6 ms·

The relevant bit is on Page 22. >Further, records from Pure VPN show that the same email accounts Lin's gmail account and the teleportfx gmail account-were acc

by Nadya 8y ago

The relevant bit is on Page 22. >Further, records from Pure VPN show that the same email accounts Lin's gmail account and the teleportfx gmail account-were accessed from the same WANSecurity IP address. Significantly, Pure VPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time. Also, it seems Lin knew or suspected this at least, seeing as he doesn't believe in a VPN service that doesn't keep logs: >For example, on June 15, 2017, Lin ... re-tweeted a tweet from "IPVanish," that read: "Your privacy is our priority. That's why we have a strict zero log policy." Lin criticized the tweet, saying, "There is no such thing as VPN that doesn't keep logs. If they can limit your connections or track bandwidth usage, they keep logs." This will be a useful .pdf to keep on hand because I also don't believe in VPN's that don't keep logs. At a minimum they'll keep 30 days worth and in many countries may actually be required by law to keep them longer than that even (60-90 days usually). As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion. E: A few typo fixes and the last 4 words.

microcolonel 8y ago
Bandwidth counting can be accomplished without keeping "logs" per se, and with WireGuard, I think there would be very little reason to attempt to limit connections.
- 0xCMP 8y ago
  WireGuard is very hard to run without logging. It simply wasn’t designed for that and the maintainer was paid once to write “a rootkit-like” piece of code for a VPN provider which hired him to help them fix that. It’s still an open question afaik edit: I've worded this weird. I was typing on my phone at lunch stuff I'd just learned this morning[0] which referenced this[1] article saying running a log-less Wireguard might not be possible. AirVPN in [0]: > "Wireguard, in its current state, not only is dangerous because it lacks basic features and is an experimental software, but it also weakens dangerously the anonymity layer." and Perfect Privacy: > "WireGuard has no dynamic address management, the client addresses are fixed. That means we would have to register every active device of our customers and assign the static IP addresses on each of our VPN servers. [...]" Things may have changed, but it appears that running a log-less vpn provider is actually more complicated with Wireguard than at first glance. Namely the issues around DynamicIPs. [0]: https://restoreprivacy.com/wireguard/ https://restoreprivacy.com/wireguard/ [1]: https://www.perfect-privacy.com/blog/2018/10/10/wireguard-vpn-pros-and-cons/?a_aid=vpnrep https://www.perfect-privacy.com/blog/2018/10/10/wireguard-vp...
  - tanderson92 8y ago
    I run Wireguard on my systems and to my knowledge it does not log anything on my Linux systems (not that I intended specifically to set it up that way, it is just something that I noticed). Can you tell me where I can find these logs which I am seemingly unaware of? I do know that my iOS app logs things but I'm talking about Linux.
  - kakarot 8y ago
    Your statement is vacant without an explanation of what kind of logging Wireguard requires. Currently, all it does is attempt to scare the user with the word "rootkit".
    - microcolonel 8y ago
      FWIW Jason called it A Defensive Rootkit [0]. But the parent post is wrong, the defensive rootkit is not to prevent logging, it's to prevent extracting the configuration from the kernel. It effectively makes the WireGuard configuration write-only from the perspective of userspace. WireGuard does not do any access logging by default as far as I am aware. [0]: https://lists.zx2c4.com/pipermail/wireguard/2017-November/001969.html https://lists.zx2c4.com/pipermail/wireguard/2017-November/00...
  - pimeys 8y ago
    At least AzireVPN has some claims of not logging Wireguard: https://www.azirevpn.com/docs/security#blind-operator-mode https://www.azirevpn.com/docs/security#blind-operator-mode
  - ryanlol 8y ago
    >WireGuard is very hard to run without logging. It simply wasn’t designed for that and the maintainer was paid once to write “a rootkit-like” piece of code for a VPN provider which hired him to help them fix that. This is a really bizarre misunderstanding of the events. Wireguard does not generate any log entries by default. zx2c4 wrote a rootkit which makes it more difficult to retrieve connected users IPs from a running wireguard instance.
crankylinuxuser 8y ago
Again, its easier to buy a cheap VPS in a country that is at odds with the one you're in. Then, any intelligence the other country gets will likely not be sent to the country of residence. Ally countries usually have extradition treaties, and have a greater chance of sharing intel.
- daxorid 8y ago
  Correlation is still quite easy in that scenario, unless you're sharing that VPS with a thousand other people. NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you.
  - AmericanChopper 8y ago
    >it's a simple matter of parallel construction for domestic law enforcement to pop you. This is more just putting some circumstantial evidence together. Parallel construction refers to going out and getting evidence a second time, because you don’t want to reveal how you got it the first time. Usually because the first time it was collected was without a warrant, or collected from a sources or via a method you want to keep secret. So the evidence is reconstructed in parallel.
  - tivert 8y ago
    > NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you. Couldn't that be countered by using two foreign IPs for your VPN, one for your inbound connection and another for your outbound traffic? It would make it more difficult to correlate your US IP with the outbound VPN traffic without extra information.
pedrocx486 8y ago
In Brazil law requires services to keep logs for a year. This made me very wary of services like ProtonVPN that put some servers there. A lot of people trust them, but I for some reason don't...
- bilbo0s 8y ago
  >A lot of people trust them, but I for some reason don't... No offense or anything, but it sounds like you actually have very GOOD reasons for not trusting them.
- protonmail 8y ago
  We don't keep logs in Brazil, and as we have no operations in Brazil, so this is not a point that particularly concerns us. We have something known as Secure Core VPN that offers additional protection if our Brazilian ISP starts monitoring our connection: https://protonvpn.com/support/secure-core-vpn/ https://protonvpn.com/support/secure-core-vpn/
ukyrgf 8y ago
I mean, the special agent even calls it a fact: "the fact that VPN's track activity with logs." >As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion. Seriously, all this over a roommate found on Craigslist. I did like the part where his victim repeatedly smashed his computer monitor with a hammer, though.
jclay 8y ago
One important distinction could be that these were HTTP requests made on his account page or other. If he logs into the account to update billing, etc that would certainly be logged. All of what is claimed in the statement would be possible even if we assume no logs are stored for the VPN Server they run, which makes no guarantees about access to their HTTP properties.
ALittleLight 8y ago
I opened the document expecting to sympathize with Lin. In my imagination this was some FBI surveillance state overreach, or "cyberharassment" thing getting overblown. Instead, reading through the allegations, Lin came off as abominable. Contrary to your conclusion that this shows the FBI takes cyber harassment seriously, it seems like law enforcement generally allowed Lin to publicly subject this poor woman to psychological torture for a couple years before doing anything about it. Provided the allegations are true, whatever sentence he gets will not be enough...
- claudiawerner 8y ago
  Why would you expect to sympathize with him? Is it usual (i.e more likely than not) that cases of cyberharassment are overblown, or based on faulty knowledge, or outright false? It's strange to me that someone would immediately be so skeptical, unless the rate of false accusations is higher than the rate of true accusations (at least insofar as determined by the imperfect legal system). Is that the case? I'd like to be corrected if it is.
  - ukyrgf 8y ago
    The title changed! I hate when Hacker News does this. Before, it was: > FBI arrests PureVPN user with log data that was said to not exist (justice.gov) Nothing about cyberstalking. I too figured it was going to be something stupid like piracy.
  - ALittleLight 8y ago
    I don't know what the rate of false or overblown allegations is. I wrote above about my intuition and not my judgment after a considered study of the issues and evidence. It's just what I expected. As for why my intuition went that way, I suspect it's because, from the title, I felt like Lin was wronged by the VPN company which misled him, I generally distrust the FBI, deanonymizing VPN traffic seems troubling to me, "cyberharassment" sounds more like being mean to people online than the things Lin did and I don't think sending rude words to people should be criminal, and I suppose that I personally am more likely to be (falsely) accused of cyberharassment than I am to be victimized by it which probably results in implicitly identifying more with the attacker than the victim.
iqy 8y ago
Why not just use Tor?
- LinuxBender 8y ago
  For some things, Tor works just fine. For some sites, Tor is either blocked, or may send you through endless captchas. At least, that has been my experience.
memeograph 8y ago
>As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion. Probably cos they investigated certain cases and found nothing, to the great dismay of certain people who wanted to be seen as victims and others who wanted to be seen defending them.

by Nadya 8y ago

microcolonel 8y ago

Bandwidth counting can be accomplished without keeping "logs" per se, and with WireGuard, I think there would be very little reason to attempt to limit connections.

0xCMP 8y ago
WireGuard is very hard to run without logging. It simply wasn’t designed for that and the maintainer was paid once to write “a rootkit-like” piece of code for a VPN provider which hired him to help them fix that. It’s still an open question afaik edit: I've worded this weird. I was typing on my phone at lunch stuff I'd just learned this morning[0] which referenced this[1] article saying running a log-less Wireguard might not be possible. AirVPN in [0]: > "Wireguard, in its current state, not only is dangerous because it lacks basic features and is an experimental software, but it also weakens dangerously the anonymity layer." and Perfect Privacy: > "WireGuard has no dynamic address management, the client addresses are fixed. That means we would have to register every active device of our customers and assign the static IP addresses on each of our VPN servers. [...]" Things may have changed, but it appears that running a log-less vpn provider is actually more complicated with Wireguard than at first glance. Namely the issues around DynamicIPs. [0]: https://restoreprivacy.com/wireguard/ https://restoreprivacy.com/wireguard/ [1]: https://www.perfect-privacy.com/blog/2018/10/10/wireguard-vpn-pros-and-cons/?a_aid=vpnrep https://www.perfect-privacy.com/blog/2018/10/10/wireguard-vp...
- tanderson92 8y ago
  I run Wireguard on my systems and to my knowledge it does not log anything on my Linux systems (not that I intended specifically to set it up that way, it is just something that I noticed). Can you tell me where I can find these logs which I am seemingly unaware of? I do know that my iOS app logs things but I'm talking about Linux.
- kakarot 8y ago
  Your statement is vacant without an explanation of what kind of logging Wireguard requires. Currently, all it does is attempt to scare the user with the word "rootkit".
  - microcolonel 8y ago
    FWIW Jason called it A Defensive Rootkit [0]. But the parent post is wrong, the defensive rootkit is not to prevent logging, it's to prevent extracting the configuration from the kernel. It effectively makes the WireGuard configuration write-only from the perspective of userspace. WireGuard does not do any access logging by default as far as I am aware. [0]: https://lists.zx2c4.com/pipermail/wireguard/2017-November/001969.html https://lists.zx2c4.com/pipermail/wireguard/2017-November/00...
- pimeys 8y ago
  At least AzireVPN has some claims of not logging Wireguard: https://www.azirevpn.com/docs/security#blind-operator-mode https://www.azirevpn.com/docs/security#blind-operator-mode
- ryanlol 8y ago
  >WireGuard is very hard to run without logging. It simply wasn’t designed for that and the maintainer was paid once to write “a rootkit-like” piece of code for a VPN provider which hired him to help them fix that. This is a really bizarre misunderstanding of the events. Wireguard does not generate any log entries by default. zx2c4 wrote a rootkit which makes it more difficult to retrieve connected users IPs from a running wireguard instance.

crankylinuxuser 8y ago

Again, its easier to buy a cheap VPS in a country that is at odds with the one you're in. Then, any intelligence the other country gets will likely not be sent to the country of residence. Ally countries usually have extradition treaties, and have a greater chance of sharing intel.

daxorid 8y ago
Correlation is still quite easy in that scenario, unless you're sharing that VPS with a thousand other people. NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you.
- AmericanChopper 8y ago
  >it's a simple matter of parallel construction for domestic law enforcement to pop you. This is more just putting some circumstantial evidence together. Parallel construction refers to going out and getting evidence a second time, because you don’t want to reveal how you got it the first time. Usually because the first time it was collected was without a warrant, or collected from a sources or via a method you want to keep secret. So the evidence is reconstructed in parallel.
- tivert 8y ago
  > NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you. Couldn't that be countered by using two foreign IPs for your VPN, one for your inbound connection and another for your outbound traffic? It would make it more difficult to correlate your US IP with the outbound VPN traffic without extra information.

pedrocx486 8y ago

In Brazil law requires services to keep logs for a year. This made me very wary of services like ProtonVPN that put some servers there. A lot of people trust them, but I for some reason don't...

bilbo0s 8y ago
>A lot of people trust them, but I for some reason don't... No offense or anything, but it sounds like you actually have very GOOD reasons for not trusting them.
protonmail 8y ago
We don't keep logs in Brazil, and as we have no operations in Brazil, so this is not a point that particularly concerns us. We have something known as Secure Core VPN that offers additional protection if our Brazilian ISP starts monitoring our connection: https://protonvpn.com/support/secure-core-vpn/ https://protonvpn.com/support/secure-core-vpn/

ukyrgf 8y ago

I mean, the special agent even calls it a fact: "the fact that VPN's track activity with logs." >As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion. Seriously, all this over a roommate found on Craigslist. I did like the part where his victim repeatedly smashed his computer monitor with a hammer, though.

jclay 8y ago

One important distinction could be that these were HTTP requests made on his account page or other. If he logs into the account to update billing, etc that would certainly be logged. All of what is claimed in the statement would be possible even if we assume no logs are stored for the VPN Server they run, which makes no guarantees about access to their HTTP properties.

ALittleLight 8y ago

I opened the document expecting to sympathize with Lin. In my imagination this was some FBI surveillance state overreach, or "cyberharassment" thing getting overblown. Instead, reading through the allegations, Lin came off as abominable. Contrary to your conclusion that this shows the FBI takes cyber harassment seriously, it seems like law enforcement generally allowed Lin to publicly subject this poor woman to psychological torture for a couple years before doing anything about it. Provided the allegations are true, whatever sentence he gets will not be enough...

claudiawerner 8y ago
Why would you expect to sympathize with him? Is it usual (i.e more likely than not) that cases of cyberharassment are overblown, or based on faulty knowledge, or outright false? It's strange to me that someone would immediately be so skeptical, unless the rate of false accusations is higher than the rate of true accusations (at least insofar as determined by the imperfect legal system). Is that the case? I'd like to be corrected if it is.
- ukyrgf 8y ago
  The title changed! I hate when Hacker News does this. Before, it was: > FBI arrests PureVPN user with log data that was said to not exist (justice.gov) Nothing about cyberstalking. I too figured it was going to be something stupid like piracy.
- ALittleLight 8y ago
  I don't know what the rate of false or overblown allegations is. I wrote above about my intuition and not my judgment after a considered study of the issues and evidence. It's just what I expected. As for why my intuition went that way, I suspect it's because, from the title, I felt like Lin was wronged by the VPN company which misled him, I generally distrust the FBI, deanonymizing VPN traffic seems troubling to me, "cyberharassment" sounds more like being mean to people online than the things Lin did and I don't think sending rude words to people should be criminal, and I suppose that I personally am more likely to be (falsely) accused of cyberharassment than I am to be victimized by it which probably results in implicitly identifying more with the attacker than the victim.

iqy 8y ago

Why not just use Tor?

LinuxBender 8y ago
For some things, Tor works just fine. For some sites, Tor is either blocked, or may send you through endless captchas. At least, that has been my experience.

memeograph 8y ago

>As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion. Probably cos they investigated certain cases and found nothing, to the great dismay of certain people who wanted to be seen as victims and others who wanted to be seen defending them.