Vpns and security

[lambrinoul 0]

I have been wondering how secure vpns really are.

 

Let's say that I am doing a research and someone wants to eavesdrop to what I search for. Of course if someone would do that, they'd already know 3-4 things about me. Can't they combine the data from my ISP and the searches from the VPN to see what the research is about?

 

1)From the ISP data they know that I am connected to a specific VPN service and they know the country where I am located.

 

2)By looking at the the specific VPN service, they can filter the content as to what I would/could be searching.

 

3)By comparing the time when I was online (through ISP) and the time a relevant site was accessed they can filter it even more and find the server I am usually accessing.

 

4)By knowing the VPN service server I am using, they have an almost direct link to the info I am digesting. At least to a part of them.

 

5)Furthermore if the searches mostly come from a server that could be having only 5 connected users (like   Sador in Spain as I am writing this) or perhaps 103 (Persei, US ) they could almost with great certainty follow my online activity.

 

 

Even an anonymity system like JonDo has a dozen servers. It could be very easy to filter the content that these servers are connected to and use the same method.

 

 

Of course i am not talking about torrents or other on-off material access. I am talking about a research that a scientist, a journalist, etc could/would do and I am wondering if in the end this could be tracked down.

 

 

Just curious what you think about that. 

 

 

[lambrinoul 0]

ok. I found the answer just now. and it was the one I was afraid it would be.

http://security.stackexchange.com/questions/17855/is-it-possible-to-identify-a-vpn-user-by-finding-relations-in-traffic

[Staff 9781]

Hello,

 

that was the problem we faced even before building up AirVPN. Without entering a debate about the confusion you make between security and anonymity, an adversary needs to control different networks and must have the ability to correlate traffic in order to crumble the anonymity layer. For example an adversary with the power to wiretap simultaneously your line AND the VPN server (the server, not the datacenter lines: in this case timing correlations become necessary and the task becomes overwhelming for every single client) you're connected to has this power. Mitigation is possible by picking servers outside your country and by rotating servers, but in order to defeat completely an adversary with such power (and even some higher powers) you need partition of trust: https://airvpn.org/topic/54-using-airvpn-over-tor/?do=findComment&comment=1745

Of course, if you mix identities, and one of these identities is your real identity or can anyway be exploited to reveal your real identity, no service and no technique and no partition of trust in this world can 100% protect you. Remember that a VPN protects your line, not your behavior. A very trivial example is using a VPN connection to log in Facebook with an account which is related (or has been related at least once in the past) to your real identity.

 

Kind regards

[dd79 15]

This is unethical but: Someone elses WLAN -> VPN paid via Bitcoin -> TOR (and not getting busted in the act) should be the ultimate in security.

[Staff 9781]

This is unethical but: Someone elses WLAN -> VPN paid via Bitcoin -> TOR (and not getting busted in the act) should be the ultimate in security.

 

Hello,

 

even that would be insufficient to remain anonymous if, in the action, you use an identity that can be exploited to reveal your real identity.

 

Kind regards

[lambrinoul 0]

Hello,

 

that was the problem we faced even before building up AirVPN. Without entering a debate about the confusion you make between security and anonymity, an adversary needs to control different networks and must have the ability to correlate traffic in order to crumble the anonymity layer. For example an adversary with the power to wiretap simultaneously your line AND the VPN server (the server, not the datacenter lines: in this case timing correlations become necessary and the task becomes overwhelming for every single client) you're connected to has this power. Mitigation is possible by picking servers outside your country and by rotating servers, but in order to defeat completely an adversary with such power (and even some higher powers) you need partition of trust: https://airvpn.org/topic/54-using-airvpn-over-tor/?do=findComment&comment=1745

 

Of course, if you mix identities, and one of these identities is your real identity or can anyway be exploited to reveal your real identity, no service and no technique and no partition of trust in this world can 100% protect you. Remember that a VPN protects your line, not your behavior. A very trivial example is using a VPN connection to log in Facebook with an account which is related (or has been related at least once in the past) to your real identity.

 

Kind regards

 

Thank you, that was informative.

 

I am trying to use Air over Tor but  I am facing some problems. I have posted on another post but I am on Moderators queue.