[lazerwalker]

I can't read the original article, but I'd hope it has a rational discussion of threat models?

I don't necessarily assume my VPN is 100% secure; I do trust a company that I pay money to more than I trust that nobody's sniffing my traffic at a rando coffee shop.

[alasdair_]

I think the biggest risk a random user faces is when a single entity is storing their connection history and then sells it (or it gets leaked, or demanded by law enforcement).

Some rando at a coffee shop sniffing my traffic will get a tiny portion of my online life, but my ISP or a few other large firms can build a much bigger privacy-destroying picture of my behavior.

My concern with a large VPN company is that there is now a single place where all my traffic can be gathered, trivially.

As an aside, I use Striesand - https://github.com/StreisandEffect/streisand - to create my own VPN. I generally create a new one every week or so with a simple script and I tend to rotate hosting providers fairly regularly. It's definitely not completely secure, but it's very fast, very cheap and works well for all my devices.

[clubm8]

>As an aside, I use Striesand - https://github.com/StreisandEffect/streisand - to create my own VPN. I generally create a new one every week or so with a simple script and I tend to rotate hosting providers fairly regularly. It's definitely not completely secure, but it's very fast, very cheap and works well for all my devices.

Interesting. I'd be interested in hearing more about how you did that. Algo seems to require a human in the loop to generate and insert an API token.

[jstanley]

Why do you trust the VPN more than you trust Tor?

[lazerwalker]

Honestly? My VPN setup works for me, so I haven't particularly bothered to spend time investigating alternatives. It's not that I do or don't trust it more than Tor.

That said, the few times in the far past I've tried to use Tor as a VPN, it's been slower and less reliable than the VPN I pay for (especially on my phone). Using a regular VPN also makes it easier for me to do things like spoof my country for region-locked services.

(If I was going to bother making a change, it'd probably be to hosting my own VPN server on a VPS provider instead of specifically paying a VPN provider)

[jstanley]

Fair enough.

For what it's worth, Tor does support choosing the country of your exit node, and is not as slow or unreliable as it has been in the past (although still not as fast as just using a VPS), but I watch YouTube over Tor without noticing anything unusual.

[lazerwalker]

To flip the question around: what benefits does Tor give me over my existing setup? I can see an ideological argument, and I can see the $5 or $10 a month savings, but — especially given my threat model is well enough served by a VPN — I'm curious if there are other practical benefits of Tor that might help overcome the obvious downsides (more complicated setup, slower)

[jstanley]

> I can see an ideological argument, and I can see the $5 or $10 a month savings

That is the benefit of Tor.

There's also the fact that the VPN provider is in a position to know where your traffic is both coming from and going to, and there is nobody who can do that in Tor.

[clubm8]

> Why do you trust the VPN more than you trust Tor?

Why not both? Why does my ISP need to know when I use Tor?

[jstanley]

They'll know whether you're using a VPN or tor