0

Please excuse the lack of details, you can understand why. I have a friend in a foreign country who is certain that he is a surveillance target of his local government. Other people he knows in his same category have already had their internet connections spied on, and seen contents of their emails leaked. He refuses to use his local ISP because the government runs it, so he uses another means of internet but which is very unreliable.

He really would like to use a landline ISP for it's stability, but knows he can't trust it. I thought of setting him up with a serious firewall (like pfSense) with a permanent VPN tunnel to a provider that is based outside of his country.

Given these considerations, would this be a safe solution? Or rather if the ISP is compromised, are all bets off?

Improve this question
2
  • you don't need to trust the ISP very much if you use a VPN.
    – dandavis
    Commented Sep 15, 2020 at 21:36
  • @dandavis it's not always that easy
    – Conor Mancone
    Commented Sep 16, 2020 at 1:34

1 Answer 1

Reset to default
1

An encrypted VPN out of country is the classic approach.

Set up correctly, all the ISP will see is that there is an encrypted tunnel to the VPN.

Common VPN errors include:

  • Failing to make sure that all of the DNS traffic moves through the VPN
  • Failing to make sure the connection drops completely with no auto reconnect in the event the VPN is disrupted.
  • Failing to select an appropriately reliable VPN

The stronger and potentially easier solution in many cases is to use Tor. Simply download the TBB (Tor Browser Bundle) and use that for internet traffic.

The ISP can see that Tor is being used, but that's all.

In either case, use a reliable email service.

All of these tools are to protect against outside monitoring and intrusion. None will protect against foolishness such as logging into an identifiable account attributable to your friend and posting or emailing content you don't want attributed.

Improve this answer
3
  • 1
    The trouble is that the ISP will know you are doing these things, and even if they can't see your traffic they can always just block it - which many do
    – Conor Mancone
    Commented Sep 16, 2020 at 1:36
  • @ConorMancone I'd argue that then they fail to meet the definition of an Internet Service Provider. If they are not providing you the service you can't really do anything about that, other than try to evade detection by making your vpn traffic look like an HTTPS communication. Take a look at obfsproxy or similar projects, or use an ssh connection (they are legitimately used by IT professionals and shouldn't be banned).
    – Andrew Morozko
    Commented Sep 16, 2020 at 23:49
  • 1
    @AndrewMorozko please explain these facts to China, Iran, or any other country that has strict views about internet usage :)
    – Conor Mancone
    Commented Sep 17, 2020 at 0:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .