85
I hate how the privacy services shove in your face the "unprotected" word (lemmy.today)
submitted 5 months ago by to c/privacy@lemmy.ml
48 comments fedilink hide all child comments
 

You disable the VPN, they show "unprotected", come on, I'm not really unprotected, why such a dramatic word, I just disabled the thing a little, I'm "disconnected" but it doesn't mean I'm actually unprotected, the same way it doesn't mean I'm actually protected if I'm using a VPN.

you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 5 months ago (2 children)

VPN-alone is weak opsec. It changes your exit IP and that's the whole trick. Meanwhile your browser leaks entropy everywhere: user agent, screen size, timezone, installed fonts, canvas/WebGL hashes, audio fingerprint, and your extension list — each add-on detectable through web-accessible resources, injected DOM, blocked bait requests, or timing tells. uBlock + Privacy Badger + Stylus + some niche translator + Vimium = probably a globally unique signature that follows you across every VPN exit you use. EFF's Cover Your Tracks has been showing this for a decade. Customization is identity. And WebRTC just hands your real IP over anyway. STUN requests for peer discovery go straight through the tunnel in most default setups and leak both your local and real public IP to any page that asks — VPN connected, doesn't matter. DNS leaks work the same way: if the OS resolver isn't forced through the tunnel, you're querying your ISP while pretending to be in Romania. Add OS telemetry, background apps phoning home, clock skew, TLS fingerprints (JA3/JA4) — none of which a VPN touches — and the "I'm anonymous because VPN xyz" idea falls apart. Tor Browser exists exactly because the only winning move against fingerprinting is to look identical to everyone else. Anything custom is a name tag.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago* (1 child)

    1. No, changing your exit IP is not the whole trick. The whole trick is keeping your web traffic private from a snooping network operator, ISP, and the state, all of which a VPN is very good at, and is completely unaffected by anything else chatGPT just listed in your reply. None of those things are relevant to this conversation at all. You need to understand what a threat model is, and which one a VPN applies to.

    2. The fact that you had to resort to asking ChatGPT to reply to me is an admission that you have no idea what you’re talking about and never did. If you can’t even speak for yourself then we’re done here.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    There are cases where Iranian feminist authors and freedom fighters live in exile — for instance in Germany — and use their phones completely normally, whether Apple, Android, or whatever else. Yet Iranian agents still manage to track them. The reason is that the data is simply bought from data brokers: the Iranian regime purchases it and then sends people to observe these women in person.

    Data broker tracking can be curtailed with a VPN, but a VPN alone does relatively little. What matters more is blending into the largest possible crowd. The point of using something like a default Firefox setup isn't the browser itself — it's that you end up with the same screen resolution, the same fonts, the same default settings that the largest number of people on the planet also have. If your browser deviates from that baseline, then details such as when you're online, which apps you've installed, which websites you visit, which fonts and add-ons you have, your browser settings, your user agent, and so on, can uniquely identify you or single you out. The whole game is to keep the indistinguishable mass as big as possible: if someone knows the person they're hunting is in a certain group, you want that group to be huge.

    Once that fingerprint is known, you can be re-identified even under a different IP. So the data brokers who buy data from Facebook, Instagram, or wherever still have what they need. It's also been shown that apps communicate with each other in ways that allow unique attribution across them. And depending on which country you live in, default regional versions — US builds, Apple US, and the like — aren't necessarily privacy-compliant; whether that's actually illegal depends on the jurisdiction.

    On a desktop PC, the situation is similar. There it depends heavily on which browser you use. If you take a browser with completely default settings and then surf either with or without a VPN, you'll be recognized all the same — meaning users can be de-anonymized regardless. So it really doesn't help much at all.

    And while we're at it — go on, tell me what exactly in my last message you think I didn't come up with myself. Be specific. Which sentence, which idea? I'd genuinely like to know what you think was put in my head.

  • permalink
  • fedilink
  • source
  • parent