8 ms·

Many free mobile VPN apps are based in China or have Chinese ownership

182 points by wglb 8y ago

userbinator 8y ago
I'm not surprised, because the Chinese also have the most need for a VPN. Contrary to the article I think them "trying to keep a low profile" is not a bad sign at all, and you shouldn't really need to worry about privacy if you're using end-to-end encryption through the VPN.
- tehlike 8y ago
  Except if the phone itself contains an exploit.
  - echevil 8y ago
    Privacy is not a big concern for the Chinese based VPN services. It’s useful for both accessing websites blocked inside China, and also Chinese content blocked outside China
forkLding 8y ago
Likely the reason why a lot of VPN apps are Chinese is because there is an actual demand for VPN usage in China. You then multiply that with the population size (19% of the world is Chinese or roughly 1 in 5 people in this world) and you will have a massive market to grow for local Chinese VPN developers and for them to prosper. The article author sounds surprised but it is quite logical if you think about it.
- tehlike 8y ago
  This is not entirely true. Some, if not all, of these companies start outside of china, but end up getting bought by chinese capital. I do not have a source for this, i just know from my chat with friends.
  - dis-sys 8y ago
    It works both way. I used to use a shadowsocks based service called "God Use VPN" or 佛跳墙 in Chinese, which is a dish name. It was so popular to the extend that google translation used to believe that the English name of that Chinese dish known as "佛跳墙" is "God Use VPN". It was recently sold to a foreign owner and stopped provided any Chinese based services - if you send them some emails in Chinese, you get English responses. Pretty clear sign that they quit the Chinese market for whatever reason.
    - ElBarto 8y ago
      VPN use is illegal in China, which is a good reason to quit the market. For Chinese apps, we can only imagine that the government does really police the ban or that they are honey pots...
      - cauldron 8y ago
        In fact they don't care that much if you are deemed reliable, like some state institutes, researchers, there's is a priviledged net CSTNET for those people, they don't block anything on that. They are far more lenient on English sites, presumably due to the requirement of high education level to read. And there is a university net, it's slightly less blocked than public nets. They've charged someone for selling VPN online, but charging users is effectively unprobable due to the sheer number, but since Chinese laws are generally vague, judges and prosecutors are easily influenced and arbitrary on party security cases, they can always pick couple guys off to make a statement or set an example, like Sabotaging Computer Systems.
        baybal2 8y ago
        That myth was perpetuated for a long time. So far, I have not seen any genuine "unblocked network" in China. The few companies and universities with campus-wide unblocked internet simply use VSAT, or just a regular VPN. I've been on Microsoft's campus once, and the external IP of their wifi was that of an HK colo, same with the famed "very secret" Nottingham uni network that had Singaporean IPs. Not even people in Qinghua (number one uni in China, if you don't count central party school) I know, know of anything that amounts to that. The very same thing with MPLS, and allegedly "physically uninterrupted" links to HK. They also have GFW on them. There is nothing that amounts to "officially permitted VPN" in China. That's a myth. The only thing that amounts to that are microwave to HK/Macau, HK SIM, VSAT, or a cable across Sham Chun, and all of this is being actively looked for by police and three letter services.
- deleted 8y ago
  [deleted]
- jobigoud 8y ago
  How do these VPN bypass the Great Firewall if they are in China?
  - deleted 8y ago
    [deleted]
  - klipt 8y ago
    Some are based in e.g. Hong Kong which is in China but separately administered. (E.g. Chinese residents in Hong Kong are allowed dual citizenship while mainland Chinese are not.)
tehlike 8y ago
Almost all of the utility apps (battery cleaners, ram optimizers etc) are owned by chinese, and they are a bigger threat than vpn services. They have a huge footprint of devices outside of china, and have a lot of permissions granted
- echevil 8y ago
  Yeah, I wouldn’t be surprised at all. VPN is useful in both direction. There are quite some Chinese content not accessible outside China.
  - kakaorka 8y ago
    Can you mention an example of Chinese content that’s not accessible?
    - yorwba 8y ago
      Various streaming services prevent access to their site from non-Chinese IPs because they don't have distribution rights for other countries.
- rasz 8y ago
  Same on PC. Opera browser, MiniTool Partition Wizard, etc. Tons of "free" programs with build in call home "telemetry".
User23 8y ago
The odds of a Chinese homed VPN provider not sharing logs with the Party asymptotically approach zero as time and user count increase.
- majia 8y ago
  Providing vpn services is almost illegal in china. The party doesnt ask for logs; it shuts down vpn services and punishes the providers. So the odds of vpn provider sharing logs with the government is ironically low.
  - netsharc 8y ago
    Well... if "dissidents" use VPN that you ("Chinese government") can't monitor, what's one easy way to continue monitoring them? Yes, offer them free VPN, what good is encryption if you're connected to a server they own/have influence over?
    - majia 8y ago
      The party doesn’t need to offer them free vpn. Instead, it figures out what vpn services they are using and shuts them down. It goes as far as using machine learning to detect vpn traffic. I guess this is more effective because dissents is a very small subset of vpn users, and application layer encryption makes it hard to extract much information even if you can monitor vpn traffic.
- echevil 8y ago
  Given the scale of VPN usage in China, it’s unlikely the party could do anything about it even if it got access to some logs. Vast majority of the users of these services inside China are most likely very educated group of people, like academia, software engineers, scientists etc. Large tech companies usually have some way for their employees to access banned websites in China, but mostly just for accessing tech related information. It’s just yet another gray area
duxup 8y ago
Is there any reason to trust a free VPN service? At least with a paid service I might think that my money ... could be enough to sustain the company. At least it could be. I would assume a free service would have to be selling your information just as a matter of policy / economics.
- echevil 8y ago
  There is usually a free version and a paid version for better speed.
- gog 8y ago
  If a provider is offering free and paid plans, free plan is usually used to attract customers to try your service. The free plan is "paid off" with money that would otherwise go to marketing.
  - kakarot 8y ago
    Mullvad offers unlimited 3-hour trial accounts. A few days messing around with that was enough for me to decide become a lifetime customer. That's the correct model for onboarding with free services, not offering a free service tier with restricted speeds. It's simply stupid as a user to forward all of your traffic to another company for free. Thus any VPN that offers such a service does not believe in fully educating its users of the dangers involved in using a VPN, and are operating at an ethical boundary.
    - Kaveren 8y ago
      I feel like I could theoretically just spend an hour writing a script to abuse acquiring the apparently unlimited Mullvad trial accounts, and just post it on GitHub. Sounds like a business problem.
      - kakarot 8y ago
        You can't be suggesting that the first time someone attempts to do something like this on a large scale, that Mullvad's team would be surprised. You surely can't be suggesting that this didn't come up in meetings, and that the opportunity cost wasn't determined and taken into account when offering this trial service. The painlessness of the service, along with the encouragement to generate as many new account numbers as needed while testing, along with allowing full feature access without throttling, meant that I generated two weeks' worth of trials before finally deciding Mullvad was right for me. But now I know they are right for me, and as I said in an earlier post I am now a customer for life. As long as nothing changes, that will remain so, and I will, as I am now, frequently proselytize their service and encourage others to try them out for free. I'd say they calculated the opportunity cost correctly.
donadaso 8y ago
Check out best VPN on sale https://bestleap.com/best-black-friday-deals-live/ https://bestleap.com/best-black-friday-deals-live/
crb912 8y ago
No need surperised. I use VPN for crossing GFW in the past. But free VPN is not stable, so that I use VPS (in the US) now. Just need $20/year
cauldron 8y ago
If they install root certificate then all your date is naked, not sure if they do tho. But either way, you give away DNS log, http data, and possibly forced affiliate link when shopping online.
deleted 8y ago
[deleted]
DyslexicAtheist 8y ago
VPN just shifts the trust from your ISP to the VPN company. It doesn't matter where they're based. If you pay with a credit card under your real name the burden of risk is always on you and if the company has agreements with whichever jurisdiction you are in then they will collaborate with LE. that said, trust is fickle: The ultimate example of why not to put trust in companies was WoSign/StartCom. WoSign acquired Startcom because they were a trusted fresh player with a still untarnished name and available cheaply (also thanks to Eddy Nigg and his investor Wes Kussmaul who both saw no conflict of interest and indeed claimed in public Eddy didn't know who the buyer actually was until it was too late). When somebody shows up with a fat cheque and tells your VPN company that Christmas came early, and that they're being bought out, then you have no reason to continue to trust or? Yet people do continue to trust (see the N.N. Taleb Turkey problem). People then are forgetting their trust assumption actually doesn't hold when main mode of growth for the company is M&A and not product development & innovation. When trust is just a commodity that can be acquired and resold willy-nilly by some people with enough cash, then the product/service is automatically snake-oil (no matter if the crypto and the implementation of the software is 100% rock solid and was written by gods). For VPN's a good rule is to choose a neutral company that has very little in common with you. If you are doing shit in Iran don't use an Iranian VPN company. likewise if you do shit in Russia then US/UK VPN should be safer than a VPN located in Cyprus. If you do "shit" against Turkey, with a VPN in Australia while you are based in Taiwan that's 3 jurisdictions and much better than doing shit against Turkey connecting from Australia with your VPN based in Australia. Finally it is best not to do shit, but sometimes doing shit is the only way crimes by governments and those in power can be exposed.
- Heliosmaster 8y ago
  Not to forget that sometimes the definition of shit changes over time and while the things you were doing were not classified as shit at the time, after a certain date they might become (even retroactively) so.
- projectramo 8y ago
  I thought the VPN protects me from US tech firms scooping up my data. Private browsing + VPN means each session looks like a new person and they can’t tie my browsing back to me (pretty innocent browsing but still). Edit: right?
supergirl 8y ago
and?
Taniwha 8y ago
My guess is that the once ubiquitous Chinese VPN companies one found ads for everywhere in China have been driven out of the local market leaving people with gear and no customers, moving to courting offshore (from China) customers is the obvious move for these guys
thanosnose 8y ago
This should be the HN motto: "If you aren't paying for it, you are the product". Also, VPN isn't a magic cure for the disease of privacy violation. You are just choosing to trust the people running the VPN service over the people running your ISP. Should you trust a VPN company more than your ISP? I really can't say, but VPN isn't a magic fix.
- h4waii 8y ago
  Sorry, but this is just not true at all. There are thousands of open (and closed) source projects, software, and services that do not fall under this silly statement. Does it mean that if you do pay for a product, that you still can't "be the product"? Blanket statements shouldn't be anyone's motto.
Pica_soO 8y ago
P2P VPN Services should be a thing.
kristofferR 8y ago
What's the best free peer-to-peer VPN? Not a VPN that supports P2P filesharing, but a VPN where the users are the "servers", like Hola used to be before it started sucking (can't even select country now without paying).
- Kaveren 8y ago
  I wouldn't recommend using one. P2P VPNs are great for people to commit crimes with, so unless every time your VPN is off, you want to be solving reCAPTCHAs all day, and not be able to make a purchase online, I would avoid it. P2P VPNs don't offer much in the way of privacy, decentralization is only better in theory here. For unblocking services, many normal VPNs can do this fine as well.
- nawtacawp 8y ago
  https://www.torproject.org https://www.torproject.org
- stordoff 8y ago
  > a VPN where the users are the "servers" Is this really something desirable? It seems like it would be asking for somebody to commit crimes using your connection (without the plausible deniability/justification that you are running a VPN company).
jen_h 8y ago
Heck, many free mobile VPN apps don't even encrypt your traffic. An analysis of VPN apps on Android done back in 2016 found 84% leaked IPv6, 66% leaked DNS, 38% contained malware...and 18% didn't even encrypt anything... Study is two years old, but I doubt it's gotten any better. (Source, PDF: https://research.csiro.au/ng/wp-content/uploads/sites/106/2016/08/paper-1.pdf https://research.csiro.au/ng/wp-content/uploads/sites/106/20...)
crazy_monkey 8y ago
... on the bright side, Chinese companies are less likely to sell you out to the NSA. Let's face it; NSA is probably far more interested in the insignificant American everyman than the Chinese government.
deleted 8y ago
[deleted]
aham_34 8y ago
Free startup idea : Create a VPN service using lambda or some function as service and sell it.

182 points by wglb 8y ago

I'm not surprised, because the Chinese also have the most need for a VPN. Contrary to the article I think them "trying to keep a low profile" is not a bad sign at all, and you shouldn't really need to worry about privacy if you're using end-to-end encryption through the VPN.

tehlike 8y ago
Except if the phone itself contains an exploit.
- echevil 8y ago
  Privacy is not a big concern for the Chinese based VPN services. It’s useful for both accessing websites blocked inside China, and also Chinese content blocked outside China

forkLding 8y ago

Likely the reason why a lot of VPN apps are Chinese is because there is an actual demand for VPN usage in China. You then multiply that with the population size (19% of the world is Chinese or roughly 1 in 5 people in this world) and you will have a massive market to grow for local Chinese VPN developers and for them to prosper. The article author sounds surprised but it is quite logical if you think about it.

tehlike 8y ago
This is not entirely true. Some, if not all, of these companies start outside of china, but end up getting bought by chinese capital. I do not have a source for this, i just know from my chat with friends.
- dis-sys 8y ago
  It works both way. I used to use a shadowsocks based service called "God Use VPN" or 佛跳墙 in Chinese, which is a dish name. It was so popular to the extend that google translation used to believe that the English name of that Chinese dish known as "佛跳墙" is "God Use VPN". It was recently sold to a foreign owner and stopped provided any Chinese based services - if you send them some emails in Chinese, you get English responses. Pretty clear sign that they quit the Chinese market for whatever reason.
  - ElBarto 8y ago
    VPN use is illegal in China, which is a good reason to quit the market. For Chinese apps, we can only imagine that the government does really police the ban or that they are honey pots...
    - cauldron 8y ago
      In fact they don't care that much if you are deemed reliable, like some state institutes, researchers, there's is a priviledged net CSTNET for those people, they don't block anything on that. They are far more lenient on English sites, presumably due to the requirement of high education level to read. And there is a university net, it's slightly less blocked than public nets. They've charged someone for selling VPN online, but charging users is effectively unprobable due to the sheer number, but since Chinese laws are generally vague, judges and prosecutors are easily influenced and arbitrary on party security cases, they can always pick couple guys off to make a statement or set an example, like Sabotaging Computer Systems.
      - baybal2 8y ago
        That myth was perpetuated for a long time. So far, I have not seen any genuine "unblocked network" in China. The few companies and universities with campus-wide unblocked internet simply use VSAT, or just a regular VPN. I've been on Microsoft's campus once, and the external IP of their wifi was that of an HK colo, same with the famed "very secret" Nottingham uni network that had Singaporean IPs. Not even people in Qinghua (number one uni in China, if you don't count central party school) I know, know of anything that amounts to that. The very same thing with MPLS, and allegedly "physically uninterrupted" links to HK. They also have GFW on them. There is nothing that amounts to "officially permitted VPN" in China. That's a myth. The only thing that amounts to that are microwave to HK/Macau, HK SIM, VSAT, or a cable across Sham Chun, and all of this is being actively looked for by police and three letter services.
deleted 8y ago
[deleted]
jobigoud 8y ago
How do these VPN bypass the Great Firewall if they are in China?
- deleted 8y ago
  [deleted]
- klipt 8y ago
  Some are based in e.g. Hong Kong which is in China but separately administered. (E.g. Chinese residents in Hong Kong are allowed dual citizenship while mainland Chinese are not.)

tehlike 8y ago

Almost all of the utility apps (battery cleaners, ram optimizers etc) are owned by chinese, and they are a bigger threat than vpn services. They have a huge footprint of devices outside of china, and have a lot of permissions granted

echevil 8y ago
Yeah, I wouldn’t be surprised at all. VPN is useful in both direction. There are quite some Chinese content not accessible outside China.
- kakaorka 8y ago
  Can you mention an example of Chinese content that’s not accessible?
  - yorwba 8y ago
    Various streaming services prevent access to their site from non-Chinese IPs because they don't have distribution rights for other countries.
rasz 8y ago
Same on PC. Opera browser, MiniTool Partition Wizard, etc. Tons of "free" programs with build in call home "telemetry".

User23 8y ago

The odds of a Chinese homed VPN provider not sharing logs with the Party asymptotically approach zero as time and user count increase.

majia 8y ago
Providing vpn services is almost illegal in china. The party doesnt ask for logs; it shuts down vpn services and punishes the providers. So the odds of vpn provider sharing logs with the government is ironically low.
- netsharc 8y ago
  Well... if "dissidents" use VPN that you ("Chinese government") can't monitor, what's one easy way to continue monitoring them? Yes, offer them free VPN, what good is encryption if you're connected to a server they own/have influence over?
  - majia 8y ago
    The party doesn’t need to offer them free vpn. Instead, it figures out what vpn services they are using and shuts them down. It goes as far as using machine learning to detect vpn traffic. I guess this is more effective because dissents is a very small subset of vpn users, and application layer encryption makes it hard to extract much information even if you can monitor vpn traffic.
echevil 8y ago
Given the scale of VPN usage in China, it’s unlikely the party could do anything about it even if it got access to some logs. Vast majority of the users of these services inside China are most likely very educated group of people, like academia, software engineers, scientists etc. Large tech companies usually have some way for their employees to access banned websites in China, but mostly just for accessing tech related information. It’s just yet another gray area

duxup 8y ago

Is there any reason to trust a free VPN service? At least with a paid service I might think that my money ... could be enough to sustain the company. At least it could be. I would assume a free service would have to be selling your information just as a matter of policy / economics.

echevil 8y ago
There is usually a free version and a paid version for better speed.
gog 8y ago
If a provider is offering free and paid plans, free plan is usually used to attract customers to try your service. The free plan is "paid off" with money that would otherwise go to marketing.
- kakarot 8y ago
  Mullvad offers unlimited 3-hour trial accounts. A few days messing around with that was enough for me to decide become a lifetime customer. That's the correct model for onboarding with free services, not offering a free service tier with restricted speeds. It's simply stupid as a user to forward all of your traffic to another company for free. Thus any VPN that offers such a service does not believe in fully educating its users of the dangers involved in using a VPN, and are operating at an ethical boundary.
  - Kaveren 8y ago
    I feel like I could theoretically just spend an hour writing a script to abuse acquiring the apparently unlimited Mullvad trial accounts, and just post it on GitHub. Sounds like a business problem.
    - kakarot 8y ago
      You can't be suggesting that the first time someone attempts to do something like this on a large scale, that Mullvad's team would be surprised. You surely can't be suggesting that this didn't come up in meetings, and that the opportunity cost wasn't determined and taken into account when offering this trial service. The painlessness of the service, along with the encouragement to generate as many new account numbers as needed while testing, along with allowing full feature access without throttling, meant that I generated two weeks' worth of trials before finally deciding Mullvad was right for me. But now I know they are right for me, and as I said in an earlier post I am now a customer for life. As long as nothing changes, that will remain so, and I will, as I am now, frequently proselytize their service and encourage others to try them out for free. I'd say they calculated the opportunity cost correctly.

donadaso 8y ago

Check out best VPN on sale https://bestleap.com/best-black-friday-deals-live/ https://bestleap.com/best-black-friday-deals-live/

crb912 8y ago

No need surperised. I use VPN for crossing GFW in the past. But free VPN is not stable, so that I use VPS (in the US) now. Just need $20/year

cauldron 8y ago

If they install root certificate then all your date is naked, not sure if they do tho. But either way, you give away DNS log, http data, and possibly forced affiliate link when shopping online.

deleted 8y ago

[deleted]

DyslexicAtheist 8y ago

VPN just shifts the trust from your ISP to the VPN company. It doesn't matter where they're based. If you pay with a credit card under your real name the burden of risk is always on you and if the company has agreements with whichever jurisdiction you are in then they will collaborate with LE. that said, trust is fickle: The ultimate example of why not to put trust in companies was WoSign/StartCom. WoSign acquired Startcom because they were a trusted fresh player with a still untarnished name and available cheaply (also thanks to Eddy Nigg and his investor Wes Kussmaul who both saw no conflict of interest and indeed claimed in public Eddy didn't know who the buyer actually was until it was too late). When somebody shows up with a fat cheque and tells your VPN company that Christmas came early, and that they're being bought out, then you have no reason to continue to trust or? Yet people do continue to trust (see the N.N. Taleb Turkey problem). People then are forgetting their trust assumption actually doesn't hold when main mode of growth for the company is M&A and not product development & innovation. When trust is just a commodity that can be acquired and resold willy-nilly by some people with enough cash, then the product/service is automatically snake-oil (no matter if the crypto and the implementation of the software is 100% rock solid and was written by gods). For VPN's a good rule is to choose a neutral company that has very little in common with you. If you are doing shit in Iran don't use an Iranian VPN company. likewise if you do shit in Russia then US/UK VPN should be safer than a VPN located in Cyprus. If you do "shit" against Turkey, with a VPN in Australia while you are based in Taiwan that's 3 jurisdictions and much better than doing shit against Turkey connecting from Australia with your VPN based in Australia. Finally it is best not to do shit, but sometimes doing shit is the only way crimes by governments and those in power can be exposed.

Heliosmaster 8y ago
Not to forget that sometimes the definition of shit changes over time and while the things you were doing were not classified as shit at the time, after a certain date they might become (even retroactively) so.
projectramo 8y ago
I thought the VPN protects me from US tech firms scooping up my data. Private browsing + VPN means each session looks like a new person and they can’t tie my browsing back to me (pretty innocent browsing but still). Edit: right?

supergirl 8y ago

and?

Taniwha 8y ago

My guess is that the once ubiquitous Chinese VPN companies one found ads for everywhere in China have been driven out of the local market leaving people with gear and no customers, moving to courting offshore (from China) customers is the obvious move for these guys

thanosnose 8y ago

This should be the HN motto: "If you aren't paying for it, you are the product". Also, VPN isn't a magic cure for the disease of privacy violation. You are just choosing to trust the people running the VPN service over the people running your ISP. Should you trust a VPN company more than your ISP? I really can't say, but VPN isn't a magic fix.

h4waii 8y ago
Sorry, but this is just not true at all. There are thousands of open (and closed) source projects, software, and services that do not fall under this silly statement. Does it mean that if you do pay for a product, that you still can't "be the product"? Blanket statements shouldn't be anyone's motto.

Pica_soO 8y ago

P2P VPN Services should be a thing.

kristofferR 8y ago

What's the best free peer-to-peer VPN? Not a VPN that supports P2P filesharing, but a VPN where the users are the "servers", like Hola used to be before it started sucking (can't even select country now without paying).

Kaveren 8y ago
I wouldn't recommend using one. P2P VPNs are great for people to commit crimes with, so unless every time your VPN is off, you want to be solving reCAPTCHAs all day, and not be able to make a purchase online, I would avoid it. P2P VPNs don't offer much in the way of privacy, decentralization is only better in theory here. For unblocking services, many normal VPNs can do this fine as well.
nawtacawp 8y ago
https://www.torproject.org https://www.torproject.org
stordoff 8y ago
> a VPN where the users are the "servers" Is this really something desirable? It seems like it would be asking for somebody to commit crimes using your connection (without the plausible deniability/justification that you are running a VPN company).

jen_h 8y ago

Heck, many free mobile VPN apps don't even encrypt your traffic. An analysis of VPN apps on Android done back in 2016 found 84% leaked IPv6, 66% leaked DNS, 38% contained malware...and 18% didn't even encrypt anything... Study is two years old, but I doubt it's gotten any better. (Source, PDF: https://research.csiro.au/ng/wp-content/uploads/sites/106/2016/08/paper-1.pdf https://research.csiro.au/ng/wp-content/uploads/sites/106/20...)

crazy_monkey 8y ago

... on the bright side, Chinese companies are less likely to sell you out to the NSA. Let's face it; NSA is probably far more interested in the insignificant American everyman than the Chinese government.

deleted 8y ago

[deleted]

aham_34 8y ago

Free startup idea : Create a VPN service using lambda or some function as service and sell it.