I'm fine with VPN to evade restrictions or whatever purpose you want, but stop pretending it's all that different.
I can say though for a fact that a few of the largest security companies have been paying for strategic access to netflow in the us for years. The reality is there are good arguments pro and against.. and that doesn't even account for any "netflow" visibility US and Foreign Agencies may have.
We really have to determine what we want to be standard for privacy and what advancements we're willing to give up in exchange.
Most people I talk to buy VPN services to avoid legal threats from pirated movies or to avoid traffic surveillance from their local ISP / workplace / institution.
I’ve never heard someone describe it like a hard-to-denonymize tor node or anything.
Power: Businesses are run by humans, who do not merely optimize discounted cashflows. Some humans enjoy wielding power, and frequently do so in an antisocial manner. See eg Stanford Prison Experiment.
Paranoia: Royalty have always been paranoid. Much has been written about the intelligence operations of paranoid merchants in Renaissance Venice. You should think of huge private entities like Koch Industries and Bloomberg as kingdoms. Maybe security teams want to see threats, which increases their importance to the organization.
Crime: Theft, manipulation, subversion. Companies do crime all the time, and are rarely held to account. There are indirect indicators that this type of conduct is becoming more common.
Curiosity: According to Snowden, even cleared NSA employees who pass a polygraph and invasive FBI background check abuse their access to personal data out of curiosity. This is probably a human invariant.
The fact that ISPs are monetizing it and letting this data out of their control is utterly terrifying, and in the United States, specifically permitted by law.
Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.
Why should everyone be surveillance for catching the minority who do the wrong thing. It’s not about whether anyone cares about atok1’s data specifically right now.
EDIT: looks like this is addressed to some extent in the FAQ for Tor https://2019.www.torproject.org/docs/faq.html.en#SendPadding.
So I wonder: would the copyright nazis be able to use this kind of data corollary in court against an accused defendant? If the offense is civil I could see it being admissible since the burden of proof is lower (just has to be “fairly likely” AFAIK, but IANAL) than in criminal court. Though I don’t know if copyright infringement is a civil or criminal charge, and trust may depend on state.
Still, at best they could only match up pieces of the chain to dates times and data sizes, not see the actual data being transmitted over that connection (broken/weak crypto withstanding). But that might be enough to further persecute fair use, not to mention since other very dark stuff.
Exactly that. As with Tor, if you can observe the entry and exit flows you can deanonymize the traffic.
It's only a matter of time before either hardware or OS creators are all compelled.
