6 ms·

Private Internet Access > A pretty boring company. Extremely transactional. You get in and get out. It delivers its experience the way a utility company would.

Private Internet Access > A pretty boring company. Extremely transactional. You get in and get out. It delivers its experience the way a utility company would. Sometimes, that may be a good thing. But in this case, since I have choice, I'd rather give my money to a company who would appreciate it a little more — perhaps put it to better use. PIA might be very "transactional" but I like them and I've never had any issues with their service. I'm surprised it didn't get a better rating. I don't need a flashy VPN, a utility is exactly what I'm looking for.

mobitar 9y ago
They connect on port 80 (HTTP instead of HTTPS) on startup. That's unacceptable for a privacy company.
- nilved 9y ago
  It's worse than that. Back when I used PIA a few years ago, they would pass your username and password around in the query string, completely plain-text. That was their session mechanism. I sent them an email explaining the problem and got a refund. Their security mistakes, and the fact that they are based in the US, disqualify them for me. I really wish people would recommend someone else.
  - Kadin 9y ago
    I would be interested to know more about this; why they were doing it at the time and if it's still being done. The use of port 80 is not really important; I'm not sure if the article's author is using "port 80" as shorthand for "unencrypted" but that's sloppy writing if so; you can certainly establish encrypted connections over port 80, of course. I used to do SSH on port 80 all the time to get around stupid firewalls...
    - Hnrobert42 9y ago
      Rasengan answers above the port 80 call is for non-sensitive data and is signed.
- jwfxpr 9y ago
  > That's unacceptable for a privacy company. Why? The fact of a connection being established in port 80 is to do with how TCP/IP works. You aren't even claiming to understand what protocol is in use on port 80, not to mention whether the data is in the clear, what it is for, etc. This isn't analysis, it's... something far short of analysis that I can't think of a kind name for.
  - deleted 9y ago
    [deleted]
- jlgaddis 9y ago
  That, in and of itself, is not an issue. Your browsers, for example, download Certificate Revocation Lists over plain-text HTTP as well -- but they are digitally signed.
gtf21 9y ago
Given that he rates Vyrpr above PIA, when Vypr have had clear incidents of doing enough logging to identify which user has done something [1][2], and PIA do no logging [3], I'm not particularly inclined to trust this analysis on the basis of which app is more "fun" to use. Disclaimer: I used to use Vyrpr, when I found out about the logging, I switched to PIA, which I use with Tunnelblick anyway instead of their app. Furthermore, I can only really go by what they say, as I don't have inside access to their systems. [1]: https://www.reddit.com/r/torrents/comments/17g53i/if_you_thought_you_were_safe_using_golden_frog/ https://www.reddit.com/r/torrents/comments/17g53i/if_you_tho... [2]: https://www.goldenfrog.com/copyright https://www.goldenfrog.com/copyright [3]: https://helpdesk.privateinternetaccess.com/hc/en-us/articles/219457547-Do-you-log-the-traffic-of-your-users- https://helpdesk.privateinternetaccess.com/hc/en-us/articles...
- averagewall 9y ago
  He doesn't rate Vyper above PIA: Vyper: 8,2,0 PIA: 9,4,0 The stars are identified as being from his personal experience and he discusses the rationale behind them.
  - jwfxpr 9y ago
    Since the entries on the site are ordered top-to-bottom based entirely on his subjective rating, ignoring the objective criteria, the list absolutely rates Vype higher, in both a figurative and literal sense, and in a way that implies that his 5-star ratings are far more important than the objective criteria.
charlieflowers 9y ago
PIA used to be fast, a year ago. Somehow at times they were faster than my underlying connection! Now, they're _much_ slower. Surely it's not just me.
- deckar01 9y ago
  I have not noticed any change in speed. I did use an ISP at one point that would throttle high bandwidth VPN traffic pretty aggressively though.
  - charlieflowers 9y ago
    Wow, surprising. I thought I'd see a lot of "me too" responses. So maybe it _is_ just me, or my ISP throttles encrypted traffic, or ....

mobitar 9y ago

They connect on port 80 (HTTP instead of HTTPS) on startup. That's unacceptable for a privacy company.

nilved 9y ago
It's worse than that. Back when I used PIA a few years ago, they would pass your username and password around in the query string, completely plain-text. That was their session mechanism. I sent them an email explaining the problem and got a refund. Their security mistakes, and the fact that they are based in the US, disqualify them for me. I really wish people would recommend someone else.
- Kadin 9y ago
  I would be interested to know more about this; why they were doing it at the time and if it's still being done. The use of port 80 is not really important; I'm not sure if the article's author is using "port 80" as shorthand for "unencrypted" but that's sloppy writing if so; you can certainly establish encrypted connections over port 80, of course. I used to do SSH on port 80 all the time to get around stupid firewalls...
  - Hnrobert42 9y ago
    Rasengan answers above the port 80 call is for non-sensitive data and is signed.
jwfxpr 9y ago
> That's unacceptable for a privacy company. Why? The fact of a connection being established in port 80 is to do with how TCP/IP works. You aren't even claiming to understand what protocol is in use on port 80, not to mention whether the data is in the clear, what it is for, etc. This isn't analysis, it's... something far short of analysis that I can't think of a kind name for.
- deleted 9y ago
  [deleted]
jlgaddis 9y ago
That, in and of itself, is not an issue. Your browsers, for example, download Certificate Revocation Lists over plain-text HTTP as well -- but they are digitally signed.

gtf21 9y ago

Given that he rates Vyrpr above PIA, when Vypr have had clear incidents of doing enough logging to identify which user has done something [1][2], and PIA do no logging [3], I'm not particularly inclined to trust this analysis on the basis of which app is more "fun" to use. Disclaimer: I used to use Vyrpr, when I found out about the logging, I switched to PIA, which I use with Tunnelblick anyway instead of their app. Furthermore, I can only really go by what they say, as I don't have inside access to their systems. [1]: https://www.reddit.com/r/torrents/comments/17g53i/if_you_thought_you_were_safe_using_golden_frog/ https://www.reddit.com/r/torrents/comments/17g53i/if_you_tho... [2]: https://www.goldenfrog.com/copyright https://www.goldenfrog.com/copyright [3]: https://helpdesk.privateinternetaccess.com/hc/en-us/articles/219457547-Do-you-log-the-traffic-of-your-users- https://helpdesk.privateinternetaccess.com/hc/en-us/articles...

averagewall 9y ago
He doesn't rate Vyper above PIA: Vyper: 8,2,0 PIA: 9,4,0 The stars are identified as being from his personal experience and he discusses the rationale behind them.
- jwfxpr 9y ago
  Since the entries on the site are ordered top-to-bottom based entirely on his subjective rating, ignoring the objective criteria, the list absolutely rates Vype higher, in both a figurative and literal sense, and in a way that implies that his 5-star ratings are far more important than the objective criteria.

charlieflowers 9y ago

PIA used to be fast, a year ago. Somehow at times they were faster than my underlying connection! Now, they're _much_ slower. Surely it's not just me.

deckar01 9y ago
I have not noticed any change in speed. I did use an ISP at one point that would throttle high bandwidth VPN traffic pretty aggressively though.
- charlieflowers 9y ago
  Wow, surprising. I thought I'd see a lot of "me too" responses. So maybe it _is_ just me, or my ISP throttles encrypted traffic, or ....