algo

Vote with your feet if you can. Meanwhile, use a VPN. https://github.com/jawj/IKEv2-setup https://github.com/trailofbits/algo etc.

Yes, I provide some details in a blog article: https://stan.sh/posts/building-a-distributed-vpn-service The underlying technology used is from Algo VPN, a well-acclaimed open source VPN solution. https://github.com/trailofbits/algo

VPNs aren't a defense against subpoenas or warrants, they're a defense against ISPs scraping your connections and selling them to advertisers. No advertiser is going to come after your VPN provider asking for logs, and even if they did your VPN provider is going to tell them to get fucked anyway. Again, unless the advertiser in question happens to be the federal government and they have a subpoena or a warrant, no VPN provider is going to give you logs to help you associate a user, I have no idea why you would even think that. If you don't want traffic from users on the VPN you are free to block them (Netflix does this) but nobody is going to give logs over to a random webmaster to help deanonymize users. If you want to remove the VPN provider from the question entirely (many of them are on the shady side), you can use Algo to automatic

I typically don't trust VPN providers, so I set up my own on AWS with this CloudFormation script. [0] It is almost effortless, takes 10 minutes and I can spin it up or spin it down without paying for a subscription, only AWS metered costs. EDIT: another poster mentioned Algo [1]. This method requires a high degree of savvy and entails a higher level of difficulty, but looks much more configurable. [0] https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-pr... [1] https://github.com/trailofbits/algo

I don't know why anyone advocates using a VPN provider when it's so trivial to set up your own VPN now. https://github.com/trailofbits/algo https://github.com/Angristan/OpenVPN-install Either of these options, depending on your preferences (protip: use Algo, unless you're in a place that blocks IPSEC VPNs...It's cheap enough to have both available). This at least covers the basics of what they're talking about being snooped in the post. Then you don't have to worry about trusting the VPN provider (but you do have to worry about trusting your cloud provider). If your threat model is different, you might want to be in a pool of users, but you can use the same service and solve this problem socially...

Yes, algo ships with an option to setup Privoxy and dnsmasq for just this: https://github.com/trailofbits/algo/issues/14 If you look at the commits, it regularly downloads and concats a large number of host files that track ad/analytics/malware hosts.

You are right, but only for the perfect 'VPN'. There are also many insecure VPNs out there, which don't cover all your bases (for ex: VPNs that don't tunnel DNS requests through the VPN is a common mistake) So while there are VPNs with great security, you have to make sure your VPN is not vulnerable to common MITM attacks. So choose your VPN which has been well vetted. I'm a fan of OpenVPN due to it being able to pass as HTTPS traffic, but a popular recommendation is algo which is IKEv2 based IPSec VPN. https://github.com/trailofbits/algo

Dnsmasq with a black list is very powerful for that matter. AlgoVPN [1] is using it, and provides a network-wide ad blocking and anti-tracking. Also, I made an app which is a distributed version of AlgoVPN, for iOS devices. People testing it find it very convenient. [1] https://github.com/trailofbits/algo

Or https://github.com/trailofbits/algo or https://github.com/jawj/IKEv2-setup

hahah same! Then you can use these instructions then: https://github.com/trailofbits/algo#ubuntu-server-1604-examp...

1) Kind of (more details in the link below). You need a supervised profile on iOS in order to ensure that _every_single_packet_ gets sent over the VPN. Only large enterprises configure their devices this way and it requires wiping your device clean in order to install the profile, so we don't do it. On-demand is the 99.9% solution with the best balance of ease of use and security (allowing things like local network access, AirPrint, etc). You can find more info here: https://github.com/trailofbits/algo/issues/278 2) If you choose the option for "enhanced security" during the install process then you get automated updates turned on. We have seen issues where automated updates will brick VPS servers on DigitalOcean and other VPS providers. Considering the extreme lengths we went to in reducing attack surface and disabling features, hardenin

Hi, author here. First, that issue was way overblown (it's exactly what streisand does, and assumes an attacker with local access to your VPN server... which means you are already wayyyy owned). Second, yes, we moved certificate generation to the client and delete keys by default after we generate them to avoid this issue entirely: https://github.com/trailofbits/algo/pull/169

Hi, author here. Yes! IPSEC works great in most of the major client platforms. All the information to set them up is documented in the Algo readme: https://github.com/trailofbits/algo#configure-the-vpn-client...