Good VPN service?

Now that Grand High Marshal The Right Honourable Pry Minister May has managed to force through the Snoopers Charter, which aside from anything else may well have snuck in an encryption back door law as well as being the largest invasion of privacy I've ever seen outside China, can anyone recommend a decent VPN service?

Ideally it would be affordable, not based in either the UK or the US, fast enough not to kill internet performance, and allow me to point a router at it to make the entire house network use it.

Does this exist?

pca

Is there a cost constraint?

How much are you willing to pay for a very good VPN?

I'm still using Private Internet Access, USD$40/year. USA owned, but has exit portals around the globe.

It has given rather good speeds overall in the past, but seems to have slowed down some in the past couple of months (using mainly the London UK portal).

Pretty sure it must be owned/operated by some USA agency in order to be so cheap, and the HQ is certainly in the right neighbourhood for that.

Definitely cheap and good enough to start out with if you're new to the turf. 7-day money back guarantee (untested).

EDIT: Heh, I just noticed they now claim to be headquartered in California rather than Virginia, so not in the spooks neighbourhood now.

VPNs require CPU horsepower. Most routers don't have enough. The newer dual-core ARMv7 based routers should be able to handle it though. Many of those routers consume under 10watts.

Hmm, should we hunt elsewhere for competent VPN router recommendations or might someone on here have first hand info to share?

It has been a long time since I looked at 'hardware assisted' routers, let alone the VPN services they connect through. That said, I was just helping a friend ease into secure Internet/cloud document storage. So much to get wrong, so easy to not know what one is getting wrong.

Routers which can accept the "Merlin" firmware seem to be regarded as rather good for VPNs. This includes ASUS routers, as well as a select few others with very similar hardware (eg. Netgear R7000, very similar to the ASUS RT-AC68U).

I have an AC68U here (actually, a T-Mobile AC-1900 by name, identical hardware though). Nice router, lots of horsepower, VPN client/server in the web GUI, along with capabilities for selective VPN routing: deciding what goes via VPN, versus what doesn't. Eg. this BBS rejects my connections from the VPN, so I could set rules to bypass VPN for empegbbs.com.

As a bonus, this router also accepts TomatoUSB and DD-WRT firmware, among others. The Netgear R7000 and ASUS RT-AC68U are very much the choice of 3rd party firmware developers, which means pretty good to excellent support for them.

I haven't used the VPN setup in the router yet though.

I use StrongVPN and have had a good experience. Unlimited OpenVPN for $85/yr. Not sure where they're based. I have it setup on a DD-WRT router and use it for my Roku's so that I can stream content that would normally be limited to the US only.

Here's their router page: http://strongvpn.com/vpn-routers-new.html

That said, although I like it, I might try Mark's suggestion at half the price next year.

Odd. Any idea why ?

Does the BBS, or the server it runs upon, or the service provider it connects through, have a blacklist for rejecting specific IP ranges which might tend to be spam or hack sources? I could imagine situations where people tunneling through a VPN might find themselves getting blacklisted in some situations due to the company they're keeping, as it were.

I don't believe the BBS code has anything like that. The server certainly doesn't (plain Ubuntu) and I'm 99% sure Linode who host the virtual machine don't.

AirVPN is probably what you need. Founded by (h)activists in defense of net neutrality. Offers the strongest level of encryption (4096 bit RSA keys), welcomes every protocol and has a zero logs policy. They are based in Italy so answer to EU law. You can connect to them via any thinkable way, including straight from the router (DD-wrt, AsusWRT, Tomato and PfSense)

I can also recommend IPVanish. Very fast, zero logs, but they are US based. Also router setup possible here (DD-wrt or Tomato)

Would not being able to connect via https:// have anything to do with that.

That seems unlikely.

its likely the spam blocker. Could also be a few IP ranges still in the banned part of the settings.

Something in the BBS side is also not IPV6 friendly.

The server isn't setup for IPV6 at all at the moment anyway I'm afraid.

I know there are spam checks on new user registrations, but is there really stuff in the forum code for more general spam checks ?

To the extent that the HTTPS Everywhere movement takes off, with significant wind in its sails coming from Google's treatment of https as a ranking signal, the world is slowly but surely moving to a regime where there's a lot less that an ISP (with or without nation-state assistance) can observe.

The only way they'd be able to snoop on your Google queries would be if they forced you to install a proxy certificate (allowing them to MITM your connections to Google). When a previously trusted CA has been discovered to be issuing the equivalent sort of thing, they've generally been quickly removed from all browsers (see, e.g., DigiNotar or WoSign). The HTTPS universe is actually holding up pretty well, all things considered.

So fine then. What's an invasive nation-state have left as a means to compel your ISP to listen in on what you do?

Easy: They can trace all your DNS activity and do traffic analysis on where you visit. (This sort of tracking isn't all that bothersome to my mind. If I feel a need to visit something untoward, which I sometimes do as part of my research, I'll use Tor or other such things.)

Medium: They can instruct your ISP to block VPN traffic and/or they can block traffic to known VPN endpoints. (This sort of thing is standard practice in a number of non-democratic countries.)

Hard: They can hack your router, hack your computer, and/or require specific software with backdoors on those devices. (China tried this, at one point, with its Green Dam thing.)

I haven't studied exactly how the U.K. plans to implement its surveillance society, but I suspect they'd follow some variant of this easy/medium/hard progression.

As I recall, before I changed my routing for the BBS, it would allow me to browse without logging in, but would not permit login over the VPN. I thought that, sure, maybe block new user registrations, but blocking an existing user from logging in? Peculiar.

EDIT: At the moment, I am posting this from a VPN connection, so whatever/wherever the restriction lies (if still there), it was probably IP-based. My VPN provider has thousands of exit points, and regularly rotates IP addresses, so.. difficult to conclude anything about it.

For now I'll run without the special routing, and post more information next time I get blocked, if ever.

Cheers

Yep, it's the spam system then, it checks all logins as well as new user registrations. If it was the non spam IP blocking the forms have, anonymous browsing would have also been blocked.

The reasoning for the login checks is that a number of spammers were mass signing up for accounts on various boards while laying low. Weeks or months later, the spam posts would begin. Spam checking solutions bound only to new user registration were rendered ineffective and the software was upgraded to do checks at every login.

Quite reasonable. When it happened, I didn't complain or anything, figuring there must be some logic there. Easy enough to work around at the time.

So what criteria is the spam system using to block the logins? Is it purely IP-address related, or is something more complex?

I think the new law is intended to simply force the service provider at the far end to provide the back door, not only the intermediate links/ISP. Or perhaps force the user end software to be compromised by an 'update' from the official provider.

Once you cannot trust the providers of the far end services or the tools/apps you use at your end, it gets tricky quickly.

Ahh, so the UK wishes to force Google to provide a backdoor. Presumably only for accounts that are UK residents. But what I visit the UK as a tourist? Can they demand access? Such complexities, and Google will presumably resist them.

Google does have a detailed legal process, which makes it pretty clear that Google sees itself operating as a U.S. institution, and external requests need to go through MLATs between other countries and ours. I'm guessing that the UK wants something far more direct than this.

Google, the parent company, may see themselves as a US institution, but they do have subsidiaries in many other countries (including one in the UK). So if their Chinese subsidiary was beholden to Chinese censorship laws, I can't see why their UK subsidiary wouldn't be beholden to the UK snooping laws.

I can't vouch for the service, but I just saw that PureVPN.com is currently offering a deal for $2.45/month if you get a 2-year deal. Servers all over the world.

If actual privacy is the reason for using a VPN then the price should not be a primary consideration.

My understanding is that a number of the discounted and especially the 'free' VPN services monetize the end users and their traffic. If you want complete privacy via a VPN then do not look for low price. Actually paying for the very private service can itself be a privacy risk vector, so navigate carefully.

Thanks for all the suggestions. I'll look into AirVPN, it seems like a possible solution.

pca

Another vote for PIA here. They claim no logs etc. If they ever got caught out logging their business would go kaput so I have faith in their commitment.

Aha. I did not know that. That's sort of counter to the idea of using a VPN, isn't it. Although, I suppose if the only reason you're using a VPN is to get around regional content blocking, that might not be such a concern.

Here is an example article discussing how VPN services can do bad things.

https://www.wired.com/2015/07/proxy-services-totally-unsecure-alternatives/