安全与隐私gist.github.com
不要使用 VPN 服务
Don't Use VPN Services
2018 — 2020，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这篇广为流传的文章认为，商业 VPN 服务被严重高估：它们本质上是“美化版代理”，提供商能看到你全部流量，“无日志”承诺无法验证，且大多数场景下 HTTPS 加密已足够。作者主张按实际威胁模型选择工具，如 Tor 或自建服务器，而不是盲目付费买安全感。
为什么经久不衰：它把“VPN=隐私”的流行迷思拆解清楚，教人按威胁模型思考安全工具，多年来反复引发争论，至今仍是讨论 VPN 时的经典参考。
HN 评论精选
VPN 至少提供一层额外保护，说它毫无用处是极端化。
VPN 提供商可能在“无日志”上撒谎，但至少你多了一层保护：源 IP 被隐藏，要拿到它需要传票，而且如果 VPN 端点在别国，法律障碍更高。当然不能只靠它，Tor 是明智的补充。说 VPN 毫无隐私收益，就像说主机可能被入侵所以不如用 telnet 而不是 SSH。
thothamon查看英文原文
While it's true that your VPN provider _may_ be lying about their "no logging" policy, at a minimum, you get additional layers of protection. Your source IP is masked. A subpoena would be required to reveal your source IP, and perhaps your VPN provider is telling the truth about not keeping logs. If your VPN endpoint is in a different country than your network endpoint, then the legal obstacles get even higher. Surely you shouldn't depend on that alone. Tor would be a wise additional layer of protection, if applicable. But to suggest that you get no privacy benefit at all from a VPN is like saying your host may be compromised, so you might as well use regular telnet rather than SSH.
用“柠檬市场”理论解释为何 VPN 市场充斥劣质服务。
建议大家查一下“柠檬市场”理论。VPN 提供商与用户之间存在巨大的信息不对称：用户根本无法验证提供商关于日志的种种声明，因此无法区分产品好坏。这反而让公司没有动力提供高质量产品，最终整个市场充斥着劣质可疑的服务。
slg查看英文原文
I suggest people lookup "The Market For Lemons"[1] as it is a good warning for what can happen to markets with extreme information asymmetry. VPN providers like many tech companies have a huge information asymmetry over their customers. There is no way to really verify many of the claims that a provider is making, especially when it comes to something like logging. The result is that the consumer can't actually distinguish a low quality product from a high quality product. This creates a disincentive for companies to actually provide a high quality product when they can provide a product that is lower quality and cheaper to produce and still pull in the same revenue from users. If this is allowed to go on without any form of third party intervention, the end result is a market filled of products with dubious quality. [1] - https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofMarketforLemons.pdf
VPN 的共享 IP 提供了自建服务器没有的匿名混入效果。
这篇文章论证不错，但用 VPN 服务商而非自建服务器有一个很现实的原因——合理推诿。用 VPN 时你的流量混在众多其他用户之中；而用自己的服务器，来自该 IP 的任何流量都可以被认定是你的。
infodroid查看英文原文
This seems like bad advice because it doesn't address the legitimate need for keeping your browsing history private from overzealous, data-mining ISP's [1]. And even in the case of a known-hostile ISP that engages in invasive practices like supercookies or ad injection, it's unrealistic to ask users to set up and maintain their own VPS servers. For the average internet user, a "glorified proxy" service that is hassle-free to set up is a simple and effective means of protection against such a menace. [1] https://techcrunch.com/2017/03/29/everything-you-need-to-know-about-congress-decision-to-expose-your-data-to-internet-providers/
HTTPS 普及后，VPN 保护流量的价值已大不如前。
“因为提供商能看到你所有流量！”——可不用 VPN 的话，你的 ISP（宽带、咖啡店 Wi-Fi）同样能看到。20 年前我把全部流量走自建 VPN，因为那时流量大多未加密；如今几乎所有网页流量都加密了，VPN 的必要性大大降低。
linsomniac查看英文原文
"... because the provider can see all your traffic!" However, if you don't use a VPN: Your ISPs (Broadband, coffee shop, whatever) can see all your traffic! 20 years ago I passed ALL my traffic on my laptop through a VPN, I just happened to run my own. But back then much less of the standard traffic was encrypted. Now, pretty much all web traffic is encrypted. So that makes the VPN less of a concern, IMHO. Depends on what you're doing though... There was this one time I went to Defcon. Installed a scratch laptop for it. The firewall on it would only allow DHCP and OpenVPN on the physical interfaces.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选