9 ms·

ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveilla

by krn 8y ago

ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. When a VPN is run by NSA, of course it will stand up in all courts. How would a state surveillance agency let its tool be so publicly destroyed? And it doesn't have to keep any logs at all. They can just be forwarded in real-time, based on a set of filters and rules ("URLs that are requested by <IP>", "IPs that are requesting <URL>"). [1] https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/

d0lph 8y ago
How did their security team identify that?
- ddalex 8y ago
  connect to VPNs, make illegal traffic, see which traffic triggered an investigation ... ?
- hinkley 8y ago
  Probably someone venting over beers at a convention?
consumer451 8y ago
Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I ask because my main privacy concern is state sponsored industrial espionage. I have often thought that if I wanted to gather kompromat on high level professionals, I would probably start an "anonymous" VPN service to further that effort. Say what you will about the NSA, but I am not worried about them in that space.
- kinsomo 8y ago
  > Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I would also like to know the motivation for a US intel agency to want to run a VPN. It seems to me like it wouldn't be worth the bother: VPNs aren't illegal in the US, so it would be too hard to convince everyone to use theirs. Spies, etc. could just use private ones they control. They'd just see a bunch of crap from unsophisticated people. Seems to me like it would be more likely for US law enforcement to want to do something like that, but I'm skeptical they have the resources.
  - zippy 8y ago
    if you're a spy using it to hide your identity from websites when you visit, it would be good for your VPN to have a mix of normal activity and spy activity. If you run your own, it's going to have a weird pattern of traffic that might stand out to a website with decent analytics.
    - Kalium 8y ago
      This is exactly why Tor is publicly available.
- TheForumTroll 8y ago
  >Say what you will about the NSA, but I am not worried about them in that space. We know from leaks that the steal industry secrets.
kinsomo 8y ago
> ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." > If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. If I had to guess, the state surveillance agency-run VPN would be one that's still accessible from China. I understand (but I could be wrong) there are still a few that manage to evade the blocks and provide good service despite all the crackdowns. Chinese state security has many more reasons to want to watch domestic VPN traffic than the US does. Their motivation is proven by the fact that they've spent the effort to build and maintain the "Great Firewall," and crack down on VPNs that bypass it. It would be reasonably clever for the Chinese to crack down on all the VPNs that they don't control, funneling all the "illicit" traffic to the few VPNs they do control. It would make spying, monitoring dissidents, etc. much easier for them. The NSA and other US intelligence agencies probably don't care very much about anyone that's dumb enough to need to use public VPN. Seems like the only people who would care in the US are domestic law enforcement, like the FBI.
- protonmail 8y ago
  We're not ready to name names at this point, but you're actually correct. If one looks closely at what China lets through the Great Firewall in terms of the major VPN providers, there is something that stands out.
  - kinsomo 8y ago
    > We're not ready to name names at this point, but you're actually correct. Where do you plan to announce when you're ready to name names? I may have some need in the future to use a VPN in China and would like to be aware. Also props on your mail service, it's very impressive. If it had been released a bit earlier, I think I'd have been a customer.
rasengan 8y ago
[Comment retracted and removed by author's request.]
- deleted 7y ago
  [deleted]
- dang 7y ago
  In addition to the redacting the above comment, we deleted several comments below by request of their authors. My understanding is that the dispute has been resolved and that the allegations are retracted.
- deleted 8y ago
  [deleted]
  - deleted 8y ago
    [deleted]
    - deleted 8y ago
      [deleted]
      - deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]

by krn 8y ago

d0lph 8y ago

How did their security team identify that?

ddalex 8y ago
connect to VPNs, make illegal traffic, see which traffic triggered an investigation ... ?
hinkley 8y ago
Probably someone venting over beers at a convention?

consumer451 8y ago

Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I ask because my main privacy concern is state sponsored industrial espionage. I have often thought that if I wanted to gather kompromat on high level professionals, I would probably start an "anonymous" VPN service to further that effort. Say what you will about the NSA, but I am not worried about them in that space.

kinsomo 8y ago
> Honest question: Is there any reason to believe that PIA is a US intel operation vs, say a Russian one? I would also like to know the motivation for a US intel agency to want to run a VPN. It seems to me like it wouldn't be worth the bother: VPNs aren't illegal in the US, so it would be too hard to convince everyone to use theirs. Spies, etc. could just use private ones they control. They'd just see a bunch of crap from unsophisticated people. Seems to me like it would be more likely for US law enforcement to want to do something like that, but I'm skeptical they have the resources.
- zippy 8y ago
  if you're a spy using it to hide your identity from websites when you visit, it would be good for your VPN to have a mix of normal activity and spy activity. If you run your own, it's going to have a weird pattern of traffic that might stand out to a website with decent analytics.
  - Kalium 8y ago
    This is exactly why Tor is publicly available.
TheForumTroll 8y ago
>Say what you will about the NSA, but I am not worried about them in that space. We know from leaks that the steal industry secrets.

kinsomo 8y ago

> ProtonVPN (operated from Switzerland) claims[1]: "Our security team has also identified at least one VPN service which is working on behalf of a state surveillance agency." > If I had to guess, it would be PIA: the most popular, the most accessible, and the most affordable US-based VPN. If I had to guess, the state surveillance agency-run VPN would be one that's still accessible from China. I understand (but I could be wrong) there are still a few that manage to evade the blocks and provide good service despite all the crackdowns. Chinese state security has many more reasons to want to watch domestic VPN traffic than the US does. Their motivation is proven by the fact that they've spent the effort to build and maintain the "Great Firewall," and crack down on VPNs that bypass it. It would be reasonably clever for the Chinese to crack down on all the VPNs that they don't control, funneling all the "illicit" traffic to the few VPNs they do control. It would make spying, monitoring dissidents, etc. much easier for them. The NSA and other US intelligence agencies probably don't care very much about anyone that's dumb enough to need to use public VPN. Seems like the only people who would care in the US are domestic law enforcement, like the FBI.

protonmail 8y ago
We're not ready to name names at this point, but you're actually correct. If one looks closely at what China lets through the Great Firewall in terms of the major VPN providers, there is something that stands out.
- kinsomo 8y ago
  > We're not ready to name names at this point, but you're actually correct. Where do you plan to announce when you're ready to name names? I may have some need in the future to use a VPN in China and would like to be aware. Also props on your mail service, it's very impressive. If it had been released a bit earlier, I think I'd have been a customer.

rasengan 8y ago

[Comment retracted and removed by author's request.]

deleted 7y ago
[deleted]
dang 7y ago
In addition to the redacting the above comment, we deleted several comments below by request of their authors. My understanding is that the dispute has been resolved and that the allegations are retracted.
deleted 8y ago
[deleted]
- deleted 8y ago
  [deleted]
  - deleted 8y ago
    [deleted]
    - deleted 8y ago
      [deleted]
      - deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]