algo

You could try setting up a WireGuard server that listens on udp port 53, which is typically used by DNS and unlikely to be blocked. I haven't used it, but algo recently added a configuration option to do so[1]. Of course WireGuard traffic will look much different than DNS, so they could still block it if they really care to. [1]: https://github.com/trailofbits/algo/pull/1594

> I had a seamless time using wireguard (via a streisand installation) ... I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest. First: it's fast. If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation to automatically and randomly switch between a few wireguard back ends, and I generally can't detect it. Second: it's easy. For me, an experienced technical user. I don't know enough about the ecosystem to recommend it to less technical people, though given how basically sound it is, I'll be surprised if there aren't really easy and robust front-ends coming up.

This is what I've advising people with a little bit of know-how to do. Using Algo [0] (If you only need Wireguard and little else) or Streisand [1] (If you need Wireguard in addition to many other things) makes it pretty much trivial. [0] https://github.com/trailofbits/algo [1] https://github.com/StreisandEffect/streisand

None. Don't ever use any commercial VPN service for any reason, ever. Especially if you have even the slightest bit of tech savvy. They are completely untrustworthy, and will sell you down the river at their own convenience every time. These services are one of the largest sources of malware, stolen account credentials, and credit cards on the internet. Run your own IPSEC VPN on a $5 VPS instance using Streisand [https://github.com/StreisandEffect/streisand] or Algo [https://github.com/trailofbits/algo]. It takes 10 minutes of setup.

For anyone displaced from their VPN by this... Not mine, but another HN user made a tool to automatically create a VPN instance on your choice of cloud provider. https://github.com/trailofbits/algo

https://github.com/trailofbits/algo It’s an Ansible playbook for easily setting up a VPN with good security defaults. It’s so easy and really the only knowledge you need to know is how to get api keys for the provider of choice.

> OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to update and maintain the software themselves. OpenVPN depends on the security of TLS, both the protocol and its implementations, and we simply trust the server less due to past security incidents. Writeup with links available in our FAQ: https://github.com/trailofbits/algo/blob/master/docs/faq.md#...

I appreciated that Wirecutter's review of VPN services began with investigating which ones had contracted for 3rd party security reviews. This presciently excluded many providers that were all about marketing, like NordVPN. I think this is the best approach rather than the litany of mostly useless criteria that's cataloged on ThatOnePrivacySite. You want to extract out the high signal, and "will my VPN service get hacked and all my traffic get leaked?" should probably be your first question when choosing a service. https://thewirecutter.com/reviews/best-vpn-service/#how-we-p... Full disclosure, I'm the author of AlgoVPN, a set of scripts for hosting your own VPN rather than using a 3rd party service, and was interviewed by Wirecutter for their article. You should use Algo if you're at all capable of doing so: https://github.com/trailofbit

Same! If you're trying to tinker with security stuff Høgh makes a great post, but for anything else Algo is the way to go. https://github.com/trailofbits/algo

Cool to see this done by hand. I’m running IPSec on my Edgerouter but am about to redo my home network and lab environment and will likely implement WireGuard. There’s also a more plug-n-play tool called Algo that is highly spoken of, which automates a lot of this: https://github.com/trailofbits/algo

The title should be renamed to "Don't Use 3rd Party VPN Services".[1] On-prem VPN deployments with solutions like AlgoVPN[2] from TrailOfBits is still very useful. Let alone mass majority of the the corporate IT's internal VPNs that is required for some workforces to perform their jobs remotely on public Internet. [1]: https://gist.github.com/joepie91/5a9909939e6ce7d09e29#gistco... [2]: https://github.com/trailofbits/algo

It came from a protonvpn founder, an obviously biased source: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... but was conveniently never denied by PIA that I could ever find. If it was a lie, it would be easy for them (PIA) to prove under libel laws in the discovery phase of a trial. I'd argue if it was a lie from ProtonVPN, it would have been in PIA's best interests to clear their name. After all, PIA and ProtonVPN are a few of the only providers who've proven in courts they don't have logs of users. We know they're legit because they said so in court under penalty of perjury. Also, the European Commission has investigated these exact claims, and would have privileged access to a lot of the business documents, and found the claims without merit. Me? Just a happy protonvpn user who finds the oft repeated shilling for PIA

You can always setup Algo on your own personal VPS running on Azure, GCE, DigitalOcean, Vultr, etc. https://github.com/trailofbits/algo Also, hasn't CloudFlare been audited to verify their no log claims? I know while Mullvad hasn't been audited to verify their no log claims, they have at least been audited to verify the security of their app. https://blog.cloudflare.com/1111-warp-better-vpn/ "1. We don't write user-identifiable log data to disk; 2. We will never sell your browsing data or use it in any way to target you with advertising data; 3. Don’t need to provide any personal information — not your name, phone number, or email address — in order to use the 1.1.1.1 App with Warp; and 4. We will regularly hire outside auditors to ensure we're living up to these promises." https://mullvad.net/en/blog/2018/9/24/read-results-security-...

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo