[fulafel]

The confidentiality protection is not really absolute - the encrypted VPN traffic is susceptible to traffic analysis[1]. For example, your traffic pattern fingerprint could be correlated and matched to your online identity if your ISP and an ad network or another globally positioned middleman actor colluded on it.

[1] A term of art in intelligence & cryptanalysis, https://en.wikipedia.org/wiki/Traffic_analysis

[GhettoMaestro]

Respectfully, unless your adversary is the NSA, and they are targeting you, your argument is full of shit.

[fulafel]

Why do you think it would be unworkable for a corrupt ad network in cahoots with your corrupt ISP to correlate your web requests based on time, length and previously seen traffic from the VPN IP?

[GhettoMaestro]

Because it is way too much effort with questionable return on investment.

[fulafel]

I agree that the business case is not that obvious but converting a "can't be done" argument to a "not interesting enough" is already pretty significant. The amortized cost per user would be very low after all, assuming this was used for automated mass surveillance.

[GhettoMaestro]

> [...] The amortized cost per user would be very low after all, assuming this was used for automated mass surveillance.

Honestly I think this is the total opposite case. "Full take" collection systems are notoriously money pits due to the nature (hence, full take). Targeted surveillance will ALWAYS be far more cost efficient than blanket mass surveillance.

[fulafel]

This is much different from full take, as there is a well defined equation to be solved. There would be no need to store the traffic contents, just size+ timestamp + addrs, info that will compress very well.

[guest0914]

Can't it be automated?