18 ms·
IPVanish “No-Logging” VPN Led Homeland Security to Comcast User
- neverminder 8y agoIn the mean while it looks like PIA is still standing it's ground (for now): https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...
- mirimir 8y agoYes, and good for them! The problem is that, without a publicized investigation, there is absolutely no way for users to verify no-logging claims by VPN providers. The same is so for Tor relays. And Tor deals with that by using three-relays circuits. In order to connect users with online activity, adversaries would need access to logs from multiple relays. One can do the same, albeit more crudely, using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways.
- CodesInChaos 8y ago> It's quite easy, using pfSense VMs as VPN gateways. One privacy tool that I'd like to see is a program that takes a .ovpn file and user credentials and outputs a pfSense config file which the user just has to import. Following a guide like yours is quite a bit of work and somewhat error prone. Few users will be able and willing to do that.
- vxxzy 8y agoThis is available within pfSesne. There is a package called openvpn-client-export that exports the pfSense config to .ovpn and a number of other config/packages.
- mirimir 8y agoI agree that it's tedious and error-prone. Perhaps someone could automate it. But that's over my head. There is the argument that, in doing the setup manually, users come to understand what they're doing. But yes, it seems that most are put off by it all.
- ddtaylor 8y ago.
- jstanley 8y agoNothing has any defence against global traffic analysis. Tor still does better than anything else. I don't think it's worth scaring people away from using Tor, because whatever else they'd be using instead is certainly worse. EDIT: Parent comment originally said words to the effect of "Reminder that Tor has no defence against global traffic analysis".
- ddtaylor 8y agoI'm not against Tor but I think it's an important fact if we're going to discus how using multiple relays is a way to obfusticate traffic.
- zrm 8y ago> Nothing has any defence against global traffic analysis. It's possible to guard against global traffic analysis by establishing permanent fixed-bandwidth links between each node and sending traffic along them even when they aren't assigned to a circuit (or the circuit is idle). Then there is nothing to passively analyze because the amount of traffic between each node is always the same. The problem is that this consumes a very large amount of bandwidth.
- owenmarshall 8y agoThis works against global passive adversaries. If you instead ask yourself "how many Tor nodes are out there"[1], and then ask yourself "what is the NSA's annual budget"[2], the concept of a global active adversary makes me a bit nervous. [1]: http://torstatus.blutmagie.de http://torstatus.blutmagie.de [2]: https://www.theverge.com/2013/8/29/4672414/leaked-snowden-documents-reveal-details-of-surveillance-budget https://www.theverge.com/2013/8/29/4672414/leaked-snowden-do...
- zrm 8y ago
- bogomipz 8y ago>"using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways" Can you elaborate on this? I am not familiar with the term "nested VPN chains", is this a specific configuration supported by pfSense?
- icedchai 8y ago1) You create a VPN. 2) Over that VPN connection, you connect to another VPN... Repeat until your tinfoil hat feels secure.
- Thriptic 8y agohttps://www.ivpn.net/blog/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/blog/privacy-guides/advanced-privacy-an...
- bogomipz 8y agoWhat a great resource, thanks for sharing. Might you have any feedback on IVPN as a provider as well?
- mirimir 8y agoI've freelanced with IVPN for five years. IVPN was "[f]ounded in 2009 by a group of security professionals at the prestigious Information Security Group at the University of London (Royal Holloway)".[0] In my experience, their CEO Nick Pestell is fundamentally a privacy activist. 0) https://www.ivpn.net/aboutus https://www.ivpn.net/aboutus
- torenthusiast 8y agoI can think of few reasons not to extend this even further, and compose proxy chains from an eclectic mix of VPNs, and other networks, such as Tor, JonDonym, and i2p (using private, short-lived outproxies). The first hop ought to be as innocuous as possible, for which a VPN is a good candidate. The exit node ought to be as widely shared as possible, making Tor a natural choice there. While not purely additive, it would, at least intuitively (here be dragons), make it substantially harder to determine the origin of the traffic. Finally, and perhaps most importantly, your physical internet gateway link should also be difficult to trace. Here, you could do a lot worse than a frequency- or cell-locked (to possibly thwart any commodity geolocation systems) cellular modem, or a Yagi antenna pointed at an open Wi-Fi AP. One possible caveat which is apparent even to a dilettante like me is that this might increase your exposure to so-called passive traffic correlation attacks. The addition of a high-latency proxy could mitigate this, but I'm not aware of any in common use.
- aurbano 8y agoI've recently switched to Mullvad from PIA, mainly because it's not US based and they "sound" more privacy focused. I quote sound because as another commenter mentioned, without trusted third party audits it's all marketing...
- syoc 8y agoMullvad allows for cash in mail payment. They also don't really have accounts in the traditional sense. Just a long account number that is associated with the payments. Really ticks all the boxes for me.
- tssva 8y agoThe US has some of the laxest data retention and filtering laws in the world. Especially compared to most European countries. Mullvad is based in Sweden which has much more strict data retention and filtering requirements for ISPs than in the US and the government has already expressed a desire to expand these to VPN providers. And as the Snowden leaks have shown being located outside the US is not even a speed bump to the NSA being able to access your communications.
- vxxzy 8y agoMullvad has gateways in the US. Does this help?
- simon1573 8y agoBut Mullvad is not an ISP.
- aurbano 8y agoI understand your point, but I believe in this case it doesn't apply necessarily because Sweden/Europe are only concerned with privacy related data. Mullvad gets around this by not storing customer information. As others have pointed out, your "account" is just a long number. You top it up any way you want (including sending cash in an envelope if you are truly paranoid). So I do believe that it stands a better chance of being fully anonymous & private than a US counterpart.
- Big_crimpin 8y agoStrange that Colby needed help setting up a VPN from his roommate (PIA is setup with an installer and your type a user/pass in) but was alleged to be able to hack emails and websites.
- bogomipz 8y agoI know PIA likes to talk a big game here but I didn't see anything in your link that would instill overwhelming confidence in their marketing claims. Specifically: If you click on the Almanac News source in your link, it states: >"John Allan Arsenault, general counsel for London Trust Media, a VPN company, testified about how many VPN companies, including his, intentionally don’t retain logs of internet activity of their clients so that they cannot be produced in response to subpoenas from law enforcement or others." Note it doesn't say they don't log only that they don't retain them. So it's quite possible that the subpoena process simply lagged behind the log retention window. Also the claim in only for "internet activity" and nowhere do we see that defined. Does that include client authentication? Then article then goes on to state: >"Arsenault said he could not find any record of Ross Colby subscribing to the VPN service when he searched using Ross Colby’s two known email addresses, which he received from law enforcement." Could not find is not the same thing as there was nothing to search.
- shalomhomes 8y agoIt's all marketing claims when all is said and done. PIA is still the only VPN company that has proven its no log policy not once but twice. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
- bogomipz 8y agoI'm not sure why you are providing that second link as proof that they don't log. That is just a link to the same story being discussed here and the same one I am quoting in my comment. Also the first link continues its insistence on using the phrase "user activity" logging. That's a rather nebulous term. Nowhere is "user activity" defined and it's certainly not a term that meaning in the context of syslog/journald. Does "user activity" logging preclude RADIUS authentication?
- rasengan 8y agoInteresting analysis, but it's wrong. We don't log, period. By stating that we don't retain logs, it means that we don't EVER retain them, not even for 0.001ms. Hope this helps.
- lkurusa 8y agoWhat I also like about PIA is their continued support of Open Source projects. I have been a PIA customer for a while now and will remain for the time to come.
- Fnoord 8y agoThat doesn't make them more or less secure though. NSA and privacy activists both love open source.
- lkurusa 8y agoWhile you’re right, this is a point to me which made me choose PIA over competitors. I like when companies give back to open source communities.
- Fnoord 8y agoAgreed. OTOH, I don't like the way (ie. tone) the co-founder is discussing in this thread. I find that unprofessional. That said, I'm biased; I'm a ProtonVPN customer. Here's the catch: I don't assume I'm anonymous with it. Just enough anonymous to use it for copyright infringement. At this point though I am so impressed with WireGuard when my ProtonVPN sub expired I really just want a good VPN provider which supports that.
- krn 8y agoProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. When a VPN is run by NSA, of course it will stand up in all courts. How would a state surveillance agency let its tool be so publicly destroyed? And it doesn't have to keep any logs at all. They can just be forwarded in real-time, based on a set of filters and rules ("URLs that are requested by <IP>", "IPs that are requesting <URL>"). [1] https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/
- d0lph 8y agoHow did their security team identify that?
- consumer451 8y agoHonest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I ask because my main privacy concern is state sponsored industrial espionage. I have often thought that if I wanted to gather kompromat on high level professionals, I would probably start an "anonymous" VPN service to further that effort. Say what you will about the NSA, but I am not worried about them in that space.
- kinsomo 8y ago> Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I would also like to know the motivation for a US intel agency to want to run a VPN. It seems to me like it wouldn't be worth the bother: VPNs aren't illegal in the US, so it would be too hard to convince everyone to use theirs. Spies, etc. could just use private ones they control. They'd just see a bunch of crap from unsophisticated people. Seems to me like it would be more likely for US law enforcement to want to do something like that, but I'm skeptical they have the resources.
- fegu 8y agoHow many VPN services are run by the government three letter agencies through decoy companies? Seems like a match made in heaven.
- mirimir 8y agoThere's no way to know that, either. One of the first VPN services, Anonymizer, morphed into a CIA operation. And Tor, after all, is still heavily funded by the US government. However, as cynical as I've become, I believe that the US freedom vibe is more than PR. But anyway, there's no way to know. So your best bet is nested VPN chains. Including providers from jurisdictions where cooperation is less likely. Insorg is Russian, for example. Also, AirVPN, IVPN and Riseup have said that they'll shut down before they'll log.
- gant 8y agoProblem with Riseup is, that they're invite-only and at the same time becoming the most centralized email service for anonymous left-learning political use. Personally I can recommend Autistici/Inventati. More smaller services/servers seems like a much better way to go.
- mirimir 8y agoYes, Autistici/Inventati are excellent too.
- stef25 8y agoRiseup will also shut down before not handing over the details of an extreme right winger that somehow slipped through their vetting process.
- TimTheTinker 8y ago> your best bet is nested VPN chains It is possible to set up an anonymous DigitalOcean account funded by a Visa gift card and associated with an anonymous email provider. Perhaps the best privacy-preserving tool would be a pool of anonymous, public accounts to public and private VPN services, and a client app that dynamically builds and connects via nested VPN chains.
- lolc 8y agoBeginner's mistake: Choosing a VPN-cloak based in one's own jurisdiction.
- curiousgal 8y agoTo be honest, The US' federal arm is far-reaching
- lagadu 8y agoStill it's a lot harder to convince a, lets say, Chinese court to order that kind of surveillance on a local company over an allegation of a crime that happened half a world away. Add a couple more vpn layers over multiple international jurisdictions and it's a huge effort that can easily take years.
- mseebach 8y agoThe user sounds like he was a regular on the IRC channel. Did they perhaps add particular logging on the IP/port combo when asked to, rather than having always logged, and lied about it? I mean, it's still not consistent with "no logging", but it still protects "backwards" privacy of connections happening in the past, and crucially it's a kind of logging that will always be technically possible to implement for a VPN provider, and probably legally trivial for law enforcement to mandate with a court order (or national security letter) - regardless of how strongly a worded policy the provider has in place.
- Casseres 8y agoAnyone looking for VPN suggestions, start here: https://www.privacytools.io/#vpn https://www.privacytools.io/#vpn
- huhtenberg 8y agoCare to elaborate why this particular site is notable?
- Casseres 8y agoIt's a decent all-in-one site with links and explanations. Good for the average user. Take a look and let me know what you think or if you disagree.
- boomboomsubban 8y agoIt's run in the open by a group on reddit, with relatively detailed explanations on why they make their recommendations and timely changing of recommendations. A strong place to start, though you may wish to do further research before a large decision.
- aphextron 8y agoDo not use any of these. Never ever ever trust a 3rd party VPN for any use whatsoever. Period.
- KarenSatantsby 8y agoSeems like a good investigator doing an investigation. When people do investigations they find information. This information leads to further information and helps build a case.
- sandGorgon 8y agoCEO's statement on Reddit : https://www.reddit.com/r/Piracy/comments/8ogup1/ipvanish_claims_0_log_policy_busted_for_logging/e03mrw6/ https://www.reddit.com/r/Piracy/comments/8ogup1/ipvanish_cla... >We don't typically jump into Reddit or other forums but this topic is too important to me. I'm the CEO of StackPath and we acquired IPVanish in February, 2017 (more than a year after the lawsuit from 2016). With no exception IPVanish does not, has not, and will not log or store logs of our users as a StackPath company. Most important, StackPath will defend the privacy of our users regardless of who demands otherwise. I can't speak to what happened on someone else's watch but Technology is my life and I've spent my career helping customers build on and use the Internet on their terms. StackPath takes that even further—security and privacy is our core mission. I also happen to be a lawyer and I will spend my last breath protecting individuals' rights to privacy, especially our customers.
- hashkb 8y agoToo stupid for words. They know they are working with customers who barely understand the technology and they are outright lying to them. I'm not here to defend kiddie porn addicts or idiots on the internet, but it's definitely worth pointing out 1) that's an empty statement and 2) they know it guarantees nothing.
- rhacker 8y agoI would have to say that any company in the world can pretty much state whatever it is that they want regarding logging/not logging. Unfortunately if it ends up being a lie, they can be sued by people directly suffering damages (in this case probably when the kiddie porn person is out of jail - I am assuming he will go up against a lot of judges and may have to go to the supreme court which would likely end up siding with him - lucky for us, he's probably not that passionate about fighting his cause). And secondly the FTC could sue the company just the same for not being truthful in the advertising. But it sounds like IPVanish had previous owners, so who knows how that will go.
- saas_co_de 8y agoWhether a company promises not to keep logs or not they can and always will comply with legal requests (court order, warrant, national security letter, etc, etc) to monitor specific targets. Otherwise they will be out of business. Bottom line: don't do illegal stuff. These services (if they are actually telling the truth about not logging) are good for protecting your privacy as a law abiding citizen but they don't really provide any shield for criminal activity.
- cascom 8y agoSeems pretty naive to risk jail timeover the commercial claims of some internet company... I use a vpn to reduce tracking and keep my ISP in the dark - and so have gravitated to the names in the space that seem to be more solid corporate citizens F-secure - https://www.f-secure.com/en/web/home_global/freedome https://www.f-secure.com/en/web/home_global/freedome Proton Tech - https://protonvpn.com https://protonvpn.com
- openasocket 8y agoAn important thing to note here is that they were served with a "Summons for Records," not a warrant. With a warrant the DHS has to provide probable cause, it has to be signed off on by a judge, and cannot be refused. A summons has none of those things; it can absolutely be refused, at which point they would have to get a warrant. I'd also like to add that I don't have an ethical problem with a VPN company that keeps logs and turns them over to law enforcement with a valid warrant. Lying about keeping logs, though, I do find unethical, as well as not requiring a warrant for access. I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. If law enforcement has a valid warrant, I don't have an issue with providing them with the data they need to find and prosecute.
- SlowRobotAhead 8y agoAgree with first half, but second half is an appeal to authority, which is a fallacy. By not keeping logs, a VPN would take themselves out of a situation where corrupt authorities could exploit their power.
- openasocket 8y agoBut they'd also take themselves out of a situation where non-corrupt authorities could use their power appropriately. You have to do the ethical math on the likelihood of either possibility and the consequences, which is subjective.
- gsich 8y agoDon't advertise with "no logs" then.
- detaro 8y agoThe parent explicitly said that would be unethical, so you agree with them.
- openasocket 8y ago
- deleted 8y ago[deleted]
- Grollicus 8y agoWould it be possible to sue a lying company for damages in a case like this? Especially if (as it seems) they were not forced to give traffic data by a warrant but instead complied on their own?
- jorge-fundido 8y agoVPN companies don't care too much about customers that are concerned about privacy - too small a percentage of their customer base. Catering to those trying access geo-blocked content is where the money's at.
- justadudeama 8y agoThis is why I host my own open vpn instance on AWS EC2. If the government is going to come after me/my IP, they are going to get it one way or another (I know Amazon will hand over my account info if asked for it) so I might as well cut out any security risks in between (are the servers that my VPN providers using secure?).
- phyzome 8y ago« It’s impossible for me to speculate or comment about what may have happened under different ownership/management. » You keep using that word, "impossible". I do not think it means what you think it means.
- aphextron 8y agoI spent some time looking into building a VPN business. It's a real bottom feeder industry. The margins are tiny and the bulk of your traffic will be malicious. Anyone who says they don't log is simply lying to your face; the liability is insane if they don't. I'd rather use a provider that at least is honest about their logging policy, although even that is a terrible idea. The only real solution is running your own Streisand node on an anonymous VPS paid with crypto.
- tlrobinson 8y ago> Anyone who says they don't log is simply lying to your face; the liability is insane if they don't ... > The only real solution is running your own Streisand node on an anonymous VPS paid with crypto Why would VPN providers need to log but VPS providers don't?
- aphextron 8y ago>Why would VPN providers need to log but VPS providers don't? It's a question of obfuscation. A private VPN provider is receiving explicit logs of every single URL request you make, and has access to the actual machine processing the request. A VPS provider cannot. With an IPSEC tunnel terminated inside the VM, there's no way they can see your incoming traffic. They could monitor your outgoing traffic in theory, but would have to be specifically looking for this and targeting you.
- tlrobinson 8y agoIf you're the only one using a private VPN run on a VPS then they effectively have access to the same information: your IP address and all of your traffic. I'm just curious why VPNs would be required to log but VPS aren't if they can be used for the same purposes. Is it just because VPNs are more likely to be used for illegal purposes?
- EmilyHealth 8y agohttp://everydayhappy7.com/2018/01/16/mix-dried-figs-olive-oil-watch-happens-cholesterol-levels-stomach-issues/ http://everydayhappy7.com/2018/01/16/mix-dried-figs-olive-oi...