263
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Feb 2024
263 points (88.6% liked)
No Stupid Questions
35729 readers
903 users here now
No such thing. Ask away!
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Credits
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!
founded 1 year ago
MODERATORS
Slightly off-topic rant:
I hate how the 'VPN' term has been took over by companies selling services using VPN technology.
VPN was initially 'Virtual Private Network' – used to securely connect own (as belonging to an organization or person) devices over a public network. Like securely connecting bank branches. Or allowing employee connect to a company network. And VPN are still used that way. They are secure and provide the privacy needed.
Now when people say 'VPN' they often mean a service where they use VPN software (initially designed for the use case mentioned above) to connect to the public interned via some third-party. This is not a 'private network' any more. It just changes who you need to trust with you network activity. And changes how others may see you (breaking other trust).
When you cannot trust your ISP and your local authorities those 'VPNs' can be useful. But I have more trust to my ISP I have a contract with and my country legal system than in some exotic company in some tax haven or other country that our consumer protections or GDPR obligations won't reach.
Back to the topic:
I do not believe that all VPN services are owned/funded by governments, but some may be. I don't have much reason to trust them, they are doing it for money and not necessarily only the money their customers pay them. In fact I trust my government more that some random very foreign company.
I cringe when I see people touting VPN services as somehow better than HTTPS.
Sure VPN helps you re-source your IP address but that doesn’t do anything to help the security of online banking.
You know MITM an https website is child's play, right? If you're inputting your password on a network you don't trust you're doomed. SSL certificates are worthless because they can be easily forged by anyone pretending to be the site as long as they're between you and the actual site, which they need to be to MITM.
VPN and HTTPS solve different issues, and are better when used together. Most of the time you don't need a VPN because you trust your home network and ISP, but if you're using a public access point https does not replace a VPN.
Tell me more about SSL certificate forgery. As far as I know, for a device to trust it, it needs to be signed by a trusted CA. You'd either need to compromise a CA and create your own certificate for the website or make the target device trust a custom CA. In the case of a custom CA, the user explicitly needs to perform an action to trust it. How is this not enough on a public network?
There are cases of malicious/incompetent CAs issuing certificates to parties who don't own the domains. DigiNotar was the most famous one, and recently there was a Chinese CA (I forgot the name) booted from the list as well. Once they're detected (browsers report SSL certs they see back to mothership for audit) they would be removed from trusted lists though, so chance that they're only used for high value targets and can't be used that often.
There are several ways, most common is to MITM the address to redirect to a different but similar one, which is unlikely to get noticed since you know you typed the address correctly or you clicked from a trusted link/favourite, then that wrong address has it's own valid SSL certificate. Another way is to use self-signed certificates, which browsers would warn people about, but apps are not likely to. Also you can MITM the CA themselves, whole you wouldn't be able to actually pass by them you can do an exhaustion attack and essentially block all certificate exchanges, yes your site won't have a valid certificate, but neither will any real site, so most people will just ignore the message the browser is showing them because it's showing it for every site.
None of these methods would fool an attentive educated person, but they might fool someone in a rush. Also even if the attack doesn't succeed in stealing information it 100% succeeds in blocking access, while I might not be as concerned about blocking my Facebook, blocking my bank might prevent me from doing important stuff, and worse people who need to get into their bank are likely to just wave security warnings out of the way without reading them, especially if they've been getting them for everything else and nothing had a problem.
Edit: I also forgot to mention the other ways, there are leaks from CAs constantly, which allow you to either impersonate them or sign other certificates. Sure these get patched rather quickly once found, but after you have the signed certificate from them it's game over. Also what I was referring in the other post is self-signed certificates, most browsers show a warning about them nowadays, but again you can win by exhaustion.
You went from "MITM TLS is child's play" to "there are some ways we can social engineer our way around it if the stars align just right" in like one post. You're clearly not qualified here, stop with the FUD bullshit.
Yes, I trust my ISP more than my VPN, but I trust my VPN more than I trust the random wi-fi in the shopping mall. Using a VPN in your house for internet access is pointless, unless you're purposefully trying to keep your ISP out of the loop for legal reasons, e.g. Torrent, but MITM a VPN is much harder to do than an open wi-fi.
Agreed. What they're really selling is a proxy service, I don't know why that term isn't used. The fact that VPN software is used to establish that proxy isn't relevant, the end result is a proxy.
How is the term "proxy" more appropriate though? It's also the technical name for a concept that already exists. VPNs are by definition broader in scope than proxies, they work at a lower level of the networking stack and have different capabilities even if most people don't take full advantage of it. Anyway the point is that it's not a more appropriate term.
AFAIK the only thing VPN providers let you do, like SurfShark, ExpressVPN, NordVPN, ProtonVPN etc., is to route all of your outgoing traffic through their servers. They don't allow you e.g. to be in the the same fake LAN as a friend, which is what a VPN does.
Quote from Wikipedia:
That's pretty much what those commercial "VPN" providers offer.
That's not what a VPN does, that's what a VPN can do, if desired. What a VPN does is set up an encrypted tunnel between you and some remote network. That's it. How that remote network is laid out, how the traffic (and also what kind of traffic) is routed into/through/out of that network, and what the clients are allowed to do within are entirely up to the wishes of the network's owner. It might very well choose to isolate you from all the other clients on the network; that's not just a possibility, it's actually one of VPN's most important, most useful features.
Those commercial VPN providers offer you a fully encrypted tunnel that you can route all your network traffic through if you wish. It's just that people don't generally use it as anything more than just a proxy. Still, the connection is a textbook VPN connection, it's there, and it's capable of things a regular proxy is not, if you choose to make use of them.
Lucky you to be able to trust your ISP. Mine injects ads whenever they can, even hijack DNS and redirect invalid/blocked domains to a page full of ads.
In correct law, that'd be copyright-violation committed by your ISP:
IF the website you hit didn't authorize your ISP to create a derivative-work,
THEN your ISP adulterating it should be considered commercial-copyright-violation, and stomped by the copyright-lobby.
Notice how this has been going-on for decades, and the copyright-lobby .. ignores it, to stomp-on individuals only..
Interesting evidence of "rule of 'law'", isn't it?