100

I am moving to Germany, and in the contract I signed I had to accept that all my data traffic can/will be checked by the apartment owner. The contract states:

Flatrate, aber hinter 30GB Tarif priorisiert, aslo etwas langsamer

Ja ich weiss, daß meine Daten überprüft werden.

Which translates to:

That after using an amount of 30GB data, the speed can/will be slower.

And the critical:

Yes, I know that my data is checked/investigated

Later in the contract one can read the following

Im Rahmen der gesetzlichen Bestimmungen (Anti-Terror-Gesetze und TKG) kann das Protokollieren der Daten erfolgen. Im Mietpreis ist eine FLAT-Rate enthalten, dabei können jedoch einzelne Ports gesperrt sein oder bestimmte Verbindungen mittels Traffic-Shapping bevorzugt oder verlangsamt werden. Bestimmte Geschwindigkeiten werden nicht zugesichert. Die Verbindung funktioniert nur, wenn DHCP eingeschaltet ist (z.B. bei Windows IP-adresse automatisch beziehen).

Which translates to:

In accordance with statutory requirements (anti-terror laws and TKG) to log the data can take place. a FLAT rate is in the rental amount, but it can individual ports to be blocked or certain compounds by traffic Shapping preferred or slowed. Certain speeds are not guaranteed. The connection works only if DHCP is enabled (eg automatically when Windows IP address relate).

Since I really needed this apartment I was forced to accept this. But not anywhere does the contract says that I can not make it difficult for the landlord to check my traffic.

So my question is: would it be possible to make it difficult for the person watching my data traffic to see what I am actually doing on the internet? As you probably can tell, I do not know alot in this field.

Internet is provided via LAN, but I am going to use a D-link dir-635 router. And I am running Linux Mint.

I am not familiar with the prices of 4g/LTE in Germany, so I can not say if that is an option yet. I do not think I can get my own internet installed, and since the internet is provided in the rent (whether I want it to or not) it feels redundant to install a personal internet.

Community
  • 1
Olba12
  • 1,069
  • 2
  • 8
  • 13
  • Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/45485/discussion-on-question-by-olba12-landlord-will-be-watching-my-data-traffic-as-m). – Rory Alsop Sep 16 '16 at 21:02
  • I would simply rent a VPS, install OpenVPN and use compression. That would cover me and also save data. SOCKS5 proxy is also a way. Opera also has "Turbo", but now it's owned by China - so I would stay away from it. – Apache Oct 01 '16 at 12:00
  • 1
    This sounds like a language issue. The original text "daß meine Daten überprüft werden" doesn't sound at all like data traffic monitoring, but more like checking that the information you provided is valid. Are you sure you got the right context? – mastov Nov 29 '16 at 18:20
  • Data privacy is quite strict in Germany, and your landlord is certainly not allowed to snoop on you. But maybe he is force by the authorities to get consent / make you aware of the mentioned laws? – Marcel May 30 '22 at 06:19

12 Answers12

68

FINAL (hopefully) UPDATE: Well after all the very interesting and valuable discussion, it seems to me as though initial thoughts were correct. From the updated question, I would say that the restrictions are pretty standard for Germany.

My recommendation is that you ignore the noise and the concerns and simply make use of the service. Unless you have some very specific security needs that you haven't shared, using HTTPS wherever possible (which is best practice anyway) is sufficient.

In any case, the other options discussed would all add overheads to your traffic which would use up your 30GB even sooner and slow things down.

There are several things you can do. Provided that the terms and conditions of use are OK with them.

You don't say what country you are in but you might want to get the terms of use checked by a lawyer since some terms may not be legally permissible anyway.

Here are four of the main ways you can protect your Internet traffic from the prying intermediate.

  1. Make sure you always only connect to HTTPS sites

    When you use HTTPS sites, the traffic is encrypted between you and the endpoint. Your landlords infrastructure will not be able to do more than examine the destination IP address, port and DNS. In particular, things like banking and health sites will remain secure.

  2. Use a VPN

    A VPN in this case is a 3rd party service that encrypts ALL of the traffic (not just web traffic as in 1) between your machine and the VPN host. This prevents any inspection of the traffic at all and it will appear as though you only talk to the VPN destination.

    Unfortunately, it is possible that common VPN end-points might be blocked or even a smart security system used that will dynamically identify VPN traffic and ban it. Check the terms of use from your landlord carefully.

  3. TOR

    TOR is a way to obfuscate connections across the Internet and is often associated with "the dark web". However, it has legitimate uses as well. Unfortunately, it can add quite an overhead to traffic and may be unacceptably slow. Typically TOR will be used for web browsing, other network traffic would not be affected.

  4. Use the Mobile network

    If you are fortunate enough to live in an area with a) good (4G/LTE) mobile coverage and b) an affordable data tariff. Then using a 4G/LTE mobile router may be an option. You can get some staggeringly good data rates.

    Don't expect to be free of restrictions though. Many tariffs don't allow device sharing, you'll need a special tariff for mobile data. You might not be allowed to use all services (like VPN's) and you are more likely to have national-level restrictions applied such as the UK's national "firewall".

It goes without saying (so I will say it anyway!) that you should ensure that you are staying within the letter of the laws of your locality & the legitimate terms of use of the landlords network. However, none of the above are illegal in most countries (well in most Western countries anyway) as long as you are not using them to do illegal activities. TOR and VPN's may possibly be illegal or at least get you unwelcome attention in certain countries.

UPDATE: Without question, the most security would be provided by a VPN.

However, that will only be useful if the landlords network allows VPN traffic. In addition, VPN's also carry an overhead so things like real-time traffic (Skype voice/video for example) and online gaming would be impacted quite significantly.

In addition, VPN's will normally come at a cost though there are some discount codes around that might help.

It is possible to set up your own VPN if you have a server on the Internet to run it on. Most VPS hosts wont allow it but some will as long as you keep it private.

The real question is - do you really need to be bothered? That's why I mentioned HTTPS first. Since this protects your information to sites and since all decent online services already use HTTPS, you might find that this is a storm in a teacup.

UPDATE 2: As some others have pointed out. There are many flavours of VPN. A commercial service will be the easiest to consume but you need to do your homework to find the best for your region. Commercial VPN's can also be relatively easily blocked both by end point and by traffic inspection. Some VPN's require specific ports to be open on the network and these might not be available. Test before you buy. In general, those offering SSL-based or OpenVPN-based are likely to offer more options and be easier to get through any blocks.

Another form of VPN is to use an SSH client such as PUTTY (for Windows) connected to an SSH server (perhaps on your own or a friends VPS). You can throw in a local SOCKS proxy client and then you will have a very configurable private VPN service. Not especially easy to set up though if you don't understand the terminology. Note that many VPS services ban their use for even private VPNs.

Another thing to note is that there are several ways for security infrastructure to spot VPN traffic and therefore block it. Known end points for commercial services and known ports for VPN types are the easiest but it is possible to examine traffic patterns and work out that even apparent SSL traffic (e.g. if using port 443 for VPN) isn't actually.

Julian Knight
  • 7,092
  • 17
  • 23
  • 23
    In before the landlord shoves our asker an SSL certificate to install... – John Dvorak Sep 11 '16 at 21:50
  • 18
    If you are asked to do that, respectfully decline and possibly point them to the local laws on the interception of communications. I didn't include that in my answer as it adds significant complexity and is (should be?) an unlikely scenario. – Julian Knight Sep 11 '16 at 22:03
  • 62
    You should add "beware of any alarms about SSL certificate" if OP have any it coulb be the owner using his own SSL certificate to watch traffic. – Walfrat Sep 12 '16 at 06:43
  • 10
    Correct. Any unusual certificate warnings, especially on well known sites are a clear indication that someone is trying a Man-in-The-Middle attack. In that case, unless you've agreed to that, report them to local law enforcement as it is almost certainly illegal. – Julian Knight Sep 12 '16 at 07:41
  • 1
    You can use a https fingerprint service like https://www.grc.com/fingerprints.htm to check if the certificate has been spoofed. – David Glickman Sep 12 '16 at 08:39
  • 2
    It's worth noting without a VPN the landlord can still see _where_ the OP is visiting (dns, sni). Depending on why the landlord wants to do this (morality policing?) https may not be enough to do what the OP wants. – Mark Henderson Sep 12 '16 at 10:45
  • 6
    @MarkHenderson maybe the landlord just wants to make sure that he won't get his connection shut down for any filesharing, etc. There's no reason to assume that his motives are to vet content any further than that. – JamesRyan Sep 12 '16 at 11:07
  • 1
    @JamesRyan That is plausible, but without further information from the OP we've no way to know either way, hence just wanting to make sure that the information is there so that the OP can make their own informed decision. – Mark Henderson Sep 12 '16 at 11:08
  • Tor can handles any TCP and DNS, not only for web browsing. It also doesn't add much overhead. – v7d8dpo4 Sep 12 '16 at 12:34
  • 1
    Besides configuring every device to use VPN or proxy, it is also possible to use a spare computer to route all the traffic. – v7d8dpo4 Sep 12 '16 at 12:41
  • 2
    Some Routers also allow to tunnel all traffic over VPN. This uses less electricity than a spare PC – Josef Sep 12 '16 at 13:01
  • Well I was concerned with webbrowsing and also downloading torrents, but I guess torrent downloading breaks the rules on this forum. So yes, I believe that I have shared my security needs. – Olba12 Sep 12 '16 at 22:44
  • Everyone is assuming it is the landlord that is doing the logging. The landlord may just be covering their obligations. SSL can't be relied upon. – mckenzm Sep 13 '16 at 03:08
  • 1
    @Olba12: Torrents in themselves are absolutely fine though it may attract attention. What you download is, of course, another matter. – Julian Knight Sep 13 '16 at 05:44
  • 4
    JamesRyan is probably right about the landlord's intentions. Germany used to have a law that said that the owner of a network connection is responsible for any law breaches made over that connection unless he can prove that he didn't do it. So when people shared their connection, they often included some basic logging (like who connected to which IPs and when) in order to be able to proove that it wasn't them. This law has been changed only this summer and many landlords might not know about the change, yet. See Ariser's answer for more details on this. – Sumyrda - remember Monica Sep 13 '16 at 07:03
  • 1
    *"When you use HTTPS sites, the traffic is encrypted between you and the endpoint. Your landlords infrastructure will not be able to do more than examine the destination IP address, port and DNS."* HTTPS requests still contains the FQDN (necessary for several servers on the same IP), so the landlord will also examine the domain (name). The DNS request is an additional request. Either way, I'd recommend "HTTPSEverywhere", which is available for both Firefox and Chrome. – Zeta Sep 14 '16 at 06:05
  • Using VPN can actually improve the quality of streaming/gaming. If you connect to one of the big VPN providers with worldwide networks, your packages may become routed more efficiently. Additionally, VPN can provide traffic compression which varies depending on what exactly you do. – Barafu Albino Sep 15 '16 at 20:01
  • I found that you can add "safervpn" to chrome, I'll figure that will be enough for me. I has good ratings on the chrome store and many downloads, so It should be legit. – Olba12 Sep 15 '16 at 23:47
  • Services like purevpn offer multiple protocols so you can connect over OpenVPN, L2TP/IPSec, PPTP, SSTP, and IKEv2 blocking all of these ports would break the internet so they wont. TOR is ok but you place your trust in the exit node. – Chris McKee Sep 16 '16 at 13:10
  • I'd also recommend dnscrypt. – Tanath Sep 16 '16 at 17:24
  • @ChrisMcKee: Of course "they" can block those ports. Some however can be configured to use common ports such as 443 - those would require far more processing to block (to spot patterns different to the norm) so generally aren't. – Julian Knight Sep 16 '16 at 20:17
46

I don't want to write about the technical details because I think the options have been clearly defined by the other posts. But I'd like to contribute some thoughts on the legal stuff.

Disclaimer: I'm not a lawyer, please understand my following words as a translation of readily available texts on German laws. Before taking real actions, I strongly recommend to consult an experienced lawyer

In my opinion, the attempt of your landlord getting a blank cheque for reading your traffic is illegal. I'll explain why.

Germany has a very strict law for the protection of private data (Bundesdatenschutzgesetz aka BDSG). It prohibits not only the collection of any data without consent of the concerned persons it also shows hard and reasonable limits even if consent was given.

In detail: §3a demands "Datensparsamkeit", which translates into austerity in collection of any data. This means, anybody wanting to collect private data related to identifiable persons has to restrict this attempt to the minimum amount necessary to fulfil either legal necessities or duties from a contract with the concerned people.

Neither of these applies here. There are no legal obligations for your landlord to store or evaluate data. TKÜ (Telekommunikationsüberwachung = telecom intercept) was always in duty of the public authorities in Germany. To refer to the TKG to insiinuate anything different is a blatant lie.

The so called Vorratsdatenspeicherung (VDS, an obligation for ISPs to store connection related data for police investigations) was declared void by the highest court in Germany twice. A modified version passing legislation is still far away. Anyways this law only applies to ISPs and I doubt your landlord can be deemed as an ISP. Furthermore the VDS would only enforce the storage of IP-Addresses and connection times, never any content.

The remaining, rather difficult issue could have been the so called "Störerhaftung" which made everyone who gives other people access to the internet over his own accont liable for any damage caused by the one given access. But this specimen of case law has been toppled by the German Bundestag on 6/1/2016. Still even if liability for giving access was still in effect it would empower your landlord only to store IP addresses and connection times.

I'd suggest the following: Sign the contract and send the contract information to the responsible federal office. (Bundesdatenschutzbeauftragter / Landesdatenschutzbeauftragter) Let the relevant authorities crack down on this moron of a landlord.

In Germany it can be considered "contra bonos mores" to chisel your basic rights out of you in way like this. Having signed such a contract does not sanctionise the unlawful parts. They are simply spoken void. You can even get a temporary restraining order at a court prohibiting your landlord from performing any surveillance tasks on your connection. Prior to this you can file a reminder, but you may need an lawyer with certain expertise in this field.

addendum

Some of you may think, "why is Ariser so rabid about a landlord who is sooo nice that it lets you use its internet uplink. It's just a contract, they can write in it whatever they like, and who cares what they can see when logging?".

Because it's basically the same as saying: "To prevent our tenants from throwing used condoms, rags and hygiene products into the toilet, they agree we have a camera installed in the bowl". You all would easily refuse to sign a contract not because anybody has a problem with the prevention of clogged sewers, but because noone wants to be stared on the buttocks or genitals when washing hands. Think of it how often we have our pants down in our digital conversation figuratively. And in this case the landlord even had a personal interest because plumbers are expensive. But we won't let him watch either. In the origignal case there's nothing to bother for the landlord. The content of the transmission is absolutely of no concern for the landlord.

Community
  • 1
Ariser
  • 591
  • 3
  • 10
  • 9
    German law is crazy about information security, and not in the good sense. German security researchers move to Austria to publish their papers since it is forbidden to publish working exploits in Germany (not even under responsible disclosure) – grochmal Sep 12 '16 at 16:22
  • 1
    Once again, the contract does not specify the landlord will be doing the logging. He may just be covering his end so you cannot ask for a rent reduction when shaping eventually occurs, or claiming to be surprised when you are eventually arrested for whatever.....In other words they cannot shelter you if you are an enemy of the state. SSL is not a real barrier for the state, either. – mckenzm Sep 13 '16 at 03:14
  • 6
    @mckenzm So when the ll does no logging, why does he claim the right to do it then? Regardless how often the contrary is written: In Germany a landlord is not the deputy of the police. And he cannot claim to have the right to break the law just to be on the safe side. It is not his duty to find out, whether some tenant is an "enemy of the state" by using unlawful terms in a contract or spying at him. These are methods used by dictatorships as we had one next to us until 1989. – Ariser Sep 13 '16 at 06:26
  • @Ariser He doesn't claim the right to do it. The contract uses a passive construction: "logging can take place", but it doesn't mention by whom; with the clause that it only takes place in accordance with anti-terror-laws and Telekommunikationsgesetz. You can rest assured that if the landlord spies on him, it is not in accordance with these laws, because these laws allow law enforcement (only when ordered by a judge) and intelligence services (BfV and BND) to intercept these messages. Wait, there's one loophole: if the landlord is an intelligence officer... – Alexander Sep 13 '16 at 09:37
  • 4
    @Alexander I've read many TOS, but none of them contained such a stupid statement. Think of walking into a restaurant and the waiter tells you: "When you enter here you know, you may be hit on the head... " omitting the part: "... if the hooligans (which may come later) start a brawl and the police is cleaning the mess up eventually". Everybody would think, the waiter is threatening you with immediate danger resulting from actions originated by staff or guests directly not something which could take place everywhere else with equal probability. That's called common sense. – Ariser Sep 13 '16 at 09:47
  • 1
    Erm... https://www.tagesschau.de/inland/vorratsdatenspeicherung-149.html Just saying... VDS declared void is a tidbit optimistic on your part. The Verfassungsgericht has stated that they will certainly not declare it void according to the expedited proceedings filed. A final decision is pending, but this may take years. Until then, VDS is a very real everyday truth. Besides, we have had VDS since Schröder... only now it's _solidly legal_ for the first time. – Damon Sep 13 '16 at 13:57
  • 1
    @Damon: thx for the correction. Nevertheless does the VDS not empower a scruffy landlord to do packet inspection or connection tracking. – Ariser Sep 13 '16 at 14:12
  • 1
    @Ariser: That's right, on the contrary. It's a very clear violation of aritcle 10 of the GG, and arguably a violation of article 2.1 as well (assuming the OP is not known to use the internet for criminal activity). In particular since government sees explicitly "no difference" between online activity and phone calls as recently stated in Maizière's action plan. That puts them on one level for the new planned anti-terror actionism to come, but it consequentially it also explicitly puts them on one level for Art. 10GG (necessary logical conclusion). – Damon Sep 13 '16 at 16:30
  • "The landlord retains the right to open and read your mail, and listen to your telephone calls." – alexw Sep 14 '16 at 03:03
  • @alexw good analogy. – Ariser Sep 14 '16 at 06:10
  • @grochmal: Do you have a trustworthy reference for your claim? – countermode Sep 14 '16 at 12:49
  • @Ariser: _the attempt of your landlord getting a blank cheque for reading your traffic_ - the LL isn't attempting to get a blank cheque, he is acting as an ISP und thus is obliged to follow the according regulations. All that has happened is that he bothered to inform the prospective tenants about this. – countermode Sep 14 '16 at 12:52
  • 1
    @countermode: I doubt, that a real estate owner can be counted as ISP. In Germany there are currently roughly 1000 registered ISPs which have to store connection data. And if the real estate owner counts as ISP why doesn't he write "your connection data will be stored according EgStPO §12"? The sentence in the contract is so moronic, the RE owner seems to have no clue of the VDS at all. So one has to assume the RE owner wants to inspect the transmitted data on his own whim. If not he should have written, what he meant! – Ariser Sep 14 '16 at 13:44
  • Your assumption doesn't make sense at all and if the landlord really did this, this would illegal and subject to complains at the Landesdatenschutzbeauftragter (at the very least). And yes, anyone providing connectivity to a broader audience falls under the definition of an ISP. For instance, any employer that lets the employees surf privately using enterprise resources counts as an ISP. – countermode Sep 14 '16 at 14:13
  • @countermode - Eyup, Tobias Klein argues in his book [Bug Hunter's Diary](https://www.nostarch.com/bughunter) that he cannot publish full (working) exploits due to German law. He can only provide a way to get the instruction pointer, and stops there. – grochmal Sep 14 '16 at 14:24
  • @grochmal: I won't buy the book just to check, but the author probably overrated the whole thing. The book is dated 2011, and in 2008 §202c was introduced to the German criminal code which caused some uproar in the community as it made the use of hacking tools a criminal act. However, things are not as bad as they seemed, and by today there is solid consensus that security research or pentesting are legal as long as their purpose is not purely and obviously destructive. – countermode Sep 14 '16 at 14:37
  • @countermode that's exactly what I wrote in my answer. The statement is formulated so universally with no relation to legal issues, that noone can put it into relation to the VDS. You are basically saying: "It can't be concerning other things than VDS otherwise it was illegal". But that's exactly what I think. Read that sentence again. BTW: All sources state, that a company has no obligation to collect connection data from its employees, because the internal access is not deemed "public". Please give some references, if you know better. – Ariser Sep 14 '16 at 14:55
  • 2
    @countermode If the landord (as well as employers) count as ISPs, they would by largely exempted from Störerhaftung, which would somewha contradict the very principle of Störerhaftung. And if th elandlord considers himself an ISP with the *require,emt* to perform VDS, I'd ask if he really has the *equipment* to do so in a way suitable for the law (techical and physical security of the storage, access-control, off-site backups, ...) – Hagen von Eitzen Sep 14 '16 at 19:50
  • Also see the recent case of McFadden vs Sony, which went all the way oup to the European Court ([ECLI:EU:C:2016:689](http://curia.europa.eu/juris/document/document.jsf?text=&docid=183363&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=725971)). McFadden (a store) was operating a free-access WiFi-network for use by its customers and was held liable for a copyright infringement made through that network. The landlord may want to prevent similar charges by actively monitoring. – SQB Sep 20 '16 at 08:15
22

HTTPS, TOR and VPN have all been mentioned already. Yet, there another two viable solutions: proxying and plain tunneling (non-VPN tunneling).

Proxying

A proxy is just a server that you connect that will relay your connection to the actual destination. If you use a proxy which allows for the traffic between the proxy and you to be under TLS (e.g. HTTPS) then from the perspective of your landlord you are always connecting to the same server.

Caveat: A TLS proxy is (somewhat) vulnerable to sslstrip since you are always HTTPS connecting to the same place. And a proxy without TLS is useless to hide traffic.

Plain tunneling

This is my favourite. Assuming that you have a server (or just a simple VPS) running outside of the premises of your landlord (e.g. in some data center) you can SSH tunnel traffic between your machine and that server. This has two advantages over VPN:

  • No one can complain that you're connecting through SSH to your server.
  • Does not require anything special from the router on the way between you and your server.

Assuming *nix OSes, you can do a simple:

ssh -Y user@server firefox

And browse the internet (or use a chat program, or whatever) whilst your landlord can only see SSH traffic.

For better security it is wise to perform SSH login with RSA keys (instead of typing the password each time), and keep a note of the fingerprint in the known_hosts. No sslstrip problems because you are not using CAs.

Caveat: This may be slightly expensive in some parts of the world (VPSs are expensive in Asia and Oceania, and you need the server to be close to you to have reasonable speed); and this is slightly slower than all other options but TOR, since you are sending X11 updates over the network instead of plain HTTP(S).

Extra notes

  • Both of these possibilities are pretty similar. You are connecting to a single point which is relaying the traffic. You can even combine them (for a speed increase) by running your own proxy on your VPS.

  • A simple SOCKS proxy can be made with ssh -D <port> (sshd on the server side will act as a SOCKS proxy). This is useful for plain browsing but you need to configure the browser to use the proxy. You will need to configure the proxy settings to localhost and the port used in the ssh -D call. Ask Ubuntu has a great answer about the proxy configuration from a ssh -D call.

  • Remember to configure DNS to go through the proxy. That is often not the default setting (at least it isn't in Firefox). Allowing the DNS to go through the normal network will reveal your browsing habits to your landlord.

Community
  • 1
grochmal
  • 5,677
  • 2
  • 19
  • 30
  • +1 for the ssh option. Dead simple, fast and bulletproof. Though it's probably a good idea to set up Open VPN too. – jorfus Sep 12 '16 at 02:16
  • 2
    You can also use a SSH proxy for the whole internet connection – Antzi Sep 12 '16 at 02:34
  • 1
    @Antzi - That's true, there is `ssh -D`. I'm just not sure if you need to tweak firefox to perform DNS over the SOCKS proxy. (/me starts researching about DNS through SOCKS). – grochmal Sep 12 '16 at 02:46
  • 2
    An SSH VPN is still a VPN! ;) You are pushing local network traffic through an encrypted tunnel and that is the definition of a VPN pretty much. But yes, that is an option. And yes, you would want to have encrypted DNS though DNScrypt would do that for you. I would argue though that an SSH VPN is much harder to set up than buying a 3rd party VPN service and likely slower too if using a cheap VPS. Also many VPS hosts don't allow VPN traffic at all including SSH VPN's. – Julian Knight Sep 12 '16 at 07:37
  • 2
    A huge problem with SSH forwarding is privacy. A VPN's pool of IP addresses is usually shared by many users that are possibly protected by the provider. A server's pool of addresses is probably quite restricted and statically linked to the server: In this case, your landlord might not be able to track you, but everyone else you communicate with would be. – Sebastian Hojas Sep 12 '16 at 10:07
  • @JulianKnight the great advantage of an SSH tunnel is that you can usually easier choose the port you want to bridge the traffic over. You can use common ports like 80, 443 or 993 that will hardly be blocked by the landlord. – Sebastian Hojas Sep 12 '16 at 10:10
  • @SebastianHojas: True. However some 3rd party VPN services can do this too as can OpenVPN. Smart security tools still spot them though even over port 443 so [VPN's can always be blocked](https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffic-an-introduction/) though you need more expensive tools to do it so it is less likely. – Julian Knight Sep 12 '16 at 11:58
  • I like the Plain tunneling, if I have 2 computers, would it be possible to leave one in my home country, and access it via ssh from another country? I guess the answer is yes, but I do not now how to set up "Plain tunneling" on my secondary computer. – Olba12 Sep 12 '16 at 13:01
  • @JulianKnight - OpenVPN uses IPSec by default which may be killed at the network layer. On the other hand it can be configured to use transport layer security but that may depend on the provider (of course it is always important to research VPN providers). – grochmal Sep 12 '16 at 19:51
  • @Olba12 - You certainly can. I admit that my answer is Linux focused, but you're on Linux Mint, right? You could do a port forward (say 22 for sshd) in the router in your home country and connect to a *nix machine in your home. Yet, I'd advise against it: home (ISP) connections have very poor upload speeds and you would suffer horrible lags. VPS connectivity is focused on upload speed therefore will work much better. There is a [similar question to this on U&L](http://unix.stackexchange.com/questions/306015/trick-to-create-restricted-linux-user-i-can-remotely-control-no-matter-where-it) – grochmal Sep 12 '16 at 19:56
  • @grochmal: OpenVPN is configurable to use port 443 and has a config page describing how to hide the VPN traffic. Olba12: As you say, an SSH VPN is OK. You might also look at stunnel. I recommend you **don't** leave port 22 open to the Internet otherwise a good part of the servers bandwidth and logs will be filled with hacking traffic. – Julian Knight Sep 13 '16 at 05:50
15

General

Make sure obfuscating and encrypting your internet traffic isn't illegal where you live.

HTTPS

This is not a solution. Not only because you will have to access websites which aren't secured via SSL but also because your landlord can still see which servers you're connecting to even when HTTPS is used.

Your landlord probably won't take a look at the contents of your internet traffic anyways but will merely look at what servers you connect to. HTTPS doesn't protect you from them doing this. Your landlord can still see which servers you connect to.

TOR

Tor is awesome and your landlord will have no idea which servers you connetc to but there are many websites for which you have to solve captchas all the time if you access them via TOR. This can get annoying, soon. Furthermore, your email provider may prevent you from accessing your emails via TOR.

VPN

This is the solution you're looking for.

Many routers provide tunneling connections to the internet through VPN. You can sign up for a VPN service, some of which don't require you to state personal details and even letting you pay for example in bitcoin. This will typically cost a few euros per month.

Setting this up on your router is the best solution because this makes sure your landlord cannot see the contents of your data transfers. However, they can still see that they're happening, when they're happening, and how much data is transferred. But the cannot read the contents and they cannot figure out which servers you're talking to. From their perspective, you'll always be talking to the VPN service provider.

If your router doesn't support VPN, maybe buy a new one. I got one for 40 € which supports tunneling all traffic through VPN. I got another one for 250 € which doesn't support that.

If your router doesn't support it and you don't want to buy a new one, check for alternative firmware for it.

If even that's not possible, you should use VPN on your computer and your phone. Note that this has to be done for every device of which you intend to obfuscate the internet traffic of and you have to set up VPN again if you reinstall the operating system or install a different one, whereas setting VPN up on your router obfuscates the internet traffic of all your devices so there's less to be done wrong.

Setting VPN up should be very easy on most desktop operating systems. The necessary software is already installed on most Linux distros.

If OpenVPN is used, just do a quick

sudo apt-get install openvpn

VPN is used by people to access the servers at their workplaces to it's probably very easy to set up for Windows and OSX, too. It can be used on Android but you probably have to install an app to do so.

UTF-8
  • 2,300
  • 1
  • 9
  • 24
  • Actually, HTTPS may well be all they need. See my updated answer. Nice screenshots by the way though a bit big. I hope you have the rights to post the image. – Julian Knight Sep 11 '16 at 22:10
  • 1
    @Olba12's landlord probably only cares about which servers they connect to and HTTPs doesn't change anything in this regard. You should take a look at the standard Ubuntu wallpapers, they're amazing. Posting stuff with background images visible should be fine where I live but just to be sure I added the license. Thanks. – UTF-8 Sep 11 '16 at 22:21
  • It is impossible to know what the landlord is thinking, he probably thinks he is being clever and "protecting" himself having misread some computer misuse legislation somewhere. As long as the OP is not doing anything dodgy, he is unlikely to actually have an issue. If he is doing something dodgy then I respectfully suggest we shouldn't be helping him! ;) Haven't used Ubuntu desktop much recently only server. I have my own amazing pics on my 3 Windows monitors B-) Nice job on the license. – Julian Knight Sep 11 '16 at 22:33
  • 1
    The DNS issue can be mitigated by using DNSCrypt – Antzi Sep 12 '16 at 02:35
  • 1
    @UTF-8 good point about just watching which server the OP is connecting, maybe he want to check if the user belong to some community which he don't want them to be there. – Walfrat Sep 12 '16 at 06:45
  • 1
    @JulianKnight "If he is doing something dodgy then I respectfully suggest we shouldn't be helping him!" - I think that's very morally untrue. How do you feel about the right of guilty to competent legal defense? Seems to me that landlords spying on tenant Internet traffic is an evil no matter what he might or might not find out about it. – Dronz Sep 12 '16 at 07:47
  • 1
    @Dronz: I am not making any judgement either way. I don't know enough. All I am pointing out is that, if the OP is doing something legally dubious, this forum should not supporting it. I am not suggesting that he is. It seems that the landlord is being an ass in how he is treating his customers but that doesn't mean he is doing anything wrong either - we don't have enough context to judge that. It isn't necessarily "evil" to monitor traffic for wrongdoing when you own the network. – Julian Knight Sep 12 '16 at 07:50
  • Thoughtless stupidity is far more common than deliberate malfeasance. – Julian Knight Sep 12 '16 at 07:52
  • Correctly setting up a VPN is pretty hard in my experience. I strongly recommend using a separate computer for it (or if your main OS is in a VM, a separate VM). Personally I use a pfSense VPN gateway VM since I only want to tunnel the traffic from a particular VM and not from my main OS. – CodesInChaos Sep 12 '16 at 11:20
  • The DNS issue can also be solved with Tor. – v7d8dpo4 Sep 12 '16 at 12:38
  • On linux mint I do not have the option "Configure VPN". But I have Network proxy. I checked and OPENvpn is installet on mint. I found the following link, which tells you how to set it up. https://community.linuxmint.com/tutorial/view/1965 But I do not know how secure it is, or it it will be working? – Olba12 Sep 12 '16 at 13:54
  • @Olba12 I deem it very unlikely that your landlord will try to break the encryption. If you want to set a custom DNS server, this has already been solved [here](http://serverfault.com/questions/416708/how-to-ensure-openvpn-connection-uses-specific-dns). `8.8.8.8` is Google's DNS server. – UTF-8 Sep 12 '16 at 17:45
  • Please note that [PPTP has serious security vulnerabilities](https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol#Security) that may significantly reduce its value for providing traffic confidentiality. – user Sep 12 '16 at 20:54
3

You have a series of options depending on how much money you are willing to spend, how much work you are willing to do, your technical expertise and how much speed you need.

  • You should be using HTTPS Everywhere to begin with - this will make sure that you use HTTPS on every side that supports it, so that the content of your communications cannot be monitored. However he will still see where the traffic goes, so with just this, he will know what sites you visit, but not what pages you look at in them or what you do.
  • Get a VPN. It's better to pay for a reputable one (in a jurisdiction where they can be sued on your behalf) to avoid the risk of the VPN operator spying on you. Route all traffic through VPN, block everything else, your neighbor will see you only ever connecting to one domain/set of IPs and sending encrypted packets he can't read.
  • Use Tor for everything. It will be slow, and while I think you can route things like torrent traffic through it (there's guides online) I doubt it would be worth it due to the slow speed. Tor is kind of like a VPN, except it's more decentralized - the differences mainly relate to security from governments, irrelevant in your case.
  • Connect your phone to the computer, tether, turn off wifi and turn on data through the mobile network, use that. Completely bypasses landlord's connection, but slow and you need unlimited data on your plan.
  • Get your own internet connection.
Superbest
  • 1,094
  • 8
  • 20
3

To explain this, first some background information: As confirmed in the comments, the described situation is for an apartment in a so called "Studentenwohnheim", a student residence supplied by organizations connected to the university, usually the so called "Studentenwerk".

For the most part, these are residential complexes with many small renting units, to keep costs low for the students living there. Very often, as also seems to be the case here, these renting units are wired with LAN and run an intranet spanning the entire complex, sometimes interconnecting with the networks of other "Studentenwohnheim"-locations in the area and/or the actual university network.

Thus these networks are actively managed to some degree to keep them under control. While it can be assumed that there is no malicious intent on your landlords side (remember it's not a singular person running the show, but an organisation), be aware that you are connected to an intranet and may be exposed to other residents network traffic and/or expose yours to them. The grade of isolation from other residents may vary from one Studentenwohnheim to another.

If you choose to actually connect a router to that network, be VERY careful how you configure it. Some ban the usage of almost any personal network equipment (just imagine what happens if unexperienced residents decide to plug in some cheap SOHO routers to a building-wide physical network, spamming it with various DHCP services), or even any network services, monitoring tools, sniffers or whatever.

I won't go into detail regarding methods to protect your privacy on that network, as the other answers here already did a great job describing your options. But if you decide to go for a VPN provider, choose one where you can use non-standard ports for establishing the connection, as those may be blocked by your network.

I am not familiar with the prices of 4g/LTE in Germany, so I can not say if that is an option yet.

Actual 4G/LTE in terms of speed is still kind of expensive, if you plan to use more than 5GB in a month you would be better off getting a DSL contract on your own with an ISP of your choice, cutting your landlords network out of the picture. Just ask them before if that is an option, but usually it is since the Studentenwerk networks don't offer phone services but rental offers in Germany have to offer you access to landline phone service providers somehow (as far as I know).

kasoban
  • 131
  • 1
1

Since you are not techincally savvy, you might find TOR a little difficult to set up.

If you, you should find it easier to use the Java Anon Proxy (here the English ane the German Wikipdeia entries).

It is a German universtiy project, so should get you reasonable speeds.

Aaargh! my company firewall won't let me access the site in order to qupote from it, so here is some info from Wikipedia (I won't quote the German version).

Java Anon Proxy, also known as JAP or JonDonym, is a proxy system designed to allow browsing the Web with revocable pseudonymity.[3] It was originally developed as part of a project of the Technische Universität Dresden, the Universität Regensburg and Privacy Commissioner of Schleswig-Holstein. The client-software is written in the Java programming language.

Cross-platform, free and open source, it sends requests through a cascade and mixes the data streams of multiple users in order to further obfuscate the data to outsiders.

JonDonym is available for all platforms that support Java. Furthermore, ANONdroid is a JonDonym proxy client for Android.[4][5]

Cost, name change and commercial service

Use of JonDonym has been (and still is) free, but since financial backing of the original research project ran out on 22 June 2007, a startup, Jondos GmbH, was founded by members of the original project team. Jondos GmbH has taken over development and continues to work on an improved blocking resistance function that would make it easier for users from restrictive countries to get a connection to the system[citation needed]. To cover costs of running mix cascades and increase speed as well as anonymity, Jondos and other Internet firms[who?] launched a commercial version of the anonymizing proxy.

As a consequence, the JAP client has been renamed to JonDo and the service itself from AN.ON to JonDonym.[6] JonDonym mix cascades are mostly operated by SMEs in multiple countries and mix cascades always include three mix servers for advanced security. As contractors of Jondos GmbH must ensure sufficient throughput of their mixes, anonymous web browsing at standard DSL speeds is possible[citation needed]. Cost free Cascades are still in operation, although they do not offer the low latency, multiple Mixes per Cascade or guaranteed bandwidth the commercial ones do. Privacy

The online activities of the user can be revealed if all Mixes of a cascade work together by keeping log files and correlating their logs.[7] However, all Mix operators have to sign a voluntary commitment not to keep such logs, and for any observer it is difficult to infiltrate all operators in a long cascade.

In July 2003, the German BKA[8][9] obtained a warrant to force the Dresden Mix operators to log access to a specific web address, which was hosting child pornography. AN.ON then decided to introduce a crime detection function in the server software in order to make this possible. The feature was made transparent by publishing the changed source code on August 18, 2003, and subsequently criticized by many users. For the Dresden Mix, the feature continues to be part of their software until today. Tracing activities back in the past is still technically not possible for the operators, but anonymity now extends only to the timepoint that a surveillance court order is issued.[10] It was pointed out though that the new feature was covered by the AN.ON threat model and not a security leak by itself.

As a reaction to the threat from local authorities, the system has spread internationally. If the Mixes of a cascade are spread over several countries, the law enforcement agencies of all these countries would have to work together to reveal someone's identity.[11] AN.ON publishes every year the number of successful and unsuccessful surveillance court orders.[12] Further research is being done by AN.ON to make the crime detection functionality more privacy-friendly.[3]

Since May 2005, JonDonym can also be used as a client for the Tor network and since 2006 also for the Mixminion network.[13] These features are still in an early stage and only available in the beta version of the software.

Mawg says reinstate Monica
  • 1,368
  • 2
  • 13
  • 26
1

I doubt that Ja ich weiss, daß meine Daten überprüft werden. means that particularly your traffic is inspected.

I understand from your question such that the landlord offers you internet service, and thus, by German law, is acting as an ISP and thus has to follow the regulation for ISPs, including everything regarding lawful interception, data preservation, etc.

If I were you I wouldn't bother too much.

countermode
  • 684
  • 1
  • 7
  • 22
0

I appreciate all the other answers which go out of their way to explain TOR etc., but let's be realistic here.

We are talking about a small dormitory bureaucracy in 2016 Germany, not some dictatorship that sends men to knock down your door in the night because you sent a mail with the word "freedom" in it. The OP very likely is not going to buy weapons in the darknet or something like that.

Your landlord is acting like an ISP for you, so it has (or thinks it has) some legal obligations in that respect, which may or may not be "good" but are certainly not "evil" in the sense that you will get thrown into a dank cellar until you rot. Very likely they do not have a dedicated lawyer to write those sentences in your contract, so they tend to err on the tougher side, from their point of view.

Simply treat your internet connection like you would a public WLAN, or a company internet connection with limited private usage, and you will be fine. Obviously use HTTPS for all "interesting" connections (banking etc. - they won't offer anything else, anyways); make sure your POP3/IMAP client uses TLS or similar so your passwords (and mails, obviously) do not go over the wire unencrypted. You should find some option for that in the settings of your mail client, no need to get fancy with VPNs.

As they mention that ludicrous 30GB limit, they are very likely mainly concerned about people stuffing up the lines with endless movie downloads. They probably could not care less about any legality issues there, but they likely do not have an extremely wide uplink and want to avoid people complaining that network access is very much slower than advertised, all the time.

If you absolutely want to access some sites that nobody else should know about, then get an auxiliary UMTS/LTE stick and go crazy over that connection, keeping your landlords line for general Youtube consumption or whatever.

AnoE
  • 2,370
  • 1
  • 8
  • 12
0

Additional idea: it could be useful, if you together with your VPN traffic, you also make a lot of normal, non-problematic, neutral traffic as well. It also solves the problem of the significant overhead of the tor.

It is also useful if you are using such a VPN, whose protocol is normal TSL connection, for example because it is embedded in HTTPS. OpenVPN can do this quite useful. If you can do this on a TCP port 443, nobody will be able to ever differentiate that you aren't only a regular visitor of a high-traffic https site.

There is also a possibility, that you are using a tor gateway, but not in your home, but on your remote server. It would protect you also from the possible eavesdropping of your hosting provider (which has, in my opinion, a much higher chance, as in the case of your landlord).

It is also important to hide your DNS traffic as well, because the site names you queried may say too much from your real communication channels. Everything should be embedded into your "normal" "https" connection.

peterh
  • 2,938
  • 6
  • 25
  • 31
-1

There are a few ways you could make the landlord not want to look or regret looking at your logs.

Setup a honeypot, a webpage that when visited by someone without your credentials (browser header info ect.) then it delivers a malicious code/program (this could be as simple and benign as an infinite alert or something really malicious). You then visit it lots (make it serve to you as little data as possible, if any data at all to save your data limits) and then if your landlord visits it, they regret it.

Do the same as above but with rather than malicious content, just have content that the landlord would not want to see, something like lemon party or tubgirl.

Have a program that will put random noise into the logs by visiting lots of websites/making lots of connections, this could be a simple web crawler. The only issue with this is that it will use up your data allowance but this is just an option

If your bandwidth only gets reduced at 30GB (side note: track your own data usage and see if it is 30GB or 30Gb as B is bytes and b is bits and in networking you usually work in bits not bytes which are usually 8 bits. If they are limiting your data at 30Gb when the contract says 30GB then you may have them for breach of contract) rather than getting reduced at 30GB and then reduced more and more, the more you use it. Once you get slowed down, you could just try and use as much of the bandwidth as you can to try and fill up whatever storage media that they use to store the traffic, this can be done many ways. depending on the system, once the storage is full, it will either stop collecting new data (unlikely) or will remove older data faster thus giving them less time to review it. This method is unlikely to work as storage is cheap and bandwidth is small but its worth a try.

These are just some silly ideas. They are not meant to be taken 100% seriously.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
Topher Brink
  • 1,639
  • 11
  • 13
-1

SOCKS has been mentioned but I'd like to add redsocks which makes all your traffic go through your SOCKS proxy (presumedly provided by ssh -D). This has an Android version too. I find this much easier to set up than a VPN. Finally, you can use sslh on the server end to make your SSH available at port 443 (if your server doesn't have a web page then of course you can just put SSHD on 443).

chx
  • 615
  • 3
  • 13