In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:

  • Port forwarding support
  • Open source
  • Android app and Firefox extension available
  • Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 days ago (8 children)

How does Google know the request is for example.com? It's encrypted. They only know my VPS requested some domain name from CF.

You're assuming Oracle goes inside my VPS and dumps the RAM?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 2 days ago (7 children)

    Because CF has to know the DNS request to ask the name server to resolve it. And CF sells the data to google.

    Oracle doesn't need to dump the ram. It can see the network packets coming from your device, to Cloudflare.

    It's a two hop path to the destination: you -> Oracle -> CF -> nameserver. If both Oracle and CF sell data to Google, then it's the same as both hops colluding, which reveals the entire path.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 day ago (6 children)

    It doesn't know it, it passes the encrypted content between the DNS resolver and the requester

    The packets are encrypted! Oracle doesn't know the keys unless they read the RAM of the VPS

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 day ago* (5 children)

    Doesnt matter if the packets are encrypted, they have a destination. It's like if you sent mail to a sketchy address, it doesn't matter if the envelope is never opened, the address is still on the envelope.

    So in this case the envelope would be going to cloudflare. Both Oracle and Cloudflare tell google about the envelope, and Cloudflare opens the envelope and tells google that the envelope was asking about xxx-website.com.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 day ago (4 children)

    The destination is to the DNS server. They can see I'm asking 9.9.9.9 for something maybe

    What does that tell oracle or google

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 9 hours ago (3 children)

    Somebody has to know what website you're asking about. Either cloudflare resolves the name themselves, or they ask a nameserver. Then they tell google that you asked about it.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 7 hours ago (2 children)

    That applies to any proxy server you use! Even if you use a VPN that accesses 9.9.9.9, 9.9.9.9 will know that VPN's IP address.

    In my case, 9.9.9.9 will know that CF asked for a resolution. But CF doesn't know the response because it's encrypted. So CF can't know what it was. 9.9.9.9 don't know who asked for it, but know what it is.

    The two websites must work together just to recover the IP that asked for the DNS request. Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 hours ago (1 child)

    If 9.9.9.9 is a normal name server, then CF's request to it is traditional DNS, in other words unencrypted. So CF absolutely knows the response. If CF does the resolution itself, in other words CF has their own name servers, then CF would again know the response, since it's their name servers.

    Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

    Just to be clear, so far we've been discussing ODoH and DNS specifically, and now you are mentioning the main web traffic. What proxy are you using here? Another Oracle VPS? Again, they could sell your data, and it's trivial to know what website the proxy is visiting by observing the destination IP address, so once the proxy is associated to you (when Oracle sells your data), those website visits get associated to you too.

  • source
  • parent
  • hideshow 1 child comment