Schneier on Security

Clive Robinson • May 27, 2025 10:34 AM

@ Bruce, ALL,

“One one my biggest worries about VPNs is the amount of trust users need to place in them, and how opaque most of them are about who owns them and what sorts of data they retain.”

The simple answer to that is,

“If you don’t own it from end to end then don’t trust it, mitigate it.”

Which I admit can be more difficult than it sounds… Because many VPNs see you not as “customers but product” to be packaged up an sold on. Worse now is that legislation / regulation makes record keeping as “Third Party Business Records” for amongst other reasons “to protect the children” or more importantly to enforce entertainment industry and similar rent seeking extortion via IP rights extorted from content creators.

But that is from my perspective the tip of the iceberg.

Consider the first router upstream from either end of the VPN two things are known,

1, Where your packets are comming from.
2, You have something to hide.

This automatically makes you “A person of increased interest”.

Further is “traffic analysis” it can be done by simple correlation in time or the VPN operator could “tag your packets” in various ways.

The thing about “traffic analysis” is it may not be allowed to be entered into court, but there is this little thing called “parallel construction” which is an “after the fact” way of concealing “methods and sources” and getting things into court through what is a back door that nobody in officialdom will do anything but look the other way.

As has been seen before with operation Ore[1] you don’t need to be guilty just appear to be guilty in an observers eyes thus a prime candidate for a stitch-up show trial or bonus / promotion for the investigator or even a Medal (see UK and EncroChat phones). Nothing makes for success like corrupt officialdom.

Thus even using a commercial VPN for entirely innocent reasons is raising you up that list of people who are “singled out for closer inspection” as potential candidates for persecution and prosecution.

[1] Many of the accused under Operation Ore had not even been involved. What happened was a Chinese crime organisation had gained access to a UK supermarkets sales system and stolen their credit card and other information. This they then used to rack up fake charges on a non porn hosting site that acted as a gateway to porn sites. The thing is the Chinese just billed the host to get payment and the host operator build the users credit card and took it’s “finders fee”. It was this list of credit card accounts and an FBI forged web page that was used to claim everyone was downloading kiddy-prn when in fact few ever did (though a few that actually were, like the boyfriend of a prominent male UK politician got no action taken against them). A friend however went through hell and it destroyed his life, even though he could prove he was innocent… And people wonder why I don’t do online transactions and only pay cash.

Clive Robinson • May 28, 2025 9:12 AM

@ Dave, ALL,

With regards,

“When Chinese companies started buying out all the VPNs around 10 yrs ago”

Did you ever stop and ponder,

“Why are they doing this?”

It has several interesting answers.

The first is the plain and simple “it’s a business that makes money that is growing”.

Also because of the Great Firewall of China, VPN’s through it saw rapid growth.

It was an issue that cut both ways. China like any Cyber-entity wanted “a perimeter” they controlled. In part to keep Western Government entities out. But they also wanted to attract Western Businesses in.

A firewall that does not allow VPN’s is going to “constrain business” which is “undesirable” in any economy from Nation State down to your family home.

But China like all Nation States including the UK and US want to keep an eye on it’s alleged “citizens” and other “visitors”. Likewise so do all companies on those inside their perimeter, likewise many parents on their children.

There are two basic things of interest,

1, The information in transit
2, Where the traffic travels

If you own the VPN you know the second, and from that you can infer the first in many ways. It’s part of “Traffic Analysis” and in most ways it’s a lot lot less resource intensive than “breaking encryption” that is used to keep the actual information confidential.

Traffic Analysis is something every Nation State capable of it does, especially the UK and US as well as quite a few European States.

Yes it’s very intrusive on “Personal Privacy” thus “Personal Freedom” but then “know it all” is what is behind “collect it all”. And it’s very much the province of paranoid, authoritarians who inhabit the tops of hierarchies and their authoritarian following “guard labour” that fill the lower layers.

Because as the old saw has it,

“Knowledge is power”

And for those that don’t know, information and knowledge are not the same thing…