iopq comments on Looking for a good alternative to ProtonVPN

Looking for a good alternative to ProtonVPN (feddit.online)

submitted 1 week ago by smoothspoon@feddit.online to c/privacy@lemmy.world

68 comments fedilink hide all child comments

In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:

Port forwarding support
Open source
Android app and Firefox extension available
Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.

you are viewing a single comment's thread
view the rest of the comments

[–] iopq@lemmy.world 1 point 4 days ago (15 children)

It doesn't know it, it passes the encrypted content between the DNS resolver and the requester

The packets are encrypted! Oracle doesn't know the keys unless they read the RAM of the VPS

parent

hideshow 15 child comments

[–] hirihit640@sh.itjust.works 1 point 3 days ago* (14 children)

Doesnt matter if the packets are encrypted, they have a destination. It's like if you sent mail to a sketchy address, it doesn't matter if the envelope is never opened, the address is still on the envelope.

So in this case the envelope would be going to cloudflare. Both Oracle and Cloudflare tell google about the envelope, and Cloudflare opens the envelope and tells google that the envelope was asking about xxx-website.com.

parent

hideshow 14 child comments

[–] iopq@lemmy.world 1 point 3 days ago (13 children)

The destination is to the DNS server. They can see I'm asking 9.9.9.9 for something maybe

What does that tell oracle or google

parent

hideshow 13 child comments

[–] hirihit640@sh.itjust.works 1 point 2 days ago (12 children)

Somebody has to know what website you're asking about. Either cloudflare resolves the name themselves, or they ask a nameserver. Then they tell google that you asked about it.

parent

hideshow 12 child comments

[–] iopq@lemmy.world 1 point 2 days ago (11 children)

That applies to any proxy server you use! Even if you use a VPN that accesses 9.9.9.9, 9.9.9.9 will know that VPN's IP address.

In my case, 9.9.9.9 will know that CF asked for a resolution. But CF doesn't know the response because it's encrypted. So CF can't know what it was. 9.9.9.9 don't know who asked for it, but know what it is.

The two websites must work together just to recover the IP that asked for the DNS request. Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

parent

hideshow 11 child comments

[–] hirihit640@sh.itjust.works 1 point 2 days ago (10 children)

If 9.9.9.9 is a normal name server, then CF's request to it is traditional DNS, in other words unencrypted. So CF absolutely knows the response. If CF does the resolution itself, in other words CF has their own name servers, then CF would again know the response, since it's their name servers.

Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

Just to be clear, so far we've been discussing ODoH and DNS specifically, and now you are mentioning the main web traffic. What proxy are you using here? Another Oracle VPS? Again, they could sell your data, and it's trivial to know what website the proxy is visiting by observing the destination IP address, so once the proxy is associated to you (when Oracle sells your data), those website visits get associated to you too.

parent

hideshow 10 child comments

[–] iopq@lemmy.world 1 point 2 days ago (9 children)

9.9.9.9 supports DoH, so yes, if you access it over port 443 it will be https encrypted and CF won't be able to see what you're requesting

parent

hideshow 9 child comments

[–] hirihit640@sh.itjust.works 1 point 2 days ago (8 children)

If you are using 9.9.9.9 as a DoH provider, then afaik you wouldn't be using Cloudflare DoH anymore. Cloudflare isn't an https proxy for DoH. Cloudflare handles the DoH directly.

parent

hideshow 8 child comments

[–] iopq@lemmy.world 1 point 2 days ago (7 children)

I had them confused, CF is the target, not the proxy. The proxy would be another server, like SURF

You can use your ISP's IP for DNS and the Oracle proxy for the requests.

SURF sees CF ODoH request for example.com

CF sees an encrypted DoH request to SURF from your ISP's address

example.com sees a request from Oracle

Oracle sees a request to the IP of example.com and encrypted packets from the ISP IP

Cloudflare (now as host) gets a request from Oracle's IP with ECH SNI pointing to example.com

Nobody actually knows you went to example.com and not some other cloudflare site

parent

hideshow 7 child comments

[–] hirihit640@sh.itjust.works 1 point 1 day ago (6 children)

Based on my understanding of DoH and ODoH this doesn't sound right at all.

CF is a DoH provider. They receive DNS requests wrapped in HTTPS, they unwrap it and then resolve the DNS request, and send the response back wrapped in an HTTPS response. There are no other parties necessary. No ISP, no SURF, no Oracle. Besides, since CF unwraps the HTTPS request, CF already knows everything about the DNS request. Adding more parties just means more people know about the request.

You can optionally add a proxy between you and the DoH provider (in this case CF). This is ODoH. This proxy can be an Oracle VPS. So in total there's three parties: you -> Oracle -> CF. If Oracle and CF sell data to Google, then the DNS request gets tied back to you.

If you have some resource explaining the packet flow that you are talking about, please link it.

parent

hideshow 6 child comments

[–] iopq@lemmy.world 1 point 16 hours ago (5 children)

I would use surf in this example for the proxy in ODoH, so that Oracle wouldn't see my queries. That way Oracle just sees the IP address from my ISP connecting to the server and connections to some random CF IP. It doesn't know the domain name I'm connecting to.

parent

hideshow 5 child comments

[–] hirihit640@sh.itjust.works 1 point 15 hours ago (4 children)

It's not clear what you're talking about. Are you saying you use Surf + Cloudflare for your DNS traffic and Oracle for your non-DNS traffic? What the exact path that your packets are following?

parent

hideshow 4 child comments

[–] iopq@lemmy.world 1 point 15 hours ago (3 children)

Yes, that's my idea, in this case surf and CF need to collude.

parent

hideshow 3 child comments

[–] hirihit640@sh.itjust.works 1 point 14 hours ago (2 children)

So it's the same thing then. You now have to trust that SURF is not selling data to Google. I've never heard of SURF before, they haven't built a reputation in the privacy community, what reason is there to trust them.

And since you're using Oracle as a VPN for your web traffic, Oracle still knows all the websites you're visiting. Oracle may not see your DNS requests, but they still see the IP addresses that your web traffic is going to. It isn't hard to do WHOIS or reverse DNS lookup to figure out what websites those are.

To be honest it sounds like you aren't that clear on how these technologies work and how they compare to VPNs and Tor. It definitely sounds like you haven't actually set up ODoH before, and yet you are recommending it. Maybe refrain from giving advice to others until you have more experience.

parent

hideshow 2 child comments

[–] iopq@lemmy.world 1 point 13 hours ago (1 child)

Oracle doesn't know what website I'm visiting. They know the IP

Let's say you see that I connected to the IP 168.107.12.213

What does that tell you? I honestly couldn't find much other than it's in Korea. Can't even find the address of the website that's using it. What can you tell me about this IP?

parent

hideshow 1 child comment

[–] hirihit640@sh.itjust.works 1 point 9 hours ago* (last edited 9 hours ago)

A single example doesn't say much. First off, most major websites can be determined by a whois or reverse dns lookup of their IP. 80% of your browsing history is still a lot of data.

However as you've noticed, IP addresses don't always give away the website. The website owner might enabled registrar privacy. However that won't do much against a big tech company like Google, who can track and maintain mappings between websites and IPs. So if Oracle were to sell your proxy's traffic data to Google, Google could figure out what websites these IPs were correlated to.

This doesn't always work though. Sometimes multiple websites are behind a CDN like Cloudflare, so the IP is just cloudflare's IP. This would be harder for Google to analyze, but it's still information. If Google has other data about the traffic, like timing data and payload sizes, they could guess which Cloudflare website it corresponds to. And even if they couldn't figure it out in the end, again, 80% of your data is still a lot of data.

Edit: also, if you are now making the argument that IP address data does not reveal anything, then you are conceding that Oracle is not trustworthy from a privacy standpoint. In which case, why use an Oracle VPS at all? Why not just make those HTTPS requests from your home IP? All your ISP sees are requests to IP addresses, so according to you that should be fine right?

parent