Hacker News new | ask | show | jobs
by the_sam_fischer 3469 days ago
Stupid question : If I am on a college campus and using a VPN, does it in anyway protect me from the college authorities snooping on my data ? Will they know that I am downloading a torrent ? What about normal HTTP(S) data ?
3 comments

If you're actually using a VPN (as opposed to a SOCKS proxy) then what they can certainly identify is that you're moving VPN traffic, the volume of traffic each way, and probably that it's torrent traffic (gaming, streaming, surfing will have very different usage patterns and much lower uploads most likely). For torrent traffic, they can also tell whether you're seeding a lot, leeching/downloading without seeding, or a mixture.

This makes sense if you think about the kinds of traffic you'd expect from the most common uses. There's a pretty limited set of categories that most Internet traffic can be grouped into, and they all will have pretty distinct and identifiable patterns - commercial streaming will be slow and steady, downloads will be bursty, VoIP will be small streams, etc.

For sophisticated enough systems or determined investigators with enough raw material to examine, they may even be able to get a decent guess at what sites you're using (even via a VPN) if you're only doing one activity at a time. If they can identify that almost every video view on YouTube starts with a particular traffic pattern of sets of blocks of data of roughly identifiable sizes and that video views on Netflix, Vimeo, Hulu, YouPorn, or whereever all have different patterns, they can approximate which sites you're visiting - particularly given enough data over time.

They can see your encrypted packets are going to a known VPN IP; that's about all they can tell. They can't peer into the tunnel. If you are sending and receiving hundreds of megabits per second day in day out they can probably infer you are torrenting, but are unlikely to care unless your bandwidth usage ventures into their "user abusing our networks" territory.
Lots of traffic only proves possibly abusing TOS, nothing about the content of said activity.
They can see that you are trying to hide something because all of your traffic goes to the single IP address.
Just like the authorities in any nation-state can tell if you are using Tor.