Maybe I’m completely wrong about everything I’m going to say and in that case we can laugh about this theory I guess but here it goes…

Most people are only worried about if the VPN provider is keeping logs or not. But even if they don’t keep logs you could still be tracked by anyone who can see incoming and outgoing connections to the VPN server.

This would be easier to explain if I drew some images but I hope you understand anyway with just text. What it looks like for these adversaries is:

  1. they know your IP and who you are.
  2. They see you connect to a VPN server.
  3. They see VPN server connecting to many different servers and they don’t know which one is you.

But when it comes to number 3, they could actually figure out which one is you.

Obviously, if you are the only person connected to the VPN server they will see that there is no one else besides you using it and then any outgoing connection from the VPN server must be you.

If there are just a few users. Maybe three users are just connected to the VPN server but not doing anything, just idle. Another user is spending time reading reddit. Then you connect to the vpn server and within a minute a new outgoing connection from the vpn server starts and goes to lemmy. Pretty good guess that is you from their perspective. And to make the guess even better, when the connection to lemmy ends, you decide to immediately end your connection to the VPN server. I’m confident this would be enough evidence in a court and then it’s definitely enough for data harvesting and mass surveillance.

All this analysis can be done automatically with AI, even if there are hundreds users on a VPN server, the AI will over a larger amount of time (not just hours but days/weeks/months) collect enough data to be able to profile users and make good guesses which domains you are visiting even if the VPN prpvider doesn’t have logs.

What is the solution to avoid this type of tracking? Tor baby, tor. Leeegggoooo Whonix!

  • hersh@literature.cafe
    42·
    8 days ago

    Some VPNs allow multi-hopping, similar to Tor. I couldn’t give you an exhaustive list but most popular ones support this. Mullvad and Proton do, for example. There are also strategies to add noise into VPN traffic.

    This is not a silver bullet, of course. Tor has similar problems as you describe if an adversary has visibility into enough nodes. As always, this comes down to your threat model.

    On the one hand, I find the advertising of VPNs outright dishonest. On the other hand, I would trust any reputable VPN provider much more than I trust my ISP or cell carrier.

      • hersh@literature.cafe
        81·
        8 days ago

        Sure. I’m referring to the ones that run big ad campaigns, like Nord and Mullvad. They tend to overstate how a VPN can protect you, sometimes in ways that barely make sense. There is no epidemic of criminals stealing personal credit card information over insecure wi-fi, for example. The ads play into ignorance and fear.

        That said, yeah, I’d rather be on a VPN when on a public wi-fi network. But I’m not really worried about someone sniffing my encrypted HTTPS traffic (which is pretty much everything nowadays; Firefox by default won’t even load unencrypted web sites).

          • hersh@literature.cafe
            51·
            7 days ago

            They have a big IRL ad campaign in major US cities. See https://mullvad.net/en/blog/advertising-that-targets-everyone

            These ads certainly aren’t the worst, but they’re still a bit misleading. Using a VPN is not going to prevent tracking in general. Your phone apps will still send GPS data to all the same places. Web sites will still use all the same cookies. Facebook is still gonna be Facebook. 🤷

            That said, Mullvad does include domain-based ad and tracker blocking with their DNS server (which is free and available to the public, btw), and that’s also optional on the VPN, so it does help to a point.

            (Pinging @countrypunk@slrpnk.net to avoid double-replying. )

    • masterofn001@lemmy.ca
      4·
      7 days ago

      Ivpn is one service that not only supports the use of tor, but they also invest in the tor organization and run a lot of nodes.

      Their site is also a goldmine of basic to advanced level docs on serious privacy and security (free). Including detailed instructions for cresting your own anon servers, vps, etc. And how to use a VPN with tor properly.

      They are quite serious about what they do and how they do it.