3 ms·

So if I understand correctly, you would want to know the details of how Mozilla audited ProtonVPN, is that it?

by Yoric 8y ago

JackC 8y ago
Right -- I'm looking for a white-paper level of detail somewhere behind the landing-page level of detail. What threats (internal and external) did you consider, what evidence convinced you they were addressed, and what acceptable risks remain? What would you as an engineer want to be told by another engineer who did the audit, for you to say "great, that's what I would have done, sounds like you did your due diligence, I'll use that"? The white paper won't be read by everybody and shouldn't be targeted at everybody, but it will be read by the most knowledgeable folks and be a source of confidence that filters out to everyone else. This all depends on there actually being an audit -- so far the landing page doesn't even say that! From the text on the page there's no way to tell if Mozilla just read the published policies for a bunch of VPNs and made a recommendation, or has an employee embedded in ProtonVPN's security team and a seat on the board, or somewhere in between. Without knowing the details, it's hard for me to say whether I'm looking for more documentation of the audit that already happened, or a stronger actual relationship behind the endorsement.
krn 8y ago
Everyone in Vilnius, Lithuania knows, that both, NordVPN and ProtonVPN, are being developed here by the people related to Tesonet, which has been recently sued in Texas Eastern District Court for the patent infringement in "Large-scale web data extraction products and services with residential proxy network ( https://oxylabs.io/ https://oxylabs.io/ )"[1] by Luminati Networks, an Israeli data mining company behind HolaVPN[2]. The section from the "About" page of Tesonet (26 Apr 2018)[3], which was suddenly removed in June 2018 after the connection between ProtonVPN and Tesonet was made public by the co-founder of PIA[4]: "For the latest project, Tesonet is working together with an international brand from Switzerland to create a security product that helps users protect their network traffic. As part of this technical partnership, we are collaborating on datacenter and network infrastructure that can easily supply 10 Gbps worth of bandwidth to users around the world. The product is developed using the latest authentication encryption methods and the best practices in the security world." As late as September 2018, NordVPN and ProtonVPN still become affected by the same extremely rare Windows security bugs at the same time[5], even though the CTO of ProtonMail claimed here on Hacker News, that they used Tesonet, a data mining company, for developing ProtonVPN, a free VPN service, only as "an office space provider"[6]. [1] http://litigation.maxval-ip.com/Litigation/DetailView?CaseID=Epee88Womxg%3D&logstat=false&Party=Luminati%20Networks%20Ltd.%20v.%20UAB%20Tesonet http://litigation.maxval-ip.com/Litigation/DetailView?CaseID... [2] http://fortune.com/2015/05/29/hola-luminati-vpn/ http://fortune.com/2015/05/29/hola-luminati-vpn/ [3] https://web.archive.org/web/20180426161609/https://tesonet.com/about/ https://web.archive.org/web/20180426161609/https://tesonet.c... [4] https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 [5] https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs... [6] https://news.ycombinator.com/item?id=17258538 https://news.ycombinator.com/item?id=17258538
- protonmail 7y ago
  Proton team here. Regarding this claim: > Everyone in Vilnius, Lithuania knows, that both, NordVPN and ProtonVPN, are being developed here by the people related to Tesonet This is not true. Proton has staff in Geneva, Zurich, Skopje, Vilnius, and San Francisco. Years ago, we did sublease office space from Tesonet (one of the biggest IT firms in Vilnius) as alleged above, but there is no connection today. ProtonVPN is fully developed (and owned) by Proton Technologies AG, the Swiss company that also operates ProtonMail. This can be verified in the Swiss commercial registry, which also lists all our directors: http://ge.ch/hrcintapp/externalCompanyReport.action?companyOfrcId13=CH-660-1995014-1&ofrcLanguage=4 http://ge.ch/hrcintapp/externalCompanyReport.action?companyO...
- protonmail 8y ago
  You can find Proton's response to these false allegations here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...
  - krn 8y ago
    > false allegations These are nothing but facts backed by sources anyone can verify by himself.
    - westmeal 8y ago
      Why is there an article about Hola in there?
      - krn 8y ago
        To show that Luminati Networks, which sued Tesonet for patent infringements, has publicly admitted using HolaVPN as a residential proxy network for data mining operations.
- pokemongoaway 8y ago
  Wow, thank you for posting. Protonmail's replies on Reddit are unsatisfactory, especially for this age's state of privacy. Any recommendations? Hard to trust any VPNs out there. We need some way to verify VPN server software, log deletion, and the like.

So if I understand correctly, you would want to know the details of how Mozilla audited ProtonVPN, is that it?

by Yoric 8y ago

So if I understand correctly, you would want to know the details of how Mozilla audited ProtonVPN, is that it?

Right -- I'm looking for a white-paper level of detail somewhere behind the landing-page level of detail. What threats (internal and external) did you consider, what evidence convinced you they were addressed, and what acceptable risks remain? What would you as an engineer want to be told by another engineer who did the audit, for you to say "great, that's what I would have done, sounds like you did your due diligence, I'll use that"? The white paper won't be read by everybody and shouldn't be targeted at everybody, but it will be read by the most knowledgeable folks and be a source of confidence that filters out to everyone else. This all depends on there actually being an audit -- so far the landing page doesn't even say that! From the text on the page there's no way to tell if Mozilla just read the published policies for a bunch of VPNs and made a recommendation, or has an employee embedded in ProtonVPN's security team and a seat on the board, or somewhere in between. Without knowing the details, it's hard for me to say whether I'm looking for more documentation of the audit that already happened, or a stronger actual relationship behind the endorsement.

krn 8y ago

Everyone in Vilnius, Lithuania knows, that both, NordVPN and ProtonVPN, are being developed here by the people related to Tesonet, which has been recently sued in Texas Eastern District Court for the patent infringement in "Large-scale web data extraction products and services with residential proxy network ( https://oxylabs.io/ https://oxylabs.io/ )"[1] by Luminati Networks, an Israeli data mining company behind HolaVPN[2]. The section from the "About" page of Tesonet (26 Apr 2018)[3], which was suddenly removed in June 2018 after the connection between ProtonVPN and Tesonet was made public by the co-founder of PIA[4]: "For the latest project, Tesonet is working together with an international brand from Switzerland to create a security product that helps users protect their network traffic. As part of this technical partnership, we are collaborating on datacenter and network infrastructure that can easily supply 10 Gbps worth of bandwidth to users around the world. The product is developed using the latest authentication encryption methods and the best practices in the security world." As late as September 2018, NordVPN and ProtonVPN still become affected by the same extremely rare Windows security bugs at the same time[5], even though the CTO of ProtonMail claimed here on Hacker News, that they used Tesonet, a data mining company, for developing ProtonVPN, a free VPN service, only as "an office space provider"[6]. [1] http://litigation.maxval-ip.com/Litigation/DetailView?CaseID=Epee88Womxg%3D&logstat=false&Party=Luminati%20Networks%20Ltd.%20v.%20UAB%20Tesonet http://litigation.maxval-ip.com/Litigation/DetailView?CaseID... [2] http://fortune.com/2015/05/29/hola-luminati-vpn/ http://fortune.com/2015/05/29/hola-luminati-vpn/ [3] https://web.archive.org/web/20180426161609/https://tesonet.com/about/ https://web.archive.org/web/20180426161609/https://tesonet.c... [4] https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 [5] https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs... [6] https://news.ycombinator.com/item?id=17258538 https://news.ycombinator.com/item?id=17258538

protonmail 7y ago
Proton team here. Regarding this claim: > Everyone in Vilnius, Lithuania knows, that both, NordVPN and ProtonVPN, are being developed here by the people related to Tesonet This is not true. Proton has staff in Geneva, Zurich, Skopje, Vilnius, and San Francisco. Years ago, we did sublease office space from Tesonet (one of the biggest IT firms in Vilnius) as alleged above, but there is no connection today. ProtonVPN is fully developed (and owned) by Proton Technologies AG, the Swiss company that also operates ProtonMail. This can be verified in the Swiss commercial registry, which also lists all our directors: http://ge.ch/hrcintapp/externalCompanyReport.action?companyOfrcId13=CH-660-1995014-1&ofrcLanguage=4 http://ge.ch/hrcintapp/externalCompanyReport.action?companyO...
protonmail 8y ago
You can find Proton's response to these false allegations here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...
- krn 8y ago
  > false allegations These are nothing but facts backed by sources anyone can verify by himself.
  - westmeal 8y ago
    Why is there an article about Hola in there?
    - krn 8y ago
      To show that Luminati Networks, which sued Tesonet for patent infringements, has publicly admitted using HolaVPN as a residential proxy network for data mining operations.
pokemongoaway 8y ago
Wow, thank you for posting. Protonmail's replies on Reddit are unsatisfactory, especially for this age's state of privacy. Any recommendations? Hard to trust any VPNs out there. We need some way to verify VPN server software, log deletion, and the like.