Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

VPNs in general tend to be super shady.

Many vendors surreptitiously use user nodes as exit nodes and route traffic in suspect ways.

VPN software stack is surely a major target for state and non-state actors to monitor and exploit.



I think one major problem is VPNs are advertised or promoted as if they're synonymous with antivirus software.

I partially blame the myriad YouTubers who happily push these to their fans to supposedly protect their privacy and protect their computers from harm.


Until recently, eyeglass manufacturers were marketing blue light filtered lenses (which don't even filter much blue light anyway) as a way to prevent macular degeneration, until regulators shut it down. VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL.


Any source on the blue light filtering not working? I didn't get the filter on my latest glasses and feel like my eyes fatigue more quickly, but I'm aware that could just be aging or a change in monitors, lighting, etc. which have occurred since my last subscription update.


The lenses I'm talking about are the ones that are completely or nearly completely clear. Here's a photo of the "Everyday" blue light lenses on Zenni Optical as an example. They are marketed as blocking 16x more blue light than normal lenses. https://static.zennioptical.com/marketing/campaign/blokz/202...

How could it be blocking any significant amount of light in the visible spectrum and still be clear? I'm sure the "16x" claim is true, but normal lenses block a small amount of light. 16 times nearly zero is still nearly zero. It's just a marketing gimmick.

Zenni Optical also sells lenses which are orange. I'm sure that actually does block a significant amount of blue light, but I also know from my experience visiting optician offices that many consumers are buying the first kind.

I'm aware of studies which link blue light to eye fatigue and disruption of the circadian rhythm but I'm skeptical that blocking 5% of blue light or whatever could have a perceptible medical effect.

With that being said, I don't feel strongly about claims like the 16x thing if its actually true (just a bit misleading). My comment above was mostly about the claims that they prevent macular degeneration which there is no evidence for. And regulators are right to jump in before it gets too bad, otherwise why stop at macular degeneration? Just say your lenses prevent hair loss and skin cancer while you're at it.


Hey, I have such glasses, and here in France at least they are still marketed. Do you have any reference pointing out the fact that they do not work? (Are they even worse than regular glasses?)


> they are still marketed

They're still marketed as a way to prevent macular degeneration?


They still push them at the sales end of optometrists here in Australia. My optometrist partner always gives them death stares whenever they try to push that blue light filtering scam when I'm getting new lenses (like I did a week ago)


> VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL.

That's... not exactly true, given what definition of "protecting" you follow. VPNs definitely can protect against some forms of attacks that plain old HTTPS can't:

- malicious QoS/routing policies at the ISP (or a public WiFi operator) that, say, down-prioritise or throttle stuff like YouTube, or route it through backed-up links (German Telekom was infamous for bad peering towards high traffic sites including Youtube [1] or where they all but extorted money from "double paid traffic" from server owners [2])

- ISPs hijacking DNS for a myriad of reasons (NXDOMAIN ad-hijacks, government-ordered censorship, thinking they can offer "improved" DNS service by simply answering all requests going out on UDP53 with their own servers [3], ...)

- ISPs and WiFi operators listening on DNS requests or doing traffic analysis to sell to advertisers [4]

- other devices on the network attacking your machine (e.g. in a coworking space) - proper VPN software like Cisco will "cut off" all communication with the outside with the exception of the remote VPN endpoint IP and DHCP.

The part about malware is more sketchy, but in case the VPN operator uses something like PiHole and other shared lists of malware domains and IPs to blacklist common-known vectors and C&C sites, it is a valid statement.

[1] https://winfuture.de/news,63355.html

[2] https://www.golem.de/news/hetzner-und-netzneutralitaet-extra...

[3] https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hija...

[4] https://www.washingtonpost.com/wp-dyn/content/article/2008/0...


As Linus (LTT) mentioned a while back, VPNs are an insanely profitable cash cow with super low bars of entry into the new business, but it sits at a super legally precarious position that could jeopardize major legal and ethical challenges.

I agree though that a lot of YouTubers have grown fat and comfortable with VPN providers led largely because of the financial incentives over their desire to protect fans.


Is there a name for the phenomenon when something is over-advertised to the point where potential consumers become less interested with more advertising? I’ve reached that point with NordVPN, SquareSpace, and a few others, but especially any pharmaceuticals that get TV ads (not that they’re ever relevant to any health concerns for anyone in our house).


Anecdote to the pharma comment, I recently looked up what happened with the CW because it felt like the network was falling into a pit recently. It turns out the network got "trimmed down for aquisition" which got swooped up by a cable providers. Apparently the average viewer of CW on terrestrial cable is 58!? (Taken from Wikipedia for what it's worth). If 58 is the average viewer for CW, just how old people are trending for less youth oriented networks. I makes a lot more sense to see a bunch of drug commercials (with their very high ad rates) shoved down your throat.


Pharma ads are not permitted here, so I sometimes look em up on the YouTube’s for amusement.


Law of diminishing marginal utility?


I think GP is talking about diminishing total utility (negative marginal utility).


> one major problem is VPNs are advertised or promoted as if they're synonymous with antivirus software.

Famously described by Tom Scott —

[How it started https://www.youtube.com/watch?v=WVDQEoe6ZWY

[How it's going] https://www.youtube.com/watch?v=Wif1EAgEQKI&t=320s


But he does not promote it as security thing.


This is true, but the smash cut is funny nonetheless.


Does this also work if you're using the generic OpenVPN client to connect to the VPN? I've used a bunch of different VPN providers over the years, but they usually just offer an OpenVPN configuration that you can use with the normal client. I'm not aware of this also allowing them to send traffic the other way, but maybe it does?


afaik no that's impossible without modifications of the customers OpenVPN software itself (they would need firewall/iptable rules for NAT, impossible to set via OpenVPN config). That's exactly why it's a bad sign if a VPN provider doesn't just give you VPN configuration files.


Hola VPN, for instance, is famous for using the extensions as "exit nodes"


So does this mean then that if someone appears to be using my IP to do illegal thing x y z police/lawyers would come at me first?

If so, would simply having an account and exe file be enough to argue “my wifi is open, I didn’t download all that XYZ!”


By the time the police comes at you because of your home IP, they usually have collected a lot more evidence than that. That's why torrenting from your home without a VPN usually just results in a letter from your ISP saying "we know what you're doing. cut it out".

No body has ever been convicted with their home IP as the only evidence.



Of course, you get raided most likely once they have sufficient evidence that they'll be able to collect incriminating evidence. Your IP might be enough to get a warrant, but they'll need a lot more to build a case in court. Hence the raid, confiscation of servers, etc.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: