In the wake of the Proton controversy, I’ve been looking towards alternatives towards their services. Unfortunately, I can’t seem to find a good alternative to ProtonVPN. I’m looking for the following in a VPN service:

  • Port forwarding support
  • Open source
  • Android app and Firefox extension available
  • Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I’m cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I’d like to know your thoughts.

  • iopqMEnglish
    1·
    1 day ago

    Oracle doesn’t know what website I’m visiting. They know the IP

    Let’s say you see that I connected to the IP 168.107.12.213

    What does that tell you? I honestly couldn’t find much other than it’s in Korea. Can’t even find the address of the website that’s using it. What can you tell me about this IP?

    • hirihit640@sh.itjust.worksEnglish
      1·
      21 hours ago

      A single example doesn’t say much. First off, most major websites can be determined by a whois or reverse dns lookup of their IP. 80% of your browsing history is still a lot of data.

      However as you’ve noticed, IP addresses don’t always give away the website. The website owner might enabled registrar privacy. However that won’t do much against a big tech company like Google, who can track and maintain mappings between websites and IPs. So if Oracle were to sell your proxy’s traffic data to Google, Google could figure out what websites these IPs were correlated to.

      This doesn’t always work though. Sometimes multiple websites are behind a CDN like Cloudflare, so the IP is just cloudflare’s IP. This would be harder for Google to analyze, but it’s still information. If Google has other data about the traffic, like timing data and payload sizes, they could guess which Cloudflare website it corresponds to. And even if they couldn’t figure it out in the end, again, 80% of your data is still a lot of data.

      Edit: also, if you are now making the argument that IP address data does not reveal anything, then you are conceding that Oracle is not trustworthy from a privacy standpoint. In which case, why use an Oracle VPS at all? Why not just make those HTTPS requests from your home IP? All your ISP sees are requests to IP addresses, so according to you that should be fine right?

      • iopqMEnglish
        1·
        5 hours ago

        I can’t make those requests from my home IP because my ISP from home blocks certain websites. But the scheme I described is solid:

        ISP - Oracle - WARP with frequently changing IPs

        DNS with dnscrypt

        The only thing that could make it better is if the VPS had memory encryption to protect me from memory snooping attacks

      • iopqMEnglish
        1·
        5 hours ago

        Yeah, but it doesn’t say anything if I used a Google IP. I could be doing anything. Am I searching for something? Talking to AI? Remember that the VPS doesn’t see any address or data, only IP.

        Furthermore, some sites work better with WARP than my IP address so some of the connections are outgoing to engage.cloudflareclient.com:2408 (warp will see my VPS address so it doesn’t give CF any more info than going to a CF-hosted site)

        If I really cared about the privacy of the IPs of the sites, I could route everything through WARP. Then the VPS really doesn’t know anything and CF only knows some VPS requested the data.

        I often change the Oracle VPS IP with a shell script. It’s pointing to a subdomain, so the only way to get the address of the subdomain is to get the cert. I can configure nginx to block all requests without SNI so I don’t serve the cert to people snooping.