Slashdot Mirror
Two-Thirds of Tech Workers Now Use a VPN, Survey Finds (9to5mac.com)
An anonymous reader shares a report: According to a survey, 65% of U.S. tech sector workers now use a virtual private network (VPN) on either work devices, personal ones or both. While much of that usage will be because it's installed as standard on work devices, a growing number of people are choosing to use a VPN on their own devices in response to past and proposed legislative changes. The Wombat Security survey found that 41% of those surveyed use a VPN on their personal laptop, with 31% doing so on mobile devices.
I have three different VPNs for work.
First law of people: People are generally stupid.
I have a VPN autolaunch on my laptop when I sart-up because I travel about 50% of my time and I am frequently on some random wifi connection. I was recently taken aside by an IT person who asked me very suspiciously why I was running a VPN. My response was "Almost everyone here works remotely at some point during the week. Isn't everyone running a VPN?" He grumbled something and walked off.
I used to use VPN on my Mac to connect to work until Apple broke PPTP in Sierra. I'm not bitter..... grrrr
As for pubilc wifi, I use OpenVPN back to my home router.
As for sending secrets to wikileaks, I use dual VPN (IP Vanish) and the tails OS through the TOR proxy.
This survey is useless. It includes work-issued devices (where the VPN client is installed for corporate privacy) and doesn't specify the end user's purpose for using a VPN.
Said the AC.
It little behooves the best of us to comment on the rest of us.
Seems to me like the classic metrics analysis mistake of measuring the wrong thing for your desired conclusion. Using a VPN... to do what, and why? To access internal company systems while you're working remotely? To fool content geolocation restrictions? To browse the web when you want privacy? Because your Internet-savvy friend or computer repair-person told you you should?
If we're to draw more meaningful conclusions from a survey like this, we'd need to know more about the reasons behind each responder's choice.
Not mentioned in the study: 60% use a VPN to bypass a geoblocked hulu.
bickerdyke
Do they mean to say that the VPNs are used for everyday browsing? Or in order to do work that requires connecting to computer via WAN? There are some regulations that require VPN in certain circumstances. For instance HIPPA regulations require VPC connection(s) for use in anything that sends/receives medical records.
At any rate, how is this news for those of us in the field? Kinda looks like FUD.
I use a VPN on all my devices. I don't want Comcast/Verizon/etc making me the product if I'm not getting a cut.
About a meaningless statistic.
DACA...is CACA
I use my work laptop to work from home over the company VPN. It's necessary to use it to do any work, and makes perfect sense.
I have a personal VPN that connects my home computer (on my xDSL connection), my server (VPS in a data centre) and my car's computer (connected by cellular data) so that I can securely transmit information between them, and not have to worry about the fact that 2 of those 3 devices are on dynamic IPs.
But I don't use a VPN for general internet use because it slows down the connection and racks up billable data usage at 2 locations (home and server) instead of just 1 location (home).
Sure, I know people are probably spying on me, but the tradeoff just isn't really worth it.
Had a couple different VPN solutions to access work-related services externally.
There was no other way to access them externally without a VPN.
Personal VPN services are a horse of a different color, as in much more optional, depending on what you're doing on the Internet. I have one for accessing services on my home network from outside the home network for example.
I work for the government of Canada and use a VPN from my own laptop to get into, and do, work. The shitty laptops they give out are garbage. I VM'd mine and use it in VirtualBox with double the memory and cores of the physical box. Can even get into the core data centers with it: zero problems to date.
Our whole company was using VPN back in 2012 and it was considered standard practice at that point. Every company I've dealt with since then has also had VPN.
moox. for a new generation.
VPNs are part of a badly broken security model: the perimeter defense model. It doesn't work very well at small scales, definitely does not scale for large enterprises and generally creates a lot of misunderstandings that result in bad security decisions.
Google had a segmented perimeter defense model for several years, but has spent the last five years or so getting rid of it. The VPNs aren't entirely gone, but nearly so. You now have to get special permission to run a service that requires VPNs to access.
The perimeter defense model is based on the notion that it's possible to build a network that is physically secure and which contains only trusted, managed systems. The assumption is that any machine connected to the network is inherently trusted to some degree, and has access to some potentially-sensitive resources merely by virtue of being connected.
The problem is that it's cost-prohibitive to build a physically-secure network, and a management nightmare to try to ensure that only trusted systems can be connected to it. 802.11X authentication, which requires every device that connects to perform a cryptographic authentication, can help keep unauthorized devices off the network but it doesn't prevent sniffing or impersonation, and can't prevent compromised devices from exploiting the trust they're given.
That last point is a really telling one, because if you assume that there's some ambient authority available to any device on the network, you inevitably end up granting that ambient authority permission to access resources that only a subset of the connected devices should actually have. Also, for all of the systems that require more authorization than the ambient authority, you still have to have some sort of login system, either per application, or else build out some sort of single sign-on infrastructure.
The solution is a zero-trust network, where no device is assumed to have any authority merely by virtue of being connected, and all connections are end-to-end authenticated and encrypted. Then, a compromised device still can only access the resources that it is supposed to be able to access, because it doesn't have authorization for anything else. It also means there's no need to try to keep unauthorized devices off the network, and no worry about attackers having physical access to the network (other than DoS concerns). This approach does increase the importance of keeping all "legitimate" devices on the network secured and patched, but that really has to be done anyway.
Google's calls its version of this approach BeyondCorp. It's build around a set of proxies which take responsibility for user authentication and identification. User devices connect to the proxy (in the case of web apps it's a literal HTTPS proxy) and strongly authenticate themselves with username, password and two-factor auth token. The proxy then has an already strongly-secure connection to the backend system the user is trying to reach, and it forward's the user's request to the backend with the user's identity (in an HTTP header, for web requests). The backend (or a service it delegates to) can then decide whether the user is authorized to connect and use the service, and if so which parts of the service the user can use, what data the user can see, etc.
The approach divides authentication from authorization, doing the first in the proxy and the latter in the backend that knows what different users are allowed to do. The backend doesn't have to know anything about user authentication, meaning as authentication needs and approaches change, they can all be implemented in the client and proxy, without touching the backends. Meanwhile the proxy doesn't know anything about authorization; it's a backend-agnostic, general-purpose single sign-on service. And, of course, all connections are encrypted and authenticated, all the time.
What all of this means to Google employees is that there is exactly zero difference bet
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
With all the interesting workers and the private sector embracing VPN products and services?
..VPN connections by inserting an implant on routers that break VPNs’ key exchange process, opening virtually any VPN to direct surveillance."
XKeyscore https://en.wikipedia.org/wiki/... to find the user. A Turbulence like project to get into the users systems. https://en.wikipedia.org/wiki/...
NSA’s automated hacking engine offers hands-free pwning of the world (3/13/2014)
https://arstechnica.com/inform...
Domestic spying is now "Benign Information Gathering"
I dumped VPN at my company in favor of virtual desktops (vmware view). It is much safer, I don't have to worry about "dirty" outside computers connecting to the network. Instead, employees get the same desktop every time, the same resources every time. It's generally safer. The employees love it because it's generally much faster.
It's one of the few win-win scenarios in I.T. for mobile workers.
"A plan fiendishly clever in its intricacies"- Homer Simpson
So privacy isn't really dead?
Old school cost savings. I work I.T. from home. Since the company I work for provided me with VPN, they don't have to provide me with a company laptop. I also opted to avoid buying a separate device for work purposes until recently, due to a low salary.
I have a pro of "unnamed" (don't want to ad it) for life, since I got some deal off somewhere, I can't really use it daily, since my home internet connection isn't on good level (sad), but I use it pretty much always on my laptop, when on mobile wifi or some free wifi spot. It sometimes even skips view this ad for 30s then u can use wifi. Also tunneling to different location to access something is good, since for example most channels like Nat Geo have websites, you can view exclusives or for outsiders what it is unacessible, I get a region block. Since I can't in any way sign up for that website,, I must tunnel.