136
Looking for a good alternative to ProtonVPN (feddit.online)
submitted 1 week ago by to c/privacy@lemmy.world
72 comments fedilink hide all child comments
 

In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:

  • Port forwarding support
  • Open source
  • Android app and Firefox extension available
  • Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.

all 72 comments

sorted by: hot top controversial new old
[–] 34 points 1 week ago (10 children)

AirVPN user for the past few years. No complaints except their website user interface.

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 1 point 1 week ago (2 children)

    Really? A friend left AirVPN because of the connection always dropping. Dunno what they moved to afterwards, but no complaints in the group chat since. It was difficult to have a call with them because the connection just kept dropping a few minutes into the call.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 1 week ago (4 children)

    They seem legit except they discontinued port forwarding and they're out of my price range.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
    • [–] 8 points 1 week ago (3 children)

    Get yourself a cloud host with locations you want and run your own Algo VPN. It deploys in minutes, is disposable, and is completely under your control. Keeping one up 24/7 might cost $5/month depending on your host.

    Repo: https://github.com/trailofbits/algo/

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 3 points 1 week ago* (2 children)

    Even easier and super censorship-resistant (battle-tested in Russia of all places, where all conventional options are blocked): AmneziaVPN

    https://github.com/amnezia-vpn/amnezia-client (Also available on official website, Google Play and App Store. No Firefox extension is available, but Linux/Windows/MacOS apps are all in place)

    All you need to do is spin up a server on any VPS and give AmneziaVPN app root credentials to it. The rest will be done automatically within seconds. You don't need to set up anything manually. In fact, you never need to ssh to your VPS at all.

    (Obviously, do not use this installation method if you have anything else on the server. For that case, manual AmneziaWG install is available)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 week ago (1 child)

    A major selling point of VPNs is mixing the traffic of all users.

    If you are in a surveilled country, you're the only one using your VPS, and the destination server is in a surveilled country, then all your traffic will look like: you -> VPS -> destination. You would have to have multiple VPS servers in non-surveilled countries, and constantly rotate the servers to avoid the intermediate hops from getting associated to your identity, and that's hoping that the VPS company doesn't get subpoenad (since they likely have your credit card info and can leak your identity).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 week ago

    Indeed, that's an important point to remember.

    Personally, I place exit server in a jurisditction that doesn't answer to my local authorities, and have several other people use the server.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 8 points 1 week ago*

    Surfshark. Not open source. But so far works well for a decent price.

    Mullvad went fascist and doesn't work with streaming services.

    Still have protonvpn too, but it wasn't working well on my pc. Won't renew proton.

    And in the process of ditching other proton services too. What a shame. Unless they ditch Andy Yen, not going back.

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 1 week ago (1 child)

    Someone yesterday on Lenny mentioned Obscura which I hadn’t previously been aware of. Looks cool but that’s all I know. Planning on trying them out myself when my ProtonVPN subscription ends:

    https://obscura.com/

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 4 points 1 week ago

    Exit hops never see who you are Exit servers (run by Mullvad) connect you to the internet but never see your personal info. Obscura masks your real IP address when relaying to the exit server.

    Looks like it’s just mullvad in a trench coat.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 14 points 1 week ago (9 children)

    I’ve seen AirVPN and IVPN mentioned in this type of thread but haven’t fully evaluated them yet as I’m in the same situation of gathering options.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 5 points 1 week ago (4 children)

    They appear to be the only ethical 2 left since the mullvad incident

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] -1 points 1 week ago (3 children)

    What about Windscribe?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 1 week ago (2 children)

    https://www.techradar.com/vpn/vpn-privacy-security/windscribes-bizarre-ai-hitler-marketing-stunt-sparks-fury-and-vpn-subscription-cancellations

    windscribe is also bit weird to deal with. I have exchanged messages with their customer support or whatever on reddit and it wasn't ideal, and have also interacted with their ai chat on their website. I had issues with their product on linux and their ai gave me the console instructions that if entered would have deleted my operating system.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    Seems like they're trying to hard. Wow.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 week ago

    They are one of the ones who seem decent until you look into them more, or experience them for yourselves, but that is just my opinion. It pays to try to do your own research, that isn't necessarily easy with vpns, most of them are dodgy in one way, or another. If they offer 70% etc off deals... they are obviously trash, so that is a decent way to shorten your list, after that it gets more complicated.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 4 points 1 week ago (3 children)

    I'm considering them despite the UI issues and the fact that they don't have a Firefox extension. I just don't know if I want a service that doesn't have the latter. For context, I'm particular about the extension because I want to able to whitelist specific websites from the VPN. Currently, ProtonVPN's app doesn't offer that (and I'm not sure any other VPN offers that either) so I have to enable split tunneling to disable VPN for Firefox, then install the extension to use the VPN in Firefox, except for websites I've whitelisted.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 week ago (2 children)

    For context, I’m particular about the extension because I want to able to whitelist specific websites from the VPN

    If you are able to export VPN configurations, can't you use an extension like FoxyProxy for either of these? Admittedly, this can be a little tedious, and you might have to do some research first.

    Alternatively, you might want to see if you can just download a portable version of Firefox and exclude one of the Foxes through split tunneling.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 7 points 1 week ago (1 child)

    Does anyone know anything about NymVPN?

    https://f-droid.org/packages/net.nymtech.nymvpn

    Are there any trusted reviews for this?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 6 points 1 week ago

    I am going to recommend AzireVpn, I used to be a customer and was very happy, but switched to proton some years ago because I had my email with them. Not sure if their apps are open source and if they have browser extensions though.

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 1 week ago* (last edited 1 week ago) (1 child)

    Port forwarding seems difficult to find.

    Check out hide.me, compared here, and others compared at https://techlore.tech/vpn.

    I'm looking as well.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 1 week ago

    Njalla is the most trustworthy vpn, imo. The founder is one of the founders of the Pirate Bay. He is quite committed to privacy.

  • permalink
  • fedilink
  • source
    •
    [–] 2 points 1 week ago

    I'm still waiting for my mullvad VPN (fascist CEO) to end and decided to then switch to iVPN.

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 1 week ago (1 child)

    Ivpn, not really cheap though

    Riseup is also trustworthy, but its unbearably slow

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 1 point 1 week ago* (last edited 1 week ago)

    Maybe Softether vpngate client , or paid OpenVPN

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 1 week ago

    Ivpn, AirVPN, or cryptostorm

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 1 week ago

    I'm in the same ship and pretty stuck. Was just about to start paying for plus too, I was just waiting for Black Friday sales. What now? I liked Proton VPN because it is easy - download from Bazaar, log in, advanced kill-switch and auto-connect-minimised on. There doesn't seem to be easy competitors?

  • permalink
  • fedilink
  • source
    •
    [+] -8 points 1 week ago (31 children)

    You can self-host for free on Oracle. It only costs you your time

  • permalink
  • fedilink
  • source
  • hideshow 31 child comments
    •
  • [–] 15 points 1 week ago (30 children)

    Might as well sign up for googles VPN and install Metas AI agent as root.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 30 child comments
    •
  • [–] 1 point 1 week ago (29 children)

    You realize you can encrypt your traffic, get your DNS over HTTPS and use encrypted client hello (ECH), right? Oracle sees that you connect to some cloudflare or google IP, mostly. They can't even see which site you're going to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 29 child comments
    •
  • [–] 1 point 1 week ago* (last edited 1 week ago) (28 children)

    Isn't ECH and DoH basically just using cloudflare as a VPN? I feel like a lot of privacy folk don't trust cloudflare, considering how much of the internet is now centralized on them I'm sure they're a juicy target for subpoenas.

    Edit: also, if you use ECH and DoH and trust cloudflare, then what would be the point of the Oracle VPS?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 28 child comments
    •
  • [–] 1 point 1 week ago (27 children)

    You don't need to use cloudflare at all, use cloud 9 or adguard if you like those better

    If you don't trust any of them, you can use ODoH, where cloudflare gets an encrypted request from a proxy. The proxy is only aware of your IP and CF is only aware of the request and the proxy's IP. So if the proxy doesn't report your IP to CF, CF doesn't know who you are.

    You can host the ODoH relay on your VPS and it will protect your DNS queries from the provider, while being able to monitor that the provider doesn't send your IP to CF. CF gets queries from the VPS, but not able to see your real IP. Your ISP similarly only sees encrypted blobs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 27 child comments
    •
  • [–] 1 point 1 week ago* (last edited 1 week ago) (26 children)

    Tbh ODoH sounds like Tor but with much greater chance of collusion between proxy and resolver. I'd still trust it less than a reputable VPN.

    And hosting the ODoH on an Oracle VPS doesn't make it more trustworthy. Oracle has your credit card info. They could report or sell the info, and Cloudflare would now know that the VPS belongs to you, making the setup identical to just sending DoH requests directly to Cloudflare.

    Edit: also it seems like ECH only proxies the first packet, and your normal traffic would still go directly between you and the server, or your Oracle VPS and the server. A big part of VPNs is hiding your identity from the server. And VPNs mix the traffic of many customers, unlike a private VPS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 26 child comments
    •
  • [–] 1 point 1 week ago (25 children)

    The question is whether Oracle working together with Cloudflare is a more likely scenario or the "trusted" VPN provider literally selling your data anyway.

    I think a trusted DNS server and an Oracle proxy is going to be more secure than trusting one provider with all your data

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 25 child comments
    •
  • [–] 1 point 1 week ago (24 children)

    They don't need to work together, they can just sell the data to the same company (Google, Facebook) or both get subpoena'd by the government.

    Their main business is not privacy. If they are caught selling data, they'll still survive. A VPN provider on the other hand would be staking their entire company.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 24 child comments
    •
  • [–] 1 point 6 days ago (23 children)

    How would you correlate those two things? Let's say I access cloudflare DNS from one proxy and the request over the other proxy. How would Google know that they are the same device?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 23 child comments
    •
  • [–] 1 point 6 days ago (22 children)

    I'm not sure how many proxies you are using here but let's just take the example we covered earlier. You -> Oracle VPS (ODoH) -> Cloudflare -> DNS Server

    Oracle sells your data, so now Google knows you own that VPS. Cloudflare sells data too, so now Google knows that a ODoH request came from the VPS and requested the name resolution for xxx-website.com. Google connects the dots and knows that you tried to visit xxx-website.com.

    Regardless of what you do, your ip packets have to start from your device and end at the destination server. You can try to make it go through multiple hops (using Tor, multi-hop VPNs, ODoH, etc), but if any single entity has data from every hop, then the entire path can be reconstructed and your device is linked to the destination server. With multi-hop VPNs, you just have to trust the VPN provider. With Tor, hops are picked at random and you just hope that the intermediate servers aren't colluding.

    Oracle is not a privacy business, and they give away VPS for cheap or free. I wouldn't be surprised if they sold data of their customers.

    And again, if you are the only one using your VPS proxy server, then all the traffic from that VPS becomes a "fingerprint" of its own that can eventually identify you. This is called pseudonymity. Everybody has their own tastes and preferences after all, and traffic patterns can reveal that. With a Tor or VPN, you can constantly switch proxies, and your traffic is mixed with thousands of others, so extracting a single person's traffic becomes much harder.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 22 child comments
    •
  • [–] 1 point 5 days ago (21 children)

    How does Google know the request is for example.com? It's encrypted. They only know my VPS requested some domain name from CF.

    You're assuming Oracle goes inside my VPS and dumps the RAM?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 21 child comments
    •
  • [–] 1 point 5 days ago (20 children)

    Because CF has to know the DNS request to ask the name server to resolve it. And CF sells the data to google.

    Oracle doesn't need to dump the ram. It can see the network packets coming from your device, to Cloudflare.

    It's a two hop path to the destination: you -> Oracle -> CF -> nameserver. If both Oracle and CF sell data to Google, then it's the same as both hops colluding, which reveals the entire path.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 20 child comments
    •
  • [–] 1 point 4 days ago (19 children)

    It doesn't know it, it passes the encrypted content between the DNS resolver and the requester

    The packets are encrypted! Oracle doesn't know the keys unless they read the RAM of the VPS

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 19 child comments
    •
  • [–] 1 point 4 days ago* (18 children)

    Doesnt matter if the packets are encrypted, they have a destination. It's like if you sent mail to a sketchy address, it doesn't matter if the envelope is never opened, the address is still on the envelope.

    So in this case the envelope would be going to cloudflare. Both Oracle and Cloudflare tell google about the envelope, and Cloudflare opens the envelope and tells google that the envelope was asking about xxx-website.com.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 18 child comments
    •
  • [–] 1 point 4 days ago (17 children)

    The destination is to the DNS server. They can see I'm asking 9.9.9.9 for something maybe

    What does that tell oracle or google

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 17 child comments
    •
  • [–] 1 point 3 days ago (16 children)

    Somebody has to know what website you're asking about. Either cloudflare resolves the name themselves, or they ask a nameserver. Then they tell google that you asked about it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 1 point 3 days ago (15 children)

    That applies to any proxy server you use! Even if you use a VPN that accesses 9.9.9.9, 9.9.9.9 will know that VPN's IP address.

    In my case, 9.9.9.9 will know that CF asked for a resolution. But CF doesn't know the response because it's encrypted. So CF can't know what it was. 9.9.9.9 don't know who asked for it, but know what it is.

    The two websites must work together just to recover the IP that asked for the DNS request. Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 1 point 3 days ago (14 children)

    If 9.9.9.9 is a normal name server, then CF's request to it is traditional DNS, in other words unencrypted. So CF absolutely knows the response. If CF does the resolution itself, in other words CF has their own name servers, then CF would again know the response, since it's their name servers.

    Bit that doesn't link that IP to the proxy that browsed the website, since you can use different IPs for both requests

    Just to be clear, so far we've been discussing ODoH and DNS specifically, and now you are mentioning the main web traffic. What proxy are you using here? Another Oracle VPS? Again, they could sell your data, and it's trivial to know what website the proxy is visiting by observing the destination IP address, so once the proxy is associated to you (when Oracle sells your data), those website visits get associated to you too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 1 point 3 days ago (13 children)

    9.9.9.9 supports DoH, so yes, if you access it over port 443 it will be https encrypted and CF won't be able to see what you're requesting

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] 1 point 3 days ago (12 children)

    If you are using 9.9.9.9 as a DoH provider, then afaik you wouldn't be using Cloudflare DoH anymore. Cloudflare isn't an https proxy for DoH. Cloudflare handles the DoH directly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 1 point 2 days ago (11 children)

    I had them confused, CF is the target, not the proxy. The proxy would be another server, like SURF

    You can use your ISP's IP for DNS and the Oracle proxy for the requests.

    SURF sees CF ODoH request for example.com

    CF sees an encrypted DoH request to SURF from your ISP's address

    example.com sees a request from Oracle

    Oracle sees a request to the IP of example.com and encrypted packets from the ISP IP

    Cloudflare (now as host) gets a request from Oracle's IP with ECH SNI pointing to example.com

    Nobody actually knows you went to example.com and not some other cloudflare site

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 1 point 2 days ago (10 children)

    Based on my understanding of DoH and ODoH this doesn't sound right at all.

    CF is a DoH provider. They receive DNS requests wrapped in HTTPS, they unwrap it and then resolve the DNS request, and send the response back wrapped in an HTTPS response. There are no other parties necessary. No ISP, no SURF, no Oracle. Besides, since CF unwraps the HTTPS request, CF already knows everything about the DNS request. Adding more parties just means more people know about the request.

    You can optionally add a proxy between you and the DoH provider (in this case CF). This is ODoH. This proxy can be an Oracle VPS. So in total there's three parties: you -> Oracle -> CF. If Oracle and CF sell data to Google, then the DNS request gets tied back to you.

    If you have some resource explaining the packet flow that you are talking about, please link it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 1 point 1 day ago (9 children)

    I would use surf in this example for the proxy in ODoH, so that Oracle wouldn't see my queries. That way Oracle just sees the IP address from my ISP connecting to the server and connections to some random CF IP. It doesn't know the domain name I'm connecting to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 1 day ago (8 children)

    It's not clear what you're talking about. Are you saying you use Surf + Cloudflare for your DNS traffic and Oracle for your non-DNS traffic? What the exact path that your packets are following?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 1 day ago (7 children)

    Yes, that's my idea, in this case surf and CF need to collude.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 day ago (6 children)

    So it's the same thing then. You now have to trust that SURF is not selling data to Google. I've never heard of SURF before, they haven't built a reputation in the privacy community, what reason is there to trust them.

    And since you're using Oracle as a VPN for your web traffic, Oracle still knows all the websites you're visiting. Oracle may not see your DNS requests, but they still see the IP addresses that your web traffic is going to. It isn't hard to do WHOIS or reverse DNS lookup to figure out what websites those are.

    To be honest it sounds like you aren't that clear on how these technologies work and how they compare to VPNs and Tor. It definitely sounds like you haven't actually set up ODoH before, and yet you are recommending it. Maybe refrain from giving advice to others until you have more experience.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 day ago (5 children)

    Oracle doesn't know what website I'm visiting. They know the IP

    Let's say you see that I connected to the IP 168.107.12.213

    What does that tell you? I honestly couldn't find much other than it's in Korea. Can't even find the address of the website that's using it. What can you tell me about this IP?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 day ago* (last edited 1 day ago) (4 children)

    A single example doesn't say much. First off, most major websites can be determined by a whois or reverse dns lookup of their IP. 80% of your browsing history is still a lot of data.

    However as you've noticed, IP addresses don't always give away the website. The website owner might enabled registrar privacy. However that won't do much against a big tech company like Google, who can track and maintain mappings between websites and IPs. So if Oracle were to sell your proxy's traffic data to Google, Google could figure out what websites these IPs were correlated to.

    This doesn't always work though. Sometimes multiple websites are behind a CDN like Cloudflare, so the IP is just cloudflare's IP. This would be harder for Google to analyze, but it's still information. If Google has other data about the traffic, like timing data and payload sizes, they could guess which Cloudflare website it corresponds to. And even if they couldn't figure it out in the end, again, 80% of your data is still a lot of data.

    Edit: also, if you are now making the argument that IP address data does not reveal anything, then you are conceding that Oracle is not trustworthy from a privacy standpoint. In which case, why use an Oracle VPS at all? Why not just make those HTTPS requests from your home IP? All your ISP sees are requests to IP addresses, so according to you that should be fine right?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 9 hours ago (1 child)

    Yeah, but it doesn't say anything if I used a Google IP. I could be doing anything. Am I searching for something? Talking to AI? Remember that the VPS doesn't see any address or data, only IP.

    Furthermore, some sites work better with WARP than my IP address so some of the connections are outgoing to engage.cloudflareclient.com:2408 (warp will see my VPS address so it doesn't give CF any more info than going to a CF-hosted site)

    If I really cared about the privacy of the IPs of the sites, I could route everything through WARP. Then the VPS really doesn't know anything and CF only knows some VPS requested the data.

    I often change the Oracle VPS IP with a shell script. It's pointing to a subdomain, so the only way to get the address of the subdomain is to get the cert. I can configure nginx to block all requests without SNI so I don't serve the cert to people snooping.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 hours ago

    Remember that the VPS doesn't see any address or data, only IP.

    this is just DoH + HTTPS. You can use DoH and HTTPS with proxy or VPN, and your ISP would only see IP and not domain names or data.

    Furthermore, some sites work better with WARP

    Not relevant to this discussion, which has been about privacy from the beginning

    If I really cared about the privacy of the IPs of the sites, I could route everything through WARP

    WARP is just cloudflare's VPN. So, just like any other VPN, you would have to trust Cloudflare. Note that all your traffic to WARP would be tied to your Cloudflare account. Doesn't matter if you use a VPS as the first hop.

    I often change the Oracle VPS IP with a shell script.

    The issue from the beginning is that Oracle could simply be selling your data, which includes every VPS IP change. Oracle is not a privacy business, and really shouldn't be trusted

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 9 hours ago (1 child)

    I can't make those requests from my home IP because my ISP from home blocks certain websites. But the scheme I described is solid:

    ISP - Oracle - WARP with frequently changing IPs

    DNS with dnscrypt

    The only thing that could make it better is if the VPS had memory encryption to protect me from memory snooping attacks

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 4 hours ago

    As mentioned in a sibling comment, afaik all WARP traffic would be associated with your Cloudflare account. So the Oracle VPS doesn't matter anymore.

    And again, if both Cloudflare and Oracle are selling data to the same company (like Google), Google can reconstruct the entire path of your traffic, and your privacy is now reduced to the same as somebody who isn't using any proxies at all.

    A VPN relies on trust. As of now there's no getting around that. So the question is, is ProtonVPN/Mullvad/iVPN more trustworthy than Cloudflare and Oracle? I'd bet most privacy experts would say yes.

    my ISP from home blocks certain websites

    From the beginning this was about privacy. That's what the readers of your first comment would expect. I am simply explaining why replacing ProtonVPN with an Oracle VPS is a downgrade.

  • permalink
  • fedilink
  • source
  • parent