So far.
I mentioned the word VPN in a number of lectures, but I never really explained what it is.
So in this lecture I'm going to explain what a VPN is, how it works, and how we can use it to bypass
censorship and protect our privacy, anonymity and security.
So VPN stands for Virtual Private Network, and to understand how it works, let's first have a look
on a normal scenario where we have a user trying to access Google.com, as we mentioned before.
Usually this traffic is sent unencrypted unless Google or the website they're trying to access uses
encryption.
And like we said, this traffic passes through a number of routers, it passes through your Internet
service provider and so on.
And all of these stops can see the data that you're sending and manipulate it, profile you, gather
information about you, and so on.
Now if you use a VPN, you will first connect to the VPN server, which you can think of as a computer
that exists on the Internet, on the cloud, with really good resources.
And what happens is you create an encrypted tunnel, an encrypted connection with this computer.
So whenever you want to access anything on the Internet, you send that first to this computer.
But the request is sent encrypted.
Hence, I used a green arrow in here to indicate that the data sent is encrypted.
So whenever you want to access something, both you and the VPN server will be able to read this data
and understand it.
But if anybody intercepts this data, whether it's your Internet service provider, whether it's your
network admin, whether it's a hacker, they will not be able to read this data or manipulate it or
profile you because this data will be encrypted.
It will be gibberish.
Then once the VPN receives the data, once it sees, for example, you want to go to Google.com, it
will simply forward that request to Google and then the response will follow a similar path.
Again, keep in mind traffic leaving the VPN will be unencrypted.
It will only be encrypted if the service that you're connecting to uses encryption hence are used a
red arrow in this case.
Now you can also use a VPN and connect to the Tor network, so you'll first connect to your VPN again.
Green Arrow means your traffic is encrypted and then it leaves your VPN connecting to the Tor network.
And then you can either access an onion service or go to Google or any other website on the clear net.
Now this architecture of first creating a secure tunnel and connecting to a server and then go to the
internet or to the Tor network or to whatever service is really, really useful because first of all,
it adds an extra layer of encryption.
This means that it's going to improve our privacy and anonymity because it will prevent anybody that
intercepts this connection, that intercepts this flow of data.
And here, from seeing what data you're sending or receiving, again, whether it's your network admin,
whether it's your Internet provider, whether it's a government, it doesn't really matter.
Your data in here is going to be encrypted.
Therefore, it will be useless to any entity that intercepts it.
It will also help us bypass censorship.
So we see previously that we can use pluggable transports and bridges in order to bypass censorship
and connect to the Tor network.
Even if it's being blocked by your network admin or by your internet provider.
A better solution, in my opinion, is to simply use a VPN, because let's assume we have an internet
service provider in here that doesn't allow the users to access tor.
When you use a VPN again, you're creating a secure, encrypted tunnel between you and the VPN provider.
So the internet service provider cannot see that you're trying to connect to Tor.
All it can see is encrypted data going to some server on the internet.
Therefore, in the case of the pluggable transports and bridges, in worst case scenario, the Internet
service provider or the admin or the government will be able to see that you are trying to connect to
TOR, which could cause problems in some countries.
In the case of using a VPN, the worst case scenario is your internet service provider will be able
to know that you're trying to connect to a VPN.
That's it.
They won't know that you're trying to use Tor and they won't be able to see any data you send because
like I said, the connection is encrypted and hence the use of the green arrows in here.
On top of all of these features using a VPN protect us from hackers because it is very easy for anyone
connected to the same network as you to intercept your data, to redirect the flow of data so that it
flows through their computer.
I actually covered this in my network hacking and in my ethical hacking courses.
So whether you're connected to a public network such as an airport network or a hotel or a college network
or even at your own home network, anybody connected to that network can redirect the flow of data so
that it flows through their computer.
And once they do this, they'll be able to see all the websites you visit, all the usernames and passwords
you send.
They'll even be able to modify data on the fly and backdoor files you download and in many cases even
gain full control over your computer.
Now, if a VPN is used, the hacker will still be able to redirect the flow of data, and they will
still be able to intercept your data.
But this data again will be encrypted, hence the use of the green arrows.
So they won't be able to see the usernames or the passwords or anything.
And even if they try to modify this data, they wouldn't be able to do it because it will be simply
gibberish and they wouldn't be able to analyze it or do anything with it.
That's why using a VPN is a really good solution to prevent man in the middle attacks.
With that being said, there is a number of things that you need to keep in mind when using a VPN.
First of all, we are introducing a man in the middle in here.
So if we go back to the previous diagram, you can see that our connection was going directly to the
Internet.
But when we're using a VPN, we're literally adding an extra node to our connection.
So the data is encrypted between the user and the VPN provider, but the VPN provider is able to see
this data.
Therefore, you want to make sure that you pick a reputable VPN provider and avoid free providers because
a lot of them keep logs and analyze you.
You also want to make sure that you use a provider that keeps no logs.
And with keeping all of these things in mind, with picking a reputable provider, avoid free ones and
make sure that they keep no logs.
Also use HTTPS everywhere.
This really solves the problem of having a VPN here, even if you trust them, even if you think this
company will never do anything bad, will never keep logs and analyze your traffic when you use https
everywhere, you're adding another layer of encryption so your connection between you and the VPN provider
will be secured by two layers of encryption.
First, the encryption used by the VPN and the encryption enforced by HTTPS everywhere, which is TLS.
And then when traffic leaves the VPN provider, you will have TLS encryption up to whatever destination
you're going to.
Therefore, even the VPN provider in this case will not be able to see your data because it will be
encrypted with TLS, which is a very, very secure encryption.
Last but not least, when signing up with a VPN, you want to make sure you use a VPN that does not
require a lot of information again, at the end of the day.
We're trying to improve our privacy and it doesn't really make sense to give them my address and all
this information.
You can also take this one step further and pay with crypto, but this is optional.
It really depends on you and your threat model.
Now there are a lot of BPM providers out there.
I highly recommend you go and do your own research.
Me personally, I use our own VPN that we provide added security, which you can get at zealous VPN.
So I have the website already here and I'm already at the download section.
It supports all platforms so you can use it on Windows or Linux.
iOS and Android doesn't really matter.
And using these VPN providers is actually very, very simple.
All you'll have to do is, first of all, obviously sign up with the one that you want, download their
client, and once you have the client downloaded, you simply want to select a server and connect to
it.
So I already have the client downloaded and installed and I'm simply going to connect to the Australia
server.
And right now as you can see, my location changed to Australia.
So the websites that I visit will think that I am visiting them from Australia because going back to
this diagram I connect it to a VPN server that is in Australia.
So anything I send will be leaving this server and therefore I'll appear like I'm coming from this country.
So that's another benefit of using a VPN.
You can change your location and access websites or content that is only available for a certain country
by simply connecting to a VPN that is in that country.
So now that I'm connected, we can see that it's saying here Australia, we can double check on the
website itself.
If I refresh it here, you'll see this bar will tell me that I am protected by that VPN.
My IP appears to be this one, which is not my real IP and I seem like I'm coming from Australia, so
that's perfect.
And now that we are connected to the VPN, we can go ahead and use the internet normally and will appear
like we're visiting these websites from Australia or you can use your Tor browser and this way we'll
connect to the Tor network from the VPN server that is in Australia and then bounce through another
three nodes and then access the website that we want or access to our hidden services.
So we can just go to check the Tor project dot org to confirm that we're connected to the Tor network
properly.
And as you can see, that's perfect.
We're connected to it.
This is the IP, this is the end IP, the IP of the exit node.
And we can even click on the AI here to see the nodes we're bouncing through.
So what's happening right now is we have an encrypted connection from my computer to a VPN server in
Australia and then from there we're connecting to the Netherlands, to Germany to the United States,
and then we access the Tor project website or whatever website we want.