Hacker News new | ask | show | jobs
by borski 4654 days ago
While I've heard good things about PIA, you're still trusting someone else with your data. Whether you trust them or not is entirely up to you, but it's not that hard to set up your own VPN tunnel. We posted about it a few weeks ago here: https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-publi..., and there was some good HN discussion on it here: https://news.ycombinator.com/item?id=6285458
3 comments

> Whether you trust them or not is entirely up to you, but it's not that hard to set up your own VPN tunnel.

While I agree that trust is a _giant_ issue, speed and price (due bandwidth needed/used) is also a major concern if you're one looking for an always-on VPN solution.

I personally used PIA for a few months mostly due to cost and it is at or near my speed cap at all times. I have also rolled my own VPN using a VPS at the same price point, however, considering that bandwidth would be limited and speeds were not as stable, it's hard for me to choose that route for my use cases.

Sure, if I need absolute security I wouldn't use PIA and I'd reconsider using a VPN on any VPS on US soil. But then, one would have to consider if it will be worth it.

You still have to trust somebody to host your VPN endpoint.

(Although, it's probably less risky to use some relatively obscure VPS/dedicated/colocation ISP than major VPN service which certainly attracts some attention of TLAs)

Fair point, but your personal VPN is also a lot less likely to attract scrutiny and be attractive to snooping than PIA. It's just a much bigger surface area, more popular, and potentially has a lot more useful data than your single box.
Also, public VPN services like PIA mix the traffic, i.e. multiple VPN users' traffic is coming from one IP address.
" On your CA's environment (hopefully elsewhere):

openssl x509 -CA cacert.pem -CAkey cakey.pem -CAcreateserial \ -days 730 -req -in vpn.csr -out vpn-cert.pem "

What does the author mean by 'hopefully elsewhere?' It's no longer a simple one server solution, no?

Your CA doesn't have to be (read: shouldn't be) the same box. Also, it doesn't have to be (read: shouldn't be) connected to the internet. I recommend a USB key you keep around your neck or on your keychain, but it's really up to you.