3 ms·
This is a copy of the email I received from them last night: To Our Beloved Users, The Russian Government has passed a new law that mandates that every provid
by dopamean 10y ago
This is a copy of the email I received from them last night:
To Our Beloved Users,
The Russian Government has passed a new law that mandates that every provider must log all Russian internet traffic for up to a year. We believe that due to the enforcement regime surrounding this new law, some of our Russian Servers (RU) were recently seized by Russian Authorities, without notice or any type of due process. We think it’s because we are the most outspoken and only verified no-log VPN provider.
Luckily, since we do not log any traffic or session data, period, no data has been compromised. Our users are, and will always be, private and secure.
Upon learning of the above, we immediately discontinued our Russian gateways and will no longer be doing business in the region.
To make it clear, the privacy and security of our users is our number one priority. For preventative reasons, we are rotating all of our certificates. Furthermore, we’re updating our client applications with improved security measures to mitigate circumstances like this in the future, on top of what is already in place. In addition, our manual configurations now support the strongest new encryption algorithms including AES-256, SHA-256, and RSA-4096.
All Private Internet Access users must update their desktop clients at https://www.privateinternetaccess.com/pages/client-support/ https://www.privateinternetaccess.com/pages/client-support/ and our Android App at Google Play. Manual openvpn configurations users must also download the new config files from the client download page.
We have decided not to do business within the Russian territory. We’re going to be further evaluating other countries and their policies.
In any event, we are aware that there may be times that notice and due process are forgone. However, we do not log and are default secure against seizure.
If you have any questions, please contact us at helpdesk@privateinternetaccess.com.
Thank you for your continued support and helping us fight the good fight.
Sincerely,
Private Internet Access Team
- Vexs 10y agoI really like that they were not only upfront about this, but appear to have gotten ahead of it. Good on them. Also, RSA-4069? That's pretty damn hefty, is there even a point to using that?
- sdsfasd 10y agoIts to try to mitigate against a (generally state) adversary saving the session and waiting 10 years or more and then breaking the now weak encryption (ie rsa-2046 is projected to be "usable" until 2030 by NIST) This is one of the reasons why the NSA (and other intelligence agencies around the world) have these huge data centers that essentially just store everything they collect. So that later they can retroactively go through and get a back story.
- goodplay 10y ago> RSA-4069? That's pretty damn hefty This surprised me for a different reason: I was under the impression that effective security bit size does not scale linearly with bit lengths in RSA, and that key size would need to be 16,000-bits long for a comfortable safety margin (a size not practical and not supported by RSA). Are there any practical reasons why one shouldn't use epileptic-curve based crypto?
- kobayashi 10y ago>epileptic *elliptic
- theandrewbailey 10y ago> Are there any practical reasons why one shouldn't use epileptic-curve based crypto? Because it doesn't exist yet? Sounds like it would be all over the place and secure. \s Isn't RSA more widely used? It could also be that the NSA is discouraging EC-based crypto[0]; though whether this is due to "We can't crack this" to "As a guideline to other agencies OMG THIS SHIT IS SO BROKEN" is anyone's guess. [0] by alleged concerns over quantum computing https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-hand-wringing/115150/ https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-...