>>23869564 (lb)

> use a very large ip space like AWS for vpns

not always the case, nor would i ever trust a vpn landing in aws space. they reserve 3 addresses in every subnet they handout, even unroutable space, for monitoring.

with that bit it's also possible for them to passively monitor. they can also ssl offload within their fabric and man-in-the-middle undetected. yeah sounds dumb but.

just always consider that if you can encrypt something, or hide something, given enough time and dedication it can be found and read.