Hacker News new | ask | show | jobs
by wrkronmiller 1728 days ago
Correct, but in this case, it sounds like you didn't need to use the ISP router as your VPN gateway.

If I understand the DNS rebinding attack reference correctly, you could be running the VPN software on your desktop/laptop and still have your IP revealed by your ISP router.
1 comments
lxgr 1728 days ago
Arguably, a setup using a VPN for anonymity purposes is badly flawed if it allows traffic to anything but the VPN gateway. This includes the local network.

Mediocre home appliances or (as in this case) ISP CPEs can easily deanonymize you.

link
mindslight 1728 days ago
Yes, but you do want deliberate access to specific services on the local network. Mainly NFS exports and the like.
link
lxgr 1728 days ago
Yes, but that's a deliberate security–convenience trade off then.

One solution is to use proxy servers or per-app VPNs (without local network access) instead of a system-wide VPN, and effectively partition applications into trusted and untrusted ones.

link
mindslight 1728 days ago
I've done that partitioning with virtual machines. I don't see how it's a "tradeoff". Yes, every additional service you expose can have its own security flaws, but you have to get data in/out of a VPN'd VM somehow. Even if I allocated more local storage to the VM and only ssh'd in to send/receive files, the ssh client could have a hole in it. nfsd, samba, sshd, and ssh are designed to do singular jobs. The issue in this case is the exposing of a consumer router that was never designed for security from the local network.
link