If I'm downloading from my seedbox with SFTP a VPN is unnecessary?

Am I correct in thinking this?

8 comments

Yes.
While there is no end to paranoia, I would call a VPN over sftp quite useless.
Unless, of course, the seedbox itself needs a VPN to be reached in the first place.

- Question kinda related to this post.
  I’m looking to get back into piracy and have been saving to build a server to handle it. I’m now hearing about these seed boxes in the cloud.
  So my question is this a viable option until I build a server. Like I can set up torrents and maybe Radarr, etc. then just use my home pc for Jellyfin and connect it to the seed box? Or is the seed box mainly used to do the torrenting before you STFP the files to your actual server?
  
  Yes, you can just use the seedbox to download and run jellyfin locally with the media staying on your box, but it might be a lot easier to just get a seedbox that allows you to run jellyfin on it.

Probably. Depends on how much you trust your seedbox host. Using a VPN to connect to the seedbox to download stuff is probably overkill

It's much lower risk, someone dedicated could prove you accessed a seedbox, but it would be a lot harder to prove you violated a copyright

Your seedbox should have it's torrent traffic routed through a VPN, so that copyright complaints are delivered to (and ignored by) the VPN provider.
You do not need a VPN between you and the seedbox.

Just letting this pdf here about security of Seedboxes: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Anon%20-%20Mass%20Owning%20of%20Seedboxes%20-%20A%20Live%20Hacking%20Exhibition.pdf
I could see the real source IPs for all other users in last logs.
Accessing their web interfaces shouldn't be a risk, as you've already paid them and thus left a paper trail. But the point about accessing the IPs from the last ssh (or sftp) logins might be worth using a VPN for. If another user is able to get them law enforcement could too (not that it's likely).

SFTP / SSH encryption in transit is perfectly safe.
The seed box itself will probably have logs on it that you accessed it from your home IP
The seed box hosting provider might have logs that you're connecting to them from your home.
Your ISP can see that you accessed a box on a hosting provider with an encrypted protocol.
As long as you're not hosting anything so serious that a state agency will come in raid the hosting provider break into the box and grab the content and logs, you really have nothing to worry about.

8 comments