Using VPNs for "privacy" on forums, and forum spammers

[peter-h]

Very true for wifi hotspots. I use a VPN for same reason there.

[DiTBho]

When you enter in a shop to buy some bread, do you wear a balaclava? When you go to a pharmacy shop do you wear something that covers the entire head and neck and like a visor it only leaves the eyes out?

So why do you want to hide your identity over the internet? They call it "privacy", but it's ridiculous and paranoid at the same time.

Traditional Breakfast, $2.99. ...
Swedish meatballs, $6.99. ...
Pork Shoulder, $9.99. ...
TIE: Hot Dog, $0.75, or Cheese Pizza Slice, $2. ...
Swedish Gravadlax, $5.99. ...
Chocolate caramel cake, $2.99. ...
Salmon with Wheat Pilaf, $8.99. ...
Frozen Yogurt, $1. ...

Ikea isn’t just for cheap bookcases. Almost inevitably, shoppers will end up eating at one of the Swedish retail giant’s in-store restaurants. They also offer free internet, so you can browse the public web having some of these delicious. Nothing wrong, but in this case, if you need to expose your password to a website, a VPN is a must.

It makes sense!

Protecting your identity is ok for home banking, it's ok if you really want to do home banking while you are checking the top 10 ranking of things to eat at Ikea, but ... Jesus, if you are visiting a forum, or a blog, well ... I'm like a candy seller in a little fort: I want to see you in face at the check-in before letting you in!

It's my house, it's my space, there is nothing to hide, you are my guest, and if you are a spammer, a bot, a nasty person, sorry, but ... there is no party for you.

That's it!

[peter-h]

"if you need to expose your password to a website, a VPN is a must."

That's true, except that bloody google is de-ranking non-HTTPS sites so everybody has to go HTTPS if they want SEO. And eventually browsers will start blocking HTTP sites... which is a hassle for anybody running a hobby site because they have to organise a certificate and most of them aren't free. I moved a couple of little sites behind Cloudflare, not because they needed caching or DDOS protection but to get HTTPS for free. The many old sites out there which carry valuable content but aren't maintained anymore will have problems...

So nobody can see the passwords.

POP3 email and FTP is different and they need a VPN. But few people use these today.

I also use a VPN (terminated at my house) when accessing my bank website - because the stupid people are blocking non-UK IPs 

But for a forum? No. Not even if it was HTTP, and of course the pwd is used only for that forum

[PlainName]

When you enter in a shop to buy some bread, do you wear a balaclava?

No, but I wear a mask now 

It's a different situation. The shop doesn't know where you've come from or are going to, what you've bought elsewhere or how much money you have. The tracking website, OTOH...

The problem is not so much that your data is visible but that it's easily collatable. If any data lookup involved a bloke leafing through many volumes of books, it would hardly matter. Isolated data, which is effectively what that would be, is fairly meaningless, but when computers get involved each datapoint isn't isolated but is immediately referenced to all other points. As three-letter agencies will tell you, the contents of your phone calls (what you said) is not as important or useful as the metadata (who you called, when, from where, for how long). It's the metadata (how much money you have, what do you spend it on, where do you spend it) that shops would love, not what your face looks like.

An alternative way of looking at it: suppose you go into a shop and someone is looking at you. Not a big problem. Now suppose you got to another shop and notice the same person looking at you. Not only that but you discover that this person is actually following you, making notes in a notebook whenever you buy or even just look at something. They are waiting for you when you leave your house in the morning and follow you, a few steps behind, everywhere during the day, always making little notes in the book, perhaps taking a photo of you now and then. Are you seriously suggesting that you would be OK with that?

[PlainName]

but ... Jesus, if you are visiting a forum, or a blog, well ...

I was going to post a link to some research, but I don't  have time to find it at the moment. However....

Remember Cambridge Analytica? During that fracas an appropriate data engineer was interviewed and it was shown how apparently innocuous data about you could indicate who you would vote for, for instance. It was also shown that during the Brexit election, specific groups (found using that kind of inference) were targetted for specific ads on Facebook, and those ads influenced those groups enough to swing their votes.

Remember the Capitol riots? There you have another example of people being targetted so they could be fed bullshit to achieve some end.

There are also many examples of people's Google searches, Amazon purchases, Facebook posts, etc being quoted in court to show that they are clearly terrorists or drug runners, even though when placed in less emotional contexts it obviously wasn't. Fit-ups like that wouldn't be possible if someone hadn't already grabbed that data.

[DiTBho]

That's true, except that bloody google is de-ranking non-HTTPS sites so everybody has to go HTTPS if they want SEO. And eventually browsers will start blocking HTTP sites... which is a hassle for anybody running a hobby site because they have to organise a certificate and most of them aren't free.

Yeah, that's a solid problem nowadays.

[DiTBho]

An alternative way of looking at it: suppose you go into a shop and someone is looking at you. Not a big problem. Now suppose you got to another shop and notice the same person looking at you. Not only that but you discover that this person is actually following you, making notes in a notebook whenever you buy or even just look at something. They are waiting for you when you leave your house in the morning and follow you, a few steps behind, everywhere during the day, always making little notes in the book, perhaps taking a photo of you now and then. Are you seriously suggesting that you would be OK with that?

But it's not a person, it's a machine, it's an artificial intelligence, it doesn't scary me. It's done to help someone to offer better services. Which is good.

Personally I invest a part of my money in Amazon, so ... maybe I am not the right person to talk about "data-collecting" because they help making some little profit.

Now consider when nasty guys do exactly what you have just described to and they hide their face through VPNs so they can also blackmail or something.

[DiTBho]

When you enter in a shop to buy some bread, do you wear a balaclava?

No, but I wear a mask now 

That's was really hilarious

I love this kind of humor 

[peter-h]

There are multiple issues.

There are two places where a site admin can "spy" on you. One is by looking at his server log, and the other is using google analytics (or one of the other plug-ins).

Neither tells him who you are. You would have to reveal your identity some other way on his site (or another site he runs) e.g. by registering with an email address of winston-churchill@gmail.com and posting in convincing detail about your exploits in ww2 (you get the idea). And GA doesn't even reveal your IP; the nearest you get is a rough location e.g. Birmingham, so the only way you would find out that the traffic was Winston is if you somehow knew, or could be very sure, that he was the only person accessing your site from Birmingham.

What these tools give you is a lot of info about Person X but you won't know who it actually is. So there is no breach of privacy.

It's like you set up a portfolio on some share portfolio site, as E Windsor. The portfolio, worth £100M, could be real. But they have no idea who you are. In some cases, if you are stupid, using your full name, and using a fixed IP which is known to belong to Buckingham Palace (because the dickhead in charge of royal IT set up a public DNS for the router ) the admin might guess you are the Queen

However, if you are running a shop flogging microwave ovens, and a W Churchill of 123 High Street Birmingham buys one, then suddenly you know who X is, and who it was all along. It is mainly for this reason that tracking has been made available. It enables commercial sites to track who is watching what and who is then buying what. So if X browsed some special promotion on microwaves in January and came back in June, you get a bit of a metric on how useful that promotion was.

Lots of other good reasons for tracking. It tells you the % of mobile devices, the OS, the browser, versions thereof, hitting your site, so you can make sure it works for them. This is very important. With the right plugins or log analysis tools you can get a heat map of the site (where people are clicking) so you can put a big button on the link where 95% of traffic goes, etc. You can even tell how many had to scroll the page, so you can change the design so scrolling is not needed for the most popular features, on the most popular client devices.

Cambridge Analytica is different. They bought personal data from Facebook, which sells everything. And FB knows who everybody is, because they bought Whatsapp so they got everybody's full name and mobile number, and until recently they could read all messages (now they can read only group messages). Facebook is a really shitty and ruthless company. I use FB but only to keep in touch with old friends and to exchange non PC jokes

The vast majority of non shopping sites will never find out who you actually are, and even if they did they won't care. Of course, never use your full name on any forum. Always change your surname, and make sure any personal/hobby websites of yours don't have your photo on them. And make sure the domain holder has either got a fake name for you or (like say .co.uk) does not publish the owner details, otherwise a google search for your name will find the domain. This is basic stuff.

So I don't see how VPNs help on forums, for any human user. Unless you use the same pwd on many sites (a very bad idea) and are accessing a non-HTTPS forum on a public wifi network.

[PlainName]

What these tools give you is a lot of info about Person X but you won't know who it actually is.

That's not necessarily so:

https://techcrunch.com/2019/07/24/researchers-spotlight-the-lie-of-anonymous-data

Researchers from two universities in Europe have published a method they say is able to correctly re-identify 99.98% of individuals in anonymized data sets with just 15 demographic attributes.

and

https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds

But in practice, data can be deanonymised in a number of ways. In 2008, an anonymised Netflix dataset of film ratings was deanonymised by comparing the ratings with public scores on the IMDb film website in 2014; the home addresses of New York taxi drivers were uncovered from an anonymous data set of individual trips in the city; and an attempt by Australia’s health department to offer anonymous medical billing data could be reidentified by cross-referencing “mundane facts” such as the year of birth for older mothers and their children, or for mothers with many children.

[PlainName]

But it's not a person, it's a machine

Careful what you wish for. What do you think the odds are of you arguing with Google's algorithm to give you back your automatically banned account? It is hard enough to even get to the point where you're talking to a live person, but at least you might have chance (albeit really tiny) with them if they got out the right side of the bed that day.

A big problem with privacy today is that it's not a real person with an interest in you collect and acting on the data. It's a machine who cares not one jot about who you are, just that the data points say you are a kiddy fiddling terrorist with a gun fetish. OK, (hopefully) a bit of an exaggeration, but maybe you haven't figured out why your credit rating is so low you can't get an overdraft. Or even a bank account. It's not a real person making those decisions.

[peter-h]

Sure; one can de-anonymise big databases if one has access to other big databases. But who is going to do that, in the context of this discussion which is anonymity online?

The biggest danger to one's privacy, and at the same time the biggest source of potentially real hassle, is a theft of some bank database. It's been done although usually the thief managed to get only partial data. Usually... one Swiss bank employee did rather better And airlines have had the whole lot stolen. These are serious because your full confirmed name, address and - directly or indirectly - financial data is leaked.

[DiTBho]

I'm thinking about someone who wants to open a channel on YouTube. If you want to get money by advertising, from sponsors, etc, you have to expose your name and surname.

[PlainName]

Sure; one can de-anonymise big databases if one has access to other big databases

Those reports didn't use multiple big databases. The amount of data collected for one can be enough, which is why it's important (if you care about any of this) to restrict sucking to needed data rather than data they can grab just because they can.

But who is going to do that..

Are you kidding?!?! Who isn't going to do that, is the smaller subset.

... in the context of this discussion which is anonymity online?

If you don't have multiple online IDs, who you are online is getting to be more you than what your birth name is. And if you do have multiple online IDs, it doesn't take a lot to tie them together. Remember, you have to always keep them completely separate; the data analyzer only needs to make a match once.

I think we also need to recognise that 'privacy' covers several different things. On the one hand there is the danager, as you note, of some online database being grabbed resulting in a financial offloading event. But that's different to being stalked by a nutjob, tagetted by scammers, or your potential future employer seeing what dirt they can dig up before offering you a job. Or, indeed, the aforementioned 'computer says no'. Perhaps we need another (or several) word(s) so we're each on the same page when banging on about it.

[peter-h]

Yes; this is why

- you should use a different ID on every forum
- be careful what you write about yourself
- any videos you publish will identify you readily (especially if somebody is out to get you legally because a court order on youtube etc will instantly give it to them)
- if you run a forum, don't put stuff in the server log which you don't need to run the site
- if you run multiple sites which need auth, keep the auth data in one place and use oauth on all the others, so no personal data is stored on them
- put as little on FB and LinkedIn as possible

Then there are practical things e.g. you don't want your business customers to discover what you do in your private life. Let's say you are on a boating forum, and you post that you have a $300k boat...

[ataradov]

Why though? What is the problem with having $300k boat and how that would affect a business?

I used to try to hide my identity, but over time I realized that there is more value for me in being consistent with names on the forum. If someone is really committed, they will find you no matter what.

The idea of a VPN is that it is an easy way to eliminate mass collection of information. If someone is targeting you specifically, VPN won't do anything.

[peter-h]

In modern business culture, companies are highly political inside. A lot of people are crawling up the ladder and the process is lubricated by shafting others. Shafting a supplier is the safest thing there, so if you advertise an expensive hobby, that can be used against you. I know many people who are carefully anonymous on forums simply due to this.

Not a problem with a reasonable customer, but many customers aren't.

Then you get the issue of company social media policy. Many people flout these policies, and from time to time they vanish In fact this, or getting a new job at a company which is strict about it, is a big reason for people vanishing from forums.

I too don't really care much about privacy. For a start, anybody who writes more than a line or two will be identified across forums, by the use of language (not least because that is a fairly rare skill ).

I still don't get this stuff about VPNs. They only conceal the IP. The other 30 or whatever items of data which the browser sends to the server will still be duly delivered. Some of these you can modify (browser agent etc) but some not and e.g. you could easily be using a laptop of a certain age which has an unusual size screen which immediately makes you 1 in 10k of users.

[ataradov]

They only conceal the IP. The other 30 or whatever items of data which the browser sends to the server will still be duly delivered.

It is fine. I don't mind if destination site can identify and track me. I'm likely to be logged in anyway. After all, they will still be able to track only the activity on their site.

The concern here is my ISP being able to track every single site I visit.  And the danger is that if ISP does not like what I do, they have the power to cut off my internet access (which in the US sucks, since there are not too many alternatives). And this does not have to be anything illegal. Let's say they don't like that you watch too much YouTube and not enough of their own bullshit TV service.

If individual site cuts me off if they don't like what I do there, I mostly won't care.

[David Hess]

The concern here is my ISP being able to track every single site I visit.  And the danger is that if ISP does not like what I do, they have the power to cut off my internet access (which in the US sucks, since there are not too many alternatives). And this does not have to be anything illegal. Let's say they don't like that you watch too much YouTube and not enough of their own bullshit TV service.

ISPs do more than that.  When I had AT&T U-Verse, I was able to confirm that they were transparently proxying every protocol possible, leading to all kinds of bizarre connection problems.  It was so bad that operating with a VPN to a point half way across the US yielded lower latency to any destination, including local ones on AT&T's own network.  It also prevented AT&T from intercepting and substituting their own DNS results.

[james_s]

I use a VPN whenever I'm at our cabin, we borrow WiFi from the neighbor (with permission) however it is not a very well secured connection so I use a router to uplink to their 5GHz WiFi  as the WAN and then a VPN client runs on the router and feeds my 2.4G network. I also use a VPN on my laptop whenever I'm using a network that I don't own. It's almost no effort since I have the VPN anyway.

[peter-h]

That's a worrying description of US ISPs. Here in the UK you get nothing of the sort, AFAIK.

Surveillance at the ISP is implemented everywhere, via the big routers having a "monitoring port" which can be set up to monitor specific traffic and send it to the "national security agency". But in theory a court order is needed for that, so you need to be in their sights to start with.

[ataradov]

That's a worrying description of US ISPs. Here in the UK you get nothing of the sort, AFAIK.

They just have not had a chance to make a public blunder out of it. There is no way they do not collect that information. In the contracts it is usually hidden under network performance improvement. Which is true to some extent, as knowing places you visit allows for better caching. But it is also a handy piece of information to sell to marketers.

News like this are not uncommon https://news.ycombinator.com/item?id=26430266 . Sure, involvement of government agencies implies the need for the court order. But only implies.

[Zero999]

An important thing to consider is, although it's possible for your ISP to spy on you, they almost certainly never will. The information gathered will never be seen by a pair of human eyes. It will all be processed by a computer, without anyone seeing the inputs and outputs of the algorithm. The only exception will be if they detect something illegal, which will flag an alarm.

[peter-h]

Yes I am sure that's true.

Also I would be amazed if GCHQ/NSA/etc needed a court order to intercept data. BT used to need one and probably still do, for (what was back then) a physical visit to the exchange to set it up. Nowadays call intercept is remotely set up. I would expect ISP traffic monitoring (copying) to say GCHQ needs a court order in theory but in reality they will have a system in place where they get a blanket approval for some general activity. Dragging a judge out of bed to sign a court order is going to be useless.