EDIT: If you want a truly safe VPN, you will need to do some work on both adversary modeling and technical implementation. If you are just worried about your ISP (filesharing of legally protected digital backups), use whatever. If you are worried that your data may be collected by your VPN provider, use a series of tor/vpn multihop. If you are a paranoid mf, use a privacy coin to purchase a VPS and then connect to it via tor on a public wifi network, set up a .onion hidden service for your ssh/chisel/etc port, connect over tor to forward your tunnel port to localhost, use that tunnel to connect to a multihop VPN system. Suggestions include mullvad, PIA, cryptostorm, whatever you want really. Throw a VPS with generic openvpn in the middle of your multi-provider hops, again paid in a privacy coin. Pay a homeless man to colocate a physical server that has DRAC and luks along with something like AMD TSME, then run containerized multihop there aswell.
Basically if you want something done right, at least do some of it yourself.
VPN is not classified as a communication tool in Switzerland and there are no existing Swiss laws that can compel us to log.
The Proton VPN Transparency Report & Warrant Canary is also still available at: https://protonvpn.com/blog/transparency-report
Thanks for sharing this.
https://www.bbc.com/news/world-europe-51467536.amp
Some of us also remember Hushmail.
https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-...
Protonvpn does log data and does hand it over. It doesn't matter if they "had to" (they can fight) You can't put the genie back in the bottle.
Considering you, as a person, are stateful, the strategy will inevitably fail and you'll be caught.
This is how people seeking privacy after doing bad things got found out. People were tracing patterns of behaviour long before there was an internet that produced access logs.
What's a better VPN service anyway? Mullvad? I see Proton's stealth feature as being valuable.
Disclaimer: I have no conflict of interest whatsoever with Proton other than being a free user.
The recommendation the person you're responding to (PIA and Cryptostorm), is very untrustworthy and doesn't even match the minimum criteria from PrivacyGuides.
So many questions about that server provisioning workflow :)
https://arstechnica.com/information-technology/2021/09/priva...
however there is a significant issue with using hard drives to transfer data in airgapped networks without proper f-caging, optical transfer of data via taking a video of rapidly flashing QR codes is fairly secure when under enough blankets, but mylar shielding of walls and windows may be required depending on the adversary model.
Wireguard sets up an IPV4 based internal network and the machine responsible for the routing MUST know the client IP that was assigned to the connecting machine. There are some kernel modules to OBFUSCATE but not eliminate this data. Wireguard therefore has a fundamental design flaw that makes it faster but potentially less anonymous than OpenVPN protocol.
DYOR and YMMV. I always disable WG for at least my first hop.
While theoretically there may be more secure approaches you may also be introducing new dangers as well. Eg; paying for a VPS with an anonymous coin doesn't mean your VPS provider can't deanonymize you or comply with a warrant. You need to make sure every single link in the chain is foolproof. That's way more error prone.
IMO a proven legal track record is in a way more valuable than unproven theoretical flaws (if you can even call them that).
I began mistrusting Proton some time ago with their hit piece on RAM-only VPN server confirming my bias.
Let's assume any adversary interested in reversing that new protocol, what's the point of not being transparent on how this new and fancy obfuscation works.
The TOR project has a lot of innovation in censorship circumvention[1] while still being transparent to their userbase.
In their defense, they're basically saying this doesn't do anything since it's still detectable.
Anyways kudos to them, and I can’t wait to see how it fares against China’s GFW.
[0] The article says Wireguard is easy to block, but in my experience GFW lets it through.
[2] https://xtls.github.io/en/development/protocols/vless.html
[3] https://xtls.github.io/en/development/protocols/vmess.html
Depending on how you were connecting, your traffic may have been explicitly allowed. If you were connecting via your cell phone, using roaming with your home SIM card, you're not subject to the Great Firewall (all your data was essentially VPNed through your wireless carrier's PoP already). And IIRC many larger hotel chains that cater to foreigners (and would likely refuse to allow a citizen to stay there) also aren't GFW'd
TLS-in-TLS (trojan) seems to be detectable too.
If we look at Chinese and Russian government DPI, we will see that now VLESS with XTLS‑Vision and XTLS‑Reality are not detectable. YET.
For some time. After a while, the connection eventually gets blocked or throttled. The annoying thing about understanding the GFW is that it's not quite deterministic.
https://github.com/ProtonVPN/android-app
PS: Tried their free plan in China and it won't connect ("Connection Timeout"). In fact, I had to use another VPN to get past their app's loading screen (guessing it got stuck while doing a request to their server)...
https://github.com/ProtonVPN/android-app/blob/fc9e7f500fe56b...
* Is this an open protocol?
* I would like to see a detailed comparison to similar solutions
* Looks like it's TCP so head-of-line blocking may cause performance issues.
* What prevents entities from detecting that all your traffic is going to a single endpoint, or just blocking known VPN servers directly?
I would think it would've been best to keep this update "silent", so to speak, to avoid letting said parties know of this new protocol.
Question though: don't most VPN filters simply block a list of all known VPN endpoints? Maybe I missed something but I don't see how Proton's Stealth evades this simple filter?
The reason most VPN protocols use UDP is for performance. With TCP, a single blocked packet can delay multiple streams. And fwiw, openvpn supports using TLS over TCP, but it is less performant than udp.
I would be more interested in a protocol that uses quic and looks like http/3
[1] https://apps.apple.com/ru/app/proton-vpn-fast-secure/id14370...
The actual service you are connecting to (example: website, game server etc.) most likely uses a IP-based detection service such as https://focsec.com/ or similar. In such cases, the protocol will not make a difference.
Reference: https://web.archive.org/web/20230310043036/http:/sites.inka....
I'm assuming this boils down to a cat and mouse game, then? E.g. popular firewalls patch this and Proton releases an update to bypass filters?
Also, couldn't access this site directly because of corporate firewall, how ironic.
It doesn't work against GFW nor in Russia. I've seen some people saying they're having issues in Iran as well.
If you had a protocol like this combined with something like MysteriumVPN (which has "decentralized" VPN nodes) then yeah, it'd probably help.
