Who sees what?

slinga

I sometimes use a free VPN when I'm overseas.

Are you guys saying that when I use the free VPN say to look at a UK TV channel all the stuff on my computer such as bank details can be seen by my ISP or worse even though I'm not looking at the bank's site??

kwikbreaks

All the VPN service can see is the traffic through it.

If you access a bank site through it they will see that traffic but it should be encoded by the https link you will be running within the VPN tunnel. It's the hypothetical man-in-the-middle attack mentioned above that would let them see data in clear but many bank sites require the use of a time critical code generated by a little card reader they give to users so wouldn't be able to later log in themselves.

While you are watching iPlayer all they see is iPlayer traffic. Unless they are really naughty and inject some code onto your machine. Any VPN doing that will probably get caught out. It's possible to get as paranoid about VPN providers as about "the man".

paddyrg

For background...

http://www.theregister.co.uk/2015/06/10/hola_gets_holes_poked_in_client_lulzsec/

http://www.theregister.co.uk/2015/06/30/worlds_best_vpns_fall_flat_in_security_tests/

kwikbreaks

My reading of those says Hola did get caught doing naughty stuff and even commercial VPNs are a waste of money because the technology is flawed.

Is that what you wanted to point out or have I missed something?

Moneymaker

Nothing is going to protect you if you are doing something really naughty. However, if you simply want to maintain a "low profile", you can think along these lines:

Firstly, have a completely separate computer for your nefarious activities. Create on it a false identity like "John Smith" with a real or plausible address, phone number, etc. Nothing traceable to you or your family. Set up a Google account in that name and link it to a Yahoo! account, YouTube, Hotmail, etc. Setting up the initial email address could be tricky because it will be traceable to you. I'd suggest buying a domain name, setting up the email server to establish an identity then drop the domain after a year so, hopefully, someone else picks it up. (I'm sure there must be an easier way.)

To establish "John Smith" as a real identity, make occasional posts on the various sites (Facebook, Google+, YouTube, Twitter, Quora, Pintrest, etc.) and send emails to people you don't know personally.

Don't put anything personal on this computer and don't refer to anything personal in your posts.

By flooding the internet with your false identity, you dilute your real one.