You don’t want ISPs and governments to record your complete browser history? VPNs, Tor, SSH tunnels can hide what you are doing on the internet. (Or bypass the internet with a sneakernet, but that’s another story.)
But how, you ask?
Client-end (you, using the internet)
Now you want to install the right client software; this is fairly straightforward. The only non-obvious thing is that you can set your ROUTER to use the VPN. Or some other access point.
TODO: explain how.
Make my router do VPN
Tedious. You need a fancy router, and the shitty one you got from your ISP isn’t fancy. For now, here’s a link to a setup guide from a major commerical provider.
Make another computer into a VPN access point
In practice, this is all stupidly complex, even though it should be a ubiquitous default. Realistically, what I do is usually: try to configure an access point, then discover that there is some weird kernel error/bug specific to the particular device I am using, which has never been seen on the internet, which requires a specialist network nerd, and which I don’t have time to fix.
I am somewhere in the upper single-digit percentiles of the population in terms of fluency in stupid geeky shit like this and I fail, so realistically, most of your friends are not using VPNs and therefore too much data is being leaked to unaccountable surveillance programs.
Gotcha: OpenVPN is broken for DNS on linux by default
Yes, by default OpenVPN on linux will tell your isp which site you want, and will believe their lies about which site is what.
I think this is not a pure linux problem, per se but because VPN providers tend to provide wrapper scripts for OSX and Windows, one only notices this monstrous oversight on linux.
As of OpenVPN version 2.3.9 you can now prevent DNS leaks by specifying a new OpenVPN option. Simply open the .conf (or .ovpn) file for the server that you are connecting to and add the following on a new line.block-outside-dns
For openvpn 2.3.9 there is a laborious woraround that no normal person will realistically ever use.
Gotcha: VPN breaks household sharing.
Of course it does; you need a VPN router for this shit.
Server end (which provides you this service of confidentiality)
Note that the VPNs do degrade the efficiency of your internet, but Australians are used to shit internet anyway, so this is not a major issue.
But OK, you need a VPN to maintain privacy. Which one? How? Do you want to DIY, or pay someone else to provide it?
Note, that virtual machines on someone else’s cloud can never be especially secure from determined nasty persons or state actors. But they do at least prevent concerted profiling by commercial interests, and casual ambient profiling by the state, which is good enough for me.
A commercial VPN provider can probably do that better, with greater expertise, if their intentions are pure. On the other hand, a commercial VPN might be selling your data to evil bastards for their own profit, so… make your own risk assessment.
Commercial VPN services
That one privacy guy’s big overview is a great list VPN providers by e.g. bandwidth, jurisdiction, and privacy advocacy.
Running your own VPN/proxy/anonymizing/p2p etc servers can be less convenient for the panopticon.
very easy with simple gui, outline
mostly-secure cheap, light VPN in the cloud: popup-openvpn.
openvpn on docker+digitalocean: See kylemanna/openvpn, and the digitalocean pitch, or the alternative walkthrough with a couple more terms clarified.
sshuttle --dns -r username@sshserver 0/0
Hiding that you are hiding. obfsproxy and other , tor pluggable transports, but isn’t so simple and if we really want normal people to go through these tedious steps people will die of boredom before they ever get around to overthrowing their repressive regimes.
You can get pre-rolled scripts from help sites such as scramblevpn which tells you how to make a cheap raspberry pi router.
Is already its own proxy thingy.
How does tcpcrypt fit in?
tcpcrypt is a protocol that attempts to encrypt (almost) all of your network traffic. Unlike other security mechanisms, Tcpcrypt works out of the box: it requires no configuration, no changes to applications, and your network connections will continue to work even if the remote end does not support Tcpcrypt, in which case connections will gracefully fall back to standard clear-text TCP. Install Tcpcrypt and you’ll feel no difference in your every day user experience, but yet your traffic will be more secure and you’ll have made life much harder for hackers.