A 14-Year-Old Asks: When Should I Get a VPN?

"One of my students sent me this letter," writes Slashdot reader Hasaf. "I have a good idea how I will answer, but I wanted to put it before the Slashdot community." The letter reads: Right now I am 14 years old, I was wondering when I should get a VPN... I was thinking about getting the yearly deal. But right now I really have no need for a VPN at the moment. I was thinking of getting a VPN when I'm in 11th grade or maybe in college. What do you think?
Of course, the larger question is what factors go into deciding whether your need to be using a VPN. So leave your best answers in the comments. When should you get your first VPN?

Comments

Ah, that question

[jawtheshark]

First thing is that you need to understand what exactly a VPN is and what it protects you form. People hear VPN associate it with privacy and security and think it's a magic pill. It isn't. It has very specific uses, and it can protect you in some ways, but in many it doesn't.

I always compare it with a very long cable that you stick into another network. Imagine, you are at McDonalds, and you could have a very long cable to your home network. You could access your NAS at home, surf from the IP address at home, all through that cable. That is what a VPN is: it allows you to plug into a different network. So what does this protect you from? In my example, from McDonalds and the other patrons on the McDonalds network. They can try to see what you do, but all they will see is the "cable" (the encrypted traffic) to a certain IP address (your home connection). What happens on that cable is opaque to them.

However, if you surf the Internet over a VPN, it has an endpoint. In my example, that would be your home connection. So the sites, you visit see your home connections IP, your parents still could have filtering software on that home connection, etc... It would be as if you were physically at home and no different. The sites you visit can still track you.

So, VPNs are basically good for three things:

• Hiding your geographical location
• Hiding your activity from the people that run your Internet connection (your ISP, McDonalds, your parents, etc...) However, you trade it for visibility of your activity to the people that run the VPN (or if you build your own, the people where your rent your VPS/server/connection).
• Accessing private resources on private networks. This is mostly in a business setting (granted, I do it too, but I'm a huge nerd)

So, now, with this information, you should be able to ask yourself: Is this the kind of functionality and protection I need? If no, you don't need a VPN. If yes, go ahead.

Re:Ah, that question

[Anonymous Coward]

You forgot to mention donkey porn

Re: Ah, that question

[Anonymous Coward]

Still, you can connect that VPN "cable" to a box at home running its own IP anonymizer, to further blur the origin, could you not?

Re: Ah, that question

[jawtheshark]

You can always take more measures, but it is not the VPN that does that. You can surf on the VPN using private mode only, never login anywhere, perhaps even use tor.... etc... but all that is not the VPN.

The point is that you need to understand the tool, before deciding to use the tool.

Re: Ah, that question

[Opportunist]

Yes, but it ain't turtles all the way down. At some point you have to exit your VPNs world and at that point, whoever you communicate with will get the information what that last endpoint, your "exit node" if you will, is. And could try to trace back from there if he has the means to, e.g. because you do something illegal and the ISP selling you the VPN has to hand out the information about who rented that box.

Re:Ah, that question

[Sad Loser]

So while I think that might be overkill, maybe it is simpler than my solution:

Main Browser
Firefox browser with random agent spoofer, noscript, privacy badger and adnauseam so that I am actively obfuscating tracking.

Secondary Browser
Secondary browser (chrome) that I use to book tickets, use web outlook or do anything that the main browser will sometimes break.

Tertiary browser
Use Torbrowser on the rare occassion that you really don't want to be tracked.

Re:Ah, that question

[Imrik]

One other thing VPNs are good for: controlling the routing of your data.

Re:Ah, that question

[AmiMoJo]

There is one other very important thing that a VPN protects you from: unwarranted surveillance.

Government agencies and in some countries ISP monitor and store everything. Law enforcement bypasses legal safeguards. A VPN doesn't make spying on you impossible, but it does stop it being so cheap and easy. It forces the proper channels and oversight to be used.

Re:Ah, that question

[Anonymous Coward]

There is one other very important thing that a VPN protects you from: unwarranted surveillance.

Government agencies and in some countries ISP monitor and store everything. Law enforcement bypasses legal safeguards. A VPN doesn't make spying on you impossible, but it does stop it being so cheap and easy. It forces the proper channels and oversight to be used.

For this to be true

• 1) you need to use a VPN in a different country
• 2) you need to be at least so secure that they are unlikely to automatedly break into either your computer or the VPN
• 3) you need to believe that the other country isn't

A VPN from the USA to e.g. Iceland is probably great for protecting you from big corporations trying to get you for copyright infringement. A normal VPN from Syria to the USA is very likely just painting a big target sign on your home. You will need to use other measures such as using public WiFi from a long distance, hiding your MAC address and IP address, cloaking traffic, time delays, tor and so on if you want a chance to get away from a serious opressive government.

Please don't tell people that a VPN will work without understanding and mitigating the risks they may take.

Re:Ah, that question

[jawtheshark]

There is one other very important thing that a VPN protects you from: unwarranted surveillance.

Government agencies and in some countries ISP monitor and store everything. Law enforcement bypasses legal safeguards. A VPN doesn't make spying on you impossible, but it does stop it being so cheap and easy. It forces the proper channels and oversight to be used.

Technically, that would be my second point, but I see why you would want to emphasize this.

Do keep in mind that this might not change much and you swap one surveillance for another. Recently I got myself a 1€/month VPS to use as a VPN. The locations I could chose were two European countries that were not particularly interesting to me, but the point of this VPS was to have privacy on a certain network that I don't trust, but it's free to use (unlike cellular data). My classical setup is basically OpenVPN with DNSMasq to avoid DNS leakage.

DNSMasq is easy because it turns your endpoint into your DNS based on its resolv.conf.

One day, got a really weird error for a site I frequent very irregularly. Very weird. To verify, I disconnected from the VPN and from the untrusted network and connect using cellular. Site worked fine. I looked deeper into it and it turns out that in that country, the site I wanted to visit is on a blacklist.

I surely ended up in some log file somewhere for trying to visit that site. That doesn't mean I ended up in full surveillance, but frankly, I was miffed.

So, I uninstalled DNSMasq and installed unbound instead as a full resolving DNS. The site now works flawlessly.

The lesson is: it's not because that you are on a VPN, that you cannot run into blocklists or surveillance. I'm also not naive. If the NSA or similar state entities want to see what I do, they will find out. They'll notice I connect to that VPS all the time, and will just start monitoring the endpoint.

Re:Ah, that question

[lhunath]

Furthermore, it's good to be explicit about what happens when you get a VPN through some provider.

In the same analogy, you essentially get a "very large cable" from that provider which you carry around with you. Anywhere you connect to the VPN, your network communication goes straight to the VPN provider.

What's really crucial to understand here is that you're effectively swapping out your ordinary service provider for your VPN service provider: McDonalds or your hotel, or your school can no longer monitor your network traffic, but your VPN provider can. In fact, you're essentially handing all of your Internet traffic to your VPN provider. That makes them a very interesting target for all sorts of surveillance: a single point of entry for all sorts of traffic that's trying to cover its tracks.

What that means for you is that you need to be extremely careful about which VPN provider you elect to connect to, because whatever you send into that cable, will come out on their end.

(Personal opinion follows: I quite like iVPN's services, their ideology, support for EFF, and their professionalism, as well as more uniquish features such as multi-hop connections)

Re: Ah, that question

[arth1]

and the ISP selling you the VPN has to hand out the information about who rented that box.

Only if the ISP is doing business in the same jurisdiction, or is in a country that is a de facto suzerainty to the country that seeks the information.
If in the US, avoid any ISP that has any office or serves in the US or any of the countries that roll over to please the US.

Re: Ah, that question

[bobdotexe]

Canvis fingerprint blocking too right?

Re:Ah, that question

[Anonymous Coward]

> Hiding your geographical location

I hear that is necessary in some countries where the government chases you (e.g. Russia, China) and in other countries where governmental agencies chase you (e.g. the USA). I mostly only complain about USA's usage of weird units, so I guess they got other guys to kill before caring about these issues... I hope.

> Hiding your activity from the people that run your Internet connection (your ISP, McDonalds, your parents, etc...) However, you trade it for visibility of your activity to the people that run the VPN (or if you build your own, the people where your rent your VPS/server/connection).

One can use two VPNs, one encrypted to connect to home and one encrypted to a VPN server elsewhere, bypassing your connection provider. Granted, the remote VPN server would know about what you do, but there's still the https encryption security, so they cannot really know what you're searching on Google (though Google knows, of course, so DuckDuckGo might be needed...). If I were really paranoid, I would concoct more complex schemes, but then again I don't deal with any sensitive subject.

> Accessing private resources on private networks. This is mostly in a business setting (granted, I do it too, but I'm a huge nerd)

I have that need, but I avoid it: I somewhat lack confidence that such thing could be done right by the Windows-environment we have at work. And they apparently lack confidence in themselves, too...

Also, "yuge". :-(

Re:Ah, that question

[whoever57]

Which opens an interesting question.

In the USA, we know that the NSA and/or other agencies have installed equipment to track and monitor users in the networks of ISPs.

What about datacenters? If I have a where the endpoint is a rented virtual private server in a datacenter, is the NSA also dumping that traffic? What about commercial VPNs? If the NSA can track the IP addresses used by commercial VPNs, it would not be difficult to dump all the traffic from a commercial VPN.

Re:Ah, that question

[AmiMoJo]

I'm sure datacentres are closely monitored. A VPN helps obfuscate the source of traffic, but it's not perfect. Even so, because it requires significant effort to de-anonymize the traffic flowing through the endpoint it prevents casual snooping and other abuses.

Re:Ah, that question

[Jiro]

I'll also point out that torrent sites often have scary-sounding warnings about how it is of the utmost importance that you use a VPN to protect your privacy. In fact, I would guess that this is where the 14 year old probably heard about it. Pay as much attention to those as you usually would to scary warnings on torrent sites, that is, not very much. Torrent crackdowns on individual users are very rare anyway.

The biggest situation where you may actually need a VPN is if your ISP throttles torrent speed and you can get around it using a VPN. (And if that was happening, I'd assume the poster would have mentioned it.)

Re: Ah, that question

[Anonymous Coward]

Any suggestions?

Re: Ah, that question

[dougdonovan]

if you have to ask. you dont need it.

Re:Ah, that question

[Aighearach]

There is one other very important thing that a VPN protects you from: unwarranted surveillance.

Well, don't forget to subtract the increased chances of having all your traffic recorded! I mean, maybe it protects you from surveillance, maybe it makes it more likely that you're on the list of people to surveil.

The reality is that you don't know; it isn't knowable. Who is being secretly watched is of course a secret, and the details and processes change over time, at unknown intervals. All the public data on it is suspect and could be designed just to get people used to being surveilled.

Other use cases, like for those of us who are actually creating a Virtual Private Network so that we can have private routing tunneled over a public network, well then we know exactly what we're getting, and indeed the tool is proven effective.

Re:Ah, that question

[Aighearach]

The first thing to understand is that there is no difference between "datacenter" and "ISP." The room at the ISP where the computers live is called the "datacenter," and a hosting company that has a datacenter is also known as an ISP.

I don't know about now, but around ~2002 when they were installing the stuff at a lot of places, they just had a network closet that the government controlled, (and rented from the ISP!) protected by access card. They simply route all the normal upstream traffic through that room; fiber going in, fiber coming back out. Presumably running through a passive tap that dumps out to somewhere; probably over their own VPN directly to their datacenter.

So the answer is potentially "yes," though the NSA would apparently split hairs and claim that even though your data is stored on their server, they didn't have "access" to your data until they typed a data search into their interface. Not everybody agrees that that is what the words mean.

The NSA almost always knows where your endpoints are. That's their job. And if they don't, they know it, and your name is probably on a list now.

Re:Ah, that question

[l0n3s0m3phr34k]

But you don't need to pay a monthly fee for that; you just need the proper firewall and client software. I think the submitter was more asking about a commercial VPN. Your description is what I would call a corporate VPN, just that it would be back to his house and not to a business. Looking at the current Slashdot Deals, I don't even see a "yearly" option.

Technically, there are only two "types" of VPNs: site-to-site (router-to-router) and Remote Access VPN. I'm not sure what his "yearly" one is exactly. What one would need depends on several factors; do you need access back to your "main network" from various remote connections (like coffee shops / school / libraries from your laptop / tablet)? Or are you trying to obfuscate your traffic and what IP your coming out of? Or a combination of both? Reading over a few on /. Deals it seems they are the later, and allow for multiple devices and exit out of various countries.

Personally, to be most secure, I would go with both some hardware router and a service. I would want a service that I could configure it as a site-to-site for their service, and then have RA on devices that I travel with. That way my network would always be accessible securely from the remote devices, and secure from there on out.

One issue, though: any site (like Gmail) will probably require re-auth every time your "remote" IP changes.

Re:Ah, that question

[l0n3s0m3phr34k]

Thus why Google started encrypting their DC-to-DC traffic four years ago. Microsoft is also doing the same. I would assume Amazon does the same, although I can't quickly find any article which they claim this.

Re: Ah, that question

[Anonymous Coward]

Palemoon has canvas poisoning built in

Re:Ah, that question

[pnutjam]

Bingo, you can't protect against everything, but you can make yourself a harder target.
For example, I store my address in my google maps address, because I use it to navigate traffic. I now this is a trade off, however, I don't tag it as my "home" address, which will obfuscate me from the majority of the automated processing.

Re:Ah, that question

[HermMunster]

He needs to do it now. Now is when he saves privacy. Now is when he stops the advertisers and all those trackers from building a profile. Now is when he makes the data they collect inconsistent and thus less valuable to them. Using a VPN is part of that.

I don't like using the word "hide". Instead I say protect and guard. He should be protecting his privacy now and guard the value of his property.

It is always best to not give into to the invasions of entities that just want to use you to make money.

Re:Ah, that question

[Anonymous Coward]

I think that the smarter thing for the kid to do is to make sure that he's not posting anything controversial as himself online. These days you can get fired for having a bad comment on Facebook. By not having a presence that creates trouble for you, you don't have to obfuscate your data transactions.

Re: Ah, that question

[shaitand]

"any of the countries that roll over to please the US"

Which is most all of them.

Re: Ah, that question

[arth1]

"any of the countries that roll over to please the US"

Which is most all of them.

Of the countries in the world, depending on how you count, the US does not have extradition treaties or mutual police cooperation with 83-88 of them. Quite a few of these offer VPN solutions.

And over the last couple of decades, relations have soured with several former partners too, especially where there are conflicting laws about human rights.
Perhaps especially in cases of Internet and citizen's data protection rights. In The recent action against child pornography, for example, met resistance from several European partners when it became clear that US agents had hacked computers on foreign soil, tainting the evidence and in effect making many of the suspects immune to prosecution as a result.

Re: Ah, that question

[Anonymous Coward]

If in the US, avoid any ISP that has any office or serves in the US or any of the countries that roll over to please the US.

And if not in the US: the same.

Re:Ah, that question

[Anonymous Coward]

you are naive if you think google can't infer that is your home based on where normal gps data.

Re:Ah, that question

[Anonymous Coward]

if he always uses a vpn, won't they just profile that? They will know he is the weirdo that visits their site with an IP address from Elbonia, or other random country of the week, if he rotates through different VPN's. Also a VPN isn't going to keep them from fingerprinting his browser. they will recognize him just like they recognize everyone else, and they can probably make an educated guess he is using a VPN and he isn't really from Elbonia, Especially since they will already have a list of addresses from known commercial VPN services. And if he ever makes a mistake and forgets to connect to his VPN even just one time, then from the browser finger printing they will have his real location now and can associate that with his profile.

I don't think you understand what VPN's do or how they work, and if you are truly worried about being tracked, then you really aren't paranoid enough. if you are going to extraordinary steps to try to avoid tracking it is more likely to just get you on a list because you are behaving in an unusual manner. it is easier to hide in plain sight and to just be part of the background noise by trying to make yourself look like any other normal boring person.

Re:Ah, that question

[pnutjam]

They can absolutely infer it, but when someone queries the home location of every user in the database, mine shows up empty. Privacy is a layer.

Re:Ah, that question

[Anonymous Coward]

That is a great explanation. Thanks.

Re: Ah, that question

[desdinova 216]

Russia?

Requirements first.

[Anonymous Coward]

Let's take a requirements-centric approach:

What do you need?

right now I really have no need for a VPN at the moment

Congratulations! You don't need a VPN, so don't get one yet.

Re: Requirements first.

[Anonymous Coward]

This is a 14 year old student.

Encouraging trial and exploration before it's a critical need is an excellent learning opportunity.

Re:Requirements first.

[Opportunist]

I currently have no use for a Cortex-M7 either, but still I got a few to learn about its features so when I need its power to create something I have the knowledge to use it.

The requirement here would be "I want to learn about VPNs and how to use them".

Re:Requirements first.

[rodrigoandrade]

Except that, in 2017, unless you roll your own VPN, there's really not much to learn. You just whip out a credit card, pay for a service, install their software (if you don´t just log into their https website), and you're done.

On a business environment (which's not the case in the story), unless you're the admin, you're given a user ID and password to log in a Citrix client. Done.

Remember, we're dealing with the iPone generation that replaces a smartphone when the battery doesn't hold enough charge, or tosses out a notebook when it's running "slow."

Re:Requirements first.

[Anonymous Coward]

A little requirement was not stated explicitly; it has to be drawn from context, and I'll give an example.
I'm in the middle of a huge, massive Book project, and it sits on my home Servers, which are backed up elsewhere twice a day.
It has a lot of Copyrighted material, only some of which is my own, and in fact one of the most boring sections is on Copyright. Right now, it is not ready for anybody to see, in all or part.
I'm working on it constantly, and I keep an iPad handy when out in case I want to add or edit content on the fly
Only the most current stuff is on the iPad; these things are so easy to lose. I actually take Security seriously here, not for any nefarious reason, but because this is my book dammit; I've been working on it for a year, and I want this rubbish finished before bits of it appear all across the Internet. So I Tunnel into my Servers regularly, and encrypt everything.

Students of this age may be properly cautious. Research is not an easy thing, and one should be meticulous in carrying it out. This means staying organized, and keeping prying eyes out of the primary material until it is ready. VPNs have been used, and are used, for some pretty slimy things, but the concept of secure and reliable Remote access is sound.

Re: Requirements first.

[Calydor]

Would you say the same about sex? Smoking? Drugs? Investing?

Substituting 'VPN' for any of these makes the question very interesting.

Re:Requirements first.

[Bing Tsher E]

You're operating from the conceit that everybody out there wants to read your book. So badly that they will crack into your system to read it without your permission.

The truth is, you'll have to work hard to get any publisher's agents to even glance at the manuscript, when it's complete and you have it ready for publication.

Re: Requirements first.

[Anonymous Coward]

For investing absolutely, as long as you keep it to toke namounts until you understand what you're doing and make sure that you never risk any more than you can afford to lose completely. Don't start with sex until you feel you and your partner are ready for it.

Advice about smoking and drugs is easier: simply never do it. Under no circumstances. There are no upsides, only downsides.

Re: Requirements first.

[Anonymous Coward]

What is the upside to sex, exactly, if you're not trying to procreate? Pleasure? Why do you think people smoke or do drugs?

I mean, when people have sex with you, maybe they don't do it for pleasure, but typically that is why people do it.

Re: Requirements first.

[Anonymous Coward]

What are you taking about, there are tons of upsides to doing drugs

Re: Requirements first.

[Anonymous Coward]

>For investing absolutely, as long as you keep it to toke namounts
And keep notes. Particularly keep notes as to what you were thinking when you decide what to buy and sell. If you are going to have any hope you need a written set of rules and notes for why you chose to deviate from them when you do.

Re:Requirements first.

[Anonymous Coward]

Well, this will be my fourth book; the other three didn't do too badly.
You missed the bit above about Copyright. Not my Copyrights; they're fine, I've even Registered a Trademark. But there is a lot of material by others in there, of which I have yet to secure a license for.

You haven't ever actually written a book before, have you? I suggest that you brush up on Andrew Paul Leonard v Stemtech Health Sciences, Inc., and AFP v Morel. In Copyright law, the concept of Due Diligence applies to all parties. Owners of original work must show Due Diligence in obtaining Copyrights, and those who wish to use this work beyond Fair Use provisions must show Due Diligence in obtaining reproduction Rights. (Details can vary from State to State and Country to Country.)
In AFP v Morel, it was determined that AFP had taken images from Twitter, put there by a Third Party but belonging to Morel, and published them for gain. It didn't matter how much gain. Morel walked away with $1.2M.
I did mention that one of the most boring sections is on Copyright.
I have to show Due Diligence that I protected the Copyrights of others in this work. Thus encryption and VPNs... and Releases and ~$275 an hour to some Dude who rubber stamps these kinds of things.
It doesn't matter whether everybody or nobody wants to read my book.
You really are sort of clueless on these matters, aren't you?

Re: Requirements first.

[Anonymous Coward]

There are many hormonal upregulations upsides to sex, including a sense of happiness, a better circulatory system and better immunity.

Re:Requirements first.

[thewolfkin]

Let's take a requirements-centric approach:

What do you need?

right now I really have no need for a VPN at the moment

Congratulations! You don't need a VPN, so don't get one yet.

Yeah but how well does a 14 year old even know their requirements. They might be in the mindset of "Hey Torrenting works and i haven't gotten an email. I don't *need* it" I think especially in a requirements -centric approach it's essential to first define the requirements. She might have needs she hasn't even thought of yet. That might be the reason she sent the question in the first place.

Re:Requirements first.

[Anonymous Coward]

>Let's take a requirements-centric approach:
>What do you need?

>> right now I really have no need for a VPN at the moment

>Congratulations! You don't need a VPN, so don't get one yet.

Close, but no cigar. Think about a loan: you never get one when you need it; conversely, banks will literally send you loan offers when they're 100% sure you got the money to pay them.

Whatever you want in life, act and get it before you need it. Besides, there are unplanned gains. I once learned Esperanto on the assumption it would be just fun and not useful at all... I was wrong.

Re: Requirements first.

[Anonymous Coward]

Yes, of course.

Re: Requirements first.

[Anonymous Coward]

as evidenced by most of the comments on /. and the rest of das int3rt00bzen.

Re: Requirements first.

[Vitus Wagner]

In this case he shouldn't "get a subscription". Rather it is better to BUILD own VPN (say between home computer and laptop, or between home and school compuiter, if school IT police allows this).

Re: Requirements first.

[Aighearach]

This is a 14 year old student.

Encouraging trial and exploration before it's a critical need is an excellent learning opportunity.

Well, yes, but asking questions of people on the internet might not actually encourage trial and exploration at all, and it may not be a significantly useful learning opportunity compared to, say, access to wikipedia.

The correct answer is, "If you don't know, you don't need one," and that remains true for a student who is interested in learning more; indeed, it is after learning more that they might come to discover that they do have a use case for it after all.

Not every detail of computing benefits from diving in without reading the manual; in many cases, if you're not going to invest the time to understand even the basics then you won't be able to make effective use of the tool at all.

Re: Requirements first.

[Anonymous Coward]

Well, it's probably best that he learns about donkey porn here, amongst /. family, than out in the cruel cold world. You don't know *what* you're going to get out there!

Re: Requirements first.

[Anonymous Coward]

What is the upside to sex, exactly, if you're not trying to procreate? Pleasure?

Pleasure, indeed, and health benefits.

Why do you think people smoke or do drugs?

Addiction. Smoking and drug use may provide short-term pleasure to those addicted to it, but that comes at the cost of feeling a bit more miserable at all other times.

Re: Requirements first.

[l0n3s0m3phr34k]

THIS RIGHT HERE!!! With some effort, he could build this. If he just needs a secure connection from a laptop back to the house, that's (mostly) trivial (from a cost perspective). Learning about and implementing a VPN is quite educational.

Re:Requirements first.

[Anonymous Coward]

Actually, this is sort of important, so I'll elaborate. This book will be about half images, and about half of those will be mine. In the lower right corner of my pix is the Copyright symbol, and a Studio name. In the lower lower left corner is a Trademarked Symbol. In the EXIFs, under the IPTC and TIFF Headers, are details of Copyright and Contact Information. This is tedious to set up initially, but then I just Batch-Process everything. Every few months, I send a physical DVD to the US Copyright Office containing a bunch of Images to be Registered, and $85. They will keep this physical record for ten years or so.
The Trademark is also Registered, and this cost $485 all in, but it only needs to be done once.
Without doing at least some Due Diligence in this process, once my Images hit the Internet, they are effectively free for the taking. Claiming Copyright initially means that I just might have a case on Infringement, but only up to the value of actual monetary loss. Registering Copyright means that I can also go for Statutory Damages, which are essentially unlimited. Morel was no Copyright Troll, he is a respected Professional Photographer with decades of experience. I actually don't blame AFP much here; they made an honest mistake. But Getty, who had by then licensed the Images are total assholes and known thieves, ever since Daddy Getty was convicted of Art Theft. I will never License, or allow to be sub-Licensed, any of my Images to Getty.
What about Watermarks and Watermarking Software? A total scam; Watermarks have no Legal standing without being Registered, which none of the vendors bother with.

OK, somebody sees an image of mine online, and wants to use it. As long as the Headers are kept intact and not scraped, (....Facebook, tsk tsk...), I'm easy to contact. As long as the Trademark and Copyright Symbol on the Image are kept intact, I'm pretty easy to contact. If they are all removed, about the only recourse left for our potential non-infringer is to go to the US Copyright Office and have them do a Reverse Image Search in person, for which they charge $185 an hour, two hour minimum. USCO does not have an online Reverse Image Search, those jerks.

Our potential non-infringer has two other means of using my Image about say, 6-Axes Goniometers. (Yup, there is one...)
They can claim Fair Use by substantially enhancing or altering the Image, creating a substantially new Work in the process. This is routine in Academia, and any 14 year old kid working on their Science Project is welcome to it.
There is another new Concept coming out of Britain called Orphan Works. An Orphan Work is one that no attempt to assert Copyright was ever made, or more importantly, when previous Infringements were known to have happened, no attempt to contest was made. This is not popular with older British Photographers, whose body of work is now spread across the Internet. Frankly, it's too late. Outfits like Getty and Alamy are hoovering the Internet for any old Images that they can find, and asserting Batch Copyright. First to the Copyright Office, wins. Note that Trademarks are slightly different, in that in many Countries, they have to be explicitly abandoned.

Every Friday night, I get together with some friends, and pass along my iPad. They can be quite cruel, especially the Lawyer. I pay cash for dinner, they pool on their Amex cards. Recently, the Hotspot there was hacked... so new Amex Cards for everybody!
I'm not worried that my book was hoovered; gibberish encrypted just looks like even more gibberish.
Due Diligence.

Re: Requirements first.

[Anonymous Coward]

When dealing with children a good question to ask is "can it cause permanent damage".
If a kid does something stupid and gets bruised they have learned something. If it does something stupid and dies the learning was pointless.

Sex can lead to more children and stds so it isn't something you should recommend children to experiment with until they have proper education.
Drugs (Includes smoking) causes permanent damage and can lead to an addiction. You should never recommend anyone to experiment with that.

Investing is a bit more interesting. I put this in the same group as sex, it isn't a problem as long as there is some education to go with it.
Some people are investing in lottery tickets and gambling and put themselves in debt.
Some people just make bad investments and ends up with less than they started with.
Saving "in the mattress" isn't really a bad idea until you have some experience with investing and using small amounts in riskier investments could be educational.

VPN falls in a slightly different category. It is a subset of a hobby. It is as if an aspiring baseball player asks if he should practice sprinting instead of batting.
The thing that puts VPN close to the others is that an uneducated user might think that VPN makes them anonymous.
If that leads to behavior that should be discouraged doesn't really have much to do with the technology but rather what the kid does when he thinks nobody is looking.
The question is if the kid has enough morals to use a VPN sensibly, not if they have the knowledge.

Re: Requirements first.

[sconeu]

The correct answer is, "If you don't know, you don't need one,"

I believe that was also Sony's answer to the rootkit fiasco. ""Most people, I think, don't even know what a rootkit is, so why should they care about it?".

Re: Requirements first.

[Aighearach]

Ignorance is to tools you don't use as ignorance is to security risks you didn't know you were exposed to: T/F

Surely you can do better.

NOW

[Anonymous Coward]

Nuff said!

Re:NOW

[Z00L00K]

The problem is that if you get one today for use in a few years then you will get a VPN service that is severely scrutinized by the authorities when you start to use it.

Re: NOW

[Anonymous Coward]

If the kid is smart enough to begin thinking about privacy albeit a bit late, hopefully the kid will upgrade along the way as services degrade and scrutiny rises

Anytime

[dreamchaser]

As long as the parents have man in the middle access it is not a bad idea. Before the kids all flame me for saying that, I saved my daughter from a potential predator because I monitored her Internet use when she was 14.

At that age one is still a child and still tends to have poor judgement. I know I did back then.

Re: Anytime

[Anonymous Coward]

Anti child lover spotted.

Re:Anytime

[Opportunist]

Not to mention that such parenting sets kids up for a lucrative career in IT security, with thwarting such MitM attempts without parents noticing it being the first ITSEC project.

Re: Anytime

[Anonymous Coward]

Kids should not have internet connection before age 14. There is no need to. At age 14 kids should he given a 33.6k baud modem, a pentium pc with 128mb ram, ISA card slots for the said modem and a CD with Slackware 3.6. If they get that assembled, up and running and can connect to the internet, they deserve full unfiltered access

Re: Anytime

[Anonymous Coward]

Kids aren't stupid. And 14-year old girls definitely aren't stupid.

I beg to differ.
Speaking as a parent of teenagers and an ex teacher, MOST kids are stupid, and they're the worst kind of stupid, and that is that they believe they are clever and know everything, but they are totally gullible when it comes to someone telling them what they want to hear. MOST kids are good people. But they're stupid.
And MOST 14 year old girls are astonishingly abysmally gullible if you know what to say to them.

Having said that, I would never monitor the kids computer activity. That's like reading their diaries. You can give them advice in general, but some stuff in life they must figure out on their own.
It's not like driving a car badly which can get you killed or crippled permanently, not to mention killing other people.

Re: Anytime

[Anonymous Coward]

I'm not defending real, actual child predators, but what you stopped and what you THINK you stopped are probably two completely different things.

Kids aren't stupid. And 14-year old girls definitely aren't stupid.

Have you met any 14 year olds today? Hell even 24 year old "women" still tend to be pretty stupid.

Re:Anytime

[n3r0.m4dski11z]

"I saved my daughter from a potential predator because I monitored her Internet use when she was 14."

So in exchange for busting someone chatting with your daughter to some degree that you have arbitrarily determined was "predator-ish", you violated her privacy and made her not trust you or the network ever again. Thus ensuring that any future incidents are completely out of your control and probably even awareness.

I have taught my kids to be aware, the rules, and why rules are like that and so i trust them to make good decisions online and off. Otherwise you end up holding their hand for their entire lives which is more dangerous, less sustainable and way more stressful.

Re: Anytime

[Anonymous Coward]

Just like when I was 14 :P. Also used to walk to school 20 miles uphill both ways.

Re: Anytime

[dreamchaser]

He was offering to pay her bus ticket to travel across state lines. I only sporadically perused her IMs. I'm glad I caught that one. Now, you can eat a dick. Kids are stupid.

Re: Anytime

[Anonymous Coward]

***Unmonitored*** internet connection. Some schools now require kids to access online resources for homework, submit homework online etc. And they should be learning how to use it responsibly, including how to use it for research.

Re:Anytime

[dreamchaser]

Unfortunately, in this case. her father (oh wait, that's ME!) had a long and lucrative career in IT Security ;)

Re:Anytime

[dreamchaser]

See my other post. I didn't provide full details. He was trying to buy her a bus ticket to cross State lines and meet him. Get a fucking clue. Do you have kids? You claim you do. I taught her that as well, but a 14 year old is batshit stupid. I know I was at that age. Anyone who says they were not is lying to themselves and others.

Re: Anytime

[Anonymous Coward]

I am a High School teacher and would like to strongly disagree with your assertion that 14 year old kids are intelligent enough to fend for themselves. 14 year olds are basically the stupidest motherfuckers in the world. I love them to death but there's a reason they aren't allowed to vote or really make an substantial decisions yet.

Re: Anytime

[Anonymous Coward]

those "not" stupid 14 year olds are getting abducted on a daily basis all over the world. a terrible parent is one that leaves them to fend off the predator for themselves and assumes their precious 14 year old can outsmart a canny practised predator looking to take advantage of her. People like you are why the predators are so successful.

Re:Anytime

[Gussington]

At that age one is still a child and still tends to have poor judgement. I know I did back then.

Tell me about it. My 14 year old has gone from regular problem free kid to arrested for shoplifting, to suspended from school for smoking weed, to home-made dyed hair and tattoos in the space of the one month! It's like payback for all the things I did to my parents when I was that age...

Re:Anytime

[Anonymous Coward]

Funny how you assume he 'violated' her privacy. My children know full well that I can see anything and everything they access online. It has been fully explained in these exact words multiple times. The EULA is they get continued free Internet access on the basis that if they come across something they should not be viewing, they immediately exit. If during the course of reviewing my logs for security purposes (e.g. malware infections) I find differently, they lose their privilege. They have privacy in that they know I am not spying on them. They know that they have privacy from other people because I ensure their IoT gizmos are free from infections as is the OP.

Re: Anytime

[Anonymous Coward]

Ok grandpa.

At least I had an external 9600 baud modem when I was 14, so I only had to worry about the jumper settings on the serial card.

Re: Anytime

[Anonymous Coward]

Hell even 24 year old "women" still tend to be pretty stupid.

That's true. I know it to be a fact because I got one of them to marry me.

Re:Anytime

[Opportunist]

Always two there are, a master and a student.

But you know how that ends for the master, right?

Re: Anytime

[Anonymous Coward]

14-year old girls definitely aren't stupid

This is one of the stupidest things I've read on the internet today. And I was reading Trump's Twitter feed this morning...

Re: Anytime

[Calydor]

What did she say to that, though?

If she did anything other than have him send her the money so she could 'buy it herself', she's stupid. ;-)

Re: Anytime

[Anonymous Coward]

Kids aren't stupid. And 14-year old girls definitely aren't stupid.

Let me guess, you are 14 years old?

Re: Anytime

[david_thornley]

When I was 14, I had a slide rule.

Left it way too late

[Anonymous Coward]

should have done it at conception.

Re: Left it way too late

[Anonymous Coward]

Yep, and you know most are born with a Facefarm account. A VPN isn't going to help if AI is just going to make digital fingerprinting better and better. What he should be doing is starting to think of ways to raise hell about having to need one in the first place. He's going to vote in the next election and there's nothing more embarrassing than looking ignorant to a 14 year old.

What?

[Anonymous Coward]

"I was thinking of getting a VPN when I'm in 11th grade or maybe in college."

First thing I'd be asking is what they think a VPN is and what do they think it'll do for them. I can't see a connection to age or stage in education which would make a difference, which makes me wonder if they truly understand what it's all about.

Think carefully how you set it up

[Alain Williams]

if your laptop/phone can connect into your home VPN, then what you carry with you, maybe in another country, could be inspected by border-police/... and they would have access to your home network from their country. Do you want that ? Making things easy for you will also make things easier for people who you might not like.

Re:Think carefully how you set it up

[Anonymous Coward]

Never carry anything to another country that's actually personal. Take a burner notebook/phone with you. Use a local SIM card and if that's not possible, never store contacts/addresses on your own SIM card (dumb idea anyway). When crossing a boarder, have devices that are total clean and innocuous--not signed in to any account you actually care about and maybe signed into throwaways that you don't care about.

If a device leaves your sight it's been compromised. If your notebook is in your hotel room and you are not it's been compromised. Doesn't matter if it actually has, treat it as if it has been. Wipe, reformat, or toss it when you're done. Change any passwords you may have used upon your return home.

If you cannot afford a burner notebook, at least take an image of your drive and put it somewhere safe that you leave at home, and reformat/reload things.

You will access important data using a cloud drive that contains, among other things, your VPN client, when you reach your destination.

Keep in mind that VPNs hide your traffic from prying eyes. They do not hide the fact that you're using a VPN from anyone with half a brain. So if you're traveling to a really backwards country that outlaws VPNs please remember that--and while you're at it, rethink why you're going there in the first place.

If you're not a US citizen and coming to the US, remember that the US is now a third world police state, especially at its borders, and that protections that apply to American citizens don't necessarily apply to you. Frankly, as an American, I'd say do what a lot of non-Americans are doing and just avoid coming here unless or until this place wises up, stops being politically correct, targets people who are actual problems instead of everyone, and generally starts respecting individual freedom again.

Re:Think carefully how you set it up

[Gussington]

if your laptop/phone can connect into your home VPN, then what you carry with you, maybe in another country, could be inspected by border-police/

The benefit of SSL VPN is it browser based, so no client on the machine, and no history. If you access your SSL-VPN in a private window/incognito mode, it is effectively invisible to anyone inspecting your device.

this is a troll post right?

[Idimmu Xul]

maybe wait until his 18th birthday?

Re:this is a troll post right?

[geekmux]

maybe wait until his 18th birthday?

Why do you assume privacy starts at an arbitrary number assigned by society?

If anything, I commend a 14-year old valuing privacy. Few these days do, since most are addicted to social media, and the associated narcissism that tends to make privacy obsolete.

Re:this is a troll post right?

[Mr D from 63]

maybe wait until his 18th birthday?

If you are old enough to fight for your country, you are old enough to have a VPN.

Re:this is a troll post right?

[swb]

The problem with 14 year-olds is that while they're smart enough to know the words, they don't really know the music. We mistake their verbalization of intellectual concepts as understanding.

Re:this is a troll post right?

[Opportunist]

If you're old enough to fight for your country, you're old enough to get the fuck out!

Re:this is a troll post right?

[Idimmu Xul]

i was being facetious.

wtf does he need a VPN for?

I've 3 .. i havent used any of them since i left china.. though i should as netflix and amazon prime in vietnam is lacking ...

Re:this is a troll post right?

[geekmux]

The problem with 14 year-olds is that while they're smart enough to know the words, they don't really know the music. We mistake their verbalization of intellectual concepts as understanding.

And how old do we wait to teach kids about concepts like the 1st Amendment? Should we reserve Pledge of Allegiance participation until they can pass the related lyric aptitude test?

A VPN isn't exactly something kids are blindly peer-pressuring each other into, so I'd be more inclined to believe someone asking for it understands the value of it more than we might assume.

Re:this is a troll post right?

[Anonymous Coward]

fuck your Pledge of Allegiance indoctrination.

Re:this is a troll post right?

[Anonymous Coward]

We mistake their verbalization of intellectual concepts as understanding.

Much the same can be said of many adults, some of whom we work with, some of whom are elected to high office, etc.

Re:this is a troll post right?

[Aighearach]

a VPN only gives you privacy if you're using it to connect to a private network.

If you're using it to connect to the public network, your usage might actually be public, not private, and the network might be a public service, not a private anything.

Re:this is a troll post right?

[Aighearach]

I'm 41 years old and I'm still finding out what the words in the lyrics really were, and feeling embarrassed.

At 14 I was at least smart enough to be sure I knew what all those words were. ;) Nevermind the music, or the point.

Re:this is a troll post right?

[Aighearach]

If you come from a religiously diverse area there will almost always be at least one student in the class who isn't allowed to make pledges, and then it does indeed serve to indoctrinate children in the culture of Free Speech; "No Billy, we don't ask Timmy why he doesn't say the pledge, we just accept his choice."

If you have good teachers, they can do these things in a way that makes most of the parents happy. A lot of public schools are there to help the parents with whichever version of the indoctrination they support!

Or at least, if Democrats control the school board that is what happens.

Re:this is a troll post right?

[slimjim8094]

This attitude bothers me. As a 14 year old I was pretty sure where I was making good and bad decisions, when I could do something properly vs when I didn't have enough information or experience, etc. But adults kept telling me I wasn't old enough, I lacked maturity, and so on.

So a few years later I went to college. And now I wasn't some high school kid, but I still wasn't an adult. Adults told me I lacked maturity, I wasn't old enough, my brain was still developing, etc.

Then I graduated college and I learned the secret: there's no difference and adulthood as a concept is all a scam. The *person* is what matters. Every kid attaches a certain amount of weight to things "adults" say because that title carries weight. But I learned: some adults are smart, and some are basically that dumb kid in high school you got sick of listening to. Just like in high school, some kids were smart, and some were basically dumb.

My personal theory is people are basically who they're going to be by age 15-16, and don't change much from that point on. Society changes around them.

Why do people assume you - to use your words, "know the music"? You're presumed to because... why? Something you did? Something you've demonstrated? No, when you walk into a room, people observe that you've over this arbitrary age threshold and figure you're basically mature. Sure, you could dispel them of that presumption, but some mature teenager has to start from the presumption that they're immature. Some might call this "privilege" (not I, but it's the same concept).

Ultimately this wouldn't matter much except by devaluing teenagers, we overvalue adults and do dumb things because we overestimate the average person. If we looked at the people around us and though of our high-school classmates I think we'd have a much more realistic outlook. "Immature behavior" is really just standard human weakness by another name, but easier to dismiss and harder to address since you assume people just grow out of it, when really they just lose the excuse.

And for the record, I've got a full-time job (going on 5 years and 2 promotions), an apartment, a 401(k), stocks and other assets, savings, life insurance, I do my taxes, etc. I'm 27 and I haven't changed a bit since 16 - people just give me more credit. To be clear I don't say I'm "wise" - I don't have that kind of experience - but I'm as mature as I'm ever going to be.

Re:this is a troll post right?

[Anonymous Coward]

I'll make it short because you seem to have a set opinion already. Adolescents are too young to have real life experience. What they know they learned from what they've been told. Often they've learned from people with an agenda, who try to mold you to serve their needs, or from people who couldn't quite make it themselves, so they teach what they themselves don't understand, or from people who were just lucky and teach randomly due to survivor bias. It takes experience to understand how it all fits together. By age 14 you know the words, but you use them like you've been told. If you had good teachers, you might have an edge over some adults at that age, because what you learned beats their experience, but you're still parroting. If these kids never fail during adolescence, they end up with a very dogmatic world view and are bound to fail spectacularly when that clashes with the real world later in life. If you're an adult and still haven't figured out that there's a vast difference between adolescents and adults, I'm afraid you still have some catching up to do.

VPNs are unusable today.

[Anonymous Coward]

I get constantly harassed to enter CAPTCHA after CAPTCHA and do all kinds of hoop-jumping and very often pages just don't load randomly, timing out, and have started ALWAYS showing fake errors such as "We're having technical difficulities" or "that nickname is already taken" when they actually mean that the VPN is banned (I'm not making this up). I've spent weeks now just trying to get a basic little webhost (not even a server) thing up, but none of these companies want my money. Instead, they pester me to scan in my "photo id" (which I don't have and won't be getting) and send them to them, as well as scanning my credit card and sending it to them. And make phone calls to verify. And verify with SMS. And all throwaway e-mails are banned. How much longer until you must provide a DNA sample to use any service? Facebook banned me because I refused to send in a "full face photo" to, again, "verify me for my security". The Internet has become completely worthless as far as I'm concerned.

Re:VPNs are unusable today.

[jawtheshark]

Commercial VPN? Roll your own and that goes away.

Re:VPNs are unusable today.

[Anonymous Coward]

I think that AC#1 means that when using the VPN to try to access these various services, the service providers detect the use of a VPN (they are of course using known IP addresses) and therefore become very wary of doing business with this person. Probably not because they want to violate the user's privacy but because they've been burned by ACs in the past "paying" for their services using fake credit cards.

So I am guessing that it's not that "they don't want [your] money" but rather that they want to be sure that you actually are paying with money and that it's really your money you're paying with. I can't blame them for that.

(Posting as AC#2 to avoid undoing moderation)

Re:VPNs are unusable today.

[Anonymous Coward]

AC#2 here again. OIC, you mean using their roll-your-own VPN (to a home computer, for example) will avoid being detected as a commercial VPN IP address. Yes, that's true.

Re:Tell him ....

[Anonymous Coward]

is he pirating or is he a professional troll or is his freedoms limited due to country of residence... we don't know. so we can't answer the submitter's question properly.

Motivation?

[Anonymous Coward]

You should get a VPN when you can afford it yourself, and only if it's better than the other options.

If you're 14 and already running a business where you need a VPN to avoid the internet bottlenecks on speed, then more power to you.

On the flip side, if you're intent is using a VPN to get around laws in your area, you should seriously consider instead working toward removing the offending laws legally. Start petitions and make people aware of the issue. Paying money for a VPN just to hide your head in the sand ignores the bigger problem.

Re:Motivation?

[Anonymous Coward]

Depending on which country the kid is in, it could cost him his head to petition against the government. Then again, being caught using a VPN is enough for that in some places also.

And for what use?

[sanf780]

VPN only makes sense if you want to keep a connection secure or obfuscate the connection you are making by relaying messages to another server. It does not make much sense to pay for a VPN service just for the sake of paying for it. And VPN does not help keeping you anonymous from Facebook, you know.

Re:And for what use?

[Anonymous Coward]

It could if you don't login to facebook.

Baby's First VPN

[Anonymous Coward]

What are we talking about here? Have VPNs become like cars and houses? Is owning one a rite of passage to adulthood? A sign of maturity?

It's a fucking tool. If you have a need for it then use it, and if you don't have a need for it then don't use it.

As Soon As You Can Afford It

[Salo2112]

Buy a good VPN service as soon as you can afford it. Know what it does and especially what it does not do. I got mine the first time I got a nasty letter from my ISP for downloading a torrent for a movie I already owned (Flixter *sucks* on a Mac). Don't regret the purchase a bit.

If you get a VPN, know that it bypasses firewalls

[Anonymous Coward]

VPNs tunnel through your router's firewall, so you need to make sure that the firewall on the local VPN endpoint does its job. There are several VPN providers which allow incoming connections through the VPN, so by connecting through their VPN you might just give access to your local resources to anyone on the internet. Firewall the VPN interface!

I guess EditorDavid is trolling us.

[Anonymous Coward]

To Hasaf: You should only have sex when you ready. It is OK to wait to eleven grade.

Too Old

[Anonymous Coward]

Right now I am 14 years old, I was wondering when I should get a VPN

You're already too old. You should have been dabbling into VPNs, websites, IRC, (Of course Linux, etc), programming, databases and building your own PCs towards the end of grade school. Today's technology will be old by the time you reach 11th grade. Take the time to learn stuff now.

You have free time now. Learn it all now and have fun. Keep a diary so you know what you did. You'll need it later on.

Your aim should be to past the skill level of a CS graduate by the time you hit 18. Consider skipping college, and going into business for yourself ASAP.

Get a Life!

[Anonymous Coward]

> Right now I am 14 years old

Worry less about VPN, and work on getting a girlfriend.

Re:Get a Life!

[Anonymous Coward]

Don't listen to that bozo, he's just jealous because he's stuck in a loveless marriage, with a cheating, cuckholding wife, and he can't find a way out of it, so he spreads his FUD around hoping to lure others into his own Hell.

If you're not arrogant, you'll attract a gf/bf (no judgments) naturally, don't force it.

And seriously consider doing what the AC above said: "You have free time now. Learn it all now and have fun. Keep a diary so you know what you did. You'll need it later on.
Your aim should be to past the skill level of a CS graduate by the time you hit 18. Consider skipping college, and going into business for yourself ASAP."

Ok, son, let's talk VPN

[Qbertino]

Ok, young man, here's some important details you should know about VPN

- Not all VPNs are equal. Some fit, some don't. They come and go. When your first VPN goes down, it will feel like the world is collapsing. Don't worry, it isn't. You'll get to see many VPNs in your life and eventually you'll find that one VPN that really fits and you'll stay together and maybe even start your own service. You'll know when the time is right and you've found the right VPN to do just that.

- Some VPNs come with flashy advertising and/or quite some legal block. Don't just look at such VPNs but also at the custom built ones that run their own self-built config scripts and services. Those are real gems and that is where you can find very special VPNs.

- Don't just fantasize and read about VPNs online. Go out and meet some real world VPNs in real life. That is where you will gain the experience to judge VPNs and which work best with you.

- When you get your first real VPN, you still need to protect yourself! I can't stress this enough. Practice applying Firewalls and such when you're in the mood for trying out some VPN.

- When you get your first VPN it might not connect in the first night. Don't worry, it will get better. Soon you'll be VPNing like a bunny.

- If you think you've found the right VPN and want to stick with that for life (very significant decision), do write up a contract covering all the details concerning you and your special VPN - it will save you pain later if things don't quite work out as planned.

Those are the basics, the rest you'll learn along the way.
Godspeed!

Re:Ok, son, let's talk VPN

[Opportunist]

Also important: What you hear and see about VPNs and using them in hacking movies (and yes, son, I know that you're watching them, hey, I watched them when I was your age, even though they were much, much worse garbage in my days, you didn't even get to see the screen, they even show that now), don't take it too serious, that's movies, ok? Nobody expects you to be like that, and trust me, VPNs don't behave like this either. You see how they make you invisible? They show that in the movies because that's what you want them to do, you, their user. But VPNs have their own needs and limitations and if you expect them to be like in the movies, not only will you be very disappointed, the VPN won't work for you either and you'll both be upset at each other.

Instead, find out what your VPN needs from you, find out what your VPN can do for you and best just forget everything you see on those hacker movies. They're made to excite you and deliver a fantasy, not to show you what real VPN networking is like.

Re:Ok, son, let's talk VPN

[bruce_the_loon]

- Some of your friends might claim they have connected their VPN already, but quite likely they're only connected via their loopback adapter.

Re:Ok, son, let's talk VPN

[Anonymous Coward]

and just because you saw a VPN in a movie running on a particular port, doesn't mean your own VPN will have that port open.

For connecting to Tor, of course

[Anonymous Coward]

That way your traffic will look like warez, rather than trying to buy dope in bulk to deal to your pals.

You've explained it perfectly..

[The Cisco Kid]

Far too many novice users have no understanding what a VPN is. And/or they assume you have to pay for one from some provider.

I myself use OpenVPN to tunnel to my home network when I am using my cell phone to provide access to my laptop, to protect my activity from my cellular carrier (I am not technically "allowed" to "tether") - it doesn't cost me anything, and as a bonus I can access devices on my home network such as IP cam's, etc without having to setup individual port-forwarding in the router.

Re:You've explained it perfectly..

[jawtheshark]

Same here really... I do have a few VPSes running OpenVPN for some speciality tasks.

Re:You've explained it perfectly..

[Anonymous Coward]

I myself use OpenVPN to tunnel to my home network when I am using my cell phone to provide access to my laptop, to protect my activity from my cellular carrier (I am not technically "allowed" to "tether") - it doesn't cost me anything, and as a bonus I can access devices on my home network such as IP cam's, etc without having to setup individual port-forwarding in the router.
Flag as Inappropriate

The pay VPN service offers further benefits, above and beyond the setup you describe, because it aggregates your traffic along with all other users before exiting it onto the public internet from well-known exit servers. This has the benefit of further obscuring your activity from random webservers by making it harder to pick you out from the crowd of users coming out the well-known public VPN server IP address, like an extra layer of NAT. Geo location in such cases becomes meaningless because they will be finding the location of the exit server which can be anywhere in the world you want with a good pay VPN service which should offer dozens of servers in various countries for you to chose from. This can also be useful for getting around country restrictions on some websites.

Re:You've explained it perfectly..

[Anonymous Coward]

Obscure? As in conceal? No, it just makes it an easier target for mass collection.

Re:You've explained it perfectly..

[Aighearach]

You wave your hands and declare traffic aggregation as a benefit, but it sounds like a bottleneck to me.

Traditionally that was listed on the disadvantages.

Re:You've explained it perfectly..

[gravewax]

would love to know a free option that lets me bypass geofencing all over the world and is fast. currently I use my VPN service to terminate in various countries depending on the content I want to access/purchase or to bypass local monitoring altogether.

Re:You've explained it perfectly..

[Gussington]

Far too many novice users have no understanding what a VPN is.

Everyone I know has one to get around stupid geoblocking restrictions. The Internet is not designed for geographic borders, so attempts to enforce them are what drives the VPN industry.

Re:You've explained it perfectly..

[gravewax]

Far too many novice users have no understanding what a VPN is.

Everyone I know has one to get around stupid geoblocking restrictions. The Internet is not designed for geographic borders, so attempts to enforce them are what drives the VPN industry.

exactly, The use case described by the OP is actually something I don't care about except for work in which case other people do the work needed for me. For my personal use VPN's are an anti geofencing/geoblocking mechanism and a means to get different prices on digital goods where pricing differs by region.

Re:You've explained it perfectly..

[Anonymous Coward]

It depends on your usecase, except in a few fringe scenarios a VPN is not used to give you the fastest possible connection, it is used to provide protected access to a network or to mask your location/obscure your individual traffic. If what you are after is the fastest possible connection then a VPN is rarely what you are after. For many use cases the aggregation is a benefit even though it often comes with some performance tradeoffs.

Re:You've explained it perfectly..

[HermMunster]

A VPN to your own home shouldn't have a cost except the internet bill and the costs such as the equipment and the time to set it up, but you'd have those costs anyway.

Openvpn running on your router should do the job, if you have a router capable of running it. It's not that hard to set up pfsense with openvpn, or even swap the firmware in a retail router.

No, need for a paid VPN service, unless you don't have ownership of the exit point.

Basically protection of your privacy is the main reason for a VPN. Protecting that is more than VPN use, unless he uses it wisely and thoroughly. What I mean by thoroughly is to ensure you have the tools to stop the tracking and the advertising whether you are on the vpn or not. One cheap tool is pihole. With pihole, pfsense, and a VPN you can essentially stop all that shit in its tracks.

Re:You've explained it perfectly..

[Anonymous Coward]

You wave your hands and declare traffic aggregation as a benefit, but it sounds like a bottleneck to me.

A VPN is about privacy, not speed. Speed is nice if you can get it, but not at the expense of privacy. If all you care about is speed then why are you running your traffic through an encrypted tunnel at the cost of extra routing hops?

Re:You've explained it perfectly..

[Anonymous Coward]

(I am not technically "allowed" to "tether")

So you're breaching your contract. You are a dishonest person who breaks promises.
I'm not judging, just restating.

Re:You've explained it perfectly..

[cthulhu11]

And there are lots of ads out there for VPN providers. How many of them are legit, and how many are at least as bad as the problems a VPN (well, strictly speaking a tunnel) is designed to address?

Government hostility

[Anonymous Coward]

As most governments in the world have become hostile toward their citizens, keeping your communications anonymous is extremely important. Look at what is happening in the vicious democrats attempt to bring down Trump, with the so called Russian connection. The vicious Muller and his democrat cronies haven't been able to find anything, so they are now going back 10 years to try to find something else on Trump. In our hostile political world today, it is wise to continuously cover your tracks. Even more, if cops and prosecutors ever try to pin a phony charge on you, they will pursue any and all possible communications you have had.

Re: Government hostility

[Anonymous Coward]

Or look at how Trumpâ(TM)s Department of Justice was trying to obtain details on every single person that visited an anti-Trump site.

Re:Government hostility

[Anonymous Coward]

Thank you, comrade.

wrong question!

[Anonymous Coward]

When?

Should be asking Why instead.

Insufficient context provided, so the question can't be answered without too many assumptions.

Depends

[Minupla]

Like with all of these questions, it depends.

My daughter was borrowing one of my IPs on a VPN provider when she was 5. Why? She was following me to hacker conferences, and we wanted her traffic to be encrypted (5 is too young to end up on the Wall of Sheep!)

If your 14 year old is politically active in a repressive regime, (I'll leave it as an exercise for the reader to determine if their regime is repressive) hopefully they already have one.

If they want to roll their own as a project, I'd be like "sure!" - Mind, I'm realistic that if mine decided she wanted to access the internet unfettered she'd go to a friend's place, or outsmart dear ol' Daddy (can you think of a way to get data out of your work network? Your kid can likely come up with a way to jump your firewall too...)

So best to teach them safe habits and cross the fingers. The 'great firewall of China' strategy's time has gone.

Min

Too young

[Anonymous Coward]

14-year-old is too young to use VPN. They want to act like adults and yes, they are physically ready to use it and in some cultures even younger ones have been using VPN, but they are not mentally ready. Especially if the worst happens and you get some nasty virus or a worm. And are you ready to take responsibility of the new networks that might born as a result? Young people don't usually considered at all all the negative results that might occur, they only think the positive side or the moment.

That all being said, I think parents should talk with their kids about VPN. Or if that is too embarrassing, you can read some wikipedia articles about it.

Re: Too young

[Anonymous Coward]

Network life begins at subnet assignation!#EndStaticReservations
#SubnettingNotDHCPRQ

Re:Too young

[Anonymous Coward]

Come on man, a VPN is not a condom. But thanks for the laugh though.

captcha: purely

What do you want it for?

[Hrrrg]

The question is hard to answer unless we know what your ultimate goal is. Here are a couple of scenarios.

If you don't trust you ISP to keep your surfing private, then a VPN can hide your activity. However, now someone else has your browsing history. Who is that person or people? Hard to know. Personally, I suspect that many VPNs are run by one government or another.

If you trust your ISP, you could get a VPN to connect to your home, to access your NAS, and to browse using your ISP. This protects your information from the WiFi owner, their ISP, and the country you are traveling in. It also means that you can leave your data on your NAS and not have to cross borders with it where it might be searched/copied/seized.

Some people use VPNs to hide their location so that they can get around a services geographical restrictions e.g. Netflix streaming. However, companies are aware of this and many of them block access to their content if you are using a known VPN provider.

I'll suggest a book about it

[hduff]

They should get the book "Baby's First VPN".

You should get a VPN when you have need of a VPN.

[Anonymous Coward]

It's a tool, not some tech rite of passage. If you just want to learn how they work due to general curiosity, don't pay anyone; set one up between your and a friend's computers.

TOR Onion Routing

[DrYak]

It might be a good point to also introduce the notions of onion routing.

Comparing TOR to VPN :

If VPN is a cable that runs to your home, TOR is a tangled mess of wires that runs to all your neighborhood, including your friends, but also including that new weird guy that moved recently. And one of your friend has trips the main fuse or put his house on fire every other week. And also that trigger happy redneck neighbor.

Whereas VPN creates a single jump point through which you route all traffic,
TOR uses multiple successive jump points each can one out of a very long list to blurry the leads.

This has several consequence :

- it's a bit better than VPN at hiding your activity from 3rd parties, because there's no single entity that has a complete overview over all your traffic. Everyone only sees small bits of your traffic mixed with small bits of every one else on TOR.
To keep the "cable" metaphore, it would take the police to post one officer in each of your neighborhood's house (including to the redneck that will proudly shoot anyone step un-invited on his home ground) to monitor as many exit points as possible, and another officer at the McDonalds trying to notice when traffic goes out to try to correlate with the observations spread over all the potential exit points.
In real world, trying to de-anonymize TOR is a task that can only be attempted by government-level entities.

- due to the multiple end-point vs a single known VPN vendor with a nice data center, the traffic tend to be a bit unreliable and bandwidth is erratic. (The friend that is basically as walking destruction of his home won't be a good exit point).

- it's difficult for random people to run exit nodes without special agreement with service providers : you never know what will come out of your end-point. (The weird neighbor might be into midget porn, or worse).

- people tend to look suspiciously to TOR and automatically assume it's for nefarious purpose. (You could be accused to be a drug dealer, just because of the tangled wires). In practice that means that content distribution networks such as cloudflare will always ask you to solve captcha before proceeding further.

Re:TOR Onion Routing

[arth1]

- it's a bit better than VPN at hiding your activity from 3rd parties, because there's no single entity that has a complete overview over all your traffic. Everyone only sees small bits of your traffic mixed with small bits of every one else on TOR.
To keep the "cable" metaphore, it would take the police to post one officer in each of your neighborhood's house (including to the redneck that will proudly shoot anyone step un-invited on his home ground) to monitor as many exit points as possible, and another officer at the McDonalds trying to notice when traffic goes out to try to correlate with the observations spread over all the potential exit points.

The flip side is that if any one of the exit points are monitored by an entity, and your browser traffic can be fingerprinted, they now have you on the radar, and can obtain data matching your fingerprint to a person from sites that collect the data (like online payment sites and banks, and ad aggregators that are partners with shopping sites).

Say you want to hide that you visit sedition.ve. If you use a VPN in, say, Russia, the government can only see that you accessed the VPN. If you use Tor, and as little as one of the exit nodes in the network is run by a government entity, you sooner or later will stumble upon that exit node, and the government will see that someone accessed sedition.ve, and the request details in the request. If http, they have a full fingerprint. If https, if they also have a proxy in front of the endpoint, and enough clout to get as much as one of the certificate authorities in your OS' or browser's certificate store to issue a fake cert, they can also fingerprint you.
Now they can go to, say, Google, and request all information that matches the fingerprint. That can easily match to your person.
So instead of snooping your ISP to gather evidence, they can send a van to your physical address.

Is this a problem? Well, some have estimated that in some jurisdictions, as much as 10% of all Tor endpoints is run by or monitored by state sponsored agents.

Tl;dr: While you reduce the risk of your traffic being monitored with Tor, you increase the risk of being caught in dragnets by multiplying your exposure.

Re:TOR Onion Routing

[Anonymous Coward]

...which is why you run tor on a machine exposed to the internet, away from your house, and you vpn into the endpoint machine. At which point, you'll be in constant search for free proxies so your home doesn't get associated to a specific vpn service, at which point there won't be any need to pay for a VPN!

Re:TOR Onion Routing

[tlhIngan]

- people tend to look suspiciously to TOR and automatically assume it's for nefarious purpose. (You could be accused to be a drug dealer, just because of the tangled wires). In practice that means that content distribution networks such as cloudflare will always ask you to solve captcha before proceeding

Actually, it's not because of TOR. It's because - guess what - people abuse the heck out of tor.

CloudFlare doesn't give Tor users the captcha for nothing. They've just noted that traffic from a certain IP is generally bad traffic. If you set up your own Tor exit node, CloudFlare doesn't know if it's Tor - but they know your IP will be spewing garbage at their servers and all traffic from that IP will see the same captcha.

Basically, all the other Tor users are using it for nefarious purposes - i'm sure the first day you set up an exit node things work great. But soon enough someone will use your exit node for DDoS.

The real question

[14erCleaner]

When should he ditch the "virtual" privacy, and get a real private network? Should he wait until he's 60 years old, a billionaire, living on a private island in the Mediterranean with a slide-off roof on his volcano for launching helicopter attacks on MI5, or should he go ahead and set up his private network now so that he and his teenage friends can chat in secret?

VPNs!!!

[Narcocide]

Chicks dig em.

Protect Yo Neck.

[Zeromous]

Just connecting on the Internet these days is risky, but adding the extra maturity required to use a VPN it is best to protect oneself. It's okay to be curious about and explore VPNs at such a young age, (it's only natural to be curious about one's privacy) but as 'it' can have life long consequences, I recommend that all uncommitted customers purchase their VPNs with Walmart Gift Cards. Once you decide to settle down with a VPN for a while and really start leeching, maybe it's time you gave them your credit card number and start surfing for nasty stuff with a much lower risk factor.

First understand...

[XSportSeeker]

I'd say that people should get a VPN when they actually understand how it works, what it can do for you, and why you need it, if you really do. If you don't know this, you will be wasting your money. It's not a be all end all for security, it's usefulness is limited to certain scenarios and situations, and most people still don't use one.

But in a general sense, you could get a VPN as soon as you started using the Internet to traffic sensitive information of any sort, even if you need parents or someone else to set it up for you, knowing the reasoning behind it.

I still think that for the most part, people don't need to worry about it. It has become prevalent in ads and sponsorship on tech news channels and whatnot, Tunnelbear being one of the most blatant to show up everywhere, but their slogan does not present the whole truth of it - "browse privately and securely", as Linus is always saying. :P

It's far more important for a kid, teen or user in general to first learn and understand best privacy and security practices on the Internet before even considering a VPN. Stuff that you don't need to pay for. Most common problems people have, like falling to fishing e-mails, downloading malware, getting their online identities stolen, thoughtlessly sharing sensitive information on social networks, and stuff like that - VPNs won't protect you from most of that.

Poor analogy, but you can think more or less like this: a bulletproof car. See that it's pointless to buy a bulletproof car if you are going to use it to go to shady neighborhoods flashing your money around as soon as you step out of it. Your bulletproof car won't prevent you from getting mugged in the streets once you exit it.

And sure, VPNs can be useful even for single users, specially those who are traveling a lot, who use unsecure networks, or just don't care about securing their own home network, but there are far more important and basic things than that when it comes to privacy and security.

wrong question

[prefec2]

When you are 14 then you do not need a private network. You need to get out and find out what it is with the girls/boys everyone is talking about. Also you should prepare your home and friends for your 16th birthday, the day you can drink beer and wine for the first time legally. In case you are an US citizen, save money for a trip to Europe.

Re:wrong question

[Aighearach]

Your Europe Dogma is outdated.

The legal drinking age is 18 in Spain, Bulgaria, Croatia, Estonia, Finland, Hungary, Netherlands, Ukraine, and a bunch of other places in Europe.

There is no country called Europe, and drinking laws vary by country.

Re: wrong question

[prefec2]

I did not say that Europe is a country. Still you can visit us. Beer and wine can be bought in Germany at age 16. Just as an example.

Re: wrong question

[Aighearach]

So get used to saying "Germany" when you're talking about what the rules are in your country. ;)

Re:wrong question

[Anonymous Coward]

There is no country called Europe

meh, close enough.

Any 14 yr old thinking they need a VPN should

[Anonymous Coward]

Any 14 yr old thinking they need a VPN should have their internet access highly restricted and smartphone/tablet taken away. There are many better things for someone that age to be doing.

OTOH, as an adult, I see the need for 2 different types of VPNs.

One for interfering with elections outside my home country (TOR would be a better solution) and the other for whenever I'm on a network that I don't control ... cafes, coffee shops, govt libraries, etc.

I don't see any 14 yr old needing either of those, especially after their smartphone is taken away.

14-Year-Old

[Anonymous Coward]

MODS!!!

When you learn...

[Anonymous Coward]

about BitTorrent. And never have a VPN server in your own country, always be international.

Never too soon

[Anonymous Coward]

Though it's incredibly sad to me that the child is asking (modern parents really are asleep), I would say, your parents should already have you on a VPN. They should already understand what it is and why it's important - you need to understand that what you are posting now, even at a very young age, is vulnerable in the same way, your age doesn't make difference. Have a talk with your folks. They should really be doing it for themselves, too, it's just good internet sense. Good luck, and post back if you need suggestions for a good service, as they are not all created the same or have the same features. :)

My suggestion:

[LordHighExecutioner]

Get a life, not a VPN!

changes

[PopeRatzo]

I didn't get my first VPN until just after I hit puberty.

Wait, what exactly is a VPN again?

Re:changes

[dissy]

I didn't get my first VPN until just after I hit puberty. Wait, what exactly is a VPN again?

Well, when a mommy pptp endpoint and a daddy ipsec endpoint love each other very much...

when you need a vpn

[Anonymous Coward]

My two largest things I use my VPN on my VPS for are tunneling all my public wifi to hide my public IP from home internet providers that don't allow me to offer free WiFi from their product and packet scheduling and shaping traffic from any kind of device that will work with a VPN.

In true /. style

[Anonymous Coward]

Don't be a dumbass kid. Just use linux / freebsd. Learn to program in java / c--, sharp / B flat / Pi R Round or latest flavor of crappy bloated program language. DO NOT USE WINDOWS! Scrap WIFI and your cell phone. Get a landline and use DSL. This is much safer than a VPN. Failing that, just hook into McFuckers Shit food free wifi. This is much safer than a vpn!

Good luck asking stupid questions of these assholes. You never get any decent advice other than "Hey if you have to ask you are too stupid to use technology" Self righteous assholes... :P

Re:In true /. style

[Anonymous Coward]

Come on, real /. posters are programmers. Programmers are very specific people and they won't just mumble "use Linux", they will specifically tell you to use "Tails" Linux distro which routes all traffic to Tor by default. Who needs VPN when you can install Tails for free.

It IS like driving where you can get... kill

[Bruce66423]

A serious predator who chats her and then kidnaps her after the meet is at least as bad. Teenagers are hormonally driven sub-humans - which is why their human rights are limited. Pretending otherwise, whilst attractive and reinforcing of our own perceptions of ourselves at that age - which we edit to exclude the dumb stuff we did - is dangerous foolishness.

A small but significant number of kids go missing and don't surface again. We like to assume they didn't end up in a dungeon as a paedophile's plaything, but there's no good reason for that optimism.

over 101+ post, yeah ad revenue is loving it...

[Anonymous Coward]

14 years old, come...on..., if a 14 year old is smart enough to ask this kinda question (*kuch clickbait*)... he/she probably knows better then us old timers, the answer to this question.

 

He doesn't need a VPN. He wants one.

[AlanObject]

It is the new bling.

You wouldn't expect him to be the only one on campus without one would you?

Using a VPN only INCREASES your exposure

[Anonymous Coward]

Who do you trust more? Your ISP and the people monitoring it. Or the VPN operators, plus the VPN's ISP, plus the same people monitoring it.

VPN actually REDUCES your privacy in general. It's good for appearing in a different physical location or for privacy in "hostile territory" as it were (for example using an open access point; or a cell phone ISP).

It is however, hurting your privacy if your ISP is at least as "good/bad" as the VPN's ISP because you're introducing several extra easily monitored layers to potential threats.

vpngate

[Anonymous Coward]

Offers free vpns via the University of Tsukuba. The fat connections are in japan with volunteer ones in a number of other countries (korea, us, canada, even a few in places like turkey, iran, etc.) However, not all nodes get access to the complete internet. A few or the networks they attach to perform malicious operations on the connection or attempt to mitm https connections. Unlike Tor however, they can offer you UDP access to the internet, even over a TCP-only network connection, which may offer benefits if you wanted to game or torrent from a network connection that otherwise bans it.

Simple flowcharts for deciding if you need a VPN

[SuperKendall]

Will You ever run for public office? ---> Yes

Are your porn tastes fairly mainstream, such that the common porn sites are sufficient for your carnal appetites? ---> No

Are you like, SUPER INTO drugs? --> Yes

You get all tingly when you see people n animal costumes --> Yes

You are actually a For Real criminal --> No (all VPN users will eventually be bugged by NSA/FBI).

Expert advice

[Anonymous Coward]

Tons of terrible advice and confusing comments on this thread. Hereâ(TM)s a couple of expert resources to consult about personal IT security:

https://ssd.eff.org/

https://www.yourultimatesecurity.guide/thirty-day-challenge.html

Down at Toys 'R Us

[tgibson]

You can get a pretty good deal on "Baby's first VPN".

When you start...

[VeryFluffyBunny]

Like you should buy condoms before you start having sex, you should get a VPN before you start using the interwebs. Is that clear enough?

You'll Understand When You're Older

[cstacy]

Dear Johnny,

At 14, many boys begin to notice feelings about VPNs.

You've surely noticed that the VPNs have been changing.
Some of them have bigger capacity and some look more secure
than other VPNs in your school. You may catch yourself
staring at some of the older VPNs and having daydreams
about getting on them.

You may even have woken in the morning after a strange
but pleasant dream about VPNs, a dream you didn't totally
understand, and discovered that you had a data leak overnight!
Don't be ashamed or scared.
This is all perfectly natural and normal at your age!

You are changing into a young man, and it can be exhilarating and
wonderful, strange and confusing, all at once. You might find yourself
awkward or stumbling a lttle when you're near a VPN.
Just relax, it's going to be OK!

There are important things to know and things to learn about VPNs.
Don't rush into it. Talk to your parents or any adult who you feel
comfortable with. You don't want to use just any VPN.
The adults can explain some things about the cryptic nature of VPNs,
how to approach them, how to figure out which ones are respectable,
and which ones will be the best for you. Listen to people you trust.
You're not alone, either. You can also find information on StackOverflow.

You probably don't need a VPN this week.
But in just a few years, you'll wonder how you got along without a VPN.
Congratulations! You've just taken the first step towards adulthood.

Re:You'll Understand When You're Older

[Anonymous Coward]

Nice one. Looks like a VPN is just like any girl schoolmate.

Re: "secret" surveillance

[Anonymous Coward]

I've been surveilled multiple times in spite of it being "secret". USA isn't a free country, as some might say.

If you are looking for privacy forget a VPN svc

[shaitand]

Anyone and their dog can set up a VPN service in a few hours with claims they don't retain records or some such. First they are lying, you can't verify it and it's far far easier to run such a service with records so they are lying. Second, VPN services make great honeypots, therefore you can safely assume most of them are just that. Third, IP addresses alone are no longer considered sufficient evidence of identity in most cases, a VPN solves that problem by giving a second layer of identification in the form of VPN account information. This double linkage back to you is generally viewed as greatly increasing the probability of conclusive identification.

If you are trying to use network resources at home, use a home vpn you set up yourself. Otherwise you probably want a proxy and/or TOR (not perfect and slow) with javascript disabled in the browser. If you are asking because you pirate crap, you don't really need a VPN, keep your bandwidth usage reasonable and avoid torrents for idiots like content still in theaters. Better yet, don't use torrents AND avoid content for idiots like things still in theaters.

Don't think in terms of absolute security and being untraceable, think in terms of who you don't want tracking you, their realistic resources and being the low value target with too high a cost to be worth it. Movies for instance make most of their money in the theaters and while the studios oppose all piracy efforts to hinder it cost money eating into their profits so what do you think they target to get the most bang for their buck? By avoiding that content at that critical time you aren't just avoiding their most likely target, you are from their perspective doing orders of magnitude less damage.

VPN = virtual private network

[os2fan]

It would have been nice if the original post had expanded VPN at least once, so people who have not encounted it could understand it.

Honest answer? Never.

[Anonymous Coward]

Using a VPN or any other privacy-enhancing feature like encryption will single you out on surveillance databases, grievously impacting your future opportunities to obtain housing or gainful employment. Do not be the odd one out: conformity is safety.

Back in my day this would have read...

[trevc]

Right now I am 14 years old, I was wondering when I should get a girlfriend... I was thinking about getting the yearly deal. But right now I really have no need for a girlfriend at the moment. I was thinking of getting a girlfriend when I'm in 11th grade or maybe in college. What do you think?

That second you know

[Anonymous Coward]

what a vpn is, and why someone would need it, is probably the point where you should aim to get one in the near future.

TOR and de anonymisation.

[DrYak]

The flip side is that if any one of the exit points are monitored by an entity, and your browser traffic can be fingerprinted, they now have you on the radar, and can obtain data matching your fingerprint to a person from sites that collect the data (like online payment sites and banks, and ad aggregators that are partners with shopping sites).

This is explicitly addressed by TOR :
- TOR itself constantly changes routes. An entity that doesn't control all or a very large fraction of all exit nodes will only see occasional glimpses of out traffic.
- You are definitely not alone on TOR, some people simply use it for general anonymity or just for shit and giggles, meaning that your traffic will by mixed with traffic of lots of other people, even on the same exit-node
- TOR is a high latency network (multiple jump point)
- All of the above simultaneously make very hard to correlate input and output traffic.
Which is one way to diminish risks of de-anonymisation.

TOR also provides package with a Tor Browser, which is a special built of Firefox consigured to be as un-noticeable as possible (its fingerprints match an excessively large amount of other browsers), and includes additional measures to block other risk (Flash is blocked and thus a flash App could not be used to de-anonymise).
Means that any information that an entity could collect during the short glimpses on one of its controlled exit node will perfectly match hundreds of thousands of other browsers. (You can't rely on a trick like "which of your users have a browser that has the late 90s font Quake.TTF installed ? Which of these browser has Raetho-Romansh as a listed requested language ?", etc.)
This makes it horribly difficult to use fingerprints to match an user.

Again, If you're not hunted by the NSA, the FSB or the Mossad, chances are you won't be found on TOR.

Last and third peculiarity : .onion addresses.
Some server are entirely on the TOR network and do not require any exit-node to be accessed.
The Piratebay is a known example with http://uj3wazyk5u4hnvtk.onion/
Another one is DuckDuckGo with http://3g2upl4pq6kufc4m.onion/

Traffic to these addresses will NEVER leave the TOR network and cannot be witnessed by adversary-controlled exit-nodes.
As such, that's yet a third way de-anonymising is prevented.
Also, these addresses will prevent DNS-based access blocks. (They do not even point to an IP address, DNS are useless). So no matter how often someone tries to block Pirate Bay at the ISP level, the .onion address will be unblockable.

Re:TOR and de anonymisation.

[arth1]

This is explicitly addressed by TOR :
- TOR itself constantly changes routes. An entity that doesn't control all or a very large fraction of all exit nodes will only see occasional glimpses of out traffic.

A single glimpse is enough. The problem isn't listening on your continued traffic, but being able to fingerprint any users who use that exit node as little as once.

- You are definitely not alone on TOR, some people simply use it for general anonymity or just for shit and giggles, meaning that your traffic will by mixed with traffic of lots of other people, even on the same exit-node
- TOR is a high latency network (multiple jump point)
- All of the above simultaneously make very hard to correlate input and output traffic.

You don't need to correlate input and output traffic. All you need is to log outgoing requests, and at your leisure grep for destinations you don't like, and check the fingerprint of those requests against big entities like Google, PayPal and banks.

If any of the accesses to a highly illegal source have fairly unique fingerprint that any entity is able to match to a person, you get a court order to search that person's computer for evidence.

Wrong part

[DrYak]

but being able to fingerprint any users who use that exit node as little as once. {...} and check the fingerprint of those requests against big entities like Google, PayPal and banks.

If any of the accesses to a highly illegal source have fairly unique fingerprint that any entity is able to match to a person, you get a court order to search that person's computer for evidence.

(Note: you're answering to the wrong paragraph, I've written about finger printing in the next one).

Yes, but that require a finger-printable browser.

As I've mentioned, the Tor bundle goes to great lenght to make sure that the packaged Tor Browser is as unremarkable as possible.
(Characteristics shared by hundreds of thousands)

Also in the specific case of "high illegal source": if even The Piratebay and Duck Duck Go have .onion addresses (as I've mentioned in my 3rd part), you can bet that the juicy stuff that law enforcement would be aiming (whatever is the current descendant of Silk Road ?) has also an onion address and no exit node will ever see the traffic. There won't be any log to grep.

Re:Wrong part

[arth1]

Also in the specific case of "high illegal source": if even The Piratebay and Duck Duck Go have .onion addresses (as I've mentioned in my 3rd part), you can bet that the juicy stuff that law enforcement would be aiming (whatever is the current descendant of Silk Road ?) has also an onion address and no exit node will ever see the traffic.

An .onion address isn't much help if any part of the rest of the URL is on a special interest list. azix723czou5pTr1k.onion/illegal/content/terrorists_handbook.pdf or th3b9eex7781fgp.onion/vajiralongkorn-buggering-a-pig.png are flags as good as any.
Never mind that the .onion addresses are persistent for long enough that the surveillance teams who also browse the illegal content can easily add them to their own scan lists. They don't need to know the IP address or DNS name of a site - all they need to know is that the .onion address at one point pointed to Trigger Site, and scour logs. Even old logs, scanned over again after they map another .onion.

you can bet that the juicy stuff that law enforcement would be aiming (whatever is the current descendant of Silk Road ?) has also an onion address and no exit node will ever see the traffic

I think you misunderstand how Tor works. There will always be an exit node. Earlier, you could specify an exit node with .exit, which ensures that that node is trusted by the destination site, but that has been deprecated (it also allowed goons to take over the exit node, or DoS it, or otherwise interfere).

Rogue exit nodes exist, and they are heavily used. They would not be if there was nothing to gain from it, but there certainly is.

The main problem is inherited trust. You trust someone, but then you also trust who they trust, and in turn who they trust. That is a prevalent weakness in almost all distributed systems, and a very human flaw. It's built in to our brains to do that, as it assists in survival when living with other human beings. But it is a WTF thing to do in security. Friends of friends are easily your enemy. And for TOR, you generally (unless you're a geek) even trust strangers directly.
The original Freenet had some steps to avoid this. But when they revamped it, they fell into that trap too. Where it earlier was unusable due to latency, it became less secure due to inherited trust.

WE are the problem. How we design things is irrational, and based on human concepts and gut feelings that don't work for computer networks.

Hidden services vs exit nodes

[DrYak]

An .onion address isn't much help if any part of the rest of the URL is on a special interest list. azix723czou5pTr1k.onion/illegal/content/terrorists_handbook.pdf or th3b9eex7781fgp.onion/vajiralongkorn-buggering-a-pig.png are flags as good as any.

I think you definitely need to document yourself how TOR work in general (and how .onion addresses work in peculiar).
(And also how HTTPS work, by the way)

TOR is a layered encryption scheme (hence the "onion" part of the name).
Each layer is a cryptographic public key layer. Only a node with the corresponding private key can peel a layer and see what is inside.
Inside there might be:
- (for all nodes) another encrypted layer, in which case the node forward it to the next node, identified by the public key in that new layer.
- (for exit nodes) an exit node might find underneath instructions to contact a resource on the regular net
- (for hidden service) an node with hidden service might find underneath instructions to pull data out of its own web server to which it is attached

If the target address is .onion :
in that case, the request NEVER reaches an exit node.
One of the node on the route actually happens to have a webserver attached to it, and when peeling the onion layer, get instruction to return some data from that server, instead of passing the onion to the next node in line.
No exit node will ever see the URL.
Only the hidden server will ever know which file got send.

The only thing I'm simplifying here is the gymnastics in setting up a circuit between the user and the server.
(It's done a way to guarantee each-other's anonymity, both end points have a say on the layers between them).

An exit node might see an URL as you mention, only if :
- it's a genuine web address (like slashdot.org)
- the traffic is in plain unencrypted HTTP.
In this case, the exit node will see a conenction requrest to the :80 TCP port of the server handling slashdot.org, and then will notice in the plain stream the "GET /path/image.png" stanza. So only in these circumstances does an entity owning an exit node knows exactly which URL you visit.

If the traffic is HTTPS :
in that case, the exit node sees the conenction to the :443 TCP port. But from this point onward, the browser and the web server negociate a connection.
Only an entity possessing the private keys of webserver could successfully impersonate the server and pull a man-in-the-middle. Other wise you need to hope that the browser is stupid enough to trust your shady certificate authority (e.g.: You're China, and thus you can issue a certificate for Google.cn signed by the China CA trusted by some gullible browser that hasn't removed this CA yet from their list like any other modern browser) and the user uses no certificate pinning plugin (complaining that the google certificate suddenly isn't signed by Google's own CA but by China).
Without this, the HTTPS is completely opaque. You don't see the full visited URL.

Never mind that the .onion addresses are persistent for long enough that the surveillance teams who also browse the illegal content can easily add them to their own scan lists.

Nice for them to add it to a list but WHAT are they doing to scan with this list ?
No exit node is ever going to observing that URL.

The only place where this URL will be seens is on the log of the actual server.
Either the actual position of this server is unknown.
Or the adversary actually OWNS the server. At which point the logs of the server aren't the biggest problem anymore : now the advesary can honney trap all they want as they control the server.

I think you misunderstand how Tor works. There will always be an exit node.

Nope, no. No, no, no, no.

Re:Hidden services vs exit nodes

[arth1]

If the traffic is HTTPS :
in that case, the exit node sees the conenction to the :443 TCP port. But from this point onward, the browser and the web server negociate a connection.
Only an entity possessing the private keys of webserver could successfully impersonate the server and pull a man-in-the-middle. Other wise you need to hope that the browser is stupid enough to trust your shady certificate authority

Or hope that the ones running the exit node doesn't also have thumbscrews on as much as a single entity that issues certificates and is a root CA in the certificate stores of most browsers.
How much are you willing to bet that TLAs in the US cannot get certs issued by one of the many US CAs in order to monitor traffic to a given web site?

Government and CA

[DrYak]

Or hope that the ones running the exit node doesn't also have thumbscrews on as much as a single entity that issues certificates and is a root CA in the certificate stores of most browsers.
How much are you willing to bet that TLAs in the US cannot get certs issued by one of the many US CAs in order to monitor traffic to a given web site?

Like I've written just after that, it boils down to :
- kicking out CA which are known to issue bogus certificate to third parties (par of the reason why China's CA and a few other got kicked out of every modern browser)
- certificate pinning and various other example of techniques which help make sure that the certificate you're seeing is the right certificate and not a bogus one issued by some government-controlled CA that you happen to trust.
(Such measure can already detect when a content distribution system hasn't synchronized their certificates)

And again, like I've said nearly the top of this discussion : if the NSA, the FSB and the Mossad want your ass, TOR isn't a magic bullet that can save you (and there's no single thing that could save you either). But TOR is nonetheless a step in the right direction that can limit the damage that small player can do (and a building block toward a more comprehensive solution infrastructure that can hamper a bit Mossad-level targetting)

here's a good reason why "NOW" :)

[KingBenny]

https://www.linux.com/blog/201...

I've gotten warning letters from Comcast my ISP

[Anonymous Coward]

I got a warning letter from Comcast for Bittorrent less than 2 years ago. I got a VPN service and never got the warnings again.