the most private VPN

[Irihapeti]

Your cousin is after you, Irihapeti!

Ahh… but just add a VPN and it will solve everything.

[scorp123]

On these forums, we repeatedly get the refrain that the objective is to hide from three letter agencies. This is so unrealistic that it crosses over into silliness.

Depends on how you go about it I guess? But yes, I understand what you mean.

The only realistic avenue available to one under such surveillance is to cooperate with the agency and show them that one is harmless.

I disagree with that one. I shouldn't have to prove my "innocence" just because they feel like suspecting me of something. It's their job to prove me of being "guilty" of whatever it is they want to accuse me of. "Innocent until proven guilty" is how it works in civilised countries.

On the other hand, if the objective is to avoid the attention of such agencies in the first place, then using a VPN can be counterproductive. In fact, if done injudiciously (as most people tend to do) it waves a red flag. Since the natural predisposition of such agencies is to suspect everyone, then using a VPN implies that you have something to hide. You are more apt to draw added attention to yourself than to attain your privacy objective.

Ah, the classical "Nothing to hide" argument?
https://en.wikipedia.org/wiki/Nothing_to_hide_argument

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say."
Edward Snowden.

The only realistic way to curb the power of three‑letter agencies is the political route—to have even more potent authorities limit their reach, whether these be courts, legislators or the weight of public opinion.

I'm on the other side of the Atlantic, I neither have the time, the patience, the power nor the money to go any of those routes. So that approach isn't viable for me.

In the face of such widespread privacy‑killing wilful self‑destruction, it is difficult to see most people's VPN usage as anything more than a sad joke.

True.

It is just as foolish to think that a good VPN will give us privacy as it is to think that installing AV will magically immunize us against malware. Since 99% of privacy is the result of personal behaviour, 99% of the solution must involve significant changes to personal behaviour.

Yes, I agree to that.

[DuckHook]

I disagree with that one. I shouldn't have to prove my "innocence" just because they feel like suspecting me of something. It's their job to prove me of being "guilty" of whatever it is they want to accuse me of. "Innocent until proven guilty" is how it works in civilised countries.

I don't think that we are fundamentally in disagreement here. I make no assertion that general surveillance is okay. The important condition in my statement was: "under such surveillance". This means someone already and specifically targeted. You are addressing a philosophical concern. I am addressing a pragmatic one. It's like the difference between one's legal right to be presumed innocent until proven guilty and one's pragmatic behaviour when pulled over by highway patrol. As aggrieved as one might feel, it would be unwise to be anything other than cooperative.

Ah, the classical "Nothing to hide" argument?

Actually, this wasn't at all my point, but I can see how it can be misinterpreted as such. Were I to ascribe to the view you attribute to me, I would not be using a VPN. Since I do, then I clearly don't agree with the "nothing to hide" argument.

My point is that VPN usage if used injudiciously waves a red flag to agencies sniffing for suspicious behaviour. Various security professionals agree on this same point. In the situation that exists today, where the vast majority of people do not care about their privacy and the default behaviour is the exchange of reams of data in the clear, an encrypted exchange stands out like a sore thumb. This is not an "ought" statement; it is an "is" statement. It is an assessment of the reality that we live in.

I do not pretend to have a solution to the above other than what I stated in my point #3.

I'm on the other side of the Atlantic, I neither have the time, the patience, the power nor the money to go any of those routes. So that approach isn't viable for me.

Actually, you have way more going for you than we do on our side of the pond. You have the GDPR. We have a hodge-podge of cobbled together legislation that varies from place to place and is generally toothless.

Perhaps my real point was lost in my sea of long‑windedness and can be better expressed as follows (QIII has already alluded to it):

People are overly concerned about government surveillance when the far greater danger is elsewhere. The real danger is profit‑driven personality profiling. When little‑known data agglomerators assemble a frighteningly accurate picture of who we are, anyone—including governments—can access it to their advantage and to our disadvantage. The program that Snowden blew the whistle on, called PRISM, was 13 years ago and arguably unnecessary today. The same info on almost all of us is now available through companies like Experian and Quantcast, and has been analyzed, parsed and packaged so that anyone from marketers to insurance companies to political parties to banks to crooks to, yes, governments can buy it on the cheap. Do visit the above link. It is a sobering read. So, it's a matter of paying attention to the real problem rather than getting distracted chasing shadows:

• Being denied health insurance because all insurance companies have access to our DNA profile is way scarier (and a more realistic and urgent danger) than macho fantasies of Jason Bourne.
• Being denied a mortgage or a job because of projected character defects in our personality profile (as versus basing decisions on our real past conduct) is way scarier than any three letter agency.
• Being spearphished by scumbags because they know all about our personal interests and can craft a believable story of camaraderie over a "shared hobby" is way scarier than government surveillance.
• Having our bank accounts emptied out, two mortgages registered in our name and three cars bought on our credit due to identity theft is way scarier than illusory conspiracies.
• Being manipulated by political parties or unsavoury cults because they know our susceptibilities and exactly which of our buttons to push is way scarier than imaginary spies.

I'll put it even more bluntly:

What is the point in dickering with a VPN and agonizing over government spying if one has five social media accounts; two free email accounts; subscribes to Youtube, Amazon Prime, Disney and Roku; uses Zoom, Skype and Hangouts; buys from Amazon, eBay and a dozen other online stores; and has a hundred apps installed from the Android or Apple store? I mean, really…. what would be the point? It would be a joke—a colossal waste of time. It would just be a way of beguiling oneself into feeling a false sense of privacy when one has already given the farm away through all of one's other conduct.

[aljames2]

I mean, really…. what would be the point? It would be a joke—a colossal waste of time. It would just be a way of beguiling oneself into feeling a false sense of privacy when one has already given the farm away

I agree here. I check a few of these boxes myself. I haven’t wrestled with using an outbound VPN yet because it seems I’m raveled up in some of this. My wife and I do not do social media thank goodness but we do stream content and shop online. These companies have a way of sinking their claws into you with conveniences that are paid for with not only your money, but your privacy as well.

Unplugging oneself from these dependencies, or at least a major cutback, seems to be a good first step.

Of course, a remote access VPN to access a home network I think is always in order, but I know that’s not what we’re talking about here.

[DuckHook]

…we do stream content and shop online.
…
Unplugging oneself from these dependencies, or at least a major cutback, seems to be a good first step.

There are ways of streaming content that provide decent privacy. For example, one does not have to be signed in to Google to stream Youtube content. Google wants you to (guess why?) and will offer you lots of blandishments to sucker you into doing so, but so long as you resist the temptations, you can be relatively anonymous. The method that I often use is a separate browser—either Brave or Firefox, NOT Chrome—running within a LXD container (you can run yours in a VM if that's more comfortable for you) that is automatically connected to a VPN. Do NOT sign this browser in to anything, least of all a Google account. Make sure the browser is set to delete all cookies at exit. For added privacy, install Ghostery or Privacy Badger. NoScript is even better, but some find it hard to configure. A browser hardened in this way can do double duty and stream more than Youtube. I also use mine for TubiTV.

If streaming a subscription service like Netflix, launch another browser instance in a separate container. Follow TheFu's strategy and lie. Do not sign up with your real name or your real e-mail address or your real cell number. When asked for your Mother's maiden name or your high school sweetheart, lie. When filling out your street address, lie. Payment is a problem. You can use an intermediary service like Paypal, but while this protects your actual credit card data, your identity is still shared with Netflix. More anonymous is a pay‑as‑you‑go rechargeable credit card, but not all online services will accept those. More services are accepting bitcoins these days. It's an option, although I've never used it. The main takeaway is: lie, lie, lie.

How to keep track of all those lies? Use a password manager. All password managers that I'm aware of have extra fields within their databases that can hold exactly the sort of data that make up all those lies.

What about cell phone number and email addresses? You can't exactly use a fake one because many subscriptions will only activate after contacting or confirming you on those addresses.

For email, I use anonaddy. This service allows you to create proxy email addresses that are associated with your real email only on anonaddy's server. You can create a unique email for each subscription. If you ever want to stop a subscription, you can forever cut them off from bothering you again by deleting the proxy email address. This has the added benefit of showing you which vendors sell your email addresses to third parties. There are other similar services to anonaddy. I use them because they have a good app on FDroid and FDroid is our friend.

For cell phones, I use a cell proxy. These providers operate the same way anonaddy does for email. There are many, all findable through a simple websearch.

It is an impossible ask to not use online shopping these days. What with the rotating lockdowns and the sheer convenience, asking people to forego online shopping would be pushing on a rope. But even here there are ways to preserve your privacy. In tandem with the above strategies (lie, lie, lie, pay anonymously, lie some more), if you live within or near an urban centre, then you can have purchases delivered to a mailbox service. These are providers who will receive, warehouse and notify their customers of all deliveries. All you have to do is direct your deliveries to the address of the service and then pick it up upon notification of delivery. Yes, it costs money and it's not as convenient as having things dropped off at your front door, but the reality is that our privacy comes at a cost. One further benefit is that you will eliminate the criminal parcel heists that are exploding all around us.