In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:
- Port forwarding support
- Open source
- Android app and Firefox extension available
- Relatively cheap, around $3-4 month (okay with annual pricing)
The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.
Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.
Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.
A single example doesn't say much. First off, most major websites can be determined by a whois or reverse dns lookup of their IP. 80% of your browsing history is still a lot of data.
However as you've noticed, IP addresses don't always give away the website. The website owner might enabled registrar privacy. However that won't do much against a big tech company like Google, who can track and maintain mappings between websites and IPs. So if Oracle were to sell your proxy's traffic data to Google, Google could figure out what websites these IPs were correlated to.
This doesn't always work though. Sometimes multiple websites are behind a CDN like Cloudflare, so the IP is just cloudflare's IP. This would be harder for Google to analyze, but it's still information. If Google has other data about the traffic, like timing data and payload sizes, they could guess which Cloudflare website it corresponds to. And even if they couldn't figure it out in the end, again, 80% of your data is still a lot of data.
Edit: also, if you are now making the argument that IP address data does not reveal anything, then you are conceding that Oracle is not trustworthy from a privacy standpoint. In which case, why use an Oracle VPS at all? Why not just make those HTTPS requests from your home IP? All your ISP sees are requests to IP addresses, so according to you that should be fine right?
I can't make those requests from my home IP because my ISP from home blocks certain websites. But the scheme I described is solid:
ISP - Oracle - WARP with frequently changing IPs
DNS with dnscrypt
The only thing that could make it better is if the VPS had memory encryption to protect me from memory snooping attacks
As mentioned in a sibling comment, afaik all WARP traffic would be associated with your Cloudflare account. So the Oracle VPS doesn't matter anymore.
And again, if both Cloudflare and Oracle are selling data to the same company (like Google), Google can reconstruct the entire path of your traffic, and your privacy is now reduced to the same as somebody who isn't using any proxies at all.
A VPN relies on trust. As of now there's no getting around that. So the question is, is ProtonVPN/Mullvad/iVPN more trustworthy than Cloudflare and Oracle? I'd bet most privacy experts would say yes.
From the beginning this was about privacy. That's what the readers of your first comment would expect. I am simply explaining why replacing ProtonVPN with an Oracle VPS is a downgrade.
I don't use my Cloudflare account for WARP, I use the free version
They have no data on the free version because the VPS IP keeps changing.
Also you were assuming Oracle knows that my VPS is a proxy. They can't assume that. They probably think I'm hosting a site (port 443 open)
What data do you think they are selling? They can only sell "this guy hosts sites" data
A free VPN is a huge red flag. If you seriously trust Cloudflare WARP so much, I dare you to make a post in the privacy subreddit recommending them as a VPN replacement.
And how do you still not understand that if you can't trust the VPN provider, they're useless. Let's say Oracle and Cloudflare sell data to Google, which is the assumption I brought up from the very beginning. Oracle tells Google that the VPS belongs to you. Oracle tells Google that a packet left the VPS to Cloudflare. Cloudflare tells Google that that packet had a final destination of xxx-website.com. Google puts the pieces together and knows that you tried to visit xxx-website.com. It's that simple.
They can't even assume I'm the user of it. They can only assume based on usage that I'm running a VPN service (since several IPs connect to it and the requests get proxied)
If I really cared I'd open Tor browser, of course
You really think your VPS traffic looks anything like that of a commercial VPN? Yes, they will assume it's your personal VPN. Seriously, your judgement throughout this whole thread has been horribly flawed. If you don't trust me, ask the community. Make a post in c/privacy recommending your setup, or asking about it's effectiveness.
It doesn't matter, if I use Tor browser they can't track me very well then. Tor bridges are banned here so I'm actually increasing my privacy by using Oracle
OK so just ignoring the entire discussion up until this point and pivoting to "it's for circumventing Tor restrictions". Brushing aside the fact that all the stuff you brought up earlier (DoH, ODoH, HTTPS, Cloudflare WARP) are completely irrelevant if you're using Tor browser. Man it's so hard for people to just admit when they're wrong nowadays.
But at least it's clear that you understand my point now. And please do research before giving advice to others. It takes 10 minutes to find many threads about why a self-hosted VPN is nowhere near as private as a commercial one.
Because I don't care enough to use Tor and the other shit is what I actually use
Yeah, but it doesn't say anything if I used a Google IP. I could be doing anything. Am I searching for something? Talking to AI? Remember that the VPS doesn't see any address or data, only IP.
Furthermore, some sites work better with WARP than my IP address so some of the connections are outgoing to engage.cloudflareclient.com:2408 (warp will see my VPS address so it doesn't give CF any more info than going to a CF-hosted site)
If I really cared about the privacy of the IPs of the sites, I could route everything through WARP. Then the VPS really doesn't know anything and CF only knows some VPS requested the data.
I often change the Oracle VPS IP with a shell script. It's pointing to a subdomain, so the only way to get the address of the subdomain is to get the cert. I can configure nginx to block all requests without SNI so I don't serve the cert to people snooping.
this is just DoH + HTTPS. You can use DoH and HTTPS with proxy or VPN, and your ISP would only see IP and not domain names or data.
Not relevant to this discussion, which has been about privacy from the beginning
WARP is just cloudflare's VPN. So, just like any other VPN, you would have to trust Cloudflare. Note that all your traffic to WARP would be tied to your Cloudflare account. Doesn't matter if you use a VPS as the first hop.
The issue from the beginning is that Oracle could simply be selling your data, which includes every VPS IP change. Oracle is not a privacy business, and really shouldn't be trusted