some point, hard drive space will slow me down. 
I'm a collector of videos and other documents.  If I download it, I tend
to keep it unless it is really of no use.  I've got videos on appliance
repairs, tractor, tree management and just interesting stuff that I
refer back to.  It's a lot.  Organizing it is also fun. 

I'm hoping to get it pretty soon.  It's getting really close to me. 

Dale

:-)  :-) 

[-- Attachment #2: Type: text/html, Size: 3214 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Mark Knecht]

[-- Attachment #1: Type: text/plain, Size: 1267 bytes --]

On Sat, Jul 16, 2022 at 10:18 AM Dale <rdalek1967@gmail.com> wrote:

>
> If I understand this correctly, they are stating bits but most data
speeds are commonly in bytes.  I read once where one should divide by 8 or
9 to get the true speed in common use.  Internet folks use the larger
number because it makes it look bigger.  If I'm correct, and allowing a
little for overhead, I'll see about 50MBs/sec in common use terms.  In
other words, using none salesman terms.
>
> From what they state, there is no limits.  I may be a bit of a heavy user
at first but at some point, hard drive space will slow me down.  I'm a
collector of videos and other documents.  If I download it, I tend to keep
it unless it is really of no use.  I've got videos on appliance repairs,
tractor, tree management and just interesting stuff that I refer back to.
It's a lot.  Organizing it is also fun.
>
> I'm hoping to get it pretty soon.  It's getting really close to me.
>
> Dale

Comcast currently gives me 1.3T bytes/month download. I don't think they
limit my upload because with the low speed or upload no one will ever use
that much.

bits to bytes is *8. I typically use about 200G bytes/month so I'm a long
way from hitting the 1.3T Byte limit. I don't use much 4K video though.

[-- Attachment #2: Type: text/html, Size: 1515 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2838 bytes --]

On Saturday, 16 July 2022 18:17:35 BST Dale wrote:
> Mark Knecht wrote:
> > On Sat, Jul 16, 2022 at 3:57 AM Dale <rdalek1967@gmail.com
> > <mailto:rdalek1967@gmail.com>> wrote:
> > 
> > <SNIP>
> > 
> > > Also, the package I'm getting is 500Mbs/sec.  What speeds should I
> > > really expect?  If memory serves me right, that is about 50MBs/sec, note
> > > the size of the B.  By the way, that is about 50 times faster than what
> > > I have now.  Also, up and down is the same.  Current up stream is a lot
> > > smaller.  Basically, I can upload files as fast as I download them.  Now
> > > I can upload videos or something.
> > 
> > You will almost certainly get your 500Mb pretty much right away - or 
> > within a day or two. I get 475Mb on my comcast cable connection
> > but it's rate limited at the other end. They sell and upgrade which
> > I don't need. At these speeds it's more about bytes/month than 
> > bytes/second so make sure you know how much data you can move
> > without incurring any extra charges. 
> > 
> > As for upload I'm limited at about 13Mb/S. I can upload lots of
> > data to a Google drive for backups but I have to do it slowly
> > 
> > - Mark
> 
> If I understand this correctly, they are stating bits but most data
> speeds are commonly in bytes.  I read once where one should divide by 8
> or 9 to get the true speed in common use.  Internet folks use the larger
> number because it makes it look bigger.  If I'm correct, and allowing a
> little for overhead, I'll see about 50MBs/sec in common use terms.  In
> other words, using none salesman terms. 

1 byte = 8 bits

https://www.gbmb.org/mbps-to-mbs


> From what they state, there is no limits.  I may be a bit of a heavy
> user at first but at some point, hard drive space will slow me down. 
> I'm a collector of videos and other documents.  If I download it, I tend
> to keep it unless it is really of no use.  I've got videos on appliance
> repairs, tractor, tree management and just interesting stuff that I
> refer back to.  It's a lot.  Organizing it is also fun. 
> 
> I'm hoping to get it pretty soon.  It's getting really close to me. 
> 
> Dale
> 
> :-)  :-) 

Regarding VPNs and SOCKS proxy servers, a VPN works at layer 2 or 3 of the OSI 
model while a SOCKS proxy uses layer 5.

Simply, with VPN you tunnel all your connections to the Interwebs via a remote 
VPN server which acts as a router (full tunnel mode); or you tunnel some 
connections via the remote tunnel and some via your local ISP as usual (split 
tunnel).

With a SOCKS proxy you need to use an application which has a SOCKS client 
capability, or you can 'socksify' it with a separate piece of software, e.g. 
privoxy.

As has already been commented, unless you control both ends of a VPN tunnel, 
you should not assume privacy or anonymity despite marketing claims.

 

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Dale wrote:
> Howdy,
>
> Fiber internet is right around the corner.  Some neighbors are already
> connected and they working their way to my area.  Once I get connected,
> I also want to use a VPN but only for some programs.  Example, I want
> Ktorrent and a couple Firefox profiles to use VPNs but at least one
> Firefox profile I want to remain outside of VPN.  I watched a few videos
> but want to be sure I understand this right.  If I want software to use
> a VPN, I put the IP address of the VPN into the proxy settings of the
> program and that makes it use the VPN.  If I want it to not use the VPN,
> I leave the settings as they are now.  Am I understanding this correctly? 
>
> Also, the package I'm getting is 500Mbs/sec.  What speeds should I
> really expect?  If memory serves me right, that is about 50MBs/sec, note
> the size of the B.  By the way, that is about 50 times faster than what
> I have now.  Also, up and down is the same.  Current up stream is a lot
> smaller.  Basically, I can upload files as fast as I download them.  Now
> I can upload videos or something. 
>
> I'm looking at Surfshark and NordVPN.  Both seem to be good and at a
> decent price.  Anyone used one or both of these?
>
> Just trying to make sure I'm on the right path. 
>
> Thanks.
>
> Dale
>
> :-)  :-) 
>
> P. S.  Seamonkey is still not fetching emails automatically, I'm waiting
> on a upgrade to see if it gets fixed then.  If not, revive old thread
> and bring out the hammer.  ;-) 
>


I now have fiber internet.  It was installed on Tuesday morning.  Speed
test shows it is awesome.  I downloaded a Knoppix iso file, about 4.4GBs
worth, in just about 5 minutes.  It would have taken about 9 hours on
old DSL internet.  I'm perfectly happy with that.

I also ordered a router that has openvpn installed on it.  I watched
some videos and think I can set it up to keep my traffic out of public
view.  After I learned more about it, there's no reason to not use the
VPN for all traffic really.  That way I'm protected a little bit even if
a website is not secure.  May not help much but it may be enough. 

This is as big a difference as when I went from dial-up to DSL.  I can
update my OS in minutes as far as downloading goes.  Now it will be
compiling that I have to wait on.  Again.  ;-)

Now I know what some of you guys have been enjoying, and why. :-D 

Dale

:-)  :-) 

P. S.  Seamonkey still doesn't do email fetch automatically.  I may dig
out my mini sledge hammer.  :/ 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

On Thursday, 4 August 2022 23:32:03 BST Dale wrote:

> I also ordered a router that has openvpn installed on it.  I watched
> some videos and think I can set it up to keep my traffic out of public
> view.  After I learned more about it, there's no reason to not use the
> VPN for all traffic really.  That way I'm protected a little bit even if
> a website is not secure.

If by "not secure website" you mean an unencrypted connection to a web server, 
then such an insecure website remains insecure and so does your connection to 
it, whether the leg from your router to the VPN concentrator is encrypted or 
not.

What kind of protection are you seeking - what is your threat model?

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Michael wrote:
> On Thursday, 4 August 2022 23:32:03 BST Dale wrote:
>
>> I also ordered a router that has openvpn installed on it.  I watched
>> some videos and think I can set it up to keep my traffic out of public
>> view.  After I learned more about it, there's no reason to not use the
>> VPN for all traffic really.  That way I'm protected a little bit even if
>> a website is not secure.
> If by "not secure website" you mean an unencrypted connection to a web server, 
> then such an insecure website remains insecure and so does your connection to 
> it, whether the leg from your router to the VPN concentrator is encrypted or 
> not.
>
> What kind of protection are you seeking - what is your threat model?


I'm mostly wanting it so people can't just look and see what I'm doing
or where I am, mostly my ISP.  I do a little torrenting and such too.
;-)  That said, even if I go to my bank's website which is https, it
will also go through a VPN which also encrypts the traffic.  My bank is
secure as far as I know but having more protection added can't be a bad
thing. 

I'm torn between torguard and surfshark.  I'm not sure where torguard is
located but surfshark is in the Netherlands I think.  Outside US
jurisdiction and from what I've read, they never give info to anyone
about their customers traffic.  I'm still researching torguard.  Maybe
someone here knows where they are located???

I have a add-on for one of my Firefox profiles that adds a free VPN but
it is slow since it is free.  I've been using it for a while for some
stuff.  So far, I haven't visited my bank or anything with it tho.  It
remembers my location and if it says I've moved to some other place, it
might freak out a bit.  I still have a bit to learn about VPN but some
things I'm not going into in public. 

The biggest thing, the speed of my new internet is just awesome. 
Downloading that Knoppix ISO that would normally take almost half a day
but on fiber took minutes, very few of those even, was just plain
awesome.  Used to, I waited on the internet, now it waits on me.  If I
were to upgrade to the really fast one, I'd likely fall out of my
chair.  :/ 

Dale

:-)  :-) 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2309 bytes --]

On Friday, 5 August 2022 21:45:25 BST Dale wrote:
> Michael wrote:
> > What kind of protection are you seeking - what is your threat model?
> 
> I'm mostly wanting it so people can't just look and see what I'm doing
> or where I am, mostly my ISP.  

In this case 'people' and your ISP will see you are connecting to the remote 
VPN, but not what website you visit thereon.

The website you visit will not see your real IP, but the exit IP of the VPN 
node.  This may break some websites and streaming services who only allow 
connections from specific jurisdictions.


> I do a little torrenting and such too.
> ;-)  That said, even if I go to my bank's website which is https, it
> will also go through a VPN which also encrypts the traffic.  My bank is
> secure as far as I know but having more protection added can't be a bad
> thing. 

All connections to banks are encrypted end-to-end for decades now and the 
encryption has becoming stronger over the years.


> I'm torn between torguard and surfshark.  I'm not sure where torguard is
> located but surfshark is in the Netherlands I think.  Outside US
> jurisdiction and from what I've read, they never give info to anyone
> about their customers traffic.

Yeah, that's what they all say - their business model depends on it.  State 
sponsored actors are likely to know what the need to know anyway, with or 
without the explicit VPN providers collaboration.  ;-)


> I'm still researching torguard.  Maybe
> someone here knows where they are located???

I understand they are a US based provider in Florida:

Vpnetworks, LLC
618 E South St
Orlando, FL 32801

 but they have VPN servers all over the globe.  Some are virtual servers and 
are NOT physically located in the countries they claim.  The fact it is 
located in the USA it means the authorities can request client list 
information.  VPN providers in jurisdictions like BVI, Panama, or even 
Switzerland might stand a better chance.

Anyway, this is a moot point.  If a VPN provider protects your traffic from 
'people', who protects your traffic from the ... VPN people?!  LOL!

I don't use VPNs, but the interwebs are buzzing with reviews and suggestions.  
If torrenting is a requirement, then associated forums and mailing lists would 
provide advice on what works best for your use case.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Michael wrote:
> On Friday, 5 August 2022 21:45:25 BST Dale wrote:
>> Michael wrote:
>>> What kind of protection are you seeking - what is your threat model?
>> I'm mostly wanting it so people can't just look and see what I'm doing
>> or where I am, mostly my ISP.  
> In this case 'people' and your ISP will see you are connecting to the remote 
> VPN, but not what website you visit thereon.
>
> The website you visit will not see your real IP, but the exit IP of the VPN 
> node.  This may break some websites and streaming services who only allow 
> connections from specific jurisdictions.
>

That may be the case but if it is a problem I run into, I can adjust
settings if needed.  


>> I do a little torrenting and such too.
>> ;-)  That said, even if I go to my bank's website which is https, it
>> will also go through a VPN which also encrypts the traffic.  My bank is
>> secure as far as I know but having more protection added can't be a bad
>> thing. 
> All connections to banks are encrypted end-to-end for decades now and the 
> encryption has becoming stronger over the years.

That is likely true.  I still remember Snowden tho.  We don't know what
backdoors are in use even for bank encryption.  Thing is, open source
tools are harder to fall into that trap since everyone can see what the
code is.  If a backdoor is forced in, it will be known to a lot of
people and then that tool won't be used.  It's sort of funny in a way,
they more Govts and others try to restrict things, the more tools there
is to get around it.  From what I've read, most VPNs use open source
tools.  Most even use the current best and would upgrade if needed. 
That gives me some extra protection in the event my bank or any other
website falls behind on updating theirs. 

Basically, I don't trust Govt with much of anything.  If they say they
don't do something bad, you can pretty much bet they are doing exactly
that or even worse. 


>
>> I'm torn between torguard and surfshark.  I'm not sure where torguard is
>> located but surfshark is in the Netherlands I think.  Outside US
>> jurisdiction and from what I've read, they never give info to anyone
>> about their customers traffic.
> Yeah, that's what they all say - their business model depends on it.  State 
> sponsored actors are likely to know what the need to know anyway, with or 
> without the explicit VPN providers collaboration.  ;-)
>

May be the case but I plan to try anyway.  At least it won't be easy for
them. 

>> I'm still researching torguard.  Maybe
>> someone here knows where they are located???
> I understand they are a US based provider in Florida:
>
> Vpnetworks, LLC
> 618 E South St
> Orlando, FL 32801
>
>  but they have VPN servers all over the globe.  Some are virtual servers and 
> are NOT physically located in the countries they claim.  The fact it is 
> located in the USA it means the authorities can request client list 
> information.  VPN providers in jurisdictions like BVI, Panama, or even 
> Switzerland might stand a better chance.
>
> Anyway, this is a moot point.  If a VPN provider protects your traffic from 
> 'people', who protects your traffic from the ... VPN people?!  LOL!
>
> I don't use VPNs, but the interwebs are buzzing with reviews and suggestions.  
> If torrenting is a requirement, then associated forums and mailing lists would 
> provide advice on what works best for your use case.

Well, that settles that then.  I guess it will be Surfshark.  Pretty
sure it is in the Netherlands but may be wrong on country.  I just
recall it being outside US jurisdiction.  I also read they have been
audited by independent people to ensure they have no logs even if asked. 

Thanks for all the info.  Yours to Tastytea. 

Dale

:-)  :-) 

P. S.  Anyone need some used AT&T DSL modems?  I got a few. Some have
been updated with heat sinks on the chips which makes them run cooler. 
I got several Westel black ones and a couple smaller gray Motorola
ones.  I also have one that is a AT&T marked one.  They need a home. 
;-)  May start a new thread if no one replies here.  Kinda buried in
this thread.

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2509 bytes --]

On Saturday, 6 August 2022 07:07:26 BST Dale wrote:
> Michael wrote:
> > All connections to banks are encrypted end-to-end for decades now and the
> > encryption has becoming stronger over the years.
> 
> That is likely true.  I still remember Snowden tho.  We don't know what
> backdoors are in use even for bank encryption.

It's safer to assume state actors have full access to bank information.  The 
hope is bad guys don't get access too!  ;-)


> Thing is, open source
> tools are harder to fall into that trap since everyone can see what the
> code is.  If a backdoor is forced in, it will be known to a lot of
> people and then that tool won't be used.  It's sort of funny in a way,
> they more Govts and others try to restrict things, the more tools there
> is to get around it.  From what I've read, most VPNs use open source
> tools.  Most even use the current best and would upgrade if needed. 
> That gives me some extra protection in the event my bank or any other
> website falls behind on updating theirs. 

A VPN gives no end-to-end protection whatsoever in this scenario.  All you get 
is protection in the network connection between your PC and the VPN server.  
From the VPN server onward to your bank, the connection will be no more 
protected than whatever encryption protocol the bank offers.  Only a VPN 
server offered by your bank for connections to their network would afford 
additional protection in this scenario.


> Basically, I don't trust Govt with much of anything.  If they say they
> don't do something bad, you can pretty much bet they are doing exactly
> that or even worse. 

Heh!  After the Snowden revelations any such suspicions could be taken as a 
certainty.


[snip ...]
> Well, that settles that then.  I guess it will be Surfshark.  Pretty
> sure it is in the Netherlands but may be wrong on country.  I just
> recall it being outside US jurisdiction.  I also read they have been
> audited by independent people to ensure they have no logs even if asked. 

Surfshark gets good reviews and it offers the wireguard protocol with the 
ChaCha20 cipher for better encryption and performance.  However, the 
Netherlands is part of the EU and 14 eyes, so I would think similar state 
powers exist to access your private communications and the ISPs would have no 
way of refusing and staying in business.  Surfshark offers a warrant canary, 
but it looks more like a marketing statement to me when you compare it to 
something like the Qubes digitally signed canaries.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Michael wrote:
> On Saturday, 6 August 2022 07:07:26 BST Dale wrote:
>
>> Well, that settles that then.  I guess it will be Surfshark.  Pretty
>> sure it is in the Netherlands but may be wrong on country.  I just
>> recall it being outside US jurisdiction.  I also read they have been
>> audited by independent people to ensure they have no logs even if asked. 
> Surfshark gets good reviews and it offers the wireguard protocol with the 
> ChaCha20 cipher for better encryption and performance.  However, the 
> Netherlands is part of the EU and 14 eyes, so I would think similar state 
> powers exist to access your private communications and the ISPs would have no 
> way of refusing and staying in business.  Surfshark offers a warrant canary, 
> but it looks more like a marketing statement to me when you compare it to 
> something like the Qubes digitally signed canaries.


I forgot about the 14 eyes thing.  Do you know of one outside that that
is good?  The bad thing about most, they are pricey if done by the month
for testing.  You only get a good deal if you subscribe for a year or
even two years.  I don't want to subscribe and then find out it is a bad
one. 

Dale

:-)  :-) 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Dale]

Dale wrote:
> Michael wrote:
>> On Saturday, 6 August 2022 07:07:26 BST Dale wrote:
>>
>>> Well, that settles that then.  I guess it will be Surfshark.  Pretty
>>> sure it is in the Netherlands but may be wrong on country.  I just
>>> recall it being outside US jurisdiction.  I also read they have been
>>> audited by independent people to ensure they have no logs even if asked. 
>> Surfshark gets good reviews and it offers the wireguard protocol with the 
>> ChaCha20 cipher for better encryption and performance.  However, the 
>> Netherlands is part of the EU and 14 eyes, so I would think similar state 
>> powers exist to access your private communications and the ISPs would have no 
>> way of refusing and staying in business.  Surfshark offers a warrant canary, 
>> but it looks more like a marketing statement to me when you compare it to 
>> something like the Qubes digitally signed canaries.
>
> I forgot about the 14 eyes thing.  Do you know of one outside that that
> is good?  The bad thing about most, they are pricey if done by the month
> for testing.  You only get a good deal if you subscribe for a year or
> even two years.  I don't want to subscribe and then find out it is a bad
> one. 
>
> Dale
>
> :-)  :-) 
>


I did a quick google search and Surfshark is based in British Virgin
Islands and is outside the eyes countries.  I was thinking it was
Netherlands but wasn't sure.  When I searched for VPN outside 14 eyes
country, Surfshark is highly rated.  Depending on the site, it's in the
top few each time. 

https://earthweb.com/vpn-outside-14-eyes/

https://www.privateproxyguide.com/best-vpn-outside-14-eyes/

Unless there is some good reason to avoid, still thinking of using it. 

Dale 

:-)  :-) 

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Saturday, 6 August 2022 12:08:30 BST Dale wrote:

> I did a quick google search and Surfshark is based in British Virgin
> Islands and is outside the eyes countries.

According to [1], the BVI is "considered partners or affiliates of the fourteen 
eyes alliance."

1. https://www.securitymadesimple.org/cybersecurity-blog/fourteen-eyes-surveillance-explained

-- 
Regards,
Peter.

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2778 bytes --]

On Saturday, 6 August 2022 12:08:30 BST Dale wrote:
> Dale wrote:
> > Michael wrote:
> >> On Saturday, 6 August 2022 07:07:26 BST Dale wrote:
> >>> Well, that settles that then.  I guess it will be Surfshark.  Pretty
> >>> sure it is in the Netherlands but may be wrong on country.  I just
> >>> recall it being outside US jurisdiction.  I also read they have been
> >>> audited by independent people to ensure they have no logs even if asked.
> >> 
> >> Surfshark gets good reviews and it offers the wireguard protocol with the
> >> ChaCha20 cipher for better encryption and performance.  However, the
> >> Netherlands is part of the EU and 14 eyes, so I would think similar state
> >> powers exist to access your private communications and the ISPs would
> >> have no way of refusing and staying in business.  Surfshark offers a
> >> warrant canary, but it looks more like a marketing statement to me when
> >> you compare it to something like the Qubes digitally signed canaries.
> > 
> > I forgot about the 14 eyes thing.  Do you know of one outside that that
> > is good?  The bad thing about most, they are pricey if done by the month
> > for testing.  You only get a good deal if you subscribe for a year or
> > even two years.  I don't want to subscribe and then find out it is a bad
> > one. 
> > 
> > Dale
> > 
> > :-)  :-) 
> 
> I did a quick google search and Surfshark is based in British Virgin
> Islands and is outside the eyes countries.  I was thinking it was
> Netherlands but wasn't sure.

You were thinking correctly at the start.  Surfshark is located in the 
Netherlands since 2018 and has been bought out by Nord Security, who owns 
NordVPN.


> When I searched for VPN outside 14 eyes
> country, Surfshark is highly rated.  Depending on the site, it's in the
> top few each time. 
> 
> https://earthweb.com/vpn-outside-14-eyes/
> 
> https://www.privateproxyguide.com/best-vpn-outside-14-eyes/
> 
> Unless there is some good reason to avoid, still thinking of using it. 

The more you try to escape the 14 eyes Big Brother, the closer you may fall 
into the hands of various authoritarian regimes.  LOL!  Even VPNs like NordVPN 
which operates within the jurisdiction of Panama (let's not forget it is 
Langley's doorstep), it also has offices in the UK, Netherlands and Lithuania.  
I wonder why . . .

Total privacy on the Internet is improbable.  If your only concern is to 
retain your privacy from your ISP with regards to your Internet connections, 
then most/any VPN service will offer this benefit by obfuscating your IP 
address.  Your browsing patterns, browser User Agent, addons and umpteen other 
OS and application fingerprints won't be obfuscated beyond the VPN server.  
Therefore your identity can only be protected so much and no more.


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[William Kenworthy]

On 6/8/22 20:42, Michael wrote:
> On Saturday, 6 August 2022 12:08:30 BST Dale wrote:
> ...

> The more you try to escape the 14 eyes Big Brother, the closer you may fall
> into the hands of various authoritarian regimes.  LOL!  Even VPNs like NordVPN
> which operates within the jurisdiction of Panama (let's not forget it is
> Langley's doorstep), it also has offices in the UK, Netherlands and Lithuania.
> I wonder why . . .
>
> Total privacy on the Internet is improbable.  If your only concern is to
> retain your privacy from your ISP with regards to your Internet connections,
> then most/any VPN service will offer this benefit by obfuscating your IP
> address.  Your browsing patterns, browser User Agent, addons and umpteen other
> OS and application fingerprints won't be obfuscated beyond the VPN server.
> Therefore your identity can only be protected so much and no more.
>
Also, leakage is almost inevitable ... DNS, content distribution 
networks, browser fingerprinting, timezones, paying online with a US 
credit card, US delivery address and just simple mis-configuration 
exposing you to risk etc.  My impression as a long time openvpn user is 
that TOR and the TOR browser might be the closest to secure for your 
purposes? Also, keep in mind that things like online shopping will cost 
you more overseas because if you are successful in hiding you are in the 
US you will get the international surcharges, or in some cases ordering 
IT stuff from the US you have to fill out export clearances (once even 
for sparkfun hobby stuff!) :) ... then if you pay with a US card and/or 
have a US delivery address they have got you anyway - in fact being in 
Oz I gave it up as being no gain, too much pain to use a VPN try and get 
cheaper US shopping. I found myself having to maintain two totally 
independent systems with one in a locked down VPN with US settings with 
all traffic actively blocked from the local network, and use US shipping 
and packaging firms that offered facilities to buy on my behalf.  That 
is much harder than you think - trusting the end points is only one 
small part of the problem you are trying to solve and from the Gov 
monitoring point of view almost certainly a waste of time anyway as they 
have massive resources. The best you can hope for with openvpn is SSL 
point to point level security.  Just use HTTPS, a good browser and be 
part of the crowd - if you are trawling suspect/socially compromising 
websites you do not want anyone to see you going to, no matter what you 
do there will always be a risk and as a VPN user you are a more likely 
target for a closer look anyway.  I am sure the bigger online VPN 
providers would be monitored closely - at least TOR is likely to help 
more than a plain VPN.

BillK

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 3801 bytes --]

On Sunday, 7 August 2022 07:06:55 BST William Kenworthy wrote:
> On 6/8/22 20:42, Michael wrote:
> > On Saturday, 6 August 2022 12:08:30 BST Dale wrote:
> > ...
> > 
> > The more you try to escape the 14 eyes Big Brother, the closer you may
> > fall
> > into the hands of various authoritarian regimes.  LOL!  Even VPNs like
> > NordVPN which operates within the jurisdiction of Panama (let's not
> > forget it is Langley's doorstep), it also has offices in the UK,
> > Netherlands and Lithuania. I wonder why . . .
> > 
> > Total privacy on the Internet is improbable.  If your only concern is to
> > retain your privacy from your ISP with regards to your Internet
> > connections, then most/any VPN service will offer this benefit by
> > obfuscating your IP address.  Your browsing patterns, browser User Agent,
> > addons and umpteen other OS and application fingerprints won't be
> > obfuscated beyond the VPN server. Therefore your identity can only be
> > protected so much and no more.
> Also, leakage is almost inevitable ... DNS, content distribution
> networks, browser fingerprinting, timezones, paying online with a US
> credit card, US delivery address and just simple mis-configuration
> exposing you to risk etc.  My impression as a long time openvpn user is
> that TOR and the TOR browser might be the closest to secure for your
> purposes? Also, keep in mind that things like online shopping will cost
> you more overseas because if you are successful in hiding you are in the
> US you will get the international surcharges, or in some cases ordering
> IT stuff from the US you have to fill out export clearances (once even
> for sparkfun hobby stuff!) :) ... then if you pay with a US card and/or
> have a US delivery address they have got you anyway - in fact being in
> Oz I gave it up as being no gain, too much pain to use a VPN try and get
> cheaper US shopping. I found myself having to maintain two totally
> independent systems with one in a locked down VPN with US settings with
> all traffic actively blocked from the local network, and use US shipping
> and packaging firms that offered facilities to buy on my behalf.  That
> is much harder than you think - trusting the end points is only one
> small part of the problem you are trying to solve and from the Gov
> monitoring point of view almost certainly a waste of time anyway as they
> have massive resources. The best you can hope for with openvpn is SSL
> point to point level security.  Just use HTTPS, a good browser and be
> part of the crowd - if you are trawling suspect/socially compromising
> websites you do not want anyone to see you going to, no matter what you
> do there will always be a risk and as a VPN user you are a more likely
> target for a closer look anyway.  I am sure the bigger online VPN
> providers would be monitored closely - at least TOR is likely to help
> more than a plain VPN.
> 
> BillK

TBH I don't think even TOR is to be trusted 100%.  There must be 100s if not 
1000s of honeypot TOR servers set up with the purpose of harvesting comms and 
associating entry and exit patterns as part of regular internet surveillance 
work.

The best a well configured VPN tunnel can offer is a secure connection between 
client and VPN server, which is handy if you are out and about using untrusted 
and insecure WiFi hotspots.  In such a case, having configured your home/office 
router as a VPN server for free will allow you to use your client device as a 
roadwarrior, which should be just as effective as using some remote VPN 
service.

The only other reason for using a VPN service is to present a different 
geolocation for the purpose of overcoming country-specific website 
restrictions.  In this case a VPN service works effectively as a proxy server 
in changing your IP address.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Rich Freeman]

On Sun, Aug 7, 2022 at 11:36 AM Michael <confabulate@kintzios.com> wrote:
>
> The best a well configured VPN tunnel can offer is a secure connection between
> client and VPN server, which is handy if you are out and about using untrusted
> and insecure WiFi hotspots.
>
> The only other reason for using a VPN service is to present a different
> geolocation for the purpose of overcoming country-specific website
> restrictions.

I think ONLY is a bit strong here.  A VPN effectively makes it
impossible for your ISP to know who you're talking to, and it obscures
your IP from hosts you are connecting to.

Sure, there are ways to defeat this, but most of them are only
applicable for state-level actors, and the methods available to
ordinary companies can only identify at best a unique browser profile,
which only lets them correlate traffic with those they share info with
to the degree that you use a single browser profile across those
platforms.  For non-web traffic there are generally fewer attacks
available.  Many of the attacks that are often cited like DNS-based
attacks are not that difficult to prevent (eg by ensuring your DNS
traffic goes out over the VPN).

If there are sites you browse using a different browser profile
(ideally on a VM/etc), and you never use that browser profile for
ecommerce or activity associated with your normal social media
accounts, then it is unlikely that those sites will actually be able
to identify you.

Really the biggest pain with the VPNs is the number of websites that
actively try to block connections from them or flood you with
CAPTCHAs.  Many more mainstream social media sites/etc also
effectively require association with a mobile phone number, or trigger
this behavior if they don't like your IP address.  Obviously VPNs can
be abused to attack hosts or evade bans and generally cause trouble,
which is a frustration for those who simply don't want companies to
know who you are.

Bottom line is that just because the NSA can track your connections
doesn't mean that every random webserver on the planet can do so.  The
few government agencies that are likely to be that well-connected are
also very interested in keeping the extent of their capabilities
hidden from each other, and so when they intercept your data they're
going to guard it even more carefully than you would.  A solution
doesn't need to be able to defeat the NSA to be useful.

-- 
Rich

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 3448 bytes --]

On Sunday, 7 August 2022 19:27:42 BST Rich Freeman wrote:
> On Sun, Aug 7, 2022 at 11:36 AM Michael <confabulate@kintzios.com> wrote:
> > The best a well configured VPN tunnel can offer is a secure connection
> > between client and VPN server, which is handy if you are out and about
> > using untrusted and insecure WiFi hotspots.
> > 
> > The only other reason for using a VPN service is to present a different
> > geolocation for the purpose of overcoming country-specific website
> > restrictions.
> 
> I think ONLY is a bit strong here.  A VPN effectively makes it
> impossible for your ISP to know who you're talking to, and it obscures
> your IP from hosts you are connecting to.

Yes, fair point.  I was thinking why would you go to such an effort just to 
obscure your comms from your ISP.  I'm not saying there aren't use cases 
supporting this endeavor.  I was thinking more about political activists 
operating under oppressive regimes where state-level surveillance would be the 
threat model.  In this case I would think state actors wouldn't rely on ISPs 
alone to share such information, although ISP's data would be tapped into for 
good measure.


> Sure, there are ways to defeat this, but most of them are only
> applicable for state-level actors, and the methods available to
> ordinary companies can only identify at best a unique browser profile,
> which only lets them correlate traffic with those they share info with
> to the degree that you use a single browser profile across those
> platforms.  For non-web traffic there are generally fewer attacks
> available.  Many of the attacks that are often cited like DNS-based
> attacks are not that difficult to prevent (eg by ensuring your DNS
> traffic goes out over the VPN).

Yes, careful VPN implementations would guard against DNS leaks and the like.


> If there are sites you browse using a different browser profile
> (ideally on a VM/etc), and you never use that browser profile for
> ecommerce or activity associated with your normal social media
> accounts, then it is unlikely that those sites will actually be able
> to identify you.
> 
> Really the biggest pain with the VPNs is the number of websites that
> actively try to block connections from them or flood you with
> CAPTCHAs.  Many more mainstream social media sites/etc also
> effectively require association with a mobile phone number, or trigger
> this behavior if they don't like your IP address.  Obviously VPNs can
> be abused to attack hosts or evade bans and generally cause trouble,
> which is a frustration for those who simply don't want companies to
> know who you are.
> 
> Bottom line is that just because the NSA can track your connections
> doesn't mean that every random webserver on the planet can do so.  The
> few government agencies that are likely to be that well-connected are
> also very interested in keeping the extent of their capabilities
> hidden from each other, and so when they intercept your data they're
> going to guard it even more carefully than you would.

I would sincerely hope so.  Can't vouch their contractors and subcontractors 
would do the same in all cases though.


> A solution doesn't need to be able to defeat the NSA to be useful.

ACK.  It boils down to use cases and requirements.  I suppose people who seek 
to avoid state surveillance would probably use multilayered encryption and 
steganography, or better stay off the Internet all together?  ;-)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

>-----Original Message-----
>From: Michael <confabulate@kintzios.com> 
>Sent: Saturday, August 6, 2022 1:32 AM
>To: gentoo-user@lists.gentoo.org
>Subject: Re: [gentoo-user] About to have fiber internet and need VPN info
>
>On Saturday, 6 August 2022 07:07:26 BST Dale wrote:
>> Michael wrote:
>> > All connections to banks are encrypted end-to-end for decades now 
>> > and the encryption has becoming stronger over the years.
>> 
>> That is likely true.  I still remember Snowden tho.  We don't know 
>> what backdoors are in use even for bank encryption.
>
>It's safer to assume state actors have full access to bank information.  The hope is bad guys don't get access too!  ;-)
>

They have no reason to bother.  At least not in the USA.  US courts ruled decades ago that as soon as you give information to a third party you lose all expectation of privacy (yes, even if the third party promised privacy in the contract you have with them.)

Phone voice data and U.S. Mail are specifically protected legally, as are privileged communications with a lawyer, priest, or doctor (although that last category is so riddled with exceptions as to barely count).  Otherwise, anybody you do any business with at all can be forced to give up any and all records they have about you, no warrant required, and can be ordered not to tell you it's been done.

So government level actors spying on your banking just go to the bank.  And they've been getting more nosey in recent years.  Last I heard, any transaction over $600 gets automatically reported to them, and they keep talking about lowering that threshold.

LMP

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Monday, 8 August 2022 17:34:40 BST Laurence Perkins wrote:

> They have no reason to bother.  At least not in the USA.  US courts ruled
> decades ago that as soon as you give information to a third party you lose
> all expectation of privacy (yes, even if the third party promised privacy
> in the contract you have with them.)
 
> Phone voice data and U.S. Mail are specifically protected legally, as are
> privileged communications with a lawyer, priest, or doctor (although that
> last category is so riddled with exceptions as to barely count). 
> Otherwise, anybody you do any business with at all can be forced to give up
> any and all records they have about you, no warrant required, and can be
> ordered not to tell you it's been done.
 
> So government level actors spying on your banking just go to the bank.  And
> they've been getting more nosey in recent years.  Last I heard, any
> transaction over $600 gets automatically reported to them, and they keep
> talking about lowering that threshold.

Thank goodness I don't live in the good ol' US of A. The land of the free? 
Hm...

-- 
Regards,
Peter.

Re: [gentoo-user] About to have fiber internet and need VPN info

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

On Tue, 09 Aug 2022 00:04:53 +0100, Peter Humphrey wrote:

> > So government level actors spying on your banking just go to the
> > bank.  And they've been getting more nosey in recent years.  Last I
> > heard, any transaction over $600 gets automatically reported to them,
> > and they keep talking about lowering that threshold.  
> 
> Thank goodness I don't live in the good ol' US of A. The land of the
> free? Hm...

We still have the protections introduced by the EU. Let's hope the
government aren't about to tear them up... oh, they are.


-- 
Neil Bothwick

All things in moderation, ESPECIALLY moderation.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] About to have fiber internet and need VPN info

[Michael]

[-- Attachment #1: Type: text/plain, Size: 1128 bytes --]

On Tuesday, 9 August 2022 00:35:05 BST Neil Bothwick wrote:
> On Tue, 09 Aug 2022 00:04:53 +0100, Peter Humphrey wrote:
> > > So government level actors spying on your banking just go to the
> > > bank.  And they've been getting more nosey in recent years.  Last I
> > > heard, any transaction over $600 gets automatically reported to them,
> > > and they keep talking about lowering that threshold.
> > 
> > Thank goodness I don't live in the good ol' US of A. The land of the
> > free? Hm...
> 
> We still have the protections introduced by the EU. Let's hope the
> government aren't about to tear them up... oh, they are.

My understanding is the UK (and EU) are all the same if not worse in this 
respect.  Law stipulated protections on data privacy mostly apply to private 
companies, but do not exclude access to your data by governments.  As far as I 
recall there's not even a need to seek approval by a judge to do so anymore, 
although there will be some rudimentary 'supervision' of operatives by more 
senior ... operatives.  Ha!

It's probably safer to assume Internet and privacy are effectively quite 
orthogonal.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

>
>> 
>> Thank goodness I don't live in the good ol' US of A. The land of the 
>> free? Hm...
>
>We still have the protections introduced by the EU. Let's hope the government aren't about to tear them up... oh, they are.

America has been slowly going fascist for coming up on 100 years now.  That's what happens when you let your government run your schools and teach most of the children that the government is staffed by saints who only want to keep kids out of the coal mines and prevent businesses from poisoning their customers.

But the incompetent bungling surrounding the whole COVID mess seems to have a lot of people waking up to the fact that the clowns in charge don't even know what parts of the economy actually are "essential", and are more interested in maintaining their own power and status than actually being helpful.

So we'll see what happens as the food and fuel shortages keep rolling in.  

LMP

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

> -----Original Message-----
> From: Dale <rdalek1967@gmail.com> 
> Sent: Thursday, August 4, 2022 3:32 PM
> To: gentoo-user@lists.gentoo.org
> Subject: Re: [gentoo-user] About to have fiber internet and need VPN info
> 
> Dale wrote:
> > Howdy,
> >
> > Fiber internet is right around the corner.  Some neighbors are already 
> > connected and they working their way to my area.  Once I get 
> > connected, I also want to use a VPN but only for some programs.  
> > Example, I want Ktorrent and a couple Firefox profiles to use VPNs but 
> > at least one Firefox profile I want to remain outside of VPN.  I 
> > watched a few videos but want to be sure I understand this right.  If 
> > I want software to use a VPN, I put the IP address of the VPN into the 
> > proxy settings of the program and that makes it use the VPN.  If I 
> > want it to not use the VPN, I leave the settings as they are now.  Am I understanding this correctly?
> >
> > Also, the package I'm getting is 500Mbs/sec.  What speeds should I 
> > really expect?  If memory serves me right, that is about 50MBs/sec, 
> > note the size of the B.  By the way, that is about 50 times faster 
> > than what I have now.  Also, up and down is the same.  Current up 
> > stream is a lot smaller.  Basically, I can upload files as fast as I 
> > download them.  Now I can upload videos or something.
> >
> > I'm looking at Surfshark and NordVPN.  Both seem to be good and at a 
> > decent price.  Anyone used one or both of these?
> >
> > Just trying to make sure I'm on the right path.
> >
> > Thanks.
> >
> > Dale
> >
> > :-)  :-)
> >
> > P. S.  Seamonkey is still not fetching emails automatically, I'm 
> > waiting on a upgrade to see if it gets fixed then.  If not, revive old 
> > thread and bring out the hammer.  ;-)
> >
> 
> 
> I now have fiber internet.  It was installed on Tuesday morning.  Speed test shows it is awesome.  I downloaded a Knoppix iso file, about 4.4GBs worth, in just about 5 minutes.  It would have taken about 9 hours on old DSL internet.  I'm perfectly happy with that.
> 
> I also ordered a router that has openvpn installed on it.  I watched some videos and think I can set it up to keep my traffic out of public view.  After I learned more about it, there's no reason to not use the VPN for all traffic really.  That way I'm protected a little bit even if a website is not secure.  May not help much but it may be enough. 
> 
> This is as big a difference as when I went from dial-up to DSL.  I can update my OS in minutes as far as downloading goes.  Now it will be compiling that I have to wait on.  Again.  ;-)
> 
> Now I know what some of you guys have been enjoying, and why. :-D 
> 
> Dale
> 
> :-)  :-) 
> 
> P. S.  Seamonkey still doesn't do email fetch automatically.  I may dig out my mini sledge hammer.  :/ 
> 
> 

Most commercial VPN services are of limited value privacy-wise unless you use forged credentials to sign up and chain a couple of them together.

Otherwise you have only their word that they're not collecting exactly the same information your ISP would, and if you're worried about government spying you may as well paste a big sign saying "look here, this guy thinks he's being sneaky" all over your traffic.

The main place they're useful is if you want somebody a little bit more trustworthy than random open wifi hotspots to be the ones handling your data, or if you can get a VPN service provider in a country known not to cooperate with whoever the malicious actors are in your country.

With a full on fiber connection, as long as it doesn't violate your ISPs terms of use, if you want to hide what you're actually doing, proper configuration of tor and/or i2p will likely serve you better, and help other people in oppressive countries do the same.

That said, openvpn is still useful for point-to-point links between friends.  

Oh, and note that if your ISP works the same way as mine, they have a backdoor into whatever equipment they happen to have provided.  So definitely put it in bridge mode or whatever and use your own gear if you don't want them spying on the doings of your internal network.  One of the local ISPs here even calls it a "feature" and will ping the mobile app they require you to install to use their service every time they detect "suspicious" traffic on your internal net...

LMP

Re: [gentoo-user] About to have fiber internet and need VPN info

[Wol]

On 05/08/2022 15:53, Laurence Perkins wrote:
> Oh, and note that if your ISP works the same way as mine, they have a backdoor into whatever equipment they happen to have provided.  So definitely put it in bridge mode or whatever and use your own gear if you don't want them spying on the doings of your internal network.  One of the local ISPs here even calls it a "feature" and will ping the mobile app they require you to install to use their service every time they detect "suspicious" traffic on your internal net...

What do they do if you don't know how to use a mobile? (Yes that IS a 
serious question - I provide tech support to family like that :-)

Cheers,
Wol

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Saturday, 6 August 2022 00:05:20 BST Wol wrote:
> On 05/08/2022 15:53, Laurence Perkins wrote:
> > Oh, and note that if your ISP works the same way as mine, they have a
> > backdoor into whatever equipment they happen to have provided.  So
> > definitely put it in bridge mode or whatever and use your own gear if you
> > don't want them spying on the doings of your internal network.  One of
> > the local ISPs here even calls it a "feature" and will ping the mobile
> > app they require you to install to use their service every time they
> > detect "suspicious" traffic on your internal net...
> What do they do if you don't know how to use a mobile? (Yes that IS a
> serious question - I provide tech support to family like that :-)

...or if you use your own equipment?

-- 
Regards,
Peter.

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

> -----Original Message-----
> From: Peter Humphrey <peter@prh.myzen.co.uk> 
> Sent: Friday, August 5, 2022 4:36 PM
> To: gentoo-user@lists.gentoo.org
> Subject: Re: [gentoo-user] About to have fiber internet and need VPN info
> 
> On Saturday, 6 August 2022 00:05:20 BST Wol wrote:
> > On 05/08/2022 15:53, Laurence Perkins wrote:
> > > Oh, and note that if your ISP works the same way as mine, they have 
> > > a backdoor into whatever equipment they happen to have provided.  So 
> > > definitely put it in bridge mode or whatever and use your own gear 
> > > if you don't want them spying on the doings of your internal 
> > > network.  One of the local ISPs here even calls it a "feature" and 
> > > will ping the mobile app they require you to install to use their 
> > > service every time they detect "suspicious" traffic on your internal net...
> > What do they do if you don't know how to use a mobile? (Yes that IS a 
> > serious question - I provide tech support to family like that :-)
> 
> ...or if you use your own equipment?
> 
> --
> Regards,
> Peter.
> 

I would strongly recommend getting your own equipment with most ISPs since the rental price on their equipment will buy a new modem yearly.

Now, that said, the other ISP in the area also has a backdoor, and they try to connect to it any time they're running diagnostics, and if the connection fails then they reset the circuit.  So your choice is use one of their sanctioned models and leave the backdoor alone or else have sporadic dropouts.

LMP

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Monday, 8 August 2022 17:25:08 BST Laurence Perkins wrote:

> I would strongly recommend getting your own equipment with most ISPs since
> the rental price on their equipment will buy a new modem yearly.
> 
> Now, that said, the other ISP in the area also has a backdoor, and they try
> to connect to it any time they're running diagnostics, and if the
> connection fails then they reset the circuit.  So your choice is use one of
> their sanctioned models and leave the backdoor alone or else have sporadic
> dropouts.

Life isn't like that in the UK - at least, I hope not. I'm not aware of any 
such behaviour by my ISP.

-- 
Regards,
Peter.

Re: [gentoo-user] About to have fiber internet and need VPN info

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 673 bytes --]

On Tue, 09 Aug 2022 00:07:38 +0100, Peter Humphrey wrote:

> > Now, that said, the other ISP in the area also has a backdoor, and
> > they try to connect to it any time they're running diagnostics, and
> > if the connection fails then they reset the circuit.  So your choice
> > is use one of their sanctioned models and leave the backdoor alone or
> > else have sporadic dropouts.  
> 
> Life isn't like that in the UK - at least, I hope not. I'm not aware of
> any such behaviour by my ISP.

In the UK we get a choice of ISPs, so they have to behave, or at least be
more subtle about their misbehaving.


-- 
Neil Bothwick

Make like a tree and leave.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

>-----Original Message-----
>From: Peter Humphrey <peter@prh.myzen.co.uk> 
>Sent: Monday, August 8, 2022 4:08 PM
>To: gentoo-user@lists.gentoo.org
>Subject: Re: [gentoo-user] About to have fiber internet and need VPN info
>
>On Monday, 8 August 2022 17:25:08 BST Laurence Perkins wrote:
>
>> I would strongly recommend getting your own equipment with most ISPs 
>> since the rental price on their equipment will buy a new modem yearly.
>> 
>> Now, that said, the other ISP in the area also has a backdoor, and 
>> they try to connect to it any time they're running diagnostics, and if 
>> the connection fails then they reset the circuit.  So your choice is 
>> use one of their sanctioned models and leave the backdoor alone or 
>> else have sporadic dropouts.
>
>Life isn't like that in the UK - at least, I hope not. I'm not aware of any such behaviour by my ISP.

I've heard a few, similar stories from your side of the pond.  So far as I can tell it's a matter of incompetence, not maliciousness.  99% of their customers can barely use a computer, and anything that goes wrong, even locally, will get blamed on whichever service department said customer thinks of first.

Were it me running the show I'd have the backdoor only be active when somebody has pressed the WPS button on the router.  That would seem a good compromise between privacy and service.  But lots of ISPs have standard methods they developed in the 90s when the Internet was slightly friendlier and they often don't have anyone competent to update their policies on staff.

LMP

Re: [gentoo-user] About to have fiber internet and need VPN info

[Peter Humphrey]

On Tuesday, 9 August 2022 17:06:13 BST Laurence Perkins wrote:

> I've heard a few, similar stories from your side of the pond.  So far as I
> can tell it's a matter of incompetence, not maliciousness.

The word you want is 'malice'.

-- 
Regards,
Peter.

RE: [gentoo-user] About to have fiber internet and need VPN info

[Laurence Perkins]

>-----Original Message-----
>From: Wol <antlists@youngman.org.uk> 
>Sent: Friday, August 5, 2022 4:05 PM
>To: gentoo-user@lists.gentoo.org
>Subject: Re: [gentoo-user] About to have fiber internet and need VPN info
>
>On 05/08/2022 15:53, Laurence Perkins wrote:
>> Oh, and note that if your ISP works the same way as mine, they have a backdoor into whatever equipment they happen to have provided.  So definitely put it in bridge mode or whatever and use your own gear if you don't want them spying on the doings of your internal network.  One of the local ISPs here even calls it a "feature" and will ping the mobile app they require you to install to use their service every time they detect "suspicious" traffic on your internal net...
>
>What do they do if you don't know how to use a mobile? (Yes that IS a serious question - I provide tech support to family like that :-)
>
>
Their tech will set it up for you when he comes out to hook up the cables.  No, it's not been audited for security, so it could be doing anything at all to your phone.

LMP

Re: [gentoo-user] About to have fiber internet and need VPN info

[Rich Freeman]

On Sat, Jul 16, 2022 at 6:57 AM Dale <rdalek1967@gmail.com> wrote:
>
> I also want to use a VPN but only for some programs.  Example, I want
> Ktorrent and a couple Firefox profiles to use VPNs but at least one
> Firefox profile I want to remain outside of VPN.

I can't keep up with which VPNs are more or less scummy at any moment
in time, but I will comment on this bit and on the concept in general.

Controlling which HOSTS use a VPN is pretty straightforward via the
routing tables.  If you have a decent DHCP server and can issue
routers to individual hosts you can do it that way (most consumer
routers probably won't support this with their built-in DHCP).

Controlling it at the software level is a real PITA.  On an OS like
Windows I don't think it is even possible unless via SOCKS or
whatever.  On Linux you can do it with iproute2 and often netfilter is
needed as well.  Look up policy-based routing, and be prepared to do
some studying.  I'll tell you right now you probably don't want to do
it this way.  I think for outbound-only connections it isn't as hard
to do it at a uid level, so if you run software under different uids
that would make it easier.  If you want to handle inbound connections
on servers and have the replies not go out over the normal
destination-based route then you need to mark the connections using
netfilter and then set a policy routing for the replies, otherwise
your reply traffic will go out over the wrong router and have the
wrong IP and the other end won't associate it with the connection.  I
imagine you run into the same problems with any kind of use of NAT for
inbound forwarded traffic in a multi-homed situation.

Controlling routes by container is also a potential issue.  If you're
using a container technology that uses virtual interfaces that get
their own IPs/routing/etc then it is easy - same as host-level
routing.  If you're using something like Docker/k8s where it wants all
the outbound traffic to just go out from the host then it can be a
pain.  I think they can do macvlan but I think that has its own
issues.  That is actually something I'm trying to figure out for
myself.

Ok, topic change: the threat model.  As others have pointed out, the
VPN changes WHO can see your traffic, and that's mainly it.  I think
this is still a useful consideration, because in many places your ISP
is chosen by where you live, but with a VPN provider you can choose
anyone you want.  The ISP has no reason to earn your trust because
you're a captive audience, while a VPN provider who gets outed for
leaking private info basically is out of business.  So I think there
is a benefit.  However, you're going to be reducing your risk of being
traced by private companies here, like advertisers, intellectual
property enforcement companies, and so on.  If you're worried about
the NSA or some other state-level actor then you need to do a LOT more
to evade them.  I just assume the NSA has root on all my hosts
already, and I wish that they'd at least offer to sell backups of my
systems back to me so that I didn't need to keep my own...  :)

-- 
Rich