WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:02.600
"--but her achievements were never recognised..."

2
00:00:02.600 --> 00:00:04.060
...in her lifetime.

3
00:00:04.070 --> 00:00:07.950
In 1942, penniless and forgotten,
she died of polio.

4
00:00:07.950 --> 00:00:10.200
She couldn't protect herself from viruses,

5
00:00:10.200 --> 00:00:13.610
but you can protect your computer
by using a VPN.

6
00:00:13.610 --> 00:00:18.120
Okay, look, I just want to say,
I do not want to start drama with

7
00:00:18.120 --> 00:00:21.490
people who take sponsorships from VPN companies.

8
00:00:21.490 --> 00:00:25.460
With a VPN, all the data you send and receive
goes through an encrypted tunnel,

9
00:00:25.460 --> 00:00:26.780
so no-one can see it.

10
00:00:26.780 --> 00:00:28.000
Without a VPN,

11
00:00:28.000 --> 00:00:30.960
every time you connect to free wifi
in a hotel or a cafe,

12
00:00:30.960 --> 00:00:33.240
you're risking people stealing your passwords,

13
00:00:33.240 --> 00:00:35.560
your banking details,
and your private data.

14
00:00:35.560 --> 00:00:36.940
That's not true.

15
00:00:36.940 --> 00:00:40.600
You’ve probably seen the adverts at the
end of every educational channel’s videos,

16
00:00:40.600 --> 00:00:41.560
and look,

17
00:00:41.560 --> 00:00:44.780
it's just that I do this sort of
computer security stuff,

18
00:00:44.780 --> 00:00:47.470
I am supposed to know about it
and understand it.

19
00:00:47.470 --> 00:00:50.280
Like, if I took a sponsorship
from a boat manufacturer

20
00:00:50.280 --> 00:00:53.829
and then it turned out the boats sank,
that would suck,

21
00:00:53.829 --> 00:00:55.809
but I'm not expected to know about boats.

22
00:00:55.809 --> 00:00:59.520
I am expected to know about VPNs,
Virtual Private Networks.

23
00:00:59.520 --> 00:01:04.220
And some of the claims that VPN adverts make
are wrong.

24
00:01:04.220 --> 00:01:07.850
Password-stealing over wifi was a serious
threat, a few years ago.

25
00:01:07.850 --> 00:01:09.880
Someone could run an ARP spoofing attack,

26
00:01:09.880 --> 00:01:12.430
make their computer
pretend to be the network hub,

27
00:01:12.430 --> 00:01:16.230
and steal every plain-text password that went
through that wifi network.

28
00:01:16.230 --> 00:01:18.869
It required very little technical knowledge.

29
00:01:18.869 --> 00:01:23.220
Or they could compromise the hub itself and
look at all the traffic that was going through it.

30
00:01:23.220 --> 00:01:27.220
But you know what else sends data through
an encrypted tunnel?

31
00:01:27.220 --> 00:01:29.360
Every single web site with a
padlock in the browser,

32
00:01:29.360 --> 00:01:33.480
every iPhone app since 2016,
every Android app since 2018.

33
00:01:33.490 --> 00:01:38.939
Anything that sends any sort of personal data
now uses a trusted encrypted tunnel, HTTPS,

34
00:01:38.939 --> 00:01:40.119
that padlock,

35
00:01:40.119 --> 00:01:43.340
and unless you’re using web sites or apps
from the past,

36
00:01:43.340 --> 00:01:46.729
if anyone tries to intercept your data,
it won't work.

37
00:01:46.729 --> 00:01:49.820
Now, people on the network can see what sites
you're connecting to,

38
00:01:49.820 --> 00:01:51.909
so, just the name of your bank,

39
00:01:51.909 --> 00:01:54.760
and they could see the contents
of dated web sites,

40
00:01:54.760 --> 00:01:57.150
the ones where the browser now shows "Not
Secure".

41
00:01:57.150 --> 00:01:58.270
But that's all.

42
00:01:58.270 --> 00:02:00.360
No passwords, no bank details.

43
00:02:00.360 --> 00:02:02.560
Those attacks don't work any more.

44
00:02:02.560 --> 00:02:05.680
One VPN company even had their advert banned
by the UK regulator

45
00:02:05.680 --> 00:02:07.750
because of those misleading claims.

46
00:02:07.750 --> 00:02:11.760
VPNs use military grade encryption to keep
your data safe.

47
00:02:11.760 --> 00:02:14.160
Military-grade encryption means "AES",

48
00:02:14.170 --> 00:02:17.280
which is the same encryption that's baked
into every web browser and app.

49
00:02:17.280 --> 00:02:20.489
You're using military-grade encryption to
watch this video.

50
00:02:20.489 --> 00:02:23.360
The claim’s not wrong,
it's just not special either.

51
00:02:23.360 --> 00:02:28.360
Plus, a VPN stops your internet service provider
spying on what you're doing online.

52
00:02:28.360 --> 00:02:30.660
Now, that is true, to an extent.

53
00:02:30.660 --> 00:02:31.920
Yes, without a VPN,

54
00:02:31.930 --> 00:02:33.800
your internet service provider, your ISP,

55
00:02:33.800 --> 00:02:36.490
can see what domain names
you've been connecting to.

56
00:02:36.490 --> 00:02:39.640
There can be very good reasons to hide those.

57
00:02:39.640 --> 00:02:42.780
Your country may allow ISPs to sell that data
to advertisers,

58
00:02:42.790 --> 00:02:44.730
or to build up a profile on you.

59
00:02:44.730 --> 00:02:47.480
Maybe you are studying at a fundamentalist
Christian college

60
00:02:47.480 --> 00:02:51.480
and don't want university administrators knowing
that you're questioning your faith,

61
00:02:51.480 --> 00:02:53.590
or questioning your sexuality.

62
00:02:53.590 --> 00:02:57.660
Some ISPs also prioritise some apps, sites
and traffic types over others,

63
00:02:57.660 --> 00:03:00.370
and a VPN means that they can’t do that.

64
00:03:00.370 --> 00:03:02.660
Or maybe your government is planning to introduce

65
00:03:02.660 --> 00:03:05.640
an ill-advised and often-delayed
block on adult content

66
00:03:05.640 --> 00:03:07.300
and you want to work around it.

67
00:03:07.300 --> 00:03:08.630
That's all reasonable.

68
00:03:08.630 --> 00:03:10.400
Metadata does give away a lot of information,

69
00:03:10.400 --> 00:03:13.470
and wanting to keep that private
is a fair idea.

70
00:03:13.470 --> 00:03:15.910
But that's not what a lot of the VPN ads are
implying,

71
00:03:15.910 --> 00:03:19.360
they're implying that your ISP can read the
content of your messages.

72
00:03:19.360 --> 00:03:21.440
And again, if there's a padlock in the browser,

73
00:03:21.440 --> 00:03:24.480
or if you’re using a modern app,
that's not true.

74
00:03:24.480 --> 00:03:28.920
And if you do use a VPN, all you're doing
is changing who can see that metadata.

75
00:03:28.920 --> 00:03:31.349
Your ISP can't any more,
but the VPN company can

76
00:03:31.349 --> 00:03:33.230
because at their end of the tunnel,

77
00:03:33.230 --> 00:03:37.269
they have to look at that metadata
to work out where to send your traffic to.

78
00:03:37.269 --> 00:03:38.709
But maybe that's worth it for you.

79
00:03:38.709 --> 00:03:39.709
And besides...

80
00:03:39.709 --> 00:03:42.930
A good VPN doesn’t keep any logs of who
you're talking to.

81
00:03:42.930 --> 00:03:47.183
It is a brave move for a VPN not to keep any
logs, given that if that's true,

82
00:03:47.183 --> 00:03:50.629
their service will inevitably be used for
a lot of really awful illegal stuff.

83
00:03:50.629 --> 00:03:54.269
Some do claim that, some have even brought
in independent auditors to try and prove

84
00:03:54.269 --> 00:03:55.530
that they don't keep any logs.

85
00:03:55.530 --> 00:03:57.890
And you can’t have 100% certainty of that,

86
00:03:57.890 --> 00:04:00.540
but they have got as close
as you reasonably can.

87
00:04:00.540 --> 00:04:05.000
So if you're planning an assassination and
your priority is absolutely covering your tracks,

88
00:04:05.000 --> 00:04:07.420
then sure, I guess a VPN might be worth it.

89
00:04:07.420 --> 00:04:12.500
But to customers, a VPN that
doesn't keep logs is indistinguishable

90
00:04:12.500 --> 00:04:14.840
from one that's been compromised by hackers,

91
00:04:14.840 --> 00:04:19.000
or that's been given a little government
black box that they don't understand

92
00:04:19.000 --> 00:04:22.319
but they have to plug into their systems and
not tell anyone about.

93
00:04:22.319 --> 00:04:26.139
Or from a VPN where a single employee has
been bribed

94
00:04:26.139 --> 00:04:29.300
and has started logging things for just a
few accounts.

95
00:04:29.300 --> 00:04:33.440
To be clear, I do not think any of the
VPN services are a front for the FBI,

96
00:04:33.440 --> 00:04:38.160
or Russian mobsters, or some state-sponsored
plausibly-deniable intelligence operation.

97
00:04:38.169 --> 00:04:43.000
Genuinely, they are almost certainly not,
and I do not want to scaremonger.

98
00:04:43.000 --> 00:04:48.309
Any company that was found to be logging stuff
without permission would be bankrupt soon after,

99
00:04:48.309 --> 00:04:50.379
it would be a very very bad business decision.

100
00:04:50.379 --> 00:04:55.969
And the enormous amount of money that VPN
companies suddenly have probably comes from

101
00:04:55.969 --> 00:04:57.900
overenthusiastic venture capital firms.

102
00:04:57.900 --> 00:04:59.979
Actually, it almost certainly comes from them.

103
00:04:59.979 --> 00:05:04.560
But if you wanted to see what the most paranoid,
security-conscious people are connecting to,

104
00:05:04.560 --> 00:05:06.620
and you wanted to install software
on their systems

105
00:05:06.620 --> 00:05:09.120
that is designed to read all their network traffic

106
00:05:09.120 --> 00:05:12.580
and then redirect it through
a single choke point,

107
00:05:12.580 --> 00:05:16.920
then setting up a VPN service with a huge
advertising budget would be a great way to do it.

108
00:05:16.920 --> 00:05:20.320
And if you use a VPN, you can connect to streaming
services around the world,

109
00:05:20.330 --> 00:05:21.969
as if you were in those countries!

110
00:05:21.969 --> 00:05:24.139
And that's the real reason a lot of people
use VPNs.

111
00:05:24.139 --> 00:05:27.490
Are you going to China, or somewhere else
that blocks off access to a lot of web sites?

112
00:05:27.490 --> 00:05:28.490
That's a fair reason.

113
00:05:28.490 --> 00:05:30.789
Do you want to watch another country's streaming
content,

114
00:05:30.789 --> 00:05:34.729
or download just enormous amounts of BitTorrents
without being tracked?

115
00:05:34.729 --> 00:05:38.469
Those are valid uses of VPNs, even if they
are legally questionable.

116
00:05:38.469 --> 00:05:41.770
It's just that "great for pirating stuff and
getting around the law"

117
00:05:41.770 --> 00:05:44.089
is the sort of marketing that gets a company
in trouble,

118
00:05:44.089 --> 00:05:48.120
and "we stop bad people stealing your passwords"
is the sort of marketing

119
00:05:48.120 --> 00:05:52.020
that scares people into buying something that
they might not need.

120
00:05:52.020 --> 00:05:56.300
So, with that in mind, I wrote a more honest
advert for VPN services,

121
00:05:56.300 --> 00:06:00.539
and I found a company that was willing to
sponsor the video.

122
00:06:00.539 --> 00:06:02.669
Unfortunately, they kept asking for changes,

123
00:06:02.669 --> 00:06:05.620
and we disagreed on those,
so at the last minute,

124
00:06:05.620 --> 00:06:07.520
I have had to blank their name out.

125
00:06:08.800 --> 00:06:11.300
Do you want your hide your sexuality from
your college administrators?

126
00:06:11.300 --> 00:06:15.660
Do you want to download huge amounts of pirated
content with an extremely low,

127
00:06:15.660 --> 00:06:18.249
but not zero, risk of being found out?

128
00:06:18.249 --> 00:06:21.699
Are you planning an assassination and want
to hide your tracks?

129
00:06:21.699 --> 00:06:23.869
Then you need [bleep] VPN,

130
00:06:23.869 --> 00:06:26.610
the best choice for gay people, pirates, assassins,

131
00:06:26.610 --> 00:06:28.830
and gay pirate assassins.

132
00:06:28.830 --> 00:06:33.279
[bleep] VPN is a tool that can be used both
for good and evil,

133
00:06:33.279 --> 00:06:36.399
and it's extremely unlikely to be a front
for the FBI.

134
00:06:36.399 --> 00:06:37.429
But you should know:

135
00:06:37.429 --> 00:06:41.189
unless you are being personally targeted by
well-funded hackers using exploits that the

136
00:06:41.189 --> 00:06:43.050
world doesn’t know about yet,

137
00:06:43.050 --> 00:06:46.879
it doesn't make your passwords and
financial data any more safe.

138
00:06:46.879 --> 00:06:48.599
They’re already pretty safe.

139
00:06:48.600 --> 00:06:53.300
And if you are being targeted by hackers like
that, you have bigger problems.

140
00:06:53.300 --> 00:06:55.420
But if you want to hide your identity,

141
00:06:55.429 --> 00:06:56.919
pretend you’re in another country,

142
00:06:56.919 --> 00:06:58.900
or make sure your connection is secure as
you work out the

143
00:06:58.900 --> 00:07:00.620
lethal doses of particular chemicals,

144
00:07:00.620 --> 00:07:04.420
then go to [bleep].com/honest for [bleep]

145
00:07:05.600 --> 00:07:08.320
That was a lot of money left on the table.

146
00:07:08.320 --> 00:07:09.860
Lot of money.