In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:

  • Port forwarding support
  • Open source
  • Android app and Firefox extension available
  • Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 week ago* (last edited 1 week ago) (17 children)

Isn't ECH and DoH basically just using cloudflare as a VPN? I feel like a lot of privacy folk don't trust cloudflare, considering how much of the internet is now centralized on them I'm sure they're a juicy target for subpoenas.

Edit: also, if you use ECH and DoH and trust cloudflare, then what would be the point of the Oracle VPS?

  • source
  • parent
  • hideshow 17 child comments
  • [–] 1 point 6 days ago (16 children)

    You don't need to use cloudflare at all, use cloud 9 or adguard if you like those better

    If you don't trust any of them, you can use ODoH, where cloudflare gets an encrypted request from a proxy. The proxy is only aware of your IP and CF is only aware of the request and the proxy's IP. So if the proxy doesn't report your IP to CF, CF doesn't know who you are.

    You can host the ODoH relay on your VPS and it will protect your DNS queries from the provider, while being able to monitor that the provider doesn't send your IP to CF. CF gets queries from the VPS, but not able to see your real IP. Your ISP similarly only sees encrypted blobs.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 1 point 6 days ago* (last edited 6 days ago) (15 children)

    Tbh ODoH sounds like Tor but with much greater chance of collusion between proxy and resolver. I'd still trust it less than a reputable VPN.

    And hosting the ODoH on an Oracle VPS doesn't make it more trustworthy. Oracle has your credit card info. They could report or sell the info, and Cloudflare would now know that the VPS belongs to you, making the setup identical to just sending DoH requests directly to Cloudflare.

    Edit: also it seems like ECH only proxies the first packet, and your normal traffic would still go directly between you and the server, or your Oracle VPS and the server. A big part of VPNs is hiding your identity from the server. And VPNs mix the traffic of many customers, unlike a private VPS.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 1 point 5 days ago (14 children)

    The question is whether Oracle working together with Cloudflare is a more likely scenario or the "trusted" VPN provider literally selling your data anyway.

    I think a trusted DNS server and an Oracle proxy is going to be more secure than trusting one provider with all your data

  • source
  • parent
  • hideshow 14 child comments
  • [–] 1 point 4 days ago (13 children)

    They don't need to work together, they can just sell the data to the same company (Google, Facebook) or both get subpoena'd by the government.

    Their main business is not privacy. If they are caught selling data, they'll still survive. A VPN provider on the other hand would be staking their entire company.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 1 point 4 days ago (12 children)

    How would you correlate those two things? Let's say I access cloudflare DNS from one proxy and the request over the other proxy. How would Google know that they are the same device?

  • source
  • parent
  • hideshow 12 child comments
  • [–] 1 point 3 days ago (11 children)

    I'm not sure how many proxies you are using here but let's just take the example we covered earlier. You -> Oracle VPS (ODoH) -> Cloudflare -> DNS Server

    Oracle sells your data, so now Google knows you own that VPS. Cloudflare sells data too, so now Google knows that a ODoH request came from the VPS and requested the name resolution for xxx-website.com. Google connects the dots and knows that you tried to visit xxx-website.com.

    Regardless of what you do, your ip packets have to start from your device and end at the destination server. You can try to make it go through multiple hops (using Tor, multi-hop VPNs, ODoH, etc), but if any single entity has data from every hop, then the entire path can be reconstructed and your device is linked to the destination server. With multi-hop VPNs, you just have to trust the VPN provider. With Tor, hops are picked at random and you just hope that the intermediate servers aren't colluding.

    Oracle is not a privacy business, and they give away VPS for cheap or free. I wouldn't be surprised if they sold data of their customers.

    And again, if you are the only one using your VPS proxy server, then all the traffic from that VPS becomes a "fingerprint" of its own that can eventually identify you. This is called pseudonymity. Everybody has their own tastes and preferences after all, and traffic patterns can reveal that. With a Tor or VPN, you can constantly switch proxies, and your traffic is mixed with thousands of others, so extracting a single person's traffic becomes much harder.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 1 point 3 days ago (10 children)

    How does Google know the request is for example.com? It's encrypted. They only know my VPS requested some domain name from CF.

    You're assuming Oracle goes inside my VPS and dumps the RAM?

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 3 days ago (9 children)

    Because CF has to know the DNS request to ask the name server to resolve it. And CF sells the data to google.

    Oracle doesn't need to dump the ram. It can see the network packets coming from your device, to Cloudflare.

    It's a two hop path to the destination: you -> Oracle -> CF -> nameserver. If both Oracle and CF sell data to Google, then it's the same as both hops colluding, which reveals the entire path.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 2 days ago (8 children)

    It doesn't know it, it passes the encrypted content between the DNS resolver and the requester

    The packets are encrypted! Oracle doesn't know the keys unless they read the RAM of the VPS

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 2 days ago* (7 children)

    Doesnt matter if the packets are encrypted, they have a destination. It's like if you sent mail to a sketchy address, it doesn't matter if the envelope is never opened, the address is still on the envelope.

    So in this case the envelope would be going to cloudflare. Both Oracle and Cloudflare tell google about the envelope, and Cloudflare opens the envelope and tells google that the envelope was asking about xxx-website.com.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 day ago (6 children)

    The destination is to the DNS server. They can see I'm asking 9.9.9.9 for something maybe

    What does that tell oracle or google

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 day ago (5 children)

    Somebody has to know what website you're asking about. Either cloudflare resolves the name themselves, or they ask a nameserver. Then they tell google that you asked about it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 23 hours ago (4 children)

    That applies to any proxy server you use! Even if you use a VPN that accesses 9.9.9.9, 9.9.9.9 will know that VPN's IP address.

    In my case, 9.9.9.9 will know that CF asked for a resolution. But CF doesn't know the response because it's encrypted. So CF can't know what it was. 9.9.9.9 don't know who asked for it, but know what it is.

    The two websites must work together just to recover the IP that asked for the DNS request. Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 21 hours ago (3 children)

    If 9.9.9.9 is a normal name server, then CF's request to it is traditional DNS, in other words unencrypted. So CF absolutely knows the response. If CF does the resolution itself, in other words CF has their own name servers, then CF would again know the response, since it's their name servers.

    Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

    Just to be clear, so far we've been discussing ODoH and DNS specifically, and now you are mentioning the main web traffic. What proxy are you using here? Another Oracle VPS? Again, they could sell your data, and it's trivial to know what website the proxy is visiting by observing the destination IP address, so once the proxy is associated to you (when Oracle sells your data), those website visits get associated to you too.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 20 hours ago (2 children)

    9.9.9.9 supports DoH, so yes, if you access it over port 443 it will be https encrypted and CF won't be able to see what you're requesting

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 14 hours ago (1 child)

    If you are using 9.9.9.9 as a DoH provider, then afaik you wouldn't be using Cloudflare DoH anymore. Cloudflare isn't an https proxy for DoH. Cloudflare handles the DoH directly.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 13 hours ago

    I had them confused, CF is the target, not the proxy. The proxy would be another server, like SURF

    You can use your ISP's IP for DNS and the Oracle proxy for the requests.

    SURF sees CF ODoH request for example.com

    CF sees an encrypted DoH request to SURF from your ISP's address

    example.com sees a request from Oracle

    Oracle sees a request to the IP of example.com and encrypted packets from the ISP IP

    Cloudflare (now as host) gets a request from Oracle's IP with ECH SNI pointing to example.com

    Nobody actually knows you went to example.com and not some other cloudflare site

  • source
  • parent