First of all, there's no such thing as own server. The trust you are putting into the ISP your "own server" is connected to is exactly the same as the trust you are putting into a VPN provider.

Second, for a lot of people in this world it's a given that their ISP/government is monitoring their traffic. It's vastly better to be potentially spied on by someone abroad then to be certainly spied on by someone who has direct authority over you.

To answer your first question, the most popular use cases for VPN are:

1. Circumventing censorship

2. Circumventing regional content restrictions

3. Hiding your IP while torrenting (note that this is relevant only in the US)

4. Avoiding government surveillance (again, note that US is not the only country in the world, but likely the only one with any meaningful reach outside its borders)

5. Avoiding private surveillance (public wi-fi, etc.)

6. Hiding your IP while engaging in illegal online activities (#3 is a special case of this but it's a vastly larger group so I made it separate)

Note that "weird jurisdictions" can be a significant advantage for cases #3 and #6 (because they are harder to subpoena) as well as #3 (because they don't have retention laws).

> 3. Hiding your IP while torrenting (note that this is relevant only in the US)

It's not, actually. The same BS is happening in at least Finland too these days.

Legal companies get the rights to some media (in the Nordics or whatever) and monitor some torrents and take screenshots(!) of the IP's in the torrent swarm and can then petition the market court for the subscriber details of the IP addresses in the swarm then send a threatening letter asking for a 500€ settlement. Some idiots are even caving in and paying. I don't think anyone has actually been sued yet for establishing some precedent (though the Finnish legal system isn't based on precedents).

As an example:

I set up a VPN in the Netherlands, hosted on a VPS. I was connecting from another European country (where ISPs block torrent sites).

Within minutes of attempting download of recent movie release, a Cease and Desist was emailed by ip-echelon.com.

That's the thing. With a VPN service, you don't have to read those ;)

Welp, it was only a matter of time... Thanks for the info!

> 3. Hiding your IP while torrenting (note that this is relevant only in the US)

The entire German nation would like a word with you, kind sir.

Further reading: https://www.reddit.com/r/germany/comments/2hxy4j/help_me_ger...

Between this and GEMA, using the internet in Germany is quite restricted.

>3. Hiding your IP while torrenting (note that this is relevant only in the US)

This is relevant in most of Europe and unlike in the U.S., a C/D letter can easily cost you somewhere between 300 and 1000€.

why is there a cost associated with it?

They threaten to take it to court and that would cost much more. You'll also have to deal with a lot of bureaucratic crap along the way that has very short deadlines and can cause a lot of trouble if you don't meet them, so they kindly allow you to pay to make it all go away...

because they can and a lawyer will cost you more. actually, i know a lawyer who paid upfront to avoid the threat of a lawsuit.

I can't speak for weird jurisdictions, but I use privateinternetaccess myself. I haven't tried it for torrents actually, I should give that a shot. I use it for

* getting around arbitrary region restrictions (that use case is rapidly disappearing)

* protecting myself against snoopers when on public WiFi. I'm very mobile, and often work from cafe/hotel/airport WiFi. They're mostly in the clear, but I VPN even over encrypted WiFi because of the below.

* I don't like ISPs selling my information. The service i use is fast enough that I can have it always on, without a noticeable speed loss... So I do. If my ISP wants to sell my browsing habits, they can buy them from me.

Now that you mention it, I'll totally try torrenting something. Curious to know how it performs!

PIA actually performs rather nice with bittorrent. It is slower than a bare connection from your ISP of course, but fast enough for most purposes.

I do agree that hiding bandwidth and source is reasonable use-case, but then you don't really need to know about service jurisdiction, logging policies, activism, etc. So I just seriously wonder why anyone who actually care about real privacy and logging would use public services.

For people who care about real privacy, VPNs are useful to hide Tor use from ISPs. You use a nested chain of maybe three or four VPN services, and then hit Tor. Let's say that you were using targeted onion services while the CMU jerks were pwning Tor users. Instead of your ISP-assigned IP, the FBI would just know a VPN exit IP. And they'd need to successively subpoena three or four providers in order to get your ISP-assigned IP.

So you're the guy they are talking about on TV who has "bounced through 7 proxies" ;)

That's a Snowden reference, no?

But yes, seven hops is about the minimum for any prudently private person, as I see it.

But for true overkill, see https://www.ivpn.net/privacy-guides/onion-ssh-hosts-for-logi...

It's not that hard to hit 30 hops, alternating VPNs and Tor onion services.

Nah not Snowden, it was just a joke because in TV shows whenever there is some kind of computer crime the technical specialists in the show (black hats turned white, etc.) talk about how the criminal is untraceable because they were hidden behind 7 proxies or such. Not saying you are a criminal it just made me smile/chuckle when you mentioned routing Tor over VPN which is also going through another VPN which in turn is on Tor, etc.

Thanks. I found this: http://kxan.com/2014/03/10/congressman-upset-with-edward-sno... And wondered why that was needed, given his situation. But now I see this: http://www.dailydot.com/technology/snowden-sxsw-seven-proxie...

Wow, that's a comprehensive guide indeed. Thanks for sharing

I use a VPN to watch San Francisco Giants games on my paid MLB.tv subscription. Even though I am 3+ hours from both SF and LA, and even though I can't get games on cable/broadcast TV, I am in the Dodgers blackout region. Therefore, when my favorite team plays their biggest rival, I need the VPN to watch the game.

Living in a Reds/Cubs/White Sox blackout umbrella here. Which VPN service are you using if you don't mind me asking?

I've used both Private Internet Access and Hide My Ass with success.

> *I still wonder why ... for anything other than torrets download?

"This video is not available in your region"

This government and ISP is modifying your HTTP traffic.

1. Non-unique IP, which, for good no-logging VPNs, means no way to map a connection to a person, even through the legal system.

2. Hiding your activities from your own ISP.

And I would guess that the vast majority of VPN customers are simply doing what you said VPNs are good for: hiding copyright-violating activities.

> Non-unique IP, which, for good no-logging VPNs, means no way to map a connection to a person, even through the legal system.

Not guaranteed. That depends on the network setup and on how much pressure legal system had on the ISP in question.

Possible cases:

1. Dynamic IPs allocated from a shared address pool, but no carrier-grade NAT, just 1:1 mappings. Most likely, ISP's AAA (authentication, authorization and accounting) systems keep track of those, so the account details are one warrant away. Especially if ISP has or historically had metered plans, using IP addresses is generally the most straightforward way to match flow reports (with traffic volume data) to customers.

2. User is behind a carrier-grade NAT, ISP's local jurisdiction requires ISPs to disclose information about customers, and local law enforcement aren't happy with "uh... we don't know, there's a NAT, we only can tell it's someone of those thousand accounts from that BRAS, sorry" replies, so ISP had been fined or threatened with license revocation (if ISP services are licensed in their jurisdiction). In such case they had probably at least set up two flow probes - before and after the NAT, so it's usually possible to correlate the streams. Or, more likely, implemented logging of NAT connection mappings (on GNU/Linux machines this is quite simple with conntrack and ulogd, no idea about Ciscos - not my area of expertise), so it's also well possible to determine who it was.

Since one generally can't know what ISP's routers are capable of, having carrier-grade NAT should be only considered as a possible hindrance, but not as a guaranteed way to keep their account identity anonymous.

For hiding IP and bandwidth you don't really need to know even a third of options included in that list. And for "good no-logging VPNs" do you actually belive service like that may even exist for longer than a few years?

Do check out AirVPN, BolehVPN, Cryptohippie, Insorg, iVPN, Mullvad, etc via https://archive.org/ They've been around for more than a few years. Maybe eventually they'll be unable to lease usable servers. It's hard to say.

Mullvad in the recent past had trouble find exit servers in the USA, I think it was reported in their blog.

Idiots who torrent from US endpoints tend to burn them down :(

Mullvad is one of the better companies on that list, and they've been around since at least 2010.

Another endorsement for Mullvad here.

A lot of expats and the upper middle class in China and similar countries use them. Most people don't have the expertise to set up their own

VPNs simply don't work in China. The GFW actively detects and disconnects SSH, VPN (OpenSSL, PPTP, socks.. etc)

The only reliable solution has been ShadowSocks; it's what locals and expats alike use. It simply works, and also has public servers.

I do not agree with you. I am running my own VPN Server outside of Mainland China and thanks to obfuscation my VPN is working quite well and its very reliable.

Have you tried iVPN with obfsproxy? Or AirVPN with stunnel? Or VyperVPN? Just curious.

Are you by chance aware of any simple tutorial for ShadowSocks? Last time I looked at the website it didn't seem straightforward to set up (particularly for non-techies).

Also, one needs an exit server, or not?

SoftEther VPN (Open Source) works over HTTPS and UDP, that might work for you. https://www.softether.org/

"steal everything they can"

Most people are talking about various valid use cases but it's this risk vector that I'm interested in. What exactly could a VPN steal from regular personal computing network traffic? Cookies and sessions? Web history and other meta-data? Does HTTPS / up-to-date encryption protocols stop any of this?

The advantage over your own servers is that it's harder to associate your traffic with your identity. The advantage of "weird jurisdiction" is that they won't cooperate with relevant LEA so readily.