10 ms·

In the mean while it looks like PIA is still standing it's ground (for now): https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-agai

In the mean while it looks like PIA is still standing it's ground (for now): https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...

mirimir 8y ago
Yes, and good for them! The problem is that, without a publicized investigation, there is absolutely no way for users to verify no-logging claims by VPN providers. The same is so for Tor relays. And Tor deals with that by using three-relays circuits. In order to connect users with online activity, adversaries would need access to logs from multiple relays. One can do the same, albeit more crudely, using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways.
- CodesInChaos 8y ago
  > It's quite easy, using pfSense VMs as VPN gateways. One privacy tool that I'd like to see is a program that takes a .ovpn file and user credentials and outputs a pfSense config file which the user just has to import. Following a guide like yours is quite a bit of work and somewhat error prone. Few users will be able and willing to do that.
  - vxxzy 8y ago
    This is available within pfSesne. There is a package called openvpn-client-export that exports the pfSense config to .ovpn and a number of other config/packages.
  - mirimir 8y ago
    I agree that it's tedious and error-prone. Perhaps someone could automate it. But that's over my head. There is the argument that, in doing the setup manually, users come to understand what they're doing. But yes, it seems that most are put off by it all.
- ddtaylor 8y ago
  .
  - jstanley 8y ago
    Nothing has any defence against global traffic analysis. Tor still does better than anything else. I don't think it's worth scaring people away from using Tor, because whatever else they'd be using instead is certainly worse. EDIT: Parent comment originally said words to the effect of "Reminder that Tor has no defence against global traffic analysis".
    - ddtaylor 8y ago
      I'm not against Tor but I think it's an important fact if we're going to discus how using multiple relays is a way to obfusticate traffic.
    - zrm 8y ago
      > Nothing has any defence against global traffic analysis. It's possible to guard against global traffic analysis by establishing permanent fixed-bandwidth links between each node and sending traffic along them even when they aren't assigned to a circuit (or the circuit is idle). Then there is nothing to passively analyze because the amount of traffic between each node is always the same. The problem is that this consumes a very large amount of bandwidth.
      - owenmarshall 8y ago
        This works against global passive adversaries. If you instead ask yourself "how many Tor nodes are out there"[1], and then ask yourself "what is the NSA's annual budget"[2], the concept of a global active adversary makes me a bit nervous. [1]: http://torstatus.blutmagie.de http://torstatus.blutmagie.de [2]: https://www.theverge.com/2013/8/29/4672414/leaked-snowden-documents-reveal-details-of-surveillance-budget https://www.theverge.com/2013/8/29/4672414/leaked-snowden-do...
        zrm 8y ago
- bogomipz 8y ago
  >"using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways" Can you elaborate on this? I am not familiar with the term "nested VPN chains", is this a specific configuration supported by pfSense?
  - icedchai 8y ago
    1) You create a VPN. 2) Over that VPN connection, you connect to another VPN... Repeat until your tinfoil hat feels secure.
  - Thriptic 8y ago
    https://www.ivpn.net/blog/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/blog/privacy-guides/advanced-privacy-an...
    - bogomipz 8y ago
      What a great resource, thanks for sharing. Might you have any feedback on IVPN as a provider as well?
      - mirimir 8y ago
        I've freelanced with IVPN for five years. IVPN was "[f]ounded in 2009 by a group of security professionals at the prestigious Information Security Group at the University of London (Royal Holloway)".[0] In my experience, their CEO Nick Pestell is fundamentally a privacy activist. 0) https://www.ivpn.net/aboutus https://www.ivpn.net/aboutus
- torenthusiast 8y ago
  I can think of few reasons not to extend this even further, and compose proxy chains from an eclectic mix of VPNs, and other networks, such as Tor, JonDonym, and i2p (using private, short-lived outproxies). The first hop ought to be as innocuous as possible, for which a VPN is a good candidate. The exit node ought to be as widely shared as possible, making Tor a natural choice there. While not purely additive, it would, at least intuitively (here be dragons), make it substantially harder to determine the origin of the traffic. Finally, and perhaps most importantly, your physical internet gateway link should also be difficult to trace. Here, you could do a lot worse than a frequency- or cell-locked (to possibly thwart any commodity geolocation systems) cellular modem, or a Yagi antenna pointed at an open Wi-Fi AP. One possible caveat which is apparent even to a dilettante like me is that this might increase your exposure to so-called passive traffic correlation attacks. The addition of a high-latency proxy could mitigate this, but I'm not aware of any in common use.
aurbano 8y ago
I've recently switched to Mullvad from PIA, mainly because it's not US based and they "sound" more privacy focused. I quote sound because as another commenter mentioned, without trusted third party audits it's all marketing...
- syoc 8y ago
  Mullvad allows for cash in mail payment. They also don't really have accounts in the traditional sense. Just a long account number that is associated with the payments. Really ticks all the boxes for me.
- tssva 8y ago
  The US has some of the laxest data retention and filtering laws in the world. Especially compared to most European countries. Mullvad is based in Sweden which has much more strict data retention and filtering requirements for ISPs than in the US and the government has already expressed a desire to expand these to VPN providers. And as the Snowden leaks have shown being located outside the US is not even a speed bump to the NSA being able to access your communications.
  - vxxzy 8y ago
    Mullvad has gateways in the US. Does this help?
  - simon1573 8y ago
    But Mullvad is not an ISP.
  - aurbano 8y ago
    I understand your point, but I believe in this case it doesn't apply necessarily because Sweden/Europe are only concerned with privacy related data. Mullvad gets around this by not storing customer information. As others have pointed out, your "account" is just a long number. You top it up any way you want (including sending cash in an envelope if you are truly paranoid). So I do believe that it stands a better chance of being fully anonymous & private than a US counterpart.
Big_crimpin 8y ago
Strange that Colby needed help setting up a VPN from his roommate (PIA is setup with an installer and your type a user/pass in) but was alleged to be able to hack emails and websites.
bogomipz 8y ago
I know PIA likes to talk a big game here but I didn't see anything in your link that would instill overwhelming confidence in their marketing claims. Specifically: If you click on the Almanac News source in your link, it states: >"John Allan Arsenault, general counsel for London Trust Media, a VPN company, testified about how many VPN companies, including his, intentionally don’t retain logs of internet activity of their clients so that they cannot be produced in response to subpoenas from law enforcement or others." Note it doesn't say they don't log only that they don't retain them. So it's quite possible that the subpoena process simply lagged behind the log retention window. Also the claim in only for "internet activity" and nowhere do we see that defined. Does that include client authentication? Then article then goes on to state: >"Arsenault said he could not find any record of Ross Colby subscribing to the VPN service when he searched using Ross Colby’s two known email addresses, which he received from law enforcement." Could not find is not the same thing as there was nothing to search.
- shalomhomes 8y ago
  It's all marketing claims when all is said and done. PIA is still the only VPN company that has proven its no log policy not once but twice. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
  - bogomipz 8y ago
    I'm not sure why you are providing that second link as proof that they don't log. That is just a link to the same story being discussed here and the same one I am quoting in my comment. Also the first link continues its insistence on using the phrase "user activity" logging. That's a rather nebulous term. Nowhere is "user activity" defined and it's certainly not a term that meaning in the context of syslog/journald. Does "user activity" logging preclude RADIUS authentication?
- rasengan 8y ago
  Interesting analysis, but it's wrong. We don't log, period. By stating that we don't retain logs, it means that we don't EVER retain them, not even for 0.001ms. Hope this helps.
lkurusa 8y ago
What I also like about PIA is their continued support of Open Source projects. I have been a PIA customer for a while now and will remain for the time to come.
- Fnoord 8y ago
  That doesn't make them more or less secure though. NSA and privacy activists both love open source.
  - lkurusa 8y ago
    While you’re right, this is a point to me which made me choose PIA over competitors. I like when companies give back to open source communities.
    - Fnoord 8y ago
      Agreed. OTOH, I don't like the way (ie. tone) the co-founder is discussing in this thread. I find that unprofessional. That said, I'm biased; I'm a ProtonVPN customer. Here's the catch: I don't assume I'm anonymous with it. Just enough anonymous to use it for copyright infringement. At this point though I am so impressed with WireGuard when my ProtonVPN sub expired I really just want a good VPN provider which supports that.
krn 8y ago
ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. When a VPN is run by NSA, of course it will stand up in all courts. How would a state surveillance agency let its tool be so publicly destroyed? And it doesn't have to keep any logs at all. They can just be forwarded in real-time, based on a set of filters and rules ("URLs that are requested by <IP>", "IPs that are requesting <URL>"). [1] https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/
- d0lph 8y ago
  How did their security team identify that?
  - ddalex 8y ago
    connect to VPNs, make illegal traffic, see which traffic triggered an investigation ... ?
  - hinkley 8y ago
    Probably someone venting over beers at a convention?
- consumer451 8y ago
  Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I ask because my main privacy concern is state sponsored industrial espionage. I have often thought that if I wanted to gather kompromat on high level professionals, I would probably start an "anonymous" VPN service to further that effort. Say what you will about the NSA, but I am not worried about them in that space.
  - kinsomo 8y ago
    > Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I would also like to know the motivation for a US intel agency to want to run a VPN. It seems to me like it wouldn't be worth the bother: VPNs aren't illegal in the US, so it would be too hard to convince everyone to use theirs. Spies, etc. could just use private ones they control. They'd just see a bunch of crap from unsophisticated people. Seems to me like it would be more likely for US law enforcement to want to do something like that, but I'm skeptical they have the resources.

mirimir 8y ago

Yes, and good for them! The problem is that, without a publicized investigation, there is absolutely no way for users to verify no-logging claims by VPN providers. The same is so for Tor relays. And Tor deals with that by using three-relays circuits. In order to connect users with online activity, adversaries would need access to logs from multiple relays. One can do the same, albeit more crudely, using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways.

CodesInChaos 8y ago
> It's quite easy, using pfSense VMs as VPN gateways. One privacy tool that I'd like to see is a program that takes a .ovpn file and user credentials and outputs a pfSense config file which the user just has to import. Following a guide like yours is quite a bit of work and somewhat error prone. Few users will be able and willing to do that.
- vxxzy 8y ago
  This is available within pfSesne. There is a package called openvpn-client-export that exports the pfSense config to .ovpn and a number of other config/packages.
- mirimir 8y ago
  I agree that it's tedious and error-prone. Perhaps someone could automate it. But that's over my head. There is the argument that, in doing the setup manually, users come to understand what they're doing. But yes, it seems that most are put off by it all.
ddtaylor 8y ago
.
- jstanley 8y ago
  Nothing has any defence against global traffic analysis. Tor still does better than anything else. I don't think it's worth scaring people away from using Tor, because whatever else they'd be using instead is certainly worse. EDIT: Parent comment originally said words to the effect of "Reminder that Tor has no defence against global traffic analysis".
  - ddtaylor 8y ago
    I'm not against Tor but I think it's an important fact if we're going to discus how using multiple relays is a way to obfusticate traffic.
  - zrm 8y ago
    > Nothing has any defence against global traffic analysis. It's possible to guard against global traffic analysis by establishing permanent fixed-bandwidth links between each node and sending traffic along them even when they aren't assigned to a circuit (or the circuit is idle). Then there is nothing to passively analyze because the amount of traffic between each node is always the same. The problem is that this consumes a very large amount of bandwidth.
    - owenmarshall 8y ago
      This works against global passive adversaries. If you instead ask yourself "how many Tor nodes are out there"[1], and then ask yourself "what is the NSA's annual budget"[2], the concept of a global active adversary makes me a bit nervous. [1]: http://torstatus.blutmagie.de http://torstatus.blutmagie.de [2]: https://www.theverge.com/2013/8/29/4672414/leaked-snowden-documents-reveal-details-of-surveillance-budget https://www.theverge.com/2013/8/29/4672414/leaked-snowden-do...
      - zrm 8y ago
bogomipz 8y ago
>"using nested VPN chains. It's quite easy, using pfSense VMs as VPN gateways" Can you elaborate on this? I am not familiar with the term "nested VPN chains", is this a specific configuration supported by pfSense?
- icedchai 8y ago
  1) You create a VPN. 2) Over that VPN connection, you connect to another VPN... Repeat until your tinfoil hat feels secure.
- Thriptic 8y ago
  https://www.ivpn.net/blog/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/blog/privacy-guides/advanced-privacy-an...
  - bogomipz 8y ago
    What a great resource, thanks for sharing. Might you have any feedback on IVPN as a provider as well?
    - mirimir 8y ago
      I've freelanced with IVPN for five years. IVPN was "[f]ounded in 2009 by a group of security professionals at the prestigious Information Security Group at the University of London (Royal Holloway)".[0] In my experience, their CEO Nick Pestell is fundamentally a privacy activist. 0) https://www.ivpn.net/aboutus https://www.ivpn.net/aboutus
torenthusiast 8y ago
I can think of few reasons not to extend this even further, and compose proxy chains from an eclectic mix of VPNs, and other networks, such as Tor, JonDonym, and i2p (using private, short-lived outproxies). The first hop ought to be as innocuous as possible, for which a VPN is a good candidate. The exit node ought to be as widely shared as possible, making Tor a natural choice there. While not purely additive, it would, at least intuitively (here be dragons), make it substantially harder to determine the origin of the traffic. Finally, and perhaps most importantly, your physical internet gateway link should also be difficult to trace. Here, you could do a lot worse than a frequency- or cell-locked (to possibly thwart any commodity geolocation systems) cellular modem, or a Yagi antenna pointed at an open Wi-Fi AP. One possible caveat which is apparent even to a dilettante like me is that this might increase your exposure to so-called passive traffic correlation attacks. The addition of a high-latency proxy could mitigate this, but I'm not aware of any in common use.

aurbano 8y ago

I've recently switched to Mullvad from PIA, mainly because it's not US based and they "sound" more privacy focused. I quote sound because as another commenter mentioned, without trusted third party audits it's all marketing...

syoc 8y ago
Mullvad allows for cash in mail payment. They also don't really have accounts in the traditional sense. Just a long account number that is associated with the payments. Really ticks all the boxes for me.
tssva 8y ago
The US has some of the laxest data retention and filtering laws in the world. Especially compared to most European countries. Mullvad is based in Sweden which has much more strict data retention and filtering requirements for ISPs than in the US and the government has already expressed a desire to expand these to VPN providers. And as the Snowden leaks have shown being located outside the US is not even a speed bump to the NSA being able to access your communications.
- vxxzy 8y ago
  Mullvad has gateways in the US. Does this help?
- simon1573 8y ago
  But Mullvad is not an ISP.
- aurbano 8y ago
  I understand your point, but I believe in this case it doesn't apply necessarily because Sweden/Europe are only concerned with privacy related data. Mullvad gets around this by not storing customer information. As others have pointed out, your "account" is just a long number. You top it up any way you want (including sending cash in an envelope if you are truly paranoid). So I do believe that it stands a better chance of being fully anonymous & private than a US counterpart.

Big_crimpin 8y ago

Strange that Colby needed help setting up a VPN from his roommate (PIA is setup with an installer and your type a user/pass in) but was alleged to be able to hack emails and websites.

bogomipz 8y ago

I know PIA likes to talk a big game here but I didn't see anything in your link that would instill overwhelming confidence in their marketing claims. Specifically: If you click on the Almanac News source in your link, it states: >"John Allan Arsenault, general counsel for London Trust Media, a VPN company, testified about how many VPN companies, including his, intentionally don’t retain logs of internet activity of their clients so that they cannot be produced in response to subpoenas from law enforcement or others." Note it doesn't say they don't log only that they don't retain them. So it's quite possible that the subpoena process simply lagged behind the log retention window. Also the claim in only for "internet activity" and nowhere do we see that defined. Does that include client authentication? Then article then goes on to state: >"Arsenault said he could not find any record of Ross Colby subscribing to the VPN service when he searched using Ross Colby’s two known email addresses, which he received from law enforcement." Could not find is not the same thing as there was nothing to search.

shalomhomes 8y ago
It's all marketing claims when all is said and done. PIA is still the only VPN company that has proven its no log policy not once but twice. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
- bogomipz 8y ago
  I'm not sure why you are providing that second link as proof that they don't log. That is just a link to the same story being discussed here and the same one I am quoting in my comment. Also the first link continues its insistence on using the phrase "user activity" logging. That's a rather nebulous term. Nowhere is "user activity" defined and it's certainly not a term that meaning in the context of syslog/journald. Does "user activity" logging preclude RADIUS authentication?
rasengan 8y ago
Interesting analysis, but it's wrong. We don't log, period. By stating that we don't retain logs, it means that we don't EVER retain them, not even for 0.001ms. Hope this helps.

lkurusa 8y ago

What I also like about PIA is their continued support of Open Source projects. I have been a PIA customer for a while now and will remain for the time to come.

Fnoord 8y ago
That doesn't make them more or less secure though. NSA and privacy activists both love open source.
- lkurusa 8y ago
  While you’re right, this is a point to me which made me choose PIA over competitors. I like when companies give back to open source communities.
  - Fnoord 8y ago
    Agreed. OTOH, I don't like the way (ie. tone) the co-founder is discussing in this thread. I find that unprofessional. That said, I'm biased; I'm a ProtonVPN customer. Here's the catch: I don't assume I'm anonymous with it. Just enough anonymous to use it for copyright infringement. At this point though I am so impressed with WireGuard when my ProtonVPN sub expired I really just want a good VPN provider which supports that.

krn 8y ago

ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. When a VPN is run by NSA, of course it will stand up in all courts. How would a state surveillance agency let its tool be so publicly destroyed? And it doesn't have to keep any logs at all. They can just be forwarded in real-time, based on a set of filters and rules ("URLs that are requested by <IP>", "IPs that are requesting <URL>"). [1] https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/

d0lph 8y ago
How did their security team identify that?
- ddalex 8y ago
  connect to VPNs, make illegal traffic, see which traffic triggered an investigation ... ?
- hinkley 8y ago
  Probably someone venting over beers at a convention?
consumer451 8y ago
Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I ask because my main privacy concern is state sponsored industrial espionage. I have often thought that if I wanted to gather kompromat on high level professionals, I would probably start an "anonymous" VPN service to further that effort. Say what you will about the NSA, but I am not worried about them in that space.
- kinsomo 8y ago
  > Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I would also like to know the motivation for a US intel agency to want to run a VPN. It seems to me like it wouldn't be worth the bother: VPNs aren't illegal in the US, so it would be too hard to convince everyone to use theirs. Spies, etc. could just use private ones they control. They'd just see a bunch of crap from unsophisticated people. Seems to me like it would be more likely for US law enforcement to want to do something like that, but I'm skeptical they have the resources.