I don’t. Your ISP can hardly see anything you do online. Almost all websites are encrypted with HTTPS and if you are concerned about them seeing what domains you visit you can just change your dns server to quad9 or something else privacy respecting. A more valid usecase for VPN is preventing websites from tracking you IP address, downloading “Linux ISO’s” or bypassing geographical blocks and for that I used mullvad but I am looking for something else now that they blocked port forwarding.
If you torrent copyrighted material in Germany, you definitely want a VPN. Private law firms “representing copyright holders” regularly request information about consumers based on source IPs/protocol/ports from ISPs with a court’s rubber stamp, then send out demand letters for hundreds of euros, with a risk of thousands if you choose to fight it.
Sometimes they follow up if you ignore it, sometimes not. It is horribly oppressive.
tl;dr germans who torrent from a consumer internet service should use a vpn
Even DNS traffic and IP address and packet metadata is extremely valuable to ISPs like Comcast and AT&T. They use it to control what you can and can’t do – for example, throttling your access to streaming video services that compete with their own streaming products or partners’ products. They spent millions to overturn Net Neutrality regulations so they can use what they know about your traffic to monetize you (steer you to their products).
What would you suggest now? IVPN and mullvad used to be my go-to VPN providers but now that they both removed port forwarding I really don’t know what to use.
Yup. An ISP could potentially gain some information based on the IPs you’re hitting and the number/frequency of packets sent and received, but that would take serious logging and analysis on their part. It’s much easier to collect data through DNS requests.
Deep packet inspection by definition requires the ability to see inside the packet, which if using HTTPS wouldn’t be possible for your ISP.
They can still see the destination IP, return IP, and port number, but that’s it. It would take a ton of storage to log all of that packet data though, and it’d be difficult to come up with a way not to double count it if it’s going through multiple hops on the ISP network.
Logging DNS requests on the DNS server would be a much easier way of collecting that data if they wanted it. I know cloudflare collects aggregate DNS query data through their public DNS server, and Google likely does too.
@just_browsing I was just bullshitting. Sure, they would need a proxy of sorts and a certificate to open your packages if you use HTTPS. I suppose the only thing that can help with carrier surveillance is a good VPN or TOR. But even then, the VPN provider is a problem in and of itself.
I wont go into much detail but ISPs can act as intermediaries in https calls and TLS would work only between you and the ISP and then ISP and the requested server. Software like Zscaler does similar stuff you can look it up if you want
I’m familiar. Other than key exchange for encrypted connections, the whole point of HTTPS/TLS is establishing who you’re connecting with is who they say they are and preventing man in the middle attacks just like you described.
If your traffic was being intercepted by something like Zscaler it wouldn’t be able to provide the proper signed certificate of that web address and your browser would throw a mismatch error. IT departments using such intermediaries for https traffic inspection only get around this by installing the intermediaries’ root CA on your system so it’s not flagged by your browser or whatever you’re using for TLS traffic.
The only way someone could intercept your TLS traffic and then pass it onto you without you knowing is by having that website’s private key to sign the traffic with, which is a major security breach. As soon as something like that is discovered the certificate is revoked and a new one is issued with a different private key.
I don’t. Your ISP can hardly see anything you do online. Almost all websites are encrypted with HTTPS and if you are concerned about them seeing what domains you visit you can just change your dns server to quad9 or something else privacy respecting. A more valid usecase for VPN is preventing websites from tracking you IP address, downloading “Linux ISO’s” or bypassing geographical blocks and for that I used mullvad but I am looking for something else now that they blocked port forwarding.
If you torrent copyrighted material in Germany, you definitely want a VPN. Private law firms “representing copyright holders” regularly request information about consumers based on source IPs/protocol/ports from ISPs with a court’s rubber stamp, then send out demand letters for hundreds of euros, with a risk of thousands if you choose to fight it.
Sometimes they follow up if you ignore it, sometimes not. It is horribly oppressive.
tl;dr germans who torrent from a consumer internet service should use a vpn
Even DNS traffic and IP address and packet metadata is extremely valuable to ISPs like Comcast and AT&T. They use it to control what you can and can’t do – for example, throttling your access to streaming video services that compete with their own streaming products or partners’ products. They spent millions to overturn Net Neutrality regulations so they can use what they know about your traffic to monetize you (steer you to their products).
Mullvad was really good until they removed port forwarding
What would you suggest now? IVPN and mullvad used to be my go-to VPN providers but now that they both removed port forwarding I really don’t know what to use.
I’m in the same boat as you, but I heard good things about air vpn
Yeah I moved to airvpn and had 0 problems so far. Price is about the same
Yup. An ISP could potentially gain some information based on the IPs you’re hitting and the number/frequency of packets sent and received, but that would take serious logging and analysis on their part. It’s much easier to collect data through DNS requests.
@just_browsing
@cow DPI would probably be easier.
Deep packet inspection by definition requires the ability to see inside the packet, which if using HTTPS wouldn’t be possible for your ISP.
They can still see the destination IP, return IP, and port number, but that’s it. It would take a ton of storage to log all of that packet data though, and it’d be difficult to come up with a way not to double count it if it’s going through multiple hops on the ISP network.
Logging DNS requests on the DNS server would be a much easier way of collecting that data if they wanted it. I know cloudflare collects aggregate DNS query data through their public DNS server, and Google likely does too.
@just_browsing I was just bullshitting. Sure, they would need a proxy of sorts and a certificate to open your packages if you use HTTPS. I suppose the only thing that can help with carrier surveillance is a good VPN or TOR. But even then, the VPN provider is a problem in and of itself.
İ dont know if you are serious but https dors not mean anything, all major https websites are already decrypted anyways
Yeah… that’s not how TLS works.
I wont go into much detail but ISPs can act as intermediaries in https calls and TLS would work only between you and the ISP and then ISP and the requested server. Software like Zscaler does similar stuff you can look it up if you want
I’m familiar. Other than key exchange for encrypted connections, the whole point of HTTPS/TLS is establishing who you’re connecting with is who they say they are and preventing man in the middle attacks just like you described.
If your traffic was being intercepted by something like Zscaler it wouldn’t be able to provide the proper signed certificate of that web address and your browser would throw a mismatch error. IT departments using such intermediaries for https traffic inspection only get around this by installing the intermediaries’ root CA on your system so it’s not flagged by your browser or whatever you’re using for TLS traffic.
The only way someone could intercept your TLS traffic and then pass it onto you without you knowing is by having that website’s private key to sign the traffic with, which is a major security breach. As soon as something like that is discovered the certificate is revoked and a new one is issued with a different private key.
So, again, that’s just not how TLS works.
https://en.m.wikipedia.org/wiki/Public_key_infrastructure