chiisana@lemmy.chiisana.net
on 12 Apr 2024 09:17
nextcollapse
Security when you’re on untrusted network. I can trust Google to snoop my banking data and update the spending power info on my ad profile, I can’t trust the random dude in trench coat also using the public wifi when I am traveling out of my roaming coverage.
I joke of course, but the security aspect is still valid.
PortugalSpaceMoon@infosec.pub
on 12 Apr 2024 09:26
nextcollapse
What is it that you’re doing that is still not using some form of authenticated encryption? Almost everything is https, ssh, almost all mailservers have tls support, irc does have tls support…
What’s left that needs to be encrypted by a VPN?
Vash63@lemmy.world
on 12 Apr 2024 11:33
nextcollapse
The addresses themselves that you’re connecting to as one example. Also often DNS.
chiisana@lemmy.chiisana.net
on 12 Apr 2024 14:19
nextcollapse
Strictly speaking, Encrypted Client Hello (ECH) paired with DNS Over HTTPS (DOH) can resolve this. But not many people have their systems setup this way, so it is still pretty niche.
That also doesn’t resolve the carrier seeing which IPs you’re connecting to, which can often be traced back to services or sites.
PortugalSpaceMoon@infosec.pub
on 12 Apr 2024 14:35
collapse
What’s the threat model here? I can think of no DNS shennanigans that would not be detectable through the authentication mechainsms in TLS (chain-of-trust). Not having to trust network infrastructure is exactly what TLS is for.
chiisana@lemmy.chiisana.net
on 12 Apr 2024 14:55
collapse
Most DNS requests are clear text, which is why DOH was introduced to secure it such that no one can snoop on you looking up something-embarrassing.com. Also, the initial request, before you get the SSL certificate from the web server, you must tell the server at 169.169.169.169 that you’re looking for the certificate for something-embarrassing.com before they can get you the correct certificate. This is why ECH was introduced. Neither of which have became mainstream yet, and so there are still some basic leakage going on.
So this is a question I’ve been wondering: is public WiFi safe to treat like a private one if you’re using HTTPS everywhere?
skuzz@discuss.tchncs.de
on 12 Apr 2024 18:30
collapse
You only use HTTPS everywhere until you don’t. It’s kinda like a security blanket to use a VPN in those situations. Someone could be running a MITM proxy and you’re dumb enough/in a rush/etc. and click accept on the expired cert. Or some new 0day vulnerability allows badness to happen without your knowledge. Even without being able to see your traffic, a bad actor could still see your DNS requests and narrow down what services you use for further targeting, especially if you frequent a place.
Electricblush@lemmy.world
on 15 Apr 2024 00:01
collapse
It’s not the guy in the trenchcoat next to you you need to worry about.
It’s the fact that some unknown entity owns/has set up the WiFi.
Anyone working with complex network setup and admin will tell you how much you can abuse owning the network a user is connected to.
The network guys at work never use public WiFi, not hotels or anything. Neither do I, even with my much more limited knowledge of network administration.
CosmicTurtle0@lemmy.dbzer0.com
on 12 Apr 2024 10:07
collapse
The biggest thing was being able to switch it on and off from the notifications menu. It is/was super convenient.
Not surprised this is being shut down because it lacked many of the features that most major vpns had.
But that feature was unique.
ripcord@lemmy.world
on 12 Apr 2024 10:48
nextcollapse
Is it that unique? I can connect/disconnect my Wireguard from the notification bar / utility tiles
mustbe3to20signs@feddit.de
on 12 Apr 2024 11:22
collapse
Any VPN app can be turned on from the notification short cuts or atleast WireGuard and Windscribe can.
CosmicTurtle0@lemmy.dbzer0.com
on 12 Apr 2024 11:26
collapse
Huh. I didn’t know that. I only have two vpns, mostly because they come with a product I subscribe to.
Good to know
helenslunch@feddit.nl
on 12 Apr 2024 23:43
collapse
Right, it’s probably the same as every other “free” VPN. It’s free because it gives them access to 100% of your internet traffic. Basically completely antithetical to the entire concept of a VPN.
paraphrand@lemmy.world
on 12 Apr 2024 05:40
nextcollapse
Google One is a huge disappointment.
pineapplelover@lemm.ee
on 12 Apr 2024 21:07
collapse
I hear the big sell is the drive storage
cmnybo@discuss.tchncs.de
on 12 Apr 2024 05:49
nextcollapse
Good, Google has enough access to everyone’s data already. Nobody needs to willingly give them even more access by routing all of their traffic through a Google server.
linearchaos@lemmy.world
on 13 Apr 2024 01:44
collapse
Yeah that’s the same conclusion they reached.
SpaceNoodle@lemmy.world
on 12 Apr 2024 06:21
nextcollapse
TIL they had a VPN
blackluster117@possumpat.io
on 12 Apr 2024 06:24
nextcollapse
Another service to add to the pile of things Google barely supported then killed.
How about blackholing google to limit the damage instead? And you could limit it further by not using services that you know feed data to google.
Aria@lemmygrad.ml
on 12 Apr 2024 08:40
nextcollapse
ITT people claim that a Google VPN is a bad product for all use cases because Google is not a privacy-respecting company. This ignores all non-privacy use cases for using a VPN.
And even for privacy, this would’ve been a product where the vendors interest in protecting your privacy and your interest in protecting your privacy aligned in the case where you were not hiding from Google. For example if you used a Chromebook laptop, used the Google Chrome browser, or used Google services like Google Search and Google YouTube, then Google would already know everything about you. You can’t hide your activity from them, but they can help you hide it from others.
Similar situations exist for other privacy disrespecting companies like Microsoft and Apple, where a user might reasonably want to hide from everyone other than their vendor of choice, whose product they consider good enough to allow them to see their computer activity as part of their payment. If you already subscribe to one privacy disrespecting vendor, it makes the most sense to go all-in.
threaded - newest
Why would I use a Google VPN anyways
Some people think that Google is trustworthy. They still believe that the motto “Do No Evil” was ever relevant.
The power of branding is never to be overstated.
But they even removed it from their branding. “Don’t be evil”, that is.
Probably one of the most honest policy changes they’ve made.
I use it because it comes free with a service I already pay for.
I have this vpn because it comes for free with my Google Drive subscription. I have never used it because it does not do what I expect it to do
But it’s included…. Ples give your data
what’s the utility of the vpn then???
Security when you’re on untrusted network. I can trust Google to snoop my banking data and update the spending power info on my ad profile, I can’t trust the random dude in trench coat also using the public wifi when I am traveling out of my roaming coverage.
I joke of course, but the security aspect is still valid.
What is it that you’re doing that is still not using some form of authenticated encryption? Almost everything is https, ssh, almost all mailservers have tls support, irc does have tls support… What’s left that needs to be encrypted by a VPN?
The addresses themselves that you’re connecting to as one example. Also often DNS.
Strictly speaking, Encrypted Client Hello (ECH) paired with DNS Over HTTPS (DOH) can resolve this. But not many people have their systems setup this way, so it is still pretty niche.
That also doesn’t resolve the carrier seeing which IPs you’re connecting to, which can often be traced back to services or sites.
What’s the threat model here? I can think of no DNS shennanigans that would not be detectable through the authentication mechainsms in TLS (chain-of-trust). Not having to trust network infrastructure is exactly what TLS is for.
Most DNS requests are clear text, which is why DOH was introduced to secure it such that no one can snoop on you looking up
something-embarrassing.com. Also, the initial request, before you get the SSL certificate from the web server, you must tell the server at169.169.169.169that you’re looking for the certificate forsomething-embarrassing.combefore they can get you the correct certificate. This is why ECH was introduced. Neither of which have became mainstream yet, and so there are still some basic leakage going on.So this is a question I’ve been wondering: is public WiFi safe to treat like a private one if you’re using HTTPS everywhere?
You only use HTTPS everywhere until you don’t. It’s kinda like a security blanket to use a VPN in those situations. Someone could be running a MITM proxy and you’re dumb enough/in a rush/etc. and click accept on the expired cert. Or some new 0day vulnerability allows badness to happen without your knowledge. Even without being able to see your traffic, a bad actor could still see your DNS requests and narrow down what services you use for further targeting, especially if you frequent a place.
It’s not the guy in the trenchcoat next to you you need to worry about.
It’s the fact that some unknown entity owns/has set up the WiFi.
Anyone working with complex network setup and admin will tell you how much you can abuse owning the network a user is connected to.
The network guys at work never use public WiFi, not hotels or anything. Neither do I, even with my much more limited knowledge of network administration.
The biggest thing was being able to switch it on and off from the notifications menu. It is/was super convenient.
Not surprised this is being shut down because it lacked many of the features that most major vpns had.
But that feature was unique.
Is it that unique? I can connect/disconnect my Wireguard from the notification bar / utility tiles
Any VPN app can be turned on from the notification short cuts or atleast WireGuard and Windscribe can.
Huh. I didn’t know that. I only have two vpns, mostly because they come with a product I subscribe to.
Good to know
Right, it’s probably the same as every other “free” VPN. It’s free because it gives them access to 100% of your internet traffic. Basically completely antithetical to the entire concept of a VPN.
Google One is a huge disappointment.
I hear the big sell is the drive storage
Good, Google has enough access to everyone’s data already. Nobody needs to willingly give them even more access by routing all of their traffic through a Google server.
Yeah that’s the same conclusion they reached.
TIL they had a VPN
Another service to add to the pile of things Google barely supported then killed.
killedbygoogle.com
Another one for the grave yard
Google shutting down a service?! That’s a new one. I would have never expected that.
Imagine buying a VPN off google…
Instead of being spied on by google and other companies, just make sure google is the one and only
How about blackholing google to limit the damage instead? And you could limit it further by not using services that you know feed data to google.
ITT people claim that a Google VPN is a bad product for all use cases because Google is not a privacy-respecting company. This ignores all non-privacy use cases for using a VPN.
And even for privacy, this would’ve been a product where the vendors interest in protecting your privacy and your interest in protecting your privacy aligned in the case where you were not hiding from Google. For example if you used a Chromebook laptop, used the Google Chrome browser, or used Google services like Google Search and Google YouTube, then Google would already know everything about you. You can’t hide your activity from them, but they can help you hide it from others.
Similar situations exist for other privacy disrespecting companies like Microsoft and Apple, where a user might reasonably want to hide from everyone other than their vendor of choice, whose product they consider good enough to allow them to see their computer activity as part of their payment. If you already subscribe to one privacy disrespecting vendor, it makes the most sense to go all-in.
This is why I rarely get on board with new Google products nowadays. I know they’ll get half assed support and then be killed off really quickly.
> VPN
> by Google
> Gets shut down
You literally can’t make this stuff up folks
Google killed something off? Nah that can’t be right
Google can go to hell.
Google, Meta, Microsoft.
Three companies I would never trust as a VPN provider. Not necessarily in that order.
Add Apple to the list, with their Private Relay nonsense.
No doubt, they used this to scrape network traffic.