Anyone use a VPN?

[Nick]

... But is it illegal for a UK TV licence holder to use VPNs and other methods to watch BBC programmes while abroad?...

Not illegal, just not permitted.

The BBC haven't a clue if you are a legitimate license holder or not - it's far simpler to just stop all non-UK access if they can, so that's what they do.

[Exiled Yorkshireman]

As far as security is concerned, I use a Raspberry Pi 4 with PiHole and Wireguard VPN. This puts everything in my control. It eliminates ads from both home and mobile devices, and also prevents man-in-the-middle attacks as previously noted. The impact of eliminating ad traffic has resulted in a considerable reduction in mobile data quota usage. It doesn't block youtube video ads, though.

[Nick]

As far as security is concerned, I use a Raspberry Pi 4 with PiHole and Wireguard VPN. This puts everything in my control. It eliminates ads from both home and mobile devices, and also prevents man-in-the-middle attacks as previously noted. The impact of eliminating ad traffic has resulted in a considerable reduction in mobile data quota usage. It doesn't block youtube video ads, though.

I use Pi-hole too, but it does very little for security - just blocks adverts.

Your DNS usage is still trackable unless you use Cloudflare or similar upstream resolver that guarantees that it keeps no records. However for true DNS security you should use a recursive resolver, e.g. "unbound"- a bit slower but untraceable and not hackable. Also, talk to the DNS servers with DoH (DNS over HTTPS) or DoT (DNS over TLS, and the TLS 1.3 or later) only.

The part of Wireguard under end-user control is normally just the client. The VPN server has to be guaranteed secure and that's only possible with a private VPN server. Just "using wireguard" means little - the end of the secure tunnel is the server... and what then?

Please note that a VPN on its own does not prevent DNS poisoning and many other attacks.

My Pi-hole is the small red-and-white boxed RPi in the right of the cabinet...

   

[Exiled Yorkshireman]

I use Pi-hole too, but it does very little for security - just blocks adverts.

The key as far as mitm security is concerned is the Wireguard VPN bit.

[Nick]

I use Pi-hole too, but it does very little for security - just blocks adverts.

The key as far as mitm security is concerned is the Wireguard VPN bit.

As mentioned, it's what happens at and after the target VPN server that matters.

[Exiled Yorkshireman]

As mentioned, it's what happens at and after the target VPN server that matters.

I think you misunderstand. Wireguard is a VPN that runs on your Pi.  The target VPN server is your own. No third party involvement at all. It doesn't provide any additional benefits on your home network, but really helps with your mobile devices.

[Nick]

As mentioned, it's what happens at and after the target VPN server that matters.

I think you misunderstand. Wireguard is a VPN that runs on your Pi.  The target VPN server is your own. No third party involvement at all. It doesn't provide any additional benefits on your home network, but really helps with your mobile devices.

Nope. I don't misunderstand.

Wireguard is a cross-platform  suite of programs that implement the Wireguard VPN protocol over a wide range of devices and operating systems, of which an RPi running Linux is just but one. Several commercial offerings are also built around the Wireguard protocol, but not necessarily with wireguard-provided client or server code 

I currently run several instances of Wireguard style servers, mainly, but not exclusively, on Digital Ocean droplets but hosted in different countries; typically these are Algo-managed instances.

I presume from what you have now said that you are using Wireguard from your mobile devices into your home network, tunneling through your domestic firewall. Your mobile devices then appear to be emanating from your domestic IP address for the purposes of tracking. This is a decent approach and will certainly help your mobile security as you have control of the destination server.

Depending on the resulting DNS configuration you could still be subject to a MitM attack via DNS poisoning once traffic is outside your network. i.e. as mentioned, upstream DNS handling is important.

It's really difficult to cover all bases completely. Actually, nobody can, it's always a process of risk management/mitigation and compromise.

[Diabolical Artificer]

Re trying to access BBC I player via a VPN I did this in the spirit of investigation as accessing content whilst abroad is a feature that VPN's highlight in their ad's on Youtube.

Re staying "secure" online, for the average internet user who has no technical knowledge it's a minefield made worse by spurious claims by such companies like VPN's. Is there any device or one off solution that hides ones identity and location that is 100% bombproof against probings by say government institutions? I'm thinking in terms of a hypothetical activist say.

Andy.

[Nick]

Re staying "secure" online, for the average internet user who has no technical knowledge it's a minefield made worse by spurious claims by such companies like VPN's. Is there any device or one off solution that hides ones identity and location that is 100% bombproof against probings by say government institutions? I'm thinking in terms of a hypothetical activist say.

No, there is no one-stop-shop or magic black box that will do this. If you want to be anonymous, don't use the internet....

Well, there's Tor, but it's important to remember that Tor was developed by the U.S. Naval Research Lab so a lot of folk don't trust it.

Basically, if a government wants to get to you, they will, so forget about that.

For 99 99% of use cases, general best practice and common sense will do. Security is not just a technology, it's an end-to-end process which must be rigorously followed

If you're an activist and want secure messaging, then there's really only Signal.

Telegram, WhatsApp etc all leak metadata. Even though WhatsApp uses the Signal Messaging Protocol, it leaks huge amounts of information that Facebook harvest and use (please do read the T&C's before clicking on "Agree"!). All the others are similar.

So, about the best you can do is use a search engine like DuckDuckGo (built mainly on Bing but anonymous) or Brave Search (own indexes), a browser built on Chromium but NOT Chrome, e.g. Epic or Brave, a recursive DNS resolver using DoH/DoT e.g. "unbound", never use public WiFi unless you're using a private VPN, a secure email provider like ProtonMail, only Signal for messaging and unique complex passwords with MFA (where available) for every site. There's loads more too.

There again, by doing all the above you are sticking your head above (or below, depending on your point of view) the parapet and potentially inviting closer scrutiny by those who may be wondering what you've got to hide

Even then, if a government or suitably determined, resourced and knowledgeable third party wants to get to you, then they will by using zero day attacks, social engineering and a bunch of other vectors.

Happy days!

[ppppenguin]

Put another way, the precautions you take should be proportionate to the threats. For the average internet user, nobody cares about your emails, messages or even your pr0n habits. You need to protect yourself against malware so your banking etc isn't compromised and you don't become part of a botnet that's used to attack others. You also need decent backups, but that's just sensible precaution against equipment failure as much as attack.

At the other extreme if you're an activist living under a repressive regime then you've got a lot to lose. You need every bit of security you can get. Or if you're a wealthy organisation with trade secrets then you're an obvious target; you should be employing good security people.