It seems like Tailscale is very popular, but how does that or VPN protocols like AmnesiaWG help enhance my privacy? It seems like these tools help secure the connection between the client and the server, which is great, but the server still has to connect to the internet. Typically, or at least where I am, signing up for an internet requires going through KYC (Know Your Customer) and using a valid payment method. So wouldn’t traffic out of the server could potentially be monitored? I guess I could use a secure DNS, but that doesn’t solve everything.
Why would anyone do that when they could use Mullvad, where the user can browse privately and securely, and the server is RAM only with no logging?Can someone help me understand the differences and use cases?
Correct, they are typically used for traversing between different internal and external networks.
It is monitored, ISPs have to measure network traffic for billing purposes and acceptable network usage, among others.
It solves your DNS queries from being easily eavesdropped on the wire between you and the resolver.
Trust, either you trust yourself, or someone else, and there are various attacks available against server RAM, such as Battering RAM:
There are also cold boot attacks, but their effective depends on the generation of the RAM.
I think we have to be clear in what we’re referring to. Are you referring to the server’s connection to the ISP? If so, then yea, it’s either I trust the ISP or I trust Mullvad. Here’s the confusing part, how does Mullvad protect the connection going from its servers to the internet?
Let’s say I want to go down the road of setting up my server, how do I better secure the connection between the server and the ISP.
I think we’re in agreement that the client-server connection is secured through AmnesiaWG. However, what I waito know is if someone wants to monitor the client-server connection, what will they see and are they able to pinpoint where the server is even if the connection is encrypted?
The ISP is a MITM, they will observe your network traffic regardless of whether you set up your VPN and/or encrypted DNS using a home server or at a datacentre IP address.
Mullvad VPN does nothing afterwards, VPNs are tunnels that start and end exactly at the tunnel’s edges, the rest of the connection’s security outside the tunnel is handled by the external server you are attempting to connect to.
A VPN is usually enough, regardless of whether it is hosted residentially or at a datacentre, but if your ISP does DPI or other network analysis, you may need to use obfuscation techniques in order to bypass it and approve against their internal protocol whitelist in order to gain external access to the Internet.
Your ISP already performs this passively, they will be able to see the source IP address, destination IP address, timestamps of each network activity, and how much network traffic you are generating at any given time. If you decide to put the VPN in a datacentre instead, self-hosted or not, like Mullvad VPN, then that datacentre’s ISP has the same technical capabilities. The difference is that Mullvad VPN has more users exiting from the VPN from that specific IP address, so the ISP will see multiple clients as a result.