What the hell Proton!

Yup. You can grab any unencrypted data passed between the user's browser and a server literally out of thin air when they're connected to an open access point. You sit happily at the Starbucks with your laptop, sniffing them WiFi packets and grabbing things off of them.

Oh and you have no idea what the myriad of apps you're using are connecting to and whether that endpoint is encrypted. Do not underestimate the ability of firms to produce software at the absolute lowest cost with corners and walls missing.

If I was someone who was to make money off of scamming people, one thing I'd have tried to do is to rig portable sniffers at public locations with large foot traffic and open WiFi like train stations, airports, etc. Throw em around then filter for interesting stuff. Oh here's some personal info. Oh there's a session token for some app. Let me see what else I can get from that app for that person.

How is DPI a problem if it's encrypted? That would only work if the attacker had installed their CA cert on your client machine, right?

Dpi only works if they install a cert on your phone. Else they can't crack it (in real time) or you would receive HTTPS errors

Yeah, while it is true, lots of VPN companies are grifts just buying VPS's and installing OpenVPN, this "Cyber security expert" puts far too much faith in HTTPS and probably never seen a lecture from the Black Hat conference

I'm not even an expert in this stuff, but with a tool I found online I demonstrated that it was easy to snoop people's passwords on my school's wifi networks back in the day. It took minutes.

most people don't know or use encrypted DNS

But a cybersecurity expert does. That's the point. If you know those things, VPNs become obsolete, for most people. So why not teach people about it, instead of promoting VPNs?

And can you really trust an extremely profit focused company, that is built on user data, more than your local Café? If you're in China, sure, use a VPN, they're the lesser evil. But most spots don't have the resources or expertise to analyze and sell or otherwise misuse your logs. VPN companies not only do, most rely on it.

If you're a highly targeted person, it's another story, but in that case your only hope is Tor or a new identity.

I feel bad for her, honestly. She was open about her sexuality and she's conventionally attractive, so now she has all these leering old men on TV slobbering all over her.

Bill Maher practically tried to talk her into bed on his show with his creepy shit about mentoring her.

I didn't know who she was, so I just assumed it was true and that she was just another celebrity sponsored by a VPN company.

She's handling fame better than Chappel Roan.

They need to advertise a legitimate use for their service.

If they don't have a threat from public wifi or other security concerns to remedy, then the only purpose for their service is to bypass region limits and block infringement notices. They would be considered complicit in such infringement.

That their service also hinders efforts to stop pirates needs to be an "unintended" and "unavoidable" side effect.

On public WiFi I just vpn into my home network. The issue with public WiFi is that it can be sniffed by anyone in range since there is generally no encryption.

Although pretty much everything we do is over tls these days, and DoH helps protect against even dns sniffing. There's still at least some risk to working in the clear over a public WiFi network. At least in information gathering, what bank you use, etc.

But, there's no real benefit in using a paid vpn over one you own unless you're downloading illegal content, want to watch another Netflix region, or are in a country with heavy Internet monitoring/filtering.

All ISPs are legally obligated to forward that shit to you. The alerts are not from spectrum, they're just relaying the information.

Right now, copyright owners do not have legal permission to find out who you are directly without a court order. They would only seek that information if they were planning to file a lawsuit.

Media companies know, from the Napster incident, that such actions can backfire stupendously. It's rare that they even bother anymore. I can go into detail on why, but I'll leave it out for brevity.

So they send the notice to your ISP, who is legally obligated to match the information on the notice to the subscriber and forward the notice to you.

For many, this goes to an ISP provided mailbox, which most people ignore the existence of it. Clearly spectrum operates differently.

The notices are from copyright holders who have no idea who you are, and can't determine that information unless they intend to sue you. So those can be, for the most part, ignored.

It's not your ISPs fault that you got those. They couldn't give a shit less about what you do on their service, or what you download. They just want you to pay your bill every month and keep the gravy train rolling.

Not all applications on your computer may be encrypting their packet traffic properly, though. That goes especially for the applications that might be trying to reach out for resources on your local home network (like printers, file shares, and other home servers) as well as DNS requests which are usually still made in the open. I would not recommend eschewing an entire security layer willy-nilly like that. On public Wi-Fi, I would definitely still suggest either a VPN or using your cell phone as a tether or secure hotspot instead if possible.

Yeah, the days of your local coffee shops Wi-Fi being a problem or mostly gone. Not the VPN doesn't have a place anymore though. If you're trying to hide your downloading of ISOs from your ISP it's still a perfectly reasonable method. Or temporarily relocating yourself to another country to make a purchase or watch some streaming content both perfectly reasonable.

Of course some of the streaming providers are getting wise to this.

Or the tld is .mobi

Hailey "Hawk Tuah" Welch is an influencer that gained a lot of popularity from her nickname (the sound of spitting, with HEAVY implications of performing fellacio). She used her platform to voice a very reasonable and intelligent opinion, which surprised a lot of people because her nickname is essentially blowjob queen.

One of her opinions is that it's important to spread cyber security and used her fame to try to educate the public (potentially a fake story from the image? Idk this drama). And some xit-head claiming to be a cyber security expert ate the onion and offered some shitty advice. Proton fact checked them, because there are a ton of fake news stories about her right now.

how do I reboot my computer?

Most VPNs sell themselves on encrypting your traffic to an endpoint that either is in a different locale to get around region locks or to put it out of the grasp of the RIAA so they can’t send your ISP copyright notices.

While remote access to a local network is a good use case for a self-hosted VPN it’s totally unrelated to the use case for commercial VPNs

It's also worth mentioning that the VPN in question, Proton, offers one of the best free tiers of any VPN company.

I tried setting this up, and I can connect to my honeserver, but I've no idea how to access its LAN services. How does it work?

The VPNs you characterise as "shitty" aren't necessarily a bad choice; they're cheaper than the legitimate privacy VPNs. Mullvad is famously 5€ per month, Proton is 4.49€ per month, but NordVPN is 3.09€, Surfshark is 2.19€, and PIA is 1.79€ per month.

If you're really just here to pretend you're in another country (rather than privatemaxing) or hide your torrenting activity from your ISP, the cheaper options can be a perfectly legitimate choice.

https://thatoneprivacysite.xyz/ is a good base for comparisons

I have VPN so I can look at porn.

Who is she?

https://xcancel.com/ProtonVPN you can find it here

Nobody has a Xitter account.

There are some attacks you are vulnerable to on public WiFi that a VPN can help with.

More generally, whoever is transporting your data knows who you are talking to. If you don’t use a VPN, your ISP and whoever owns the router know what websites you are visiting (although they don’t know the specific content). If you use a VPN, your ISP and router know you are using that VPN, but not what websites you are visiting. Now your VPN knows what websites you are visiting, but they still don’t know what the content is.

I hope that helps.

Networking stuff IS my strong suit, and I'm confused about what points most people here, including OP, are trying to make here. Maybe I'm just not awake enough yet.

Wtf proton what? What do people think Proton is saying and what's the WTF part...?

No, the context is that for many years, shady commercial VPNs would sponsor YouTubers and the scripts they were given were full of lies and half truths about the dangers of public WiFi, with the implication being that if you purchase their VPN service they will “protect you”. But the problems these VPN companies were claiming to solve have already been solved by HTTPS and it’s perfectly fine to use public WiFi without a VPN. They are using scare tactics to sell you a product.

What this poster is saying is that they’re disappointed to see this same fear mongering misinformation from Proton, who have an otherwise good reputation for being consumer friendly.

Yes, to a degree. A VPN protects you from an attacker on the same WiFi network as you and that's about it.

Most assaults on your privacy don't happen like that, and for the most part the attacks that do happen like that are stopped by the website using https and proper modern security.
The benefit of the VPN is that it puts some of that protection under your control, but only as far as your VPN provider.

A VPN is about as much protection from most cyber attacks as a gun is.

They're not a security tool, they're a networking tool. They let you do some network stuff securely, and done correctly they can protect from some things, but the point of them is "this looks like a small, simple LAN, but it's not".

It's much easier to package and sell network tools than security tools, and they're much more accepted by users, since security tools have a tendency to say "no" a lot, particularly when you might be doing something dumb,and users hate being told no, particularly when they're doing something dumb.

Just free, unregulated market shenanigans.

Maybe from a security perspective but in terms of privacy, no. SNI can still be read, and just because DNS isn’t plaintext doesn’t mean it’s not possible to see which servers you’re talking to. And like others have said, there’s still a lot happening in plaintext at the OS and/or application level.