[HN Gopher] Who owns Express VPN, Nord, Surfshark? VPN relations...
___________________________________________________________________
Who owns Express VPN, Nord, Surfshark? VPN relationships explained
(2024)
Author : walterbell
Score : 636 points
Date : 2025-10-04 00:30 UTC (3 days ago)
(HTM) web link (windscribe.com)
(TXT) w3m dump (windscribe.com)
| holyknight wrote:
| scary AF
| WarOnPrivacy wrote:
| This link displays just the map, freed from it's painfully small
| frame.
|
| https://kumu.io/embed/9ced55e897e74fd807be51990b26b415#vpn-c...
| schiffern wrote:
| Anyone got this as a regular single image infographic or
| (better yet) a text-only bulleted outline?
| moontear wrote:
| There is an export button. Maybe it does what you want.
|
| Don't use the embed link from above, use this one:
| https://kumu.io/Windscribe/vpn-relationships
| plmpsu wrote:
| Just pay for and use Mullvad.
| Dylan16807 wrote:
| I did until they killed port forwarding.
| bilegeek wrote:
| OOC what's your current favored provider? AirVPN? Proton?
| octo888 wrote:
| I tried Airvpn but the MacOS client is beyond trash.
|
| And the website just gives 2005 amateur PHP coder vibes.
| Not just the design. The session expiry is seems very long
| - I hadn't visited for a few days and I'm still logged in.
| I'd be surprised if it wasn't infinite.
| mk89 wrote:
| On Mac you can just use OpenVPN/Wireguard and import one
| of the profiles you can generate through their website.
| octo888 wrote:
| Not for feature parity.
|
| And I find there's a good correlation between the quality
| of the apps and the overall quality of the company. No
| surprise that the Mullvad VPN app is excellent
| baobun wrote:
| For multiple reasons it's better and safer to avoid using
| official provider client in the first place, regardless
| of provider, and connect with a good
| wireguard/openvpn/whatever client.
| octo888 wrote:
| Not universally true. The Mullvad client has lots of
| additional features to enhance privacy. Killswitch, split
| tunnelling (you might otherwise disconnect the VPN to use
| a certain app, so it can overall improve privacy),
| Shadowsocks, Lockdown mode etc
|
| It's extremely high quality on MacOS in my experience.
| It's never crashed for example whereas Airvpn's crashes
| daily. It connects almost instantly. I don't think I've
| ever seen it give an error
| MezzoDelCammin wrote:
| AirVPNs main proposition isn't "we have a nice app / UX".
| It's "we give you the most configs / options". AFAIK
| they're currently one of very few that allow you to
| configure both port forwards and give you a stable config
| (keys) to run your own wireguard instance
| 201984 wrote:
| Proton for me.
| Dylan16807 wrote:
| Proton right now. It's okay but it causes some network
| issues even when it's set to split tunnel default-exclude.
| mystraline wrote:
| Yep.
|
| And I was on Proton for 3y, until the CEO were backing Trump
| and Vance on Reddit and other places. Their port forwarding
| was also painful as well, but it worked.
|
| Cancelled. PIA does the port forwarding nicely and stabily.
| No jank scripts to run every 60 seconds.
|
| Now evidently PIA is a bunch of scum capitalists. But in
| reality, who isn't?
|
| Mullvad? But they killed port forwarding for "abuse".
| 0points wrote:
| > the CEO were backing Trump and Vance on Reddit and other
| places
|
| Something happened, but THAT didn't.
|
| https://medium.com/@ovenplayer/does-proton-really-support-
| tr...
| ashirviskas wrote:
| > Given Proton's outstanding track record and reputation
| thus far as a free, open-source, crowdfunded
| organization, owned by a non-profit and based in
| Switzerland (a country known for its neutrality), this
| topic is worth a deep dive.
|
| Either it was someone paid to write this, or if author
| really believes this, they are not someone I trust.
|
| Maybe the organization is non-profit (which I do not
| believe is practically true), it does not explain them
| sharing so much with Tesonet.
| subtextminer wrote:
| The Proton CEO is not "backing Trump and Vance." He wrote
| something positive about a narrow policy Trump supported
| that's favorable to little tech over big tech. That's it.
| It's certainly possible that someone you detest can still
| occasionally support a particular policy you think is good.
| saurik wrote:
| Particularly when dealing with someone like Trump, who
| has, on occasion, backed both sides of an issue,
| depending on the day of the week! ;P
| elorant wrote:
| I do and I like them, but Cloudflare blocks their ips
| aggressively.
| lyu07282 wrote:
| Reddit too, I wished they offered residential or dedicated
| and/or unlisted ips. But most of the time you just have to
| cycle through different ips to unblock.
| dylan604 wrote:
| At this point in the cat/mouse game, wouldn't any set of
| IPs used by a VPN eventually be able to be sussed out by
| anyone interested?
| lyu07282 wrote:
| Some vpn services offer dedicated residential IP
| addresses, meaning you get an IP from just a regular
| private ISP in some other country. It's admittedly a bit
| shady though, and more expensive ofc but that will
| unblock everything
| octo888 wrote:
| There was a bumpy ride with CF a while ago but they seem fine
| now (still plenty of captchas, of course)
| 0x073 wrote:
| Just spin up a server with wireguard.
| celaleddin wrote:
| or with Tailscale (and configure the server as an exit node).
| nerdsniper wrote:
| This is the way (or Tailscale). Easier to move around between
| datacenters to find one with an ASN/IP that isn't blocked by
| the apps/websites you use. If you do want a more off-the-
| shelf solution, Mullvad is probably the best choice. All of
| the consumer VPNs (including Mullvad) get blocked by various
| services - I get degraded/intermittent connection to Google
| Maps on them. GCC countries block most of the well-known VPNs
| as well, if you ever travel to the Arabian/Persian Gulf
| region. My private datacenter VPN gets blocked only very,
| very rarely.
| shj2105 wrote:
| WireGuard/udp commonly gets blocked on public wifi
| CryptoBanker wrote:
| That defeats the entire purpose of anonymously mingling your
| data with others'
| nerdsniper wrote:
| By mailing cash, if you like. They don't care if they know who
| you are or not. They don't ask for your email address, you just
| log in with a randomly-assigned account number and a password.
| ct0 wrote:
| They dont port forward unfortunately
| VonGuard wrote:
| Been saying it for YEARS: 95% of VPNs sell your data. It's where
| they make their money. It's absolutely insane the push-back I get
| when I say this online. I get downvoted to hell and back.
|
| Source: I bought this data from VPN companies... Hell, you can
| inject ads and surveys if you want!
| throwawayq3423 wrote:
| > Hell, you can inject ads and surveys if you want!
|
| So am I right in saying that the data that's encrypted by VPNS
| is only in transit? It then sits on a server in plain text,
| ready to be queried by third parties for money.
| andrecarini wrote:
| Yes, VPNs add encryption only between you and the VPN
| servers.
| throwawayq3423 wrote:
| How were they able to convince anyone that that matters?
| mrmuagi wrote:
| People seem to use VPNs to avoid IP based issues, like
| Netflix or ip bans/associations, not sure anyone would
| use it for actual privacy -- at best its obsfucation.
| throwawayq3423 wrote:
| Isn't Netflix pretty good at detecting VPNs at this
| point?
| mr_mitm wrote:
| How does that work with HTTPS being practically ubiquitous?
| rileymat2 wrote:
| HTTPS spills what services you are communicating with, but
| not the content...
|
| ...except approximate content sizes and timing patterns.
| mr_mitm wrote:
| The GP claimed they can inject ads though
| zubiaur wrote:
| They sell metadata. DNS queries, locations, apps using data,
| device info. Usually anonymized, but both unscrupulous and
| "better" providers do have access to your account and payment
| info.
| mr_mitm wrote:
| GP claimed they can inject ads. How does that work with
| HTTPS?
| Lammy wrote:
| If HTTPS were for privacy it would be called HTTPP. Security
| features tend to make things _less_ Private, like how opening
| apps on a Mac makes it phone home for OCSP check.
| tredre3 wrote:
| I reckon that if HTTPS was sufficient to hide your online
| activity, then you wouldn't need a VPN to hide it in the
| first place.
| Lammy wrote:
| I wouldn't be surprised if a lot of them have like a Crypto AG
| thing going on and have the capability to use paying customers
| as exit nodes as a way to launder consent-manufacturing bot
| bullshit through legitimate-looking residential and mobile
| connections.
| Dylan16807 wrote:
| > 95% of VPNs sell your data
|
| This is believable.
|
| > It's where they make their money.
|
| I'm much more skeptical of this. I know linus tech tips is not
| exactly an expert organization, but I believe the discussions
| they've had about almost starting a VPN and backing out for
| ethical reasons, and they made it clear that the core VPN
| product would have huge profit margins. You can always do
| greedy things to make _more_ money, but for a paid VPN I 'd
| need some solid evidence to believe that data sales are a huge
| line item or especially that they're the main source of money.
|
| If you're including the swaths of free VPNs then that makes
| your number a lot harder to use.
| mrmuagi wrote:
| what VPN companies?
| freetime2 wrote:
| And what types of data?
| jesterson wrote:
| > 95% of VPNs sell your data. It's where they make their money.
| It's absolutely insane the push-back I get when I say this
| online.
|
| People love to stick to what they irrationally believe in. I
| would give you push back as well by saying 95% is a very
| conservative number. I would say 98-99%
|
| But hey, they say they don't sell my data isn't it?
| flexagoon wrote:
| > Source: I bought this data from VPN companies
|
| I'm more interested in this part - how does that work? Do you
| just reach out to them directly and ask "hey, let me buy your
| user data"? Or is there some sort of service they offer?
| VonGuard wrote:
| And look! I am downvoted again!
|
| How does this work? They harvest your DNS! They inject surveys
| into your YouTube packets. They tabulate just how much traffic
| goes to which specific games on Twitch. How? The provider is
| the endpoint, not you.
|
| It's not the whole picture, but it's enough to sell to
| marketers.
|
| This is what happens EVERY time I say this! Look again! It
| happened, I have 1 upvote... It's almost as if the VPN
| companies don't want you to believe this is true!
|
| Story time! I have been cashed out of three startups. $600
| total, across them all. It's the people in the Valley who've
| struck out over and over who know the truth, not the successes.
|
| One of those startups was about tracking the games played on
| Twitch, and selling that info to Esports entities, marketing
| firms, etc. The company did not succeed because, honestly, it's
| not hard data to scrape yourself. BUT, we tried. And where did
| we get our data? VPN providers. Major VPN providers. We don't
| care about your personal data. We care about whether you
| watched a Twitch stream of GTA or Madden.
|
| And for a time, yes, we could buy injected surveys. Packets,
| literally injected into your streams of data. This was
| expensive, iffy, and controversial, but it was on the rate
| cards.
|
| DNS is very useful, and unencrypted. OpenDNS makes its money on
| this same info. Stop putting your heads in the sand. Ya'll have
| seriously lost the path.
| Ms-J wrote:
| Yes, I've heard of bad VPN companies that sell your data. I
| would like to learn more about how it is done exactly.
|
| In your later comment you said "DNS is very useful, and
| unencrypted. OpenDNS makes its money on this same info." Is the
| VPN company only openly selling DNS info or are they selling
| more, such as connection logs?
|
| How did you approach the VPN provider to ask to buy this info?
| eloisant wrote:
| Fun fact: I once interviewed for a company offering a free VPN,
| which was actually using other users as endpoints for the VPN.
| Some kind of P2P VPN if you will.
|
| How did they make money? Easy: there were also selling a
| botnet! So if you used their "free VPN", you could be part of a
| botnet for DDOS or to create fake reviews/upvotes from
| thousands of "legit" IP addresses.
| justapassenger wrote:
| Is there any other real world usecases for VPN nowadays other
| than:
|
| 1. Getting access to geolocked data
|
| 2. Torrenting "Linux ISOs"
|
| ?
| ThatMedicIsASpy wrote:
| ISPs bad routing and peering
| bilegeek wrote:
| 3. Hosting websites with DDNS (though the abuse from that
| caused Mullvad and IVPN to drop port forwarding)
|
| 4. Though it hurts anonymity, and is relatively rare: I2P or
| Hyphanet, because some websites block known P2P nodes[1].
| Important if your bank or work is being a jerk about it.
|
| 5. As ThatMedicIsASpy notes, ISP issues: some routers soil the
| bed from P2P, some ISP's throttle P2P traffic regardless of
| legality, etc.
|
| [1]
| https://old.reddit.com/r/i2p/comments/tc3bhs/is_anybody_else...
| zer0tonin wrote:
| Those two are pretty big already to be honest. I guess a third
| one would be avoiding eavesdropping on public wi-fis.
| justapassenger wrote:
| With TLS being everywhere, and just few clicks away from
| having DNS over TLS, I really don't get eavesdropping on
| public wifi prop value.
| octo888 wrote:
| TLS doesn't hide which websites (hostnames) you visit
| IggleSniggle wrote:
| It does if you do DNS over TLS or HTTPS, although I guess
| that information would still be knowable to your DNS
| provider if they terminate your TLS behind the scenes
| optimalquiet wrote:
| Not quite. In order to make TLS certs work on a per-site
| basis, requests sent over HTTPS _also_ include a virtual
| host indicator in cleartext that shows the hostname of
| the site you're trying to connect to, so if the IP on the
| other end is hosting multiple domains it can find the
| right cert. For this reason some people feel that DNS
| over TLS is pretty pointless as a privacy measure.
| MrOwen wrote:
| I think this is only true if SNI is disabled. Otherwise
| you really only get the IP of SRC and DEST.
| appointment wrote:
| SNI relies on the client specifying the host name in the
| unencrypted ClientHello message that initiates a TLS
| handshake. Encrypted Client Hello involves extra
| configuration that most websites don't implement.
| ahlCVA wrote:
| SNI leakage is what encrypted client hello (ECH) tries to
| solve: https://blog.cloudflare.com/announcing-encrypted-
| client-hell...
|
| It's still not perfect since you're still leaking
| information about the privacy set implied by the outer
| ClientHello, but this possibly isn't much worse than the
| destination IP address you're leaking anyway.
| pfexec wrote:
| Which is more likely, your barista collecting this data
| for nefarious purposes, or your ISP?
| bigiain wrote:
| Or that dude in the black hoodie in the corner who always
| seems to be camped at whatever cafe you and your cow
| orkers are using as your startup "office"?
| numpad0 wrote:
| VPN unifies all destination IPs to server.ip.addr.ess. IP
| reverse lookups tells some stories if you are to be so
| paranoid
| michaelt wrote:
| 1. example.com is not on the HSTS preload list
|
| 2. Because you normally visit example.com using an
| incognito window, your browser hasn't cached the redirect
| to SSL, or the address bar suggestion, and you haven't
| bookmarked the site.
|
| 3. You key in example.com, the browser connects over http,
| and the evil wifi MITMs your unencrypted connection -
| removing the redirect to SSL and messing with the page
| however the evildoer wants.
|
| Obviously a VPN provider can also do this, but you might
| hope they're less likely to.
| sciencejerk wrote:
| Will Chromium generate a "Your connection is not private"
| warning in this scenario, that the user has to click
| through to proceed? And the user would have to type
| example.com in the browser bar; https://example.com would
| also trigger a warning, correct?
| extraduder_ire wrote:
| You connect to an access point, and your browser/OS tries
| to open one of
| http://detectportal.firefox.com/canonical.html,
| http://www.msftconnecttest.com/connecttest.txt,
| http://connectivitycheck.gstatic.com/generate_204,
| https://captive.apple.com/hotspot-detect.html and
| loads/displays whatever unencrypted web page is served.
|
| Getting someone to open an unencrypted webpage is almost
| trivial. It's often one of the only web pages you can
| open on a device.
| Dylan16807 wrote:
| The problem isn't getting you to open a page, it's
| putting that page behind a known legitimate URL.
| TZubiri wrote:
| "Obviously a VPN provider can also do this, but you might
| hope they're less likely to."
|
| So you have identified some marginal privacy issue, and
| have identified that a VPN doesn't solve it, but rather
| that it moves the risk to a third party actor you
| subjectively feel is better. Well I feel that,
| subjectively, introducing a third party generally
| decreases security.
|
| I believe that not all privacy and security
| considerations can or should be solved technically, but
| rather we have extra-technical mechanisms like law and
| social norms that provide some protection on the edge
| cases. For example, an employee cannot lookup information
| for personal reasons on a system they are entrusted to in
| a professional capacity. I'm no expert, but you probably
| have first laws that prohibit that, second corporate
| policy that prohibits that, and thirdly social pressure
| that prohibits that to some extent. Are they perfect? Not
| necessarily which is why for the most part we rely on
| technical encryption and security mechanisms.
|
| But at some point these examples become so contrived and
| the medicine becomes the poison, so you enter into
| territory that is pretty standard in other industries,
| what's to stop a waiter from spitting into a cup? There's
| no spit filter in place of McDonalds, there's other
| mechanisms protecting us.
|
| On a similar note, logic and debate is not the only way
| to convey this phenomenon, so here's some more artistic
| retort to privacy schizophrenia.
|
| https://www.youtube.com/watch?v=jf9I04Oa-hU
| Dylan16807 wrote:
| Using a VPN means you have to trust one company instead
| of every wifi you connect to, and also makes that an
| entity that's an expert at privacy instead of working off
| a half-forgotten router in the back.
|
| How is any of this "medicine becoming the poison" or
| "schizophrenic"?
| TZubiri wrote:
| No, you have to trust the one company, as well as
| everyone you were trusting before. You are still using
| the router, and now you are also trusting the VPN
| provider, as well as the nodes in between the VPN
| provider and your original destination.
|
| Also, you are just switching up the "unprotected stretch"
| between your local wifi, and, say, Google's servers,
| whereas now that "unprotected stretch" lies between the
| VPN provider servers in Latvia or British Virgin Islands
| or Panama, or whatever dubious jurisdiction, and, say,
| Google. Sure, you added a layer of protection against the
| random hacker sitting in your Starbucks, but you have
| added many more vectors.
|
| It becomes the poison because the solution you are
| introducing brings more issues. And it's schizophrenic
| because the issue to begin with, was minuscule (a hacker
| stepping into MacDonalds, breaking the network encryption
| and then also the application encryption.
|
| Maybe if this were 2010 and websites still used HTTP, or
| you are using a local email client without TLS
| configured. But it's 2025, everything has HTTPs and you
| are using an HTTPs email client.
|
| VPNs to protect corporate networks is sensible. Consumer
| VPNs are a different thing entirely and they do not
| provide increased security at best, decrease security at
| worst, and usually cater to schizoid threat models, where
| the threat actor is the state, rather than more realistic
| threat scenarios.
| TZubiri wrote:
| Additionally, if ConsumerVPNs provide encryption, don't
| they provide encryption from the stretch between the
| consumer to the proxy? The stretch between the proxy to the
| destination would not have additional encryption, and there
| is no reason to believe that the second transit would be
| shorter.
| 0x073 wrote:
| Free wifi hotspots
|
| Nowadays most traffic is tls encrypted, but there are still
| metadata that can be collected.
| gruez wrote:
| >but there are still metadata that can be collected.
|
| That logic is questionable given how poorly "spying on public
| wifi users" scales. You either need to put a bunch of
| eavesdropping radios in a bunch of public places or somehow
| convince a bunch of small businesses to use your "free wifi"
| solution. Even if you do have access, it's hard to monetize
| the data, given that nearly every device does MAC
| randomization (so you can't track across different SSIDs) and
| iOS/windows rotates mac addresses for open/public networks.
| OTOH setting up metadata capture on a commercial VPN service
| is pretty straightforward, because you control all the
| servers.
| baby_souffle wrote:
| Doesn't pretty much every Starbucks location in the United
| States use a nationwide provider?
|
| Despite the randomized Mac address, you can still
| fingerprint devices using all the usual tricks when they
| connect to the authentication and authorization page before
| you allow them to access the broader internet.
|
| If the receipt had a passcode on it, you've got a link
| between all of your browser fingerprint, radio fingerprint
| and payment detail fingerprint and possibly customer
| loyalty provided at time of payment.
| gruez wrote:
| >Despite the randomized Mac address, you can still
| fingerprint devices using all the usual tricks when they
| connect to the authentication and authorization page
| before you allow them to access the broader internet.
|
| Fingerprinting is overrated given that every iPhone 17 is
| identical to any other iPhone 17. If you leave system
| settings at stock, which most people do, there's very
| little to fingerprint.
|
| >Doesn't pretty much every Starbucks location in the
| United States use a nationwide provider?
|
| True, although mobile data is cheap and plentiful enough
| that I rarely bother using wifi at cafes or fast food
| places. The only time I use public wifi is if I'm staying
| long term, which basically only encompasses trains,
| airports, and hotels. Those are diverse enough that it's
| tough to build a complete profile.
|
| >If the receipt had a passcode on it, you've got a link
| between all of your browser fingerprint, radio
| fingerprint and payment detail fingerprint and possibly
| customer loyalty provided at time of payment.
|
| I don't think I ever saw a place that was that guarded
| about their wifi. The closest I've seen is hotels
| requiring your room/last name, which would allow them to
| identify you, but at the same time I'm not sure how much
| information they can glean, other than that I'm logging
| into gmail or airbnb. Persistent monitoring that ISPs can
| do is far more useful.
| baby_souffle wrote:
| > Those are diverse enough that it's tough to build a
| complete profile.
|
| Debatable; i promise you that somebody out there is
| willing to buy the info and will attempt to combine it
| with $otherInfo such that it becomes valuable enough for
| somebody else to buy. Lots of adtech/survalence-tech
| operates with thin margins at _massive scale_.
|
| > I don't think I ever saw a place that was that guarded
| about their wifi.
|
| It's rare; i'd run into it only a few times a year.
| Typically PoS systems and WiFi are not integrated. I also
| haven't really been paying attention since LTE is good
| now :).
| gambiting wrote:
| 3. Avoiding government-mandated record keeping by ISPs in a
| country like the UK, where all ISPs have to keep a year of your
| browsing history and it can be accessed warrant free by 17
| different agencies(including DEFRA, the agriculture agency).
|
| And yes, I'm aware that you're most likely trading one
| surveilence for another - but honestly at this point I'd much
| rather trust my paid VPN provider with my browsing data than my
| ISP and ultimately the government.
| justapassenger wrote:
| Given that most of the web has TLS and you can easily do DNS
| over TLS - that's very very high level metadata, where I
| personally just don't see much ROI vs to giving that metadata
| to random company with no regulations whatsoever.
| octo888 wrote:
| Many TLS deployments still leak the hostname in plain text
| as part of SNI
| retube wrote:
| > but honestly at this point I'd much rather trust my paid
| VPN provider with my browsing data than my ISP and ultimately
| the government.
|
| Your ISP will need to comply with local laws and regulations,
| and you'll have some recourse if broken. A third-party VPN
| operating in an overseas jurisdiction could be doing anything
| with your data.
| anonym29 wrote:
| Unless it's selling the data back to my own government, I'd
| rather a foreign commercial VPN provider have that
| information rather than my own domestic ISP or my own
| domestic government.
|
| My government can do parallel construction, can send teams
| of armed gunmen to my house, and otherwise find far more
| methods to persecute me than the intelligence services of
| Russia or China can.
|
| Being innocent of any kind of crime does not necessarily
| remove one from the crosshairs of law enforcement
| organizations, particularly the FBI, who have an extensive,
| well-documented history of violating citizens'
| constitutional rights, conducting partisan witch hunts
| against political opponents, being a lawless menace to
| civil rights activists, anti-war activists, gay rights
| activists, both pro-abortion and anti-abortion activists,
| and is probably busy right now planning on being a menace
| to trans inclusivity activists.
|
| There is no such thing as a friendly government, but I'd
| much rather have my data in the hands of a government
| 10,000 miles away than in the hands of my own government.
| My own government hunts, injures, stalks, harasses,
| socially ostracizes, and even kills my fellow citizens far
| more than any foreign government ever has.
| IAmBroom wrote:
| > Your ISP will need to comply with local laws and
| regulations,
|
| I think you've managed to exactly describe the problem with
| them, and yet you phrase it as a positive.
| mr_mitm wrote:
| I VPN into my home network for added privacy in public wifis,
| and to access private services.
| gruez wrote:
| Protection from IP tracking, especially if your ISP doesn't do
| CGNAT. Of course there's a trade-off here between
|
| a) your ISP (who knows your billing information) knowing which
| sites you visit, and any site you visit can correlate internet
| activity back to your household
|
| b) your VPN provider knowing all the sites you visit
| Havoc wrote:
| CGNAT won't save you in a world where everything is
| fingerprinted to within an inch of it's life.
| TurboSkyline wrote:
| But a VPN, commercial or self-hosed, also won't stop
| fingerprinting. It changes your apparent IP address, but
| the rest of the characteristics of your device and browser
| stay the same.
| hemabe wrote:
| In Germany (and probably in the UK too), you now have to be
| very careful about what you write online. There is actually a
| section 188 that makes insulting, defaming, or slandering
| people in political life a criminal offense. You can now face
| heavy fines for minor insults ("idiot") or even have your home
| searched. A VPN can be useful here.
| hansvm wrote:
| What idiot signed that bullshit into law?
| skrause wrote:
| That law has existed since 1951 and is based on an
| executive order from 1931 by Hindenburg.
| dartharva wrote:
| This is actually not uncommon in most of the world.
| American 1A is actually an extremely novel concept most
| other countries still haven't caught up on.
| crossroadsguy wrote:
| American 1A is as strong as it's proving to be right now
| and increasingly proving to be stronger and stronger by
| the day, since January this year!
|
| Many other countries have protections like that, "on
| paper" (!!!) - but the point is in how it is used or
| misused, or rather completely ignored - directly or
| indirectly, like in the USA currently and many other
| countries in the world.
| Y_Y wrote:
| Novel in what sense? Are you familiar with the hisory of
| free speech in e.g. the UK, Sweden, and France?
| IAmBroom wrote:
| The UK, where the government has literally smashed
| printing presses in the newspaper age when magazines were
| thought to be publishing embarrassing news about the
| Crown? Where the government's legal authority to do so is
| still intact? That UK?
| Aerroon wrote:
| If anyone wants some background info on the "idiot" comment:
|
| A Bavarian man captioned an image of Robert Habeck (the vice
| chancellor of Germany at the time) with "Schwachkopf
| Professional" - "Professional Idiot". It was styled after the
| Schwarzkopf ad campaign. For this, Habeck filed a criminal
| complaint "to stop hate crime" against the man and the man's
| apartment was searched by the police and a tablet
| confiscated. Oh, and he was arrested over it as well. [0]
|
| (The man was also accused of posting some nazi imagery
| earlier in the year, but the order to search his house seems
| to be related _only_ to the insult. [1])
|
| Imagine if you could be arrested for calling your (vice)
| president an idiot.
|
| [0] https://www.dw.com/en/germany-greens-habeck-presses-
| charges-...
|
| [1] https://www.tagesspiegel.de/politik/falschaussage-im-
| fall-sc... (it's in German)
| jojobas wrote:
| You don't treasure your freedom of speech until you lose
| it.
| crossroadsguy wrote:
| > Imagine if you could be arrested for calling your (vice)
| president an idiot.
|
| You must not set foot in the USA, India, China, et cetera,
| then.
|
| Imagine you say? Getting arrested might be the least of
| your worries in today's world if you decide to call a
| president (or the immediate underling) an idiot in many
| countries :D
| hansvm wrote:
| A ton of ISPs use deep packet inspection for various kinds of
| filtering (and other shenanigans). When they get it wrong it
| manifests to the user as certain websites or access patterns
| being inaccessible and the ISPs customer support agreeing that
| you should have access and being able to do fuck all to fix it.
| A VPN in the middle usually solves the issue.
| TZubiri wrote:
| Wait, I think an ISP cannot inspect the content of packets
| that are encrypted, say, with HTTPs. In order to inspect TLS
| encrypted packets you need access to the end-device,
| controlling the end-router is not sufficient since you would
| not have access to the device certificates.
|
| If you can prove that an ISP can inspect packets, it would be
| major news.
| calvinmorrison wrote:
| They may not need the contents, seeing you're connecting to
| a netflix IP and having a lot of data transfer may be a
| good reason to throttle, for example.
| esseph wrote:
| * Russia
|
| * Kazakhstan
|
| * China
|
| * Belarus
|
| * Iran
|
| * Mayanmar
|
| - list of countries that are known or suspected to MITM
| traffic, including SSL
| coderatlarge wrote:
| how so they supposedly do it?
| walterbell wrote:
| SSL certificates have a centralized hierarchy. Many
| browsers trust a long list of root certificate
| authorities from multiple countries.
|
| https://cyberscoop.com/russia-tls-security-certificate-
| autho...
|
| https://jpgamboa.com/china-ssl-authority-revoked-by-
| browsers...
| sciencejerk wrote:
| Do some countries force the browser companies to add
| their root cert, despite abuse?
| botanical76 wrote:
| I imagine so. I understand that Opera GX, for example,
| provides a specialized version to Russian IPs that locks
| down the search engines that can be used.
| lmm wrote:
| There are always rumours. And some countries simply
| openly require computers sold in their country to have
| their root cert.
| af78 wrote:
| One attempt I know of:
| https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-
| middle_a... There might be others.
| hansvm wrote:
| You don't need fully broken encryption to gain useful
| information. Knowing how much data is transferred, to which
| servers, and when (especially with details like how various
| endpoints will inadvertently chunk up HTTPS requests based
| on the details about the content or how interactive
| sessions will have certain back-and-forth transmit
| patterns) is sufficent to generate a traffic "fingerprint"
| which you can correlate to other users, to automated traces
| crawling those same servers, and otherwise get a very good
| sense of what a user is up to online even above and beyond
| just knowing which IP is being queried.
|
| Toss that into any sort of "anomaly detection" or other
| such nonsense, and it's easy to create rare edge cases at
| an ISP level.
|
| It's somewhat analogous to how you can sometimes "reverse"
| hashes like SHA256. E.g., suppose the thing you're hashing
| is an IPV4 address. There are only 4 billion of those, so a
| pre-image attack just iterating through all of them and
| checking the forward direction of the hash is extremely
| effective. TLS makes that a little more complicated since
| the content itself is actually hidden, but time and space
| side-channels give you a lot of stochastic information. You
| might not be able to deduce somebody's bank password, but
| you can probably figure out where in the bank's login flow
| they are and approximately what they did once they logged
| in.
| extraduder_ire wrote:
| It may have been fixed since, but I saw a decent talk
| about this (defcon, IIRC) using Tinder as an example.
|
| Using timing, amounts of data, and what was being
| connected to, you could recreate what someone was looking
| at and swiping direction. (left/right sent different
| amounts of data)
| TZubiri wrote:
| ip addresses are not encrypted, they are part of the
| header, not the body. The mailman needs to know the
| address.
| kube-system wrote:
| Are you confusing DPI with MITM or something?
|
| DPI does not require any decryption of payload. Even cheap
| consumer devices can perform DPI on encrypted traffic. ISPs
| _absolutely_ use DPI as a part of standard practice, and
| have been for decades. It is a basic network traffic
| management tool.
| msp26 wrote:
| Accessing services from the UK without handing over your
| personal ID to a service that will inevitably get hacked.
|
| This happened to discord literally a few days ago.
| JonChesterfield wrote:
| "Hacked" will be "left the data on a public S3 bucket until
| someone noticed" or similar.
| hshdhdhehd wrote:
| Underrated comment. And why do we need to justify privacy?
| Justify our non-privacy!
| WarOnPrivacy wrote:
| > Getting access to geolocked data
|
| I use VPNs when I'm trying to ferret out the scope of an
| outage. I have VPN servers on local ISP which moves me around
| different routing. I use a commercial service to move me
| further out and to other countries.
| hshdhdhehd wrote:
| So you are doing a manual version of what uptime monitors do.
| WarOnPrivacy wrote:
| Sort of. I suppose the difference is that I don't need to
| know in advance where the fault is. ex: An upstream, 3rd
| party service provider appears offline.
| ragequittah wrote:
| One others seem to have missed 3. ad blocking on your phone
| away from home. Almost all VPNs have a block ads / known
| malicious traffic function. This can be done with just a DNS
| but often mobile carriers will block using your own DNS.
| baby_souffle wrote:
| The original use for a VPN - getting access to private
| resources - is still very much in play.
|
| I don't just mean being able to access some private web
| interface you have on a private server in your at home, I mean
| connecting a satellite office to the main corporate office.
|
| But for all of these consumer marketed VPNs, I think your list
| has 90%+ covered...
| TZubiri wrote:
| Interesting that we use the same word to describe both
| technologies, but semantically and technically they are very
| different.
|
| Perhaps we use the same word to describe them because
| initially they did use the same technologies, but they have
| branched out ever since? Maybe IPSec would be a common tech
| used. But the algorithms are not the same anymore since they
| serve different purposes (Personal privacy vs
| corporate/sysadmin security)
|
| In the corporate world VPNs were usually a lower level
| abstraction security mechanism or a redundant security
| mechanism to either complement application layer_security, or
| to hot-patch modern security unto legacy LAN systems. VPN
| encryption is usually provided by the local router. Common
| algorithms are IPSec/IKev2.
|
| In the personal privacy world, we are talking about a proxy
| that hides identification such as IP addresses, and pools
| connections to provide privacy. The actual encryption is not
| the main security mechanism even, as it only covers the
| transit between consumer to proxy, leaving (a potentially
| longer transit) between the proxy to the actual destination.
|
| In terms of purpose and architecture it's closer to bitcoin
| tumblers, or Tor or Freenet, or money laundering placement.
| The fact that they call it VPNs seems to me more of a
| marketing scheme or political play to avoid association with
| all of the above, than an actual technical or academical
| description. If someone were to analyse these technologies,
| I'm sure a neutral or critical approach would avoid
| uncritically calling them VPNs in the same way that research
| is published not about Viagra, but on Sildenafil.
| baby_souffle wrote:
| > Interesting that we use the same word to describe both
| technologies, but semantically and technically they are
| very different.
|
| That's where my head was at. When i hear my colleagues talk
| about a VPN, i'm thinking about an IPSEC tunnel and an
| afternoon of swearing at ios on some outdated ASA. When I
| hear regular people talking about a VPN, my mind
| immediately goes to "oh, so you want to watch rick and
| morty on netflix and don't know anybody hosting a
| jellyfin/plex server".
|
| When do we coin a new term? Or do we? Does "vpn" turn into
| a word like "truck" where it's only the context that tells
| you if we're talking about a 2 axle pickup truck in a home
| depot parking lot or something pulling a 40ft container
| unit?
| walterbell wrote:
| How do authoritarian regimes differentiate business and
| consumer network traffic, for the purpose of inspection
| and decryption, censorship of specific content, or
| blocking of specific protocols? This also overlaps with
| net neutrality and dump pipes vs. content-centric
| metering.
| Ekaros wrote:
| Company VPN most likely goes to set IP address associated
| with a business. And this is most likely a rather static
| thing. So tracking data going there is most likely
| legitimate. And well on other side they can make whatever
| comes out from business IP a problem for business.
| netsharc wrote:
| As you've written, the proxy services are called VPN
| because they used the same technology, e.g. OpenVPN.
|
| "Crypto" in the 90s meant secret keys and message
| encryption, nowadays it's the term for the numerous ponzi
| scheme "investments"...
| noman-land wrote:
| 3. Not revealing your IP/location with every outgoing web
| request.
| whatever1 wrote:
| Access sites the government has blocked in your state/country
| eloisant wrote:
| I would put that in the "geolocked data" category
| JonChesterfield wrote:
| Sharing corporate info with your employees and not everyone
| else. You know, the "go to work" thing some people do.
| TZubiri wrote:
| Just because something is called with the same name, doesn't
| mean it's the same thing. Especially if the naming is done on
| a product by a company that wants to sell the product, and
| especially if the name is not a protected trademark.
|
| Express VPN, NordVPN and Surfshark belong to another category
| of software than the VPNs used by companies.
|
| Some differences are:
|
| 1- One is used by consumers, the other is used by businesses.
|
| 2- One protects communications to a client-controlled Local
| area network. The other protects communications with third
| party services.
|
| 3- One provides encryption, the other provides anonymization.
| IAmBroom wrote:
| 1- If we both use a hammer, and you use it for business
| while I use it for DIY, the tool is still the same thing.
|
| 2- The hammer doesn't care where the nail is; local
| carpentry or third-party furniture still require the same
| tool.
|
| 3- Both sides of the VPN are encrypted to each other, and
| anonymous to anyone else. No difference that I can see.
| TZubiri wrote:
| 3. Creating multiple accounts with platforms to break their ToS
| without getting chainbanned.
|
| 4. Perform DDoS
|
| 5. brute force passwords
|
| 6. try out leaked passwords
|
| 7. exploit vulns.
|
| 8. CSAM
|
| 9. Phish
|
| 10. Spam
|
| 11. Evade taxes with crypto
|
| 12. Sell drugs
|
| 13. Terrorism
|
| Lots of malicious uses for VPNs, or was your question about
| legitimate usecases? In which case:
|
| 14. Sending emails about cryptography
|
| 15. Pornography
|
| 16. activism
|
| 17. Journalism/Whistleblowing
|
| 18. Military
|
| Although some of the legitimate/ilegitimate categories might be
| subjective, which is precisely why it's a grey legal area at
| all.
| tick_tock_tick wrote:
| I mean the EU has completely given up on free speech so if you
| want to say anything you better be hiding who you are.
| BLKNSLVR wrote:
| Australian ISPs are legally required to retain metadata for two
| years.
|
| That's one of the best reasons to use a VPN if you're in
| Australia. Give up as little as possible.
|
| I have found, however, lots of sites block or Captcha-restrict
| IP addresses that are (somehow determined as) non-residential,
| and Netflix restricts its content as well.
| globalnode wrote:
| Won't TOR browser block metadata collection?
| miki123211 wrote:
| 3. When you know/suspect your ISP is more shady than the VPN
| you're using. This applies particularly when you're doing
| something your government doesn't like.
|
| VPNs don't increase privacy, they just change who has the
| opportunity to spy on your traffic. Sometimes, it's much better
| if it's some foreign random ISP instead of your local
| government, who can send law enforcement agents where you live.
| miki123211 wrote:
| Another one is getting around content filters / service-
| specific throttling (think college dorms and campuses, hotels,
| public hotspots etc).
| klinch wrote:
| Accessing "the internet" while visiting your family in
| China/Russia/Iran/Thailand/...
| wyre wrote:
| My vpn bypasses the paywall on the public xfinitywifi hotspots
| making internet essentially free because I would likely being
| paying for Mullvad regardless.
| ornel wrote:
| Way too many services in Mexico only work from Mexican IPs,
| from paying your electricity or internet bills to topping up
| highway toll accounts and even ordering food from a supermarket
| Gustomaximus wrote:
| I use a VPN for 3 main reasons:
|
| 1) I need to come out of a particular country for some systems
| access. If I'm travelling it's easier than having IT team
| change permissions.
|
| 2) I use dedicated IPs for some systems.
|
| 3) Testing websites where I want to appear local to a
| particular country.
| apt-apt-apt-apt wrote:
| 3. Watching porn without your ISP knowing you are into furry
| sharks wearing banana costumes
| brisky wrote:
| Testing your app/website when it has different behaviour
| depending on locale
| IAmBroom wrote:
| Real, but pretty minimal usage.
| cess11 wrote:
| I work from home and use a VPN service to get a bunch of IP:s I
| can easily switch between.
|
| Recently a SaaS supplier blocked my IP because I was logging in
| programmatically every thirty seconds to collect data on batch
| processing in a customer project, basically two HTTP requests
| to get an access key and then the data, and I was lazy so I
| just put those in a script and dumped the second response to a
| log file and put that in a scheduler. Turned out that another
| customer of the SaaS supplier somehow could see the traffic on
| my customer's SaaS instance and panicked because in their mind
| it was obviously the russians attacking or something, and when
| they brought this to the supplier they also panicked.
|
| So to keep doing this I had to move over to checking whether
| the previous access key was still valid and reuse it if so, as
| well as moving my 'location' to another country. Apparently
| this is fine but logging in two times a minute is not. It also
| happens that I need to do research on network services and
| cloud environments, where having the ability to just hit a
| couple of terminal incantations to switch 'where' I am helps
| out quite a bit sometimes.
| walterbell wrote:
| _> another customer of the SaaS supplier somehow could see
| the traffic on my customer 's SaaS instance_
|
| Is this common?
| cess11 wrote:
| I'm not sure, but it definitely shouldn't be.
|
| It was surprising in a way I don't hesitate to call bad,
| but this supplier is an enterprise style organisation so of
| course they've only ranted at me and don't plan to alter
| their infrastructure.
| mrweasel wrote:
| It's probably more that a lot of people have been convinced
| that they need a VPN, but they don't. There are use cases, like
| I trust Mullvad more than I trust some random hotels WiFi. When
| traveling it can provide a slightly higher base layer of trust.
|
| If you live in a country that restricts your internet access,
| which to be fair is most these days, a VPN can help. Most of us
| just don't care about those restrictions or they are more
| easily circumvented using a 3rd. party DNS. Also if you're in
| country like Iran or Russia, you really need to trust your VPN
| provider and strange corporate structures and staff sharing
| really isn't helping in that respect.
|
| For the average person, no you don't need a VPN. You might need
| one for a few days or week per year, if you travel and need to
| access your bank or corporate infrastructure (in that case your
| employer most likely have their own VPN). VPNs are a niche
| business, but online influencers have convinced a lot of people
| that they need a VPN for everything, which simply isn't the
| case for the vast majority of us.
| haskellshill wrote:
| > I trust Mullvad more than I trust some random hotels WiFi
|
| For what exactly? All sites are HTTPS now anyway, so the only
| thing you're leaking is the hostnames / IPs you visit. I
| don't exactly see how the whole "hotel WIFI" thing is
| relevant at all, except as a dishonest marketing strategy by
| VPN salesmen
| Citizen8396 wrote:
| ...and the IPs you connect from, which tend to correlate
| with where you live, work, and so on.
| haskellshill wrote:
| You connect to hotel WIFI from home and work?
| Citizen8396 wrote:
| I plead the fifth.
| kelvinjps10 wrote:
| Why torrentingn Linux isos?
| IAmBroom wrote:
| It's the classic "legal" use for torrenting, as many Linux
| orgs send users to torrents for updates.
|
| If someone also accidentally downloads a TB of movies and
| music on the way to the latest Mint upgrade, oops.
| zer0tonin wrote:
| I have to admit that discovering that ProtonVPN was actually just
| owned by Proton Technologies feels underwhelming.
| ashirviskas wrote:
| Idk what's the official status, but it's Tesonet.
|
| Some fake debunking in the comments of this thread that is
| factually almost correct:
| https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...
|
| EDIT: ProtonVPN app was "accidentally" signet by Tesonet. How
| do you think this could happen?
| DyslexicAtheist wrote:
| thanks, this reddit thread doesn't inspire confidence in
| proton's story :/ at all
| jibcage wrote:
| It's not Tesonet, Proton is wholly self-owned and managed.
| Proton VPN was briefly sharing employees with Tesonet during
| initial app bringup, and that partnership is long over.
| Naturally due to competition and the huge importance of
| privacy in this space, people still bring this up, but Proton
| VPN does not and never will sell or share your data with
| anyone.
|
| Source: I am a Proton VPN employee.
| ashirviskas wrote:
| So, why were the employees shared?
|
| EDIT: I'm not saying being related to Tesonet is bad, but
| it is a fact that you cannot run away from.
| ivanmontillam wrote:
| > _Proton VPN was briefly sharing employees with Tesonet
| during initial app bringup_
|
| I assume they needed the experience in how to run a VPN
| company, so that initial partnership was needed.
| dchftcs wrote:
| But why would tesonet spend resources to help a
| competitor to start? I'd be surprised if there wasn't at
| least an equity deal.
| the_mitsuhiko wrote:
| > But why would tesonet spend resources to help a
| competitor to start?
|
| I thought tesonet is venture / seed fund?
| mdavid626 wrote:
| What the hell is employee sharing?
| fragmede wrote:
| It's when your director goes and tells you not to tell
| anyone but to report to another building to another team
| for a month or three, and help them with whatever they
| ask, because you have a very specific set of skills. (In
| this case, setting up VPN backend infra.)
| class3shock wrote:
| Proton's response in the thread:
|
| Hi everybody, this is Andy here. I'm one of the original
| researchers from CERN behind ProtonMail and ProtonVPN.
| There's some false info out there about ProtonVPN, and these
| stories were first fabricated by Private Internet Access, a
| competitor who has been feeling pressure from ProtonVPN
| lately.
|
| The stories are false, but we have always been very open with
| the community, so I would like to provide some background
| anyways. As many of you know, Proton has many partners
| (Radware, F5 Networks, Equinix, Radix, Farice, LeaseWeb,
| Dell, Supermicro, etc). Tesonet Lithuania is indeed a partner
| within our long list of partners, but it's a huge stretch to
| claim ProtonVPN is run by Tesonet.
|
| We first met Tesonet back in 2015 when they offered to
| provide us with internet infrastructure (we received many
| offers after the infamous 2015 DDoS attacks - we never bought
| infrastructure from Tesonet). During this period, Google was
| suppressing ProtonMail in search results, and we were
| financially suffering. To address this challenge, we needed
| to hire staff outside of Switzerland where costs are lower.
| This is how our Skopje, Prague, and Vilnius offices got
| started.
|
| Prague happened because two of ProtonMail's early hires from
| CERN were Czech. Skopje and Vilnius happened because we knew
| local partners there (it would not have been possible to
| source local candidates, handle HR and payroll, understand
| local regulations, etc, without outside assistance). We
| worked with Radix (Macedonia) and Tesonet (Lithuania) to
| accomplish this. Tesonet in particular was selected since
| they are one of Lithuania's largest tech companies (and we
| already knew them).
|
| While our early hires in both Vilnius and Skopje were always
| working fully for Proton, they were formally employed by our
| local partners because we did not have a local entity that
| could employ them. In the early days of Proton, this was not
| an uncommon arrangement since our team is spread across over
| 10 countries.
|
| In mid-2016, Google finally halted the suppression of
| ProtonMail in search results and we experienced strong
| growth. This gave us the resources to create our own
| corporate entities in Macedonia and Lithuania, and we engaged
| Radix and Tesonet to do this. We used the same legal address
| and nominee directors as our local partners because we still
| did not have our own office yet. For contractual reasons,
| these moves took some time. For example, ProtonLabs Skopje,
| our newest entity, only moved in November 2017.
|
| For historical reasons, some connections to our past local
| partners remain. Some of the IPs we use in ProtonVPN's global
| network might be acquired or leased from Radix (we have
| never, and do not currently use IPs from Tesonet - most IPs
| are from LeaseWeb or are our own IPs). Similarly, the
| ProtonVPN Android keystore mistakenly lists Tesonet as the
| organization name, since our Android developer was at that
| time formally employed through Tesonet. Due to the way the
| Android Play store works, this keystore can unfortunately
| never be changed, but it remains under our sole control.
|
| The entities we use today in Skopje and Vilnius are both
| subsidiaries of our corporate entities in Switzerland. While
| we no longer employ team members through third parties
| (except for in the United States where don't do direct
| employment), we do continue to share expertise and work on
| projects together with various partners. For example, our two
| new Swiss datacenters are being built together with Radix in
| order to share some of the fixed costs.
|
| Going forward, we will need to continue working with partners
| around the world as we grow (unless you're Google, you can't
| do everything yourself). This is not the first time one of
| our partnerships has been inaccurately portrayed (the other
| incident is so ridiculous I'm not going to mention it here).
| The truth however, is less interesting than the conspiracy
| theories might have you believe.
|
| --------
|
| Further comments on the smear campaign against us:
| The false allegations were originally spread by US-based VPN
| provider, Private Internet Access (PIA), who also happens to
| be a major competitor. We think it says a lot about them to
| be engaged in shady marketing tactics.
| ProtonVPN/ProtonMail does not, and has never used any IPs or
| servers from Tesonet (this can be publicly verified)
| Proton does not share any employees (or company directors)
| with Tesonet. This is also a verifiable fact.
| Proton has not used Tesonet for HR since 2016.
| There is little actual evidence that Tesonet does data-mining
| (in any case we have never used infrastructure from them).
| Proton has many suppliers (Dell, Juniper, Radware, etc). If
| you dig enough, you can find dirt on all of them and create a
| false narrative. We do business with other tech companies -
| this is not a secret or abnormal.
|
| We're not surprised to be attacked given how shady the VPN
| industry is. If anything, it indicates to us that we are
| doing something right.
| keyspawner wrote:
| I love Proton's stuff and use all their products -- maybe
| I'm just being paranoid, but even though the explanation
| makes sense, I still wonder about those old connections.
| Would be nice to see more official proofs
| supriyo-biswas wrote:
| > The false allegations were originally spread by US-based
| VPN provider, Private Internet Access (PIA)
|
| While such comments may be okay in other forums, please
| note that the HN guidelines forbid such:
|
| > Please don't post insinuations about astroturfing,
| shilling, brigading, foreign agents, and the like. It
| degrades discussion and is usually mistaken. If you're
| worried about abuse, email hn@ycombinator.com and we'll
| look at the data.
| domenbukovac wrote:
| > Due to the way the Android Play store works, this
| keystore can unfortunately never be changed, but it remains
| under our sole control.
|
| Out of curiosity, why not release the new version as a
| separate app under a new package name. I realise that's not
| an ideal solution since it would mean starting fresh with
| installs and reviews, but it could allow you to move
| forward without being locked into the old key.
| oefrha wrote:
| > it would not have been possible to source local
| candidates, handle HR and payroll, understand local
| regulations, etc, without outside assistance
|
| I have no dog in this fight, but I agree with the "smear
| campaign" that this is 100% bullshit. I work for a fully
| remote company with employees from all over the world,
| including Eastern Europe, and we didn't need to partner
| with any local company, let alone a competitor. Plus even
| if we need local HR assistance there are plenty of
| global/local HR services to choose from that focus on HR,
| no "employee sharing" needed.
|
| I don't know if any other claims are false, but this kind
| of bullshit obvious to anyone who has been in a similar
| position undermines everything else they claim. Plus it was
| never mentioned what these "local partners" get in return,
| which seems to be the most interesting thing if there's no
| secret ownership, which is the thing they set out to
| debunk.
| octo888 wrote:
| Are we allowed to discuss (edit: if it's not too political?) if
| Kape Technologies has any connections to Israeli security
| services, given the nature of VPNs and given the amount of data
| that can be trivially collected, and:
|
| "Being from Israel, Teddy Sagi had connections with the Israeli
| military intelligence sphere and was able to procure himself a
| real-life cyber spy [his co-founder] from the famed Unit 8200
| (kinda like Israel's version of the NSA)" [0]
|
| ?
|
| [0] https://windscribe.com/blog/what-is-kape-technologies/
| gruez wrote:
| >Teddy Sagi had connections with the Israeli military
| intelligence sphere
|
| Does this mean much given that israel has mandatory military
| service? Unlike in the US where you have to make a conscious
| choice (eg. patriotism or desperation) to join the
| CIA/NSA/military, that's not really the case in israel. "has
| ties to unit 8200" might as well mean "has ties to
| stanford/MIT/caltech" or "has ties to big tech".
| sporkxrocket wrote:
| Unit 8200 is a cyberwarfare and spy unit. They were
| responsible for the Lebanon pager supply chain terror attack.
| I definitely want to know if they are involved with any tech
| I'm using so I can avoid it.
| pfexec wrote:
| > I definitely want to know if they are involved with any
| tech I'm using so I can avoid it
|
| Are you going to stop using Linux because the NSA is a
| major code contributor?
|
| Huawei is too, and they were founded by a guy from the PLA.
| jasonvorhe wrote:
| this is not a helpful argument. this isn't about not
| using Israeli OSS software but services that feed data
| into the surveillance grid of quasi rogue state.
| sobelabwhaman wrote:
| Linux is not operated by NSA and is open for inspection.
| Can you say the same about VPN services in question?
|
| It would be naive to think Huawei is isn't influenced by
| CCP, specially if it is found, by presumably someone from
| PLA intelligence unit by your suggestion.
| gruez wrote:
| I don't see how that addresses my point that enlistment is
| mandatory in israel. You can make similar claims about
| other israeli military units. If anything, given the
| current war in Gaza whatever the other IDF branches/units
| are doing are probably worse than hacking a few phones.
| sporkxrocket wrote:
| Unit 8200 is part of the IDF and contributing to those
| war crimes. I as a consumer only need to consider my own
| risk profile, not the politics of an entity that's
| committing acts I consider to be terrorism.
| tguvot wrote:
| yes. they are involved in tech that you are using. they are
| working in apple, google, microsoft, nvidia, intel, amd,
| arm, qualcomm, cisco, etc that have presence in Israel and
| even expand it.
|
| https://www.timesofisrael.com/nvidia-plans-to-boost-
| presence...
| sporkxrocket wrote:
| Talking about the breath of which Israel has compromised
| our technology is actually helping to make my point.
| They're operating a comprehensive surveillance network
| and have the ability to literally plant explosives in our
| consumer devices.
| tguvot wrote:
| yeap. they are watching you right now. your toaster oven
| isn't as innocent as it appears
| sporkxrocket wrote:
| https://en.wikipedia.org/wiki/2024_Lebanon_electronic_dev
| ice...
|
| > _the attack killed 42 people, including 12 civilians,
| and injured 4,000 civilians_
| tguvot wrote:
| toaster oven records everything that you post and reports
| it back. also plants placed by 8200 engineers in your
| laptop hardware and software
| michaelt wrote:
| If I was running an intelligence agency and was given my
| choice of conscripts,
|
| I wouldn't hand my intelligence secrets to people who
| resented being forced to be there; or to mouthy people I
| thought might blab about it after the end of their service;
| or to people with an anti-authority streak or at risk of a
| Snowden-style attack of conscience about civil liberties.
|
| I would select for people with a deep love of their country;
| and a sense of loyalty that would extend well beyond the end
| of their service. The rest I'd send elsewhere - plenty of
| other units need tech folks, that drone/radio/printer isn't
| going to fix itself.
| black3r wrote:
| On the other hand, if as an aspiring software engineer I
| was forced to do military service and had the option to do
| it as part of a military cybersecurity unit, I'd pick that
| over running around with weapons without blinking an eye.
| lmm wrote:
| > Does this mean much given that israel has mandatory
| military service?
|
| Yes. Mandatory military service is still military service.
| It's still following government orders at an impressionable
| age in a culture that deliberately inculcates a mentality of
| following orders even when they go against your every human
| instinct. It still means working for an organisation that
| knows its job is killing people, even if you're not the one
| pulling the trigger yourself. And Israeli military
| intelligence specifically has a long history of keeping
| supposedly retired civilians on as sleeper agents who
| infiltrate supposedly neutral companies.
|
| (Does that mean this guy specifically is definitely one of
| them? Of course not. But to anyone with reason to be using a
| VPN at all it's probably too much of a risk)
| Hikikomori wrote:
| Israeli crypto ag
| dagaci wrote:
| I liked Express VPN
| TZubiri wrote:
| I think VPNs are one of the clearest cases of tech/politics
| intersection, it's not just OT for tech but also for hacker
| culture.
|
| What do you think @dang ?
| Illniyar wrote:
| Unit 8200 is the premier software development track in the
| Israeli military.
|
| Every Israeli tech company likely has multiple developers from
| Unit 8200 in it. Whether it's building e-commerce shops or
| making video games.
|
| While 8200 definitely falls under the military intelligence
| wing, I don't think describing people in it as Cyber Spies is
| anywhere near accurate. And unless that guy was very high
| ranking it is a stretch to imply that's an indication that IL
| military intelligence is involved in the company.
|
| That is not to say that the military isn't involved with the
| company - that might very well be true, just that someone being
| from Unit 8200 isn't an indication of it.
| jojobas wrote:
| Makes perfect cover though? "He was only a conscript changing
| printer cartridges"
| true_religion wrote:
| People who don't live in countries with mandatory
| conscription for all don't really understand: everyone is
| connected to the military but it means nothing.
|
| Judging an Israeli citizen on their IDF ties is like
| judging a US citizen on the fact that they went to public
| school.
| close04 wrote:
| It doesn't matter if it's accurate or not, such
| judgements are made by most people every day. Someone who
| was professionally formed somewhere has a higher
| probability of ties to them later on. Being intelligence
| services this might be even more true.
|
| In today's political climate where people around the
| world see Israel judging (and sentencing, and carrying
| out the punishment) every Palestinian as terrorists, I
| think this wide brush of judging Israelis on their ties
| with the IDF is probably widely accepted as "only fair".
| When it comes to Unit 8200 the implications are even
| stronger.
|
| But I don't get the US public school system reference.
| You have to start with a baseline and if you see a
| private Ivy League school on someone's CV and a random
| public school on someone else's I'm sure you'll probably
| make the obvious assumption about which one is better,
| even if sometimes the obvious is wrong.
| mnw21cam wrote:
| According to google, 87% of Americans go to a state-
| funded school, so yes judging an American based on the
| fact that they could afford to be in the top 13% and go
| to a public school instead is legitimate. This doesn't
| seem to match what you're trying to say.
| rmccue wrote:
| You're using the British definition of "public school"
| here, which is a "private school" in the US. US public
| schools are equivalent to UK state schools, in that both
| are run by the state.
| pessimizer wrote:
| > everyone is connected to the military but it means
| nothing.
|
| No, people who live in _tiny_ countries with mandatory
| conscription don 't really understand that it means that
| their entire country is militarized. It's not surprising
| that fish can't see water.
|
| > is like judging a US citizen on the fact that they went
| to public school.
|
| It's exactly like that. If public school in the US
| trained people to kill and spy, it would be entirely safe
| to assume that the US was full of killer spies. For
| example, if you know that US public school taught a view
| of world history that was distorted in particular ways,
| and had very little emphasis in foreign languages, it
| would be safe to assume that Americans have a distorted
| view of the world, and largely don't speak foreign
| languages.
|
| I don't know, this seems basic to me.
| LMYahooTFY wrote:
| Cover to do what? Insert malicious code and hope no one
| else notices? Or coerce everyone in the company to look the
| other way?
|
| If an intelligence agency wants to compromise a service,
| they have much more discreet, powerful, and deniable ways
| to accomplish this.
| class3shock wrote:
| Kape was Crossrider which was linked to malware (per link)
|
| https://cyberinsider.com/private-internet-access-kape-crossr...
| LightBug1 wrote:
| Just cancelled my Cyberghost subscription for exactly this
| reason.
| immibis wrote:
| [flagged]
| dang wrote:
| https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.
| ..
|
| https://news.ycombinator.com/item?id=45496427
| dboreham wrote:
| NSA presumably?
| tacker2000 wrote:
| I tried Proton but their VPN wasnt as good as NordVPNs...
|
| But if Nord is sketchy, what is the recommended one?
| Havoc wrote:
| Depends on what you mean by "good".
|
| Fast/low latency is to some extent diagrammatically opposed to
| high quality privacy. The fastest route is always you to
| source. The more hops/mixers/proxies/things you add the worse
| the experience gets
| zelphirkalt wrote:
| You will have to be a lot more specific than "wasn't as good
| as", to get a response that is helpful to you. What are you
| looking for in a VPN provider?
| tacker2000 wrote:
| I wanted to watch some football world cup highlights video
| from a japanese TV channel site, which didnt work with
| Proton, but did with Nord, so I have been with them since
| then.
|
| This was during the 2022 WC though, so maybe Proton is better
| nowadays.
| eloisant wrote:
| I think they got better, I'm watching geofenced Japanese
| content all the time with Proton.
|
| In the past I occasionally had to select a different server
| from whatever it picks by default but I've always been able
| to watch my content.
| flexagoon wrote:
| Mullvad, Proton, IVPN and sometimes Windscribe are generally
| considered the most trusted
| y-c-o-m-b wrote:
| That's actually interesting. My yearly Proton subscription
| ended several months ago and I tried both NordVPN and
| ExpressVPN before switching back to Proton. The other two
| options had limited server locations and I wasn't a fan of the
| software/setup. There's also a weird shady vibe with how they
| do their advertising compared to Proton, can't quite put my
| finger on it though. Proton's software also seems to be more
| intuitive (although a bit clunky).
| brikym wrote:
| Um, is it some intelligence agencies?
|
| > ExpressVPN was founded in 2009 by Peter Burchhardt and Dan
| Pomerantzwe who later sold it to British-Israeli security
| software company Kape Technologies
|
| Close enough.
| nerdsniper wrote:
| Note that all of these companies are also under the umbrella of
| Tesonet, a Lithuanian VC firm also headed by Tomas Okmanas (Tom
| Okman in TFA). Their flagship investments are Nord Security,
| Hostinger, Oxylabs, Surfshark, Decodo, Mediatech, and nexos.ai -
| all closely related business models around proxying.
|
| They don't seem to have Russian ties: "In 2022, CyberCare opened
| an office in Lviv, Ukraine. Although planning for the move
| started before the war, according to Dainius Vanagas, CEO of
| CyberCare, one of the reasons why it was followed through was a
| desire to help Ukraine rebuild."[0]
|
| They also donated money to help arm Ukraine.
|
| 0: https://en.wikipedia.org/wiki/Tesonet
| ashirviskas wrote:
| Don't forget ProtonVPN links to Tesonet, which they're trying
| hard to "debunk" (though no clue why, I have nothing against
| Tesonet). They only shared employees and accidentally signed
| apps with the same certificates, but are "totally unrelated".
| Their PR people are already on this thread.
|
| If they didn't try so hard to fight it, people might care less.
| rasengan wrote:
| Back when I was running PIA, they threatened me a significant
| amount just for pointing these facts out.
|
| Now that I launched a verifiable VPN, they are once again
| sending legal threats [1].
|
| [1] https://vp.net/l/en-US/blog/Verified-Privacy-vs-Trust
| getcrunk wrote:
| So did you sell pia? Why won't you sell your next venture ?
| rasengan wrote:
| I did not sell PIA. I entered into a merger agreement to
| create a publicly owned privacy company. Without getting
| into detail, I left the company on principle receiving
| only 1/3rd of the value for the shares.
| getcrunk wrote:
| Btw I used to love pia, I think I'll check your new one
| out!
| causality0 wrote:
| Used to love? What changed? PIA hasn't always had the
| best performance but they are on the list of VPNs who
| were subpoenaed and had no data to give the court.
| MezzoDelCammin wrote:
| my $.02 : I tried them, but found their "we support
| Wireguard" a bit misleading. They only did so via their
| app. No way to get a stable configuration for a router
| (other than run a python script to get one from the app,
| without any guarantee how long is that config valid for).
| qmr wrote:
| Why?
| nerdsniper wrote:
| "Without getting into detail"
| class3shock wrote:
| The same PIA which is now part of Kape Technologies which
| under its former name of Crossrider was known for malware?
|
| https://cyberinsider.com/private-internet-access-kape-
| crossr...
| pydry wrote:
| If you cant trust VPNs sold to dodgy Israeli spyware
| firms who can you trust?
| commandersaki wrote:
| Freenode, never forget.
| perks_12 wrote:
| what makes your vpn verifiable? can i verify you run
| specific oss on your servers? secure enclave is just
| management's idea of implementing crypto. everyone out here
| knows that it is highly flawed and intel with their
| management engine bullshit can't be trusted at all.
| rasengan wrote:
| You might find this helpful:
| https://youtu.be/sz7NAe0G1_Y?si=focPEWli8xv7NCDi
|
| Re verifiability: the point isn't trust us, it's that you
| don't have to.
|
| We built it so anyone can independently confirm what's
| running.
|
| 1. All server and client code is published.
|
| 2. Builds are reproducible.
|
| 3. Each node provides cryptographic attestations of its
| runtime and routing identity.
|
| 4. Enclaves are used for verifiable isolation.
|
| You can peruse the code yourself to see exactly why the
| transparency we bring makes legacy "trust based" VPNs
| obsolete: https://github.com/vpdotnet/vpnetd-sgx
| idiotsecant wrote:
| It looks like this boils down to 'check the magic number
| in the code against the magic number our server gives
| you. It matches!!!'
|
| Is there some indication the user has that your server
| isn't simply hard coded to return the right magic number?
| I don't understand how this provides any assurance of
| anything.
| MagicalTux wrote:
| The SGX certificate is signed by intel and includes a
| certification of the hash of the code loaded in the
| secure enclave ("MRENCLAVE").
|
| When the client connects to the server, the server
| presents a tls certificate that includes an attestation
| (with OID 1.3.6.1.4.1.311.105.1) which certifies a number
| of things:
|
| - the TLS certificate's own public key (to make sure the
| connection is secure) - The enclave hash
|
| It is signed by Intel with a chain of custody going to
| intel's CA root. It's not "just a magic number" but "a
| magic number certified by Intel", of course it's up to
| you to choose to trust Intel or not, but it goes a much
| longer way than any other VPN.
| philipwhiuk wrote:
| Ah yes, the King of Joseon Cybernation is a trustworthy
| source.
| freehorse wrote:
| There is no mention of proton whatsoever, even more sending
| legal threats to your vpn, in the link though?
| InsideOutSanta wrote:
| "Links to" is doing a lot of work in that sentence. ProtonVPN
| is owned by Proton, which has no legal ownership ties with
| Tesonet. During Proton's expansion into Eastern Europe,
| Tesonet initially assisted Proton with HR, payroll, and local
| regulation, so for a period of time, people working for
| Proton were employed by Tesonet, since Proton had no local
| subsidiary that could hire them. These were not "shared
| employees", they worked exclusively for Proton.
|
| In 2016, Proton created its own subsidiary, and these people
| are now employed by Proton. But for this historical reason,
| the ProtonVPN keystore on Android still lists Tesonet as the
| organization name, even though it is fully controlled by
| Proton.
|
| None of this is "debunking"; these are just the facts. You
| can make of them what you will, but you should be honest
| about what actually happened when you talk about it.
| bonaldi wrote:
| > Tesonet initially assisted Proton with HR, payroll, and
| local regulation
|
| Entirely normal behaviour for a competitor to provide "HR
| assistance".
| InsideOutSanta wrote:
| I've been part of a European startup that added offices
| in Asia and the US, and we initially always partnered
| with local companies to do this. It's mutually
| beneficial. It allowed us to grow more quickly, and it
| allowed them to make relatively easy money (and, in our
| case, to dump some of their shittier employees on us
| without us knowing).
|
| In Proton's case, they already knew each other because
| Tesonet had previously offered to provide infrastructure
| during a DDoS attack against Proton.
|
| So maybe it's a conspiracy, or maybe it's just how things
| go. You can make up your own mind, but you should provide
| the facts when you make sinister insinuations.
| danw1979 wrote:
| You know an awful lot of detail about the inner workings
| of two separate private companies though.
| InsideOutSanta wrote:
| LOL, now I'm part of the conspiracy. This is all public
| knowledge.
| dsr_ wrote:
| Then you could provide sources, please?
| InsideOutSanta wrote:
| Here you go: https://www.reddit.com/r/ProtonVPN/comments/
| 8ww4h2/protonvpn...
|
| Here's the Handelsregisterauszug for Proton, which shows
| ownership: https://www.zefix.admin.ch/en/search/entity/li
| st/firm/118926...
|
| Proton's peering relationships:
| https://bgp.tools/as/62371#asinfo
|
| I'm not sure what exactly you're looking for.
| steve1977 wrote:
| > Here's the Handelsregisterauszug for Proton, which
| shows ownership
|
| It doesn't. It's a joint-stock corporation and while the
| shareholders are registered, the register is not public.
| InsideOutSanta wrote:
| Proton discloses shareholder information here:
| https://proton.me/support/who-owns-protonmail
|
| But I guess they could be lying.
| ddtaylor wrote:
| Them providing information isn't the same as publicly
| verifiable information.
| squigz wrote:
| Is it really that shocking that someone on HN would have
| worked at as many as _2_ private companies?
| IAmBroom wrote:
| Nor is it shocking that a company with a PR issue would
| be astroturfing our forum.
|
| The point is: we don't know.
| rasengan wrote:
| > so for a period of time, people working for Proton were
| employed by Tesonet, since Proton had no local subsidiary
| that could hire them. These were not "shared employees",
| they worked exclusively for Proton. In 2016, Proton created
| its own subsidiary, and these people are now employed by
| Proton. But for this historical reason, the ProtonVPN
| keystore on Android still lists Tesonet as the organization
| name, even though it is fully controlled by Proton.
|
| So either:
|
| 1. Tesonet/Nord are loose with their private keys.
|
| 2. Proton isn't being truthful.
|
| Anyone who understands crypto and key management knows "not
| your keys, not your _____."
|
| If those staffers worked for Proton and not Nord, why did
| they have Nord's key?
|
| This level of negligence with private key management really
| can't be explained away.
| InsideOutSanta wrote:
| Proton explains this here:
|
| https://redlib.catsarch.com/r/ProtonVPN/comments/8ww4h2/p
| rot...
|
| I suppose you're free not to believe them, but I'm unsure
| what exactly you believe is happening here and what
| exactly Proton is lying about. Tesonet secretly owns them
| and has been running a decades-long misinformation
| campaign to trick you into thinking they don't? To what
| end? It's not like Tesonet is some nefarious company we
| should all be afraid of. What would they gain from lying
| about this if it were true?
|
| And how can they make such an obvious mistake with their
| certs and then not make another one for the next decade?
| It's just not plausible.
|
| At some point, you've gotta use some common sense.
| rasengan wrote:
| My comment still applies regardless of any level of
| "explaining" [1]:
|
| 1. Either Nord/Teso are loose with keys (horrible)
|
| Or
|
| 2. Proton isn't being truthful.
|
| I don't think it's a conspiracy or anything that it is
| Tesonet/Nord. Rather, the problem is you cannot trust
| someone with your privacy if they can't even manage their
| own keys.
|
| [1] The explanation is poor at best and doesn't explain
| why they worked so hard to try to delete all of the
| evidence (all of which was archived already).
| Additionally, nothing can explain away the lack of
| security with key management across these two orgs.
| InsideOutSanta wrote:
| The people who couldn't handle their keys were at Nord.
| The people you trust are at Proton.
|
| _> worked so hard to try to delete all of the evidence_
|
| The cert is still there. Apparently, they didn't work
| nearly hard enough.
| rasengan wrote:
| They worked pretty hard as detailed in an archived
| article changing names and any records they could [1],
| but you're right - not good enough [2].
|
| As pointed out on this reddit post [3], Proton's appears
| to contradict itself a number of times.
|
| It's a good thing trust based VPN's are obsolete. After
| all, trust isn't constant [4] as seen in this article
| showing how Proton supplied IP addresses to
| "authorities."
|
| [1] https://archive.ph/wG8t8
|
| [2] https://archive.ph/4bzBm
|
| [3] https://www.reddit.com/r/technology/comments/8x9aik/p
| rotonvp...
|
| [4] https://techcrunch.com/2021/09/06/protonmail-logged-
| ip-addre...
| ddtaylor wrote:
| Did they sign things with the wrong keys?
| 3abiton wrote:
| The streisend effect. Although, personally I am interested in
| this topic, as everyone using these VPNs is one ToU change
| away from being data mined at all time.
| haskellshill wrote:
| Proton are pretty shady. The Radware ties, the blocking of
| two journalists, etc. etc.
| mapontosevenths wrote:
| For anyone else who wondered what the radware thing was.
|
| https://proton.me/support/protonmail-israel-radware
| wraptile wrote:
| I used to work at Tesonet (as software engineer) and I'm not
| familiar with corporate politics / ownerships but they're
| lovely people that would 100% walk out if there were some real
| Russian ties involved.
|
| Lithuania is a really small country and IT has been a huge
| economic strategy since early 00s as a way to become
| economically independent specifically because of Russia and it
| worked out really well.
| nerdsniper wrote:
| I have a good friend from Lithuania, who has told me so many
| amazing/wonderful/superlative things about the country he
| grew up in and loves very dearly, as well as its people. I
| can't wait to visit someday. Unfortunately, he only has
| Russian and American citizenship, so he can't purchase real
| estate there currently, but luckily most of Lithuania's
| restrictions have been very common-sense (applying only to
| people who frequently travel between Russia and Lithuania).
|
| From what I can tell, Tesonet seems like a very patriotic
| group (as much as a corporation can be personified at all),
| and genuinely puts resources, both human and financial,
| towards raising up the local communities.
|
| It's interesting to me that Tesonet has concentrated the most
| popular VPNs under one roof and is involved in so many
| companies that could be described as "dual-use" (white
| hat/black hat) such as residential/mobile proxies, ai-powered
| scraping, etc. It tells me that Tesonet has a very sharp
| understanding of gray-hat landscapes. It does seem like their
| portfolio could be leveraged as a valuable asset to any
| powerful interest, regardless if they are benevolent or
| malicious or misguided.
|
| I mentioned Tesonet's stance towards Ukraine because
| Lithuania has a number of wealthy ex-soviet/Russian citizens
| and business-owners with differing politics, and wanted to
| clarify that for any readers who might wonder.
|
| Additionally, I've always been very impressed with Estonia's
| digital infrastructure and Ukrainian software engineering -
| not just JetBrains but also other vendors that I've worked
| with personally. Seems like there are a lot of highly skilled
| people concentrated in your region.
| crossroadsguy wrote:
| I couldn't really get that segue from Lithuania to Estonia.
| Did you mean to type "Lithuania" in the last paragraph as
| well?
|
| Here..
|
| > Additionally, I've always been very impressed with
| Estonia's ...
|
| Before that you were talking about Lithuania exclusively.
|
| And then:
|
| > ... Estonia's digital infrastructure and Ukrainian
| software engineering - not just JetBrains ...
|
| I think it was founded in CZ and is now HQed in NL. Right?
|
| A typo? Or there's some relation between the two countries
| and whether JetBrains has some history with these two that
| is missing here?
|
| (I am not trying to nitpick, really interested in knowing
| whether there's some angle/twist here, since the post
| itself is about hidden connections and what not).
| eszed wrote:
| They're neighboring small countries with similar
| (centuries' long) histories of tension with Russia, in
| its various guises. They're often considered _en bloc_ :
|
| https://en.wikipedia.org/wiki/Baltic_states
| nerdsniper wrote:
| > (I am not trying to nitpick, really interested in
| knowing whether there's some angle/twist here, since the
| post itself is about hidden connections and what not).
|
| Honestly that shone through even from the first sentence.
|
| I mentioned Estonia because Lithuania/Latvia/Estonia have
| a bit of shared identity, kind of similar to
| Sweden/Norway/Finland or USA/Canada.
|
| > I think it was founded in CZ and is now HQed in NL.
| Right?
|
| Yes I was just wrong. I was convinced it was Ukrainian
| for some reason.
|
| I agree that the combination of those two points made my
| post particularly confusing.
| konart wrote:
| JetBrains was russian (as in were most people initially
| actually worked). They were smart enough (like any
| business in russia not wanting to be trapped) to have
| registration outside of the country.
|
| Some part of management were in CZ. Most of the technical
| team were in three buildings in St.Petersburg.
| crossroadsguy wrote:
| Wow. Didn't know. As an Android developer I find it
| specially interesting. Not for any nefarious reasons, for
| I so far believe that JetBrains is one of those companies
| that has been a net positive on tech ecosystem in general
| (touchwood!) -- be their dev tools or the Kotlin itself.
| I also follow these people and tools, partly out of
| professional needs/curiosities.
| konart wrote:
| FYI Kotlin language is named after
| https://en.wikipedia.org/wiki/Kotlin_Island
| crossroadsguy wrote:
| Aha. I see that it was also called "Kotling". I guess
| they missed this opportunity, or maybe KotLang, in which
| case people would have started calling it just Kot.
|
| Also the place seems to have quite a few rebellions under
| its belt.
| ZoomZoomZoom wrote:
| > most of Lithuania's restrictions have been very common-
| sense (applying only to people who frequently travel
| between Russia and Lithuania).
|
| Common-sense like a complete ban for entering the country
| for red passport holders.
|
| Lithuania is a wonderful, beautiful country and I
| understand the need to push the hardliner stance in the EU,
| but their decisions during the conflict have been strictly
| political, not in the slightest "common-sense".
| MaxPock wrote:
| Isn't Lithuanian passport red ? or the context here is
| communism ?
| ZoomZoomZoom wrote:
| Turns out it's indeed red, but it's been green for a long
| time.
|
| Context here is Russian Federation.
| SV_BubbleTime wrote:
| After seeing the front end and the tiniest bit of backend on
| CrowdStrike and why they're in Ukraine... I wouldn't say any
| company with offices there makes me feel at ease. It's not
| better.
| fy20 wrote:
| Calling Tesonet a VC firm isn't really an accurate description
| of their history. They started as an IT services company (which
| they still do), then split out internal services into
| effectively separate companies (e.g. CyberCare was originally
| built to manage customer support for NordVPN).
|
| Now they have got more money than they know what to do with so
| are making VC investments.
| moontear wrote:
| "all of these companies" are you sure? Did you check the VPN
| relationships diagram that is within the article? Tesonet is
| listed and linked.
| pessimizer wrote:
| I have absolutely no idea why Russian ties are supposed to be
| more worrying than Ukrainian ties.
|
| Ukrainian ties with government and tech in the US have been a
| serious source of problems; our last President was haunted by
| business ties with Ukraine; our current President was impeached
| for refusing to sell weapons quickly enough to Ukraine; we
| funded neo-Nazi groups in Ukraine in order to bring down its
| elected government and replace it with a puppet government that
| immediately set its sights on eradicating the Russian presence
| from Ukraine; Crowdstrike, a company of Ukrainian origin, was
| the company whose analysis was taken as gospel for the
| Democratic Party email leaks, and that report was used to
| market Russia into the greatest enemy the world has ever known,
| creating an entirely fictional narrative now referred to as
| Russiagate; and during this entire process the West and the US
| have been sending palletloads of cash and weapons to Ukraine to
| the tune of tens or hundreds of billions of dollars, and
| becoming personally financially entangled with Ukrainian
| oligarchs.
|
| Why should I be worried if the Russians are eavesdropping on my
| proxy again? They're not going to send it to anyone who cares
| about what I'm doing, and they certainly don't care what I'm
| doing. Ukraine is the most corrupt, poorest country in Europe,
| completely tied up with US intelligence, and is "run" by a tv
| actor.
| verteu wrote:
| Russiagate was not a "fictional narrative," as a cursory
| amount of research will reveal.
|
| > The Republican-led Senate Intelligence Committee
| investigation released their report in five volumes between
| July 2019 and August 2020. The committee concluded that the
| intelligence community assessment alleging Russian
| interference was "coherent and well-constructed", and that
| the assessment was "proper", learning from analysts that
| there was "no politically motivated pressure to reach
| specific conclusions".[11][12] The report found that the
| Russian government had engaged in an "extensive campaign" to
| sabotage the election in favor of Trump, which included
| assistance from some of Trump's own advisers.
| IAmBroom wrote:
| Our last President was haunted by completely unverified
| claims of business ties with Ukraine. Someone in UKR clearly
| tried to buy influence via his son, but all the force of Fox
| News and the GOP together couldn't produce one single sticky-
| note worth of evidence tying it to any success.
|
| Painting "armed invasion" as "Russian presence" is like
| calling "stabbing someone in an alley" a "medical procedure".
|
| We get it; you love Mother Russia.
| dongcarl wrote:
| We should really be moving towards a world of Multi-Party Relays
| rather than Single-Party VPN operators:
| https://www.privacyguides.org/articles/2024/11/17/where-are-...
|
| With Multi-Party Relays you no longer have a trust a single
| entity not being malicious or compromised.
|
| Disclaimer: I run obscura.net, which does exactly this with
| Mullvad (our partner) as the Exit Hop.
| sporkxrocket wrote:
| Can you control the geography of the exit node? I really like
| Private Relay but it doesn't get around geo restrictions
| because the IP is still in the same country you are.
| dongcarl wrote:
| Yes, you can with Obscura. That limitation of Private Relay
| is just an arbitrary limitation made by Apple.
| anticensor wrote:
| And so by design.
| FlynnLivesMattr wrote:
| Hey Carl! This is the first I'm hearing of Obscura. After doing
| a deep dive into your product, it looks to be a very
| fascinating privacy tool. However, I'm concerned with your
| operating under US jurisdiction, as detailed by others here:
|
| https://discuss.grapheneos.org/d/20059-obscura-vpn-and-mullv...
|
| While I understand potentially not wanting to incorporate in
| the EU (with Chat Control on the horizon) nor Switzerland (due
| to their own non-EU-related privacy backslide), why still
| select the US, which historically other privacy tools have
| largely avoided? It feels like you're already shooting yourself
| in the foot, whereas you'd be good in the EU should Chat
| Control not pass. While it's great that you verifiably can't
| see a user's internet traffic, you're one US court order away
| from a forced compromising of the service for a user (or at
| least, giving up the connecting IP). Historically, EU court
| orders have been easier and more transparently fought by
| privacy tools.
|
| Non sequitur, it would be great if you prioritized accepting
| Monero as payment, like your exit hop Mullvad. Also, how much
| control do we have over the features Mullvad offers (e.g.
| DAITA, quantum resistance, DNS filters, IPv6, integration with
| Mullvad Browser)?
| dongcarl wrote:
| > should Chat Control not pass
|
| Unfortunately in the world we live in no single jurisdiction
| is good enough anymore, laws can always change and Chat
| Control can be re-proposed over and over again.
|
| Luckily, an MPR like Obscura with hops across different
| jurisdictions (Obscura in US, and Mullvad in EU) give you a
| much better scenario than just being in one jurisdiction.
|
| > it would be great if you prioritized accepting Monero as
| payment
|
| Definitely prioritized, one of our engineers is working on it
| right now.
|
| > Also, how much control do we have over the features Mullvad
| offers (e.g. DAITA, quantum resistance, DNS filters, IPv6,
| integration with Mullvad Browser)?
|
| We're limited by the Partner API that Mullvad offers right
| now, but we'll be looking into many of these soon. For
| example, we're implementing DNS filtering as we speak!
| Thystler wrote:
| Hey,
|
| This is is what i wrote my master thesis on. I ended up not
| turning it into something proper. Thank you! i love that you
| did this!
|
| Its awesome! OMG good job!
| dongcarl wrote:
| Ah that's excellent! Do you have a link to the thesis?
| thenthenthen wrote:
| Does obscura work in China? Doe you have a free tier option for
| me to test?
| dongcarl wrote:
| We've had many reports that it works. In fact, one of our
| users told us he took an hour video call over Obscura in
| China and things worked smoothly!
|
| Unfortunately, because we don't identify users we cannot
| offer a free tier (since that would allow anyone to use it
| freely indefinitely).
|
| However, you can always just top-up for 1 month to see how it
| works for you! Would love to hear your experience.
| mcdonje wrote:
| Hypothetically, could tor switch to using QUIC?
| dongcarl wrote:
| You could probably implement a pluggable transport for it?
| gregorvand wrote:
| Handy that while connected via ExpressVPN, this is blocked
| zImPatrick wrote:
| what server are you connected to? Switzerland works just fine
| for me
| gregorvand wrote:
| it was one of the UK servers
| aussieguy1234 wrote:
| Why you probably don't need a VPN:
| https://stevesrantsnraves.blogspot.com/2024/09/why-you-proba...
| cchance wrote:
| Mullvad nuff said
| kovrik wrote:
| They don't support port forwarding anymore though.
| codazoda wrote:
| If you're worried about your VPN provider but you can trust your
| VPS provider, try an SSH Tunnel.
|
| https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-priv...
| Theodores wrote:
| Thanks for the link. How does this work on the server side? It
| gets packets on 8080 and then what? The article needs to
| explain the server config, even if it is just how to install
| ssh-server.
|
| I have tried setting up OpenVPN on my own VPS and I didn't get
| very far with it. I have also had to use OpenVPN in the day job
| and I much prefer just using ssh without some extravagant
| OpenVPN layer.
|
| My experience of failing to configure a VPN of my own
| (primarily for testing GeoIP) led me to try a few VPNs and the
| amount of junk adverts and whatnot made me wonder if it was
| time to fdisk my computer and start over due to the virus-vibes
| I was getting from a VPN. This was in the days before VPN
| adverts on lame YouTube channels, so I presume the product has
| improved since then.
|
| In theory, someone smarter than me can rent a VPS and get
| OpenVPN on there, or, better still, a remote desktop so that
| only the screen image goes over the internet from the VPS to
| the PC, X-Window style but better. This could be further
| obfuscated by using 443 and one's own special ROT13
| 'encryption'.
|
| Presumably a skilled person that knows what they are doing
| could get it all setup in an hour, to write concise
| instructions that 'civilians' can work through in pretty much
| the same time.
|
| If you were highly invested in porn, watching Netflix in
| foreign countries and with even worse stuff to hide, you would
| think that some investment in getting a proper VPN with your
| own VPS would be the way to go, but no. Cost isn't the problem
| if you are deeply into something worth hiding, so why do so few
| people roll their own VPN?
|
| The reality is that the typical product is marketed with FUD
| and the goal is to turn you into a 'sleeping giant'. A
| 'sleeping giant' is a customer that has a standing order or
| other payment arrangement that is for a service that is not
| used, and for that to not be noticed on bank statements.
| Everyone wants you to be a 'sleeping giant', including some
| 'worthy' charities, dating websites and every software
| subscription service. They aren't using FUD marketing though.
|
| The commercial VPNs have mastered the art of selling a product
| that deserves technical knowledge to understand to the masses,
| so you have got to respect the hustle.
| londons_explore wrote:
| VPS's that you can easily spin up for an hour or two tend to
| charge $$$$ for egress bandwidth, which makes them an
| unattractive option for streaming video over.
| flexagoon wrote:
| There are very simple options to selfhost a VPN nowadays. For
| example, Amnezia allows you to just type your server ssh
| credentials into their mobile app, and it will automatically
| set up AmneziaWG on your server and add it to the app. You
| can then create Amnezia or plain WireGuard config files from
| extra devices right from there.
| harvey9 wrote:
| That sounds like I'm putting a lot of trust in an app. Also
| giving it control over my server, which I guess is not a
| big deal if the server is a disposable VPS
| flexagoon wrote:
| It's all open source though, so you can verify the
| scripts it's using, which are all here
|
| https://github.com/amnezia-vpn/amnezia-
| client/tree/dev/clien...
|
| But even without that, there are solutions like wg-easy
| that let you spin up a WireGuard server with a single
| Docker container
| sciencejerk wrote:
| I too recently tried to set up OpenVPN on a VPS and it was a
| huge pain in the @ss, even while following a (very long)
| tutorial. If I figure out an easier way to do this I'll
| message you in this thread
| CaptainOfCoit wrote:
| OpenVPN is just really complicated, which makes sense
| because of the context and history. But even me who've done
| plenty of OpenVPN setups through the years, found Wireguard
| a lot simpler and easier to both learn and use effectively.
| So if you haven't tried Wireguard, give it a go, the
| simplicity is pretty nice.
| immibis wrote:
| Note: Wireguard is good because it's simple. It makes
| point-to-point tunnels, it does that well, _and that 's
| all it does_. You're on your own for the rest.
| WinstonSmith84 wrote:
| it's very easy to setup your own VPN on your own server. I'm
| using AWS Lightsail because of virtually unlimited bandwidth
| and the locations I like, but any VPS would work well. I used
| to have my own scripts but I found this lately which is doing
| this much better than what I was doing
| https://github.com/angristan/wireguard-install
|
| The only advantage of professional VPN is the ability to use
| obfuscation, so to bypass VPN restrictions in countries like
| Egypt or others.
| Theodores wrote:
| That is brilliant, many thanks for that and the Lightsail
| suggestion. Now I just need a legitimate use case, which
| will probably be a locked down origin server with even more
| security than what I had before with ssh things.
| idatum wrote:
| This is the way: SOCKS5 via SSH
|
| You do need some minimal technical understanding and some
| scripting.
|
| Pick any cloud provider that can give you a VM with SSH access.
|
| Read up on doing this on your local device or another device on
| your LAN: ssh -NT -g -D 10001 -o
| UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -i
| your_ssh_private_key your_cloud_login@any_cloud_provider_ip
|
| Change 10001 to whatever.
|
| Now read up on how your browser points to a SOCKS5 proxy. For
| Firefox, I create a separate profile. For chromium based, I use
| the command line.
|
| You are now virtually located to whatever region you chose for
| your VM.
|
| I mentioned some scripting. It's simple enough that I have a
| /bin/sh script to spin up the VM, set up the SSH SOCKS5 proxy,
| launch the browser, then spin the VM down when the browser
| exits.
| praveen9920 wrote:
| Major issue I faced in this method is the network egress
| costs the cloud providers charge. I had to remind myself not
| to accidentally land on YouTube or some other video streaming
| sites.
|
| Are there any cloud providers who don't charge for network
| egress?
| lxgr wrote:
| Many! OVH has unmetered plans, for example.
| CaptainOfCoit wrote:
| > Major issue I faced in this method
|
| Biggest issue regular user might find with this is that
| basically all the VPS host' IP ranges are known, and plenty
| of websites give you a different (worse) experience
| compared to when using residential addresses, or straight
| up block you.
|
| Personally I found the hassle to great, compared to using
| existing VPN services.
| giobox wrote:
| Exact same experience here. In the 2010s I ran my own VPN
| exit node on a dirt cheap VPS so I could access streaming
| content in my country of birth. Worked great for years,
| but nowadays so many sites simply block non-residential
| IP ranges that I gave up ages ago now.
|
| It's a shame because deploying WireGuard was a simple two
| command process: git checkout followed by a `docker
| compose up -d` for me etc on a fresh VPS instance.
| immibis wrote:
| Yes, but search for "VPS" instead of "Cloud". "Cloud" is a
| marketing buzzword used to make people pay 10x-500x more
| than they have to. Although VPS providers are catching on,
| and starting to label their VPS services as "cloud" now.
| sofixa wrote:
| Has anyone benchmarked this against running e.g. Wireguard
| and how it is, performance wise? I'd expect Wireguard to be
| faster, but don't really know.
| lxgr wrote:
| > For Firefox, I create a separate profile.
|
| Firefox supports per-container (and as such per-tab) SOCKS
| proxies, which I find really useful.
|
| So useful, in fact, that I've come full circle and I am now
| running a userspace Wireguard to SOCKS proxy [1] in order to
| have that convenience for a VPN which does not have any host
| I could SSH to.
|
| [1] https://github.com/whyvl/wireproxy
| kawsper wrote:
| If you're using Tailscale you can install it on your Apple
| TV (if you also happen to have one of those devices).
|
| Now you can use your home connection as a proxy through
| wireguard when traveling.
| lxgr wrote:
| Tailscale is great, but by itself is the wrong tool for
| the task of routing traffic over some host only for a
| single browser tab (but to all destinations for that
| browser tab), as it seems to be "all or nothing" when it
| comes to using a remote exit node.
|
| It's probably possible to set up a local SOCKS proxy that
| knows to use some Tailscale non-exit-node for egress, and
| to manually allow that traffic within Tailscale and on
| the remote node, but not out of the box as far as I can
| tell.
|
| Installing a SOCKS proxy on the remote node, reachable
| only over Tailscale, would be an alternative, but that
| doesn't work on an Apple TV.
| kmarc wrote:
| This, and FoxyProxy for domain-based proxy settings is my go to
| when connecting to some websites (self-hosted bit
| bucket/confluence, etc) behind Corp intranet boundaries.
| vaylian wrote:
| VPS tunnels have their place, but they have one major downside:
| Your outward-facing IP address will (most likely) be static.
| And because you are the only one using that VPS, it is easy to
| link your internet activity across different sites. If you want
| to use this method to protect your privacy, then you need to
| frequently discard your VPS and pick a new one.
| commandersaki wrote:
| I like to use dsvpn: https://github.com/jedisct1/dsvpn
|
| Seems to have triggered the netsec community on reddit though.
| yegor wrote:
| Ohh cool, we made that map (I'm from Windscribe). If you spot any
| errors, let me know.
| ComplexSystems wrote:
| TL;DR: you shouldn't assume your data or activity is in any way
| anonymous when using these services. These VPNs are useful for
| changing your region for streaming and not much else. Otherwise,
| the traffic being routed through these VPNs is basically much
| more likely to involve "questionable" activity than ordinary
| traffic - and when you send your traffic through it, you are
| basically highlighting it as such - and all of this is well-known
| and of extreme interest to anyone interested in snooping on or
| analyzing such "questionable" activity.
| dkga wrote:
| I'm not a big expert on the VPN tech side, but it always seemed
| to me that the most logical option for those that actually
| understand about VPN is Proton, or am I missing something here?
| SOLAR_FIELDS wrote:
| Im a happy Proton user myself but if someone wanted the
| absolute most secure and private and reputable VPN I would
| point them to Mullvad. The main reason I use Proton is because
| I use the other apps in their suite as well and I get the VPN
| in the package deal. The threat model is good enough for my use
| cases
| 8cvor6j844qw_d6 wrote:
| Mullvad doesn't support port forwarding [1] for users that
| need it unlike proton vpn [2].
|
| Although I have never needed it myself, which in that case
| Mullvad might be better since they require minimal
| registration details.
|
| [1]: https://mullvad.net/en/blog/removing-the-support-for-
| forward...
|
| [2]: https://protonvpn.com/support/port-forwarding
| cakealert wrote:
| unless you have a specific use case where you need to run a
| server through your vpn this isn't as much of a problem as
| you think it is.
|
| torrents for example have hole punching functionality built
| into uTP where reachable peers help unreachable peers
| connect to each other.
| y-c-o-m-b wrote:
| I am also a relatively happy proton user (now, but wasn't
| always this way). I second this. Based off the site, it looks
| like Mullvad passed a real world test too, Proton has not. I
| haven't tried Mullvad in a couple of years, but they were
| always reliable and fast. The only issue I had with Mullvad
| was getting connected to enough peers when torrenting,
| especially on older torrents where the pool of users is
| small. Proton's port forwarding feature did noticeably help
| with that. I do enjoy being able to pay a discounted yearly
| subscription price with Proton and their user interface is
| nice. There are some minor problems with split-tunneling in
| Proton though, sometimes it doesn't work and I haven't
| figured out why.
| yegor wrote:
| Company who's blog post this is ain't bad either if you're
| looking for a non-ecosystem VPN. Proton is trying to be Nord
| and create an ecosystem of products that store all your most
| private data, all under the umbrella of 1 company which defeats
| the whole point of a VPN who should have no data on you (not
| even an email).
|
| PS. I'm from the company who's blog post this is.
| flexagoon wrote:
| > Proton is trying to be Nord
|
| I feel like it's Nord who's trying to be Proton but worse,
| no? Nord had just the VPN until recently, unlike Proton which
| was already trying to build an ecosystem (although they did
| speed up the new product drops significantly in the past few
| years). And unlike Nord, at least Proton actually has proper
| zero-access encryption and stuff, and they seem to know what
| they're talking about rather than just relying on influencer
| marketing.
| yegor wrote:
| Proton used to have mail, they they launched a VPN. Then
| cloud storage, then password manager, then docs + calendar,
| then wallet, now also AI and MFA app. They're following
| literally in Nord's footsteps, all Nord needs to do is
| launch a mail service and the circle is complete.
|
| Proton is doing influencer marketing now too btw. Parallels
| are uncanny. All this while claiming to fight Google/big
| tech, but essentially offering the same products that store
| the same personal data.
| Scrapemist wrote:
| But it is not a US company.
| davkan wrote:
| The companies to trust are the ones that don't run ads. I've
| used mullvad for a decade, before that airvpn.
| kxrm wrote:
| I was a Mullvad user but needed forwarded ports so went back
| to AirVPN.
|
| No issues so far.
| 8cvor6j844qw_d6 wrote:
| A long time ago, I have difficulty removing payment card
| information from ExpressVPN.
|
| Managed to contact support to remove it but they merely zeroed
| out (it shows 0 for the visible fields) the card details rather
| than truly removing payment information.
| Ms-J wrote:
| Can anyone give info on who owns Trust.Zone VPN? The company
| saves all credentials and doesn't allow the user to generate
| anything, such as Wireguard private keys. The service is very
| likely logging everything, and already admits to logging
| bandwidth, which is severe enough.
|
| Wouldn't be surprised if this was a honeypot for logging Russian
| internet users, as it appears to cater to Eastern users.
| cess11 wrote:
| They hide who they are. If you look at their privacy policy:
|
| https://trust.zone/privacy
|
| Then you'll notice that it does not tell you what entity they
| are or where it is incorporated.
|
| Elsewhere they claim to be incorporated as Trusted Solutions
| Ltd in Mahe in the Seychelles.
|
| https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-to...
|
| And this review claims they are an LLC.
|
| https://thebestvpn.com/reviews/trust-zone/
|
| But when I search for this name in the local registry I get no
| results.
|
| https://www.registry.gov.sc/BizRegistration/WebSearchBusines...
|
| The Seychelles kind of belong to the 'non-aligned' group of
| countries, and maintains decent relations with Russia, India,
| China and so on. They also advocate for a diminished US
| presence in the Indian Ocean. On the other hand, they're a
| member of the british Commonwealth and only got independence in
| 1976.
|
| Trust.Zone sure looks fishy but I can't tell from this whether
| they are surveillance for the UK, traffic to hide in for
| russian authorities and cyber crime groups or something else
| entirely. I'd avoid them unless I was already into grey or
| directly criminal activities and already had layers of
| protection and indirection in place.
| Ms-J wrote:
| The analysis is spot on.
|
| What in particular concerns me is the lack of any type of
| registration seemingly anywhere. I don't mind if a privacy
| focused VPN said they don't register at all in any country
| and stated the reasons as to why, but this company seems to
| have lied.
|
| "The Seychelles kind of belong to the 'non-aligned' group of
| countries, and maintains decent relations with Russia, India,
| China and so on. They also advocate for a diminished US
| presence in the Indian Ocean. On the other hand, they're a
| member of the british Commonwealth and only got independence
| in 1976."
|
| Seychelles is a great place to register for a privacy focused
| service but I agree with you that being a member state of the
| British commonwealth is concerning. Could you possibly
| recommend any place that would be better to register such as
| service?
|
| "Trust.Zone sure looks fishy but I can't tell from this
| whether they are surveillance for the UK, traffic to hide in
| for russian authorities and cyber crime groups or something
| else entirely. I'd avoid them unless I was already into grey
| or directly criminal activities and already had layers of
| protection and indirection in place."
|
| It gives the worst vibes possible for a supposed security
| service.
|
| Trust.Zone offers a free trial which I signed up for to test
| with a disposable VM. This is where I learned how they keep
| user credentials and other major privacy issues, such as the
| logging I mentioned in my last comment. The support also sent
| a very questionable reply to a ticket where they wanted to do
| screen sharing and run an arbitrary script on my server to
| "diagnose" the issue.
| mjbale116 wrote:
| Can someone explain to me why should I use a VPN when Tor is out
| there?
|
| It just seems to me odd that one would pipe their communications
| through a private company, that operates over a jurisdiction when
| said jurisdiction can compel the company in actions that may
| compromise my anonymity.
|
| From my perspective, its like shifting my trust from my ISP (an
| entity with way more oversight) to a pvt ltd.
|
| Isn't Tor as safe as it can get when surfing the web?
| kachapopopow wrote:
| vpns are marketed as hiding you from less trustworthy companies
| or accessing region locked content.
| tsunagatta wrote:
| From my understanding, they have different purposes. VPNs
| aren't really about safety or anonymity, Tor is the way to go
| for those. VPNs are for if you don't want your ISP specifically
| to see your traffic for some reason, or if you want your
| traffic to appear like it's coming from a different
| geographical location with minimal latency hit.
|
| Edit: I should say, VPNs as a _technology_ have far more
| applications than this, e.g. for accessing a secure intranet,
| but these are just the reasons you'd theoretically want to use
| a VPN service like Nord /Mullvad/etc.
| webstrand wrote:
| VPNs are for when you want to obfuscate your traffic from your
| ISP, not the government. By passing your traffic through a
| private company _somewhere else_ to another private entity that
| has some vested interest in not reselling your data, you can
| prevent it from being easily mapped back to you.
|
| Also VPN is generally much faster and higher bandwidth than
| TOR.
| 8cvor6j844qw_d6 wrote:
| Tor is unbearably slow for daily general use.
| walterbell wrote:
| _> [VPN] shifting my trust from my ISP (an entity with way more
| oversight) to a pvt ltd_
|
| Who do you trust when using Tor?
| vivzkestrel wrote:
| because i ll get added to a "hidden list" as soon as I even
| attempt to download tor, let alone use it
| goodpoint wrote:
| If anything, Tor Browser is much safer.
| tonetegeatinst wrote:
| Glad to see more zero trust confidential computing
| happening....but keep in mind its still vulnerable to attacks
| like Battering RAM which can fully breaks cutting-edge Intel SGX
| and AMD SEV-SNP confidential computing processor security
| technologies.
| walterbell wrote:
| How is confidential computing applied to VPNs?
| MagicalTux wrote:
| Battering RAM has been demonstrated to work well against
| Intel's "Scalable SGX" which is also known as SGX 2, and uses
| static encryption key to allow SGX to use more of the system's
| memory.
|
| For example at VP.NET we're using SGX 1, which uses AES-CTR for
| memory encryption which is not susceptible to memory reply
| attack, and comes with a limit of 512MB of ram. It's a lot of
| pain working with a very small memory allocation (especially
| nowadays where most machines come with 128GB+). batteringram.eu
| calls that "Client SGX" with a checkmark on "Read", but reading
| the actual paper it only mentions being able to know which
| areas of memory were written to (see 7.1). There might be
| applications where memory access pattern gives detail on the
| underlying work performed, but this is likely coarse
| (encryption is likely per page) and unlikely to yield to
| anything useful.
|
| This said we are also exploring other TEEs including Intel TDX,
| and having a wider array of options will give us the ability to
| instantly disable any technology for which we know security has
| been compromised.
| MoonObserver wrote:
| Intel TDX unfortunately suffers from the exact same
| vulnerability as Scalable SGX. The underlying root cause is
| the lack of randomized encryption; using a static-adversary
| encryption scheme (XTS) rather than a dynamic-adversary one.
| The result is that plaintext-ciphertext mappings are
| unchanged at a fixed memory address. While the choice of
| scheme might initially seem puzzling, it is due to a
| randomized encryption scheme requiring counters for each
| memory block, which has a prohibitive on-chip memory cost
| when scaling to hundreds of GBs of memory.
| crossroadsguy wrote:
| At this point, the VPN industry is so rife with shady dealings,
| suspicious ownership structures, weird exits, questionable
| marketing/PR practices/pushes, and rumours that waters have been
| muddied sufficiently for every provider out there. It might have
| been by design as well. Who knows.
|
| I now believe that you know your use case and use VPN only for
| that, and decide whether you really need to pay with parts of
| your kidneys for a service that claims to be the "uber privacy
| bulwark of the season" (until proven otherwise, as it happens),
| and get done with it, and make sure "anonymity and privacy" are
| not the expectations unless you have gone to great lengths to
| ensure these two, and if that's the case, you won't be in the
| market for "list most private VPNs providers" at a search or LLM
| input box.
|
| If your needs are anonymity, a VPN is not going to solve it-- in
| fact, relying on one might endanger you. Even for privacy, I'd be
| very careful in trusting a VPN (any VPN).
|
| So if you need a VPN for streaming content from other
| geographies, just get the one at the best cost that does the job
| well in your geography, without going through the rabbit hole of
| cryptographic verification, reputation spiral, etc.
| wongarsu wrote:
| A VPN is always a risk. Still, there is a difference between
| using Mulvad or PrivateInternetAccess. The difference between
| risking that the service might do bad things with your data,
| and having high certainty that it does. And this article gives
| pretty good indications which category each service belongs to
| kouru225 wrote:
| You'd put private internet access in the really bad category?
| vincentpants wrote:
| Yes. Very much so. PIA was purchased by a British-Israeli
| corporation called Kape Inc. which has been a known bad-
| actor in the past and is a giant red flag when looking for
| VPN options. (edited away the brevity)
| rasengan wrote:
| Yeah, agreed. Most VPNs just move the trust boundary from your
| ISP to another opaque network and call it privacy. There's no
| way to verify what's running, who controls it, or what happens
| to your data once it leaves your machine.
|
| We solve this with vp.net, by making the service verifiable.
| The code can be reviewed, the builds are reproducible, and each
| node can prove what software it's running and where your
| traffic actually goes [1].
|
| It doesn't turn a VPN into an anonymity tool, but it makes
| trust measurable instead of blind. That's the part the industry
| should have fixed a long time ago.
|
| [1] https://youtu.be/sz7NAe0G1_Y
| eloisant wrote:
| Not saying that this is what I do, but a VPN is useful for
| things that are illegal but not serious.
|
| For example, France is spying torrent downloads of copyrighted
| content but they only look at the domestic consumer ISP IP
| addresses. They ignore all foreign IPs, so if you're using a
| VPN it doesn't matter if the VPN keeps all the logs they won't
| bother.
|
| Of course if you're doing things that will get you personally
| targeted by the police, like cyber-bullying or CSAM, a VPN
| won't protect you.
| andrepd wrote:
| > If your needs are anonymity, a VPN is not going to solve it--
| in fact, relying on one might endanger you.
|
| Why?
| dackdel wrote:
| just use mullvad
| braza wrote:
| Despite all the shenanigans related to their corporate structure,
| does someone really trust in those services in terms of real
| privacy?
|
| It's hard to believe that for USD 10/month you can have a high-
| trust VPN so that your ISP will never know who you are, and you
| can surf the internet untraceable from the IP perspective.
|
| I mean, that kind of infrastructure costs money, and the
| mechanics to make it happen must be very expensive, and it is
| hard to believe that this is very commoditized.
|
| It sometimes sounds like someone is selling a 2-cent pizza in
| Zurich: If you're paying that, maybe you're not ready to know
| what is inside.
| userbinator wrote:
| Isn't it entirely unsurprising that those running a highly
| privacy-oriented service would themselves be rather mysterious?
|
| _All it takes is an unattended machine for someone to boot
| another os on and grab the file_
|
| If you're going to the trouble of using a VPN, that is not a very
| likely scenario, and ditto for other users(!) on your machine.
| novoreorx wrote:
| Using a VPN for regular users is like jumping from one fire pit
| to another. The real way to escape censorship and privacy leaks
| is to increase your cognition, avoid blindly following KOLs,
| think independently when choosing tools
| scyzoryk_xyz wrote:
| At least uh they sponsor a lot of great video entertainment
| content
| throwaway-0001 wrote:
| https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#map-J...
|
| Mulvad connected to malwarebytes ups
|
| I thought mullvad was clean
| la_oveja wrote:
| seems like malwarebytes uses mullvad for its vpn service.
| RyanShook wrote:
| Strange that this is a blog post by windscribe which follows many
| of the same practices as the VPN providers they criticize here.
|
| Were VPNs ever really providing privacy? The underlying business
| model is selling user data.
| daveidol wrote:
| I'm curious to learn more about Windscribe. Do you have any
| more info you can share about their practices?
| laylower wrote:
| So anyone else besides Airvpn and Mullvad is even worth
| considering?
| wsc981 wrote:
| You can setup a private VPN with Digital Ocean and a PiHole
| droplet. I guess it's a little bit less likely to be a
| honeypot. It also seems cheaper than any public VPN offering.
| eloisant wrote:
| ProtonVPN
| gorbypark wrote:
| I only ever use a VPN to access region blocked content and the
| occasional "linux iso" torrent..I tried Mullvad first, but they
| just don't play the game of cat and mouse with the streaming
| providers and all their IPs are pretty much blocked. I have about
| a 95% success rate with NordVPN (except for Amazon Prime video
| which have some sort of wizardry and always are able to detect
| VPNs).
|
| It's a shame because Mullvad has a deal with Tailscale where you
| can sign up for Mullvad through Tailscale and use any of their
| servers as a Tailscale exit node. It's super slick and nice since
| Tailscale has really decent apps for nearly everything (even
| Apple TV, etc) and I already have a decently sized Tailnet of all
| my devices / ssh accessible things.
| jiggunjer wrote:
| But you can connect any machine to any vpn and have it be a
| tailscale exit node?
| ARandomerDude wrote:
| > British-Israeli security software company Kape Technologies
|
| That doesn't sound good for privacy.
| Nifty3929 wrote:
| VPNs will become illegal or backdoored, because privacy is
| becoming illegal.
|
| This is not really a technology problem, it's a social and
| legislative one. Many of us are afraid of (other people's)
| privacy, so we vote for legislators that will make it illegal.
| The legislators stoke this fear of privacy because they want an
| excuse to deepen their control of discourse, and their own
| citizens.
|
| So really, everybody wins!
___________________________________________________________________
(page generated 2025-10-07 23:02 UTC)