12 ms·

NordVPN sued by Torguard for blackmail [pdf]

168 points by rasengan 7y ago

liamkinne 7y ago
With these VPN services having become a race to the bottom, it's not all that unsurprising that stuff like this happens.
- neilv 7y ago
  I think the race to the bottom already has many providers in fistfights at the finish line. For example, when I tried Kodi (as a non-piracy living room media box starting point) a couple years ago, one of the reasons I gave up on it was that it seemed almost every Web search for technical questions would be filled with hits for VPN affiliate pitches. I also found forums, such as on reddit, filled with shilling, drama, and intrigue about VPNs, including some prominent ones. Then there was the related scandal of Facebook targeting children with a "VPN" surveillance channel, and there's really no assurance that many VPN providers aren't doing a similar thing. I suspect there are some legitimate VPNs, but I decided I actually trust free Tor more than any random VPN, for some casual degree of protection against snooping open WiFi and ISP.
billpg 7y ago
I'm getting a TLS error from this link. Is it for everyone or just me?
- deleted 7y ago
  [deleted]
- rasengan 7y ago
  It’s working fine for me.
- bithavoc 7y ago
  It's working fine on my end.
- thebouv 7y ago
  I get that same issue.
  - computerfriend 7y ago
    Can you explain what exactly the issue is? Where is the certificate chain breaking?
- wongarsu 7y ago
  it works for me (Firefox, Windows 10)
- canadacorner 7y ago
  are you using opendns?
- maeln 7y ago
  Are you behind a proxy that does certificate interception ?
- CaliforniaKarl 7y ago
  The site's certificate chains up to the DigiCert High Assurance EV Root CA. See https://www.ssllabs.com/ssltest/analyze.html?d=torguard.net&s=104.20.88.240&latest https://www.ssllabs.com/ssltest/analyze.html?d=torguard.net&... If you are having an issue, it would be worth stating: • Do you have the above-mentioned CA in your trust store? • What OS/browser are you using? • Are you using any middle service, be it local (like virus scanning) or network-level (like a middlebox/proxy)?
- dickeytk 7y ago
  Are you using NordVPN? /s
wongarsu 7y ago
> Collective 7 is a Canadian hosting company [...] now owned or controlled by NordVPN. [...] > NordVPN threatened to release TorGuard’s confidential and trade secret information that was obtained by NordVPN from Collective 7— who, in turn, obtained this information during the time TorGuard utilized Collective 7 as a service provider. NordVPN threatened to release this information unless TorGuard forced or coerced a third party into silence, as this third party was publishing legitimate criticisms of issues associated with NordVPN’s business practices. If true this reflects very poorly on NordVPN. How much criticism did they manage to suppress successfully until someone sued for blackmail?
- rasengan 7y ago
  NordVPN has been known to suppress a lot of information about themselves - even the country in which they operate. Given C7 is involved as well I’m very confident it’s true.
  - ganoushoreilly 7y ago
    And they are closely aligned with other vpn providers that all leveraged micfo (as is stated in this complaint).
    - rasengan 7y ago
      C7’s owner is involved with quite a few VPN companies.
- robertthebruce 7y ago
  > If true this reflects very poorly on NordVPN. How much criticism did they manage to suppress successfully until someone sued for blackmail? NordVPN has sent legal threats to many Youtubers and bloggers anytime they don't like what's written. NordVPN and ProtonVPN are enemies of free speech and open internet.
cyberpunk 7y ago
Had a quick skim; it seems at a glance like someone from TorGuard badmouthed NordVPN on a youtube comment (sigh), so NordVPN apparently in response threatened to disclose "trade secret information obtained by NordVPN regarding TorGuard’s systems" it obtained via a hosting provider TorGuard used which is owned by the NordVPN people. This apparently involved some pretty sketchy stuff like sending people to the house of a TG employee to intimidate them. Whoops. What kind of 'trade secret information' could a vpn provider be blackmailed with though? What kind of information could you gleam as the owner of a 'service provider' for such a use? I'm suffering from an apparent lack of imagination here. Either way, this looks pretty messy and as a NordVPN user, I'm surprised how amateurish this all seems.
- deleted 7y ago
  [deleted]
- cyberpunk 7y ago
  Reading the parent pdf vs Nord's response [0] I'm slightly more inclined to believe Nords version of events here... 0: https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/
  - rasengan 7y ago
    NordVPN is good at spinning stories, but quite frankly they have been caught in too many lies to ever trust again [1]. [1] https://news.ycombinator.com/item?id=18609655 https://news.ycombinator.com/item?id=18609655
    - deleted 7y ago
      [deleted]
    - fao_ 7y ago
      If you take two seconds to read the responses to that link, the claims made in the post are almost entirely baseless.
      - 7y ago
mqbqi 7y ago
What exactly is the "confidential and trade secret information" about?
- capitol_ 7y ago
  I guess thats a secret.
- Aromasin 7y ago
  Seems that there were some massive security vulnerabilities that NordVPN found. [1] I'm very interested in seeing how this court case works out, as at this point I don't know who to believe. [1] https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/
- maze-le 7y ago
  https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/ Apparently its a torguard-vulnerability. To tag a vulnerability as 'trade secret', and the fact that the disclosure process involved threats (allegedly) is a very bad reflection on both of them. Why should I trust either of them to handle security vulnerabilities responsibly in the future?
- ghostwalking 7y ago
  "confidential and trade secret information" appears to reference a stolen install script: https://torguard.net/blog/when-bug-bounties-border-on-blackmail/ https://torguard.net/blog/when-bug-bounties-border-on-blackm...
dangerface 7y ago
NordVPN response https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/
- maeln 7y ago
  Well, it make it quite clear what 'trade secret' TorGuard was blackmailed about then.
- el_cujo 7y ago
  "It all started when we received information that led us to finding a TorGuard server configuration file lying in the open on the internet... We hoped that after providing this vital assistance towards securing TorGuard’s infrastructure, they would also cease with their illegal defamation campaign." So nord is shitty for digging up dirt on torguard because they were mean to them online and torguard is shitty for having these vulnerabilities in the first place. Are there any vpn services run by a company that is neither slimy nor incompetent?
  - penagwin 7y ago
    To be fair this kind of vulnerability is kinda common. All it takes is some AWS bucket to be left public. Surely you've seen it on HN for years? MongoDB for company X found with no password, government AWS bucket left public, etc. That said it would be a feasible yet simple story to fabricate. The details aren't that important, just saying "we found a file with ip addresses that had services open with no password" is plausible but also not that specific. Seems like all they need to do is publish their communication now that the vulnerability has been fixed?
  - nickik 7y ago
    Try mullvad.net. A bunch of hackers in Sweden. You can pay without exposing any information about yourself and they support wireguard (even help pay for and doing their own development on it). I meet some of them personally on hacker conferences as well and they knew what they were talking about.
    - 7y ago
kadoban 7y ago
NordVPN is by far the shittiest VPN service I have ever used. They billed me twice, two months in a row, and getting them to fix it was like pulling teeth. This is not to mention the hard time I had actually using the service, between random inability to connect and outages. They have ISP-level arrogance, without the lock-in. I have no idea how they're still in business. So I'd be very inclined towards believing this story.
- wongarsu 7y ago
  > I have no idea how they're still in business. I imagine it's good marketing. They sponsor a lot of Youtube videos.
  - ivl 7y ago
    Pretty much every VPN service does. Every tech youtuber has one VPN service advertising with them. Along with cutting prices for viewers who use those links. I have to think it's a fairly solid sales model. The viewers would also line up with their best selling demographics.
- vinnymac 7y ago
  Interesting, I have had the exact opposite experience personally. I have used the customer service in the past to fix a problem I caused (payment related), and they were prompt and helpful. Not only that but I get the best speeds (300 Mbps) from them over any other VPN I have used, and my connection is rock solid. This story doesn't make me happy with NordVPN or TordGuard as a service however.
- interfixus 7y ago
  No idea what's up and down in the actual case, but I can, anecdotally, counter your experience with a wholly positive one from the other side of the fence: I have a TorGuard account, and I use the VPN an awful lot - it's the default connection on the machine I'm currently writing on. Been using for a couple of years, and never once have I seen trouble or even inconvenience, save the obstacles a few sites choose to set up based an ip address. Nor with billing. They mail me an invoice. I pay. Stuff just works.
bitxbitxbitcoin 7y ago
Just a friendly reminder to the world that NordVPN is also the one that lies about being based in Panama :).
- Aromasin 7y ago
  Source? I can't find anything about them not being based there at all. EDIT: After some brief hunting I found a HN comment with some scattered information about them possibly being based in Lithuania [1]. Not sure what to think about that personally. [1] https://news.ycombinator.com/item?id=18609655 https://news.ycombinator.com/item?id=18609655
- UpperBodyEimi 7y ago
  Where are they based?
  - safeplanet-fesa 7y ago
    Likely, in Lithuania, where they are subject to data retention laws, which means they are obliged to keep data for 6 month. I can suggest to search for "NordVPN Tesonet", the scandal that happened a year ago or so. The data mining possibility is horrible on its own, but Reddit and Hacker News users have discovered much more on the way. Everything is already said and exposed, hard to believe how much influence in general media they have that they could bury the whole story.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
Tomspark 7y ago
Hey guys, Tom Spark here. I'm the video content creator that caused this whole thing. NordVPN hates my channel since I critique and criticize them a lot. They want to censor my channel to remove the bad reviews and so forth (ironic from a VPN company that is suppose to prevent censorship no?). To date, NordVPN is one of the lowest rated VPNs on my VPN tier list at http://vpntierlist.com/ http://vpntierlist.com/. They are also in the news a lot for various things and I make sure to cover it whereas other VPN affiliates don't (most VPN affiliates are aligned with 100% based comission VPNs like Nord). I summarized the entire story with 3 videos if anyone wants the full story. Or the latest take on Nord's blog post here (which I believe to be complete bull) :https://www.youtube.com/watch?v=icD3Bva7xtY https://www.youtube.com/watch?v=icD3Bva7xtY
- knd775 7y ago
  I'm not directly accusing you of anything, but you sort of come across as a shill or extreme fanboy of TorGuard. How can you give them 5s across the board? -Speed: During my testing with PIA and TorGuard, PIA was consistently 50% faster. -App: The TorGuard app is lacking in features and poorly designed. -Price: It's substantially more expensive than most providers. -Reputation: They've had not too great a reputation for a while now I do not believe that you are an objective party here.
  - kristofferR 7y ago
    Yeah, to still give them 5 stars for reputation after this whole lawsuit fiasco, is absurd. The apps are mediocre at best, rated just 3.1/5: https://itunes.apple.com/us/app/torguard-anonymous-vpn-service/id988743799 https://itunes.apple.com/us/app/torguard-anonymous-vpn-servi..., so if nothing else his app score is clear evidence of him being impartial. According to comments on his review they've also added Google trackers/capchas to their login page, something you wouldn't see on a reputable provider.
    - Tomspark 7y ago
      ?
safeplanet-fesa 7y ago
I used to be one using and praising ProtonMail, but after the Tesonet scandal turned me around. The worst evidence for me was their responses, how they were constantly calling it a "smear campaign by PIA", often not providing any plausible explanations. Duh, PIA published it and put work into raising public awareness. They are competitors, they found your dirty laundry and published it, duuuuh. Whoever discovered it, doesn't matter, they couldn't respond to the actual facts, only repeating the annoying combination of words "smear campaign". I don't trust a single VPN provider and would rather trust my exit point to my ISP which is regulated by local laws, rather then trusting it to god know whom god knows where. I would be happy to see the issues of Tesonet and their links to NordVPN and ProtonMail/VPN raised again!
- temptemptemp111 7y ago
  I'm skeptical of NordVPN too - but can you say a little about why you signed up just to make these comments? ProtonMail is suspect as well. I would like to see independent analysis of their mobile and desktop clients - at least we can verify that they aren't doing anything besides data-mining/not deleting logs. The problem with running your own VPN is that paying for a VPS is not typically more private than paying for a VPN. And the functionality that NordVPN et al provides would take a lot of effort to reproduce manually. You'd have to have a VPS with lots of locations and launch your VPN OS image in the location you want - which would take extra time & effort each time.
- protonmail 7y ago
  Not sure if you saw it, but Proton published a response here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... The fact that hundreds of Twitter bots were used to spread the allegations is rather strong evidence that there was indeed a smear campaign. Details about this here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/
hartator 7y ago
From NordVPN response: > It all started when we received information that led us to finding a TorGuard server configuration file lying in the open on the internet. It's highly doubtful that's some random person will send some security vulnerabilities about a company to another unrelated company. It's more probable that NordVPN had its own team trying to hack or at least test Torguard defenses. That makes the DDoS allegations more believable.
- kabacha 7y ago
  > It's highly doubtful that's some random person will send some security vulnerabilities about a company to another unrelated company. When I had a small web-crawling/automation business we'd get quite few emails like that oferring all sorts of datasets and security holes for sale. We never responded (people already have a hate boner for web-crawlers lol). Maybe someone with more gray/black hat infosec knowledge could comment on plausability on this but honestly I wouldn't underestimate black hat sales skills :)
kaivi 7y ago
Maybe off topic, but if anyone from NordVPN is reading this: for the love of god fix your iOS and OS X clients, so they don't log out randomly. I can't even begin to describe how frustrating that is.
vortico 7y ago
>$75,000 Wouldn't this only just barely cover court/lawyer costs?
- phonon 7y ago
  That's the minimum to make it a Federal lawsuit. The damages, if any, would be determined later.
skippybobby 7y ago
You can clearly see that TG include stuff about Nord that aint related to the lawsuit, nor to the court itself, and thats clearly why - to make Nord look bad guys in this scenario, while all the claims sounds like bs. Torguard hasn’t even filled in the correct company name when they filed the suit first, which speaks for itself on how professional they are. Anyhow, how is that Nord the bad guy now and everyone forgets the fact that they just wanted to let torguard know about their own vulnerability to fix?
- robertthebruce 7y ago
  And how do you know the Micfo IP fraud is not related to NordVPN? They were using them extensively. Collective Seven (C7) is related to a very long list of VPNs, including Nord, yet NordVPN has denied knowing them. > Anyhow, how is that Nord the bad guy now and everyone forgets the fact that they just wanted to let torguard know about their own vulnerability to fix? It looks bad because they tried to force censorship in exchange for a non vulnerability. Torguard has a bounty program but instead Nord sent someone to the Torguard employee's house and tried to intimidate them into silencing a Youtuber. It appears Nord knew what they had was not a vulnerability but still wanted use it as leverage for taking down the Youtuber's videos. This is censorship at it's worst.
safeplanet-fesa 7y ago
NordVPN is one of the ugliest in the on its own shady VPN business. They did their best to slowly make the Tesonet scandal slide away. Here on HN some users provided extensive insights about their connections with the Lithuanian data mining company and convincingly demonstrated that NordVPN must be the most evil VPN honeypot and deceiver.
- trymas 7y ago
  Can you tell more about what is the "Tesonet scandal"? I've heard such shady stuff about NordVPN that I would never trust them with their data, also would never trust any other VPN provider. EDIT: I thing I've found it: https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 I was informed before not to use NordVPN for their (anecdotal) shady practices, but the fact that ProtonMail is in this crap too - I do not know who to trust anymore when I am buying "privacy" online.
  - protonmail 7y ago
    ProtonMail is not involved and the story is really bogus. Proton happens to have an office in Lithuania (one of 6 globally) and was dragged in as a result, but otherwise there is no real connection as explained here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... ProtonVPN in particular has been vetted by third parties such as Mozilla, and is operated very transparently as outlined here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/ The location of Proton offices for example, has always been publicly disclosed, the directors of the Swiss parent company Proton Technologies AG, and the company's CERN roots, etc, are all in public record.
deleted 7y ago
[deleted]
sleepyburrito 7y ago
PIA has been caught orchestrating smearing campaign against nord in the past. It's funny to see how pias employee is all over this thread again, trying to undermine a competitor. Are you a messenger now for torguard now also?
rb666 7y ago
Why even use NordVPN when you can have AirVPN. Better in all ways...
matchcases 7y ago
Ohh, pias little troll army is having a feast here.
despera 7y ago
This whole drama (not of the highest quality) should be a big warning for all those naive people (trying hard not to call names) who seem to not completely understand the HUGE trust threats that _all_ VPN services entail. VPN services are black boxes. You have absolutely no idea what they doing in their black boxes despite all their claims. A nice post that sums everything up: https://schub.io/blog/2019/04/08/very-precarious-narrative.html https://schub.io/blog/2019/04/08/very-precarious-narrative.h...
- trymas 7y ago
  100% concur to your opinion. Anecdata, but from couple stories from people who worked/interviewed at VPN providers - I believe that in couple years we'll start see same horror stories of private data issues, like we are having with social network and internet ad businesses today. EDIT: apparently my anecdata is not anecdotal [0]. When it's race to the bottom for consumer pricing - your bandwith is resold (or at least there's capability to do that) for botnet purposes. [0] https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/
  - despera 7y ago
    I'm sure we will, there have already been cases where claims about not keeping logs turned to be plain lies, sure why some wouldn't share their user's habits for further "analysis" for extra profit upon subscriptions. The plain fact is that you don't know what they are doing, it's impossible to know. If they ever find a way for an introspective verification/validation of configurations coupled with the connection itself (or whatever mumbo jumbo), then we can talk again about middle-men's trust.
crisopolis 7y ago
So pretty much NordVPN pokes TorGuard into suing and now... NordVPN gets to put TorGuard in a body bag and call it a day as they've always wanted. Mission Accomplished.

168 points by rasengan 7y ago

With these VPN services having become a race to the bottom, it's not all that unsurprising that stuff like this happens.

neilv 7y ago
I think the race to the bottom already has many providers in fistfights at the finish line. For example, when I tried Kodi (as a non-piracy living room media box starting point) a couple years ago, one of the reasons I gave up on it was that it seemed almost every Web search for technical questions would be filled with hits for VPN affiliate pitches. I also found forums, such as on reddit, filled with shilling, drama, and intrigue about VPNs, including some prominent ones. Then there was the related scandal of Facebook targeting children with a "VPN" surveillance channel, and there's really no assurance that many VPN providers aren't doing a similar thing. I suspect there are some legitimate VPNs, but I decided I actually trust free Tor more than any random VPN, for some casual degree of protection against snooping open WiFi and ISP.

billpg 7y ago

I'm getting a TLS error from this link. Is it for everyone or just me?

deleted 7y ago
[deleted]
rasengan 7y ago
It’s working fine for me.
bithavoc 7y ago
It's working fine on my end.
thebouv 7y ago
I get that same issue.
- computerfriend 7y ago
  Can you explain what exactly the issue is? Where is the certificate chain breaking?
wongarsu 7y ago
it works for me (Firefox, Windows 10)
canadacorner 7y ago
are you using opendns?
maeln 7y ago
Are you behind a proxy that does certificate interception ?
CaliforniaKarl 7y ago
The site's certificate chains up to the DigiCert High Assurance EV Root CA. See https://www.ssllabs.com/ssltest/analyze.html?d=torguard.net&s=104.20.88.240&latest https://www.ssllabs.com/ssltest/analyze.html?d=torguard.net&... If you are having an issue, it would be worth stating: • Do you have the above-mentioned CA in your trust store? • What OS/browser are you using? • Are you using any middle service, be it local (like virus scanning) or network-level (like a middlebox/proxy)?
dickeytk 7y ago
Are you using NordVPN? /s

wongarsu 7y ago

> Collective 7 is a Canadian hosting company [...] now owned or controlled by NordVPN. [...] > NordVPN threatened to release TorGuard’s confidential and trade secret information that was obtained by NordVPN from Collective 7— who, in turn, obtained this information during the time TorGuard utilized Collective 7 as a service provider. NordVPN threatened to release this information unless TorGuard forced or coerced a third party into silence, as this third party was publishing legitimate criticisms of issues associated with NordVPN’s business practices. If true this reflects very poorly on NordVPN. How much criticism did they manage to suppress successfully until someone sued for blackmail?

rasengan 7y ago
NordVPN has been known to suppress a lot of information about themselves - even the country in which they operate. Given C7 is involved as well I’m very confident it’s true.
- ganoushoreilly 7y ago
  And they are closely aligned with other vpn providers that all leveraged micfo (as is stated in this complaint).
  - rasengan 7y ago
    C7’s owner is involved with quite a few VPN companies.
robertthebruce 7y ago
> If true this reflects very poorly on NordVPN. How much criticism did they manage to suppress successfully until someone sued for blackmail? NordVPN has sent legal threats to many Youtubers and bloggers anytime they don't like what's written. NordVPN and ProtonVPN are enemies of free speech and open internet.

cyberpunk 7y ago

Had a quick skim; it seems at a glance like someone from TorGuard badmouthed NordVPN on a youtube comment (sigh), so NordVPN apparently in response threatened to disclose "trade secret information obtained by NordVPN regarding TorGuard’s systems" it obtained via a hosting provider TorGuard used which is owned by the NordVPN people. This apparently involved some pretty sketchy stuff like sending people to the house of a TG employee to intimidate them. Whoops. What kind of 'trade secret information' could a vpn provider be blackmailed with though? What kind of information could you gleam as the owner of a 'service provider' for such a use? I'm suffering from an apparent lack of imagination here. Either way, this looks pretty messy and as a NordVPN user, I'm surprised how amateurish this all seems.

deleted 7y ago
[deleted]
cyberpunk 7y ago
Reading the parent pdf vs Nord's response [0] I'm slightly more inclined to believe Nords version of events here... 0: https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/
- rasengan 7y ago
  NordVPN is good at spinning stories, but quite frankly they have been caught in too many lies to ever trust again [1]. [1] https://news.ycombinator.com/item?id=18609655 https://news.ycombinator.com/item?id=18609655
  - deleted 7y ago
    [deleted]
  - fao_ 7y ago
    If you take two seconds to read the responses to that link, the claims made in the post are almost entirely baseless.
    - 7y ago

mqbqi 7y ago

What exactly is the "confidential and trade secret information" about?

capitol_ 7y ago
I guess thats a secret.
Aromasin 7y ago
Seems that there were some massive security vulnerabilities that NordVPN found. [1] I'm very interested in seeing how this court case works out, as at this point I don't know who to believe. [1] https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/
maze-le 7y ago
https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/ Apparently its a torguard-vulnerability. To tag a vulnerability as 'trade secret', and the fact that the disclosure process involved threats (allegedly) is a very bad reflection on both of them. Why should I trust either of them to handle security vulnerabilities responsibly in the future?
ghostwalking 7y ago
"confidential and trade secret information" appears to reference a stolen install script: https://torguard.net/blog/when-bug-bounties-border-on-blackmail/ https://torguard.net/blog/when-bug-bounties-border-on-blackm...

dangerface 7y ago

NordVPN response https://nordvpn.com/blog/torguard-lawsuit/ https://nordvpn.com/blog/torguard-lawsuit/

maeln 7y ago
Well, it make it quite clear what 'trade secret' TorGuard was blackmailed about then.
el_cujo 7y ago
"It all started when we received information that led us to finding a TorGuard server configuration file lying in the open on the internet... We hoped that after providing this vital assistance towards securing TorGuard’s infrastructure, they would also cease with their illegal defamation campaign." So nord is shitty for digging up dirt on torguard because they were mean to them online and torguard is shitty for having these vulnerabilities in the first place. Are there any vpn services run by a company that is neither slimy nor incompetent?
- penagwin 7y ago
  To be fair this kind of vulnerability is kinda common. All it takes is some AWS bucket to be left public. Surely you've seen it on HN for years? MongoDB for company X found with no password, government AWS bucket left public, etc. That said it would be a feasible yet simple story to fabricate. The details aren't that important, just saying "we found a file with ip addresses that had services open with no password" is plausible but also not that specific. Seems like all they need to do is publish their communication now that the vulnerability has been fixed?
- nickik 7y ago
  Try mullvad.net. A bunch of hackers in Sweden. You can pay without exposing any information about yourself and they support wireguard (even help pay for and doing their own development on it). I meet some of them personally on hacker conferences as well and they knew what they were talking about.
  - 7y ago

kadoban 7y ago

NordVPN is by far the shittiest VPN service I have ever used. They billed me twice, two months in a row, and getting them to fix it was like pulling teeth. This is not to mention the hard time I had actually using the service, between random inability to connect and outages. They have ISP-level arrogance, without the lock-in. I have no idea how they're still in business. So I'd be very inclined towards believing this story.

wongarsu 7y ago
> I have no idea how they're still in business. I imagine it's good marketing. They sponsor a lot of Youtube videos.
- ivl 7y ago
  Pretty much every VPN service does. Every tech youtuber has one VPN service advertising with them. Along with cutting prices for viewers who use those links. I have to think it's a fairly solid sales model. The viewers would also line up with their best selling demographics.
vinnymac 7y ago
Interesting, I have had the exact opposite experience personally. I have used the customer service in the past to fix a problem I caused (payment related), and they were prompt and helpful. Not only that but I get the best speeds (300 Mbps) from them over any other VPN I have used, and my connection is rock solid. This story doesn't make me happy with NordVPN or TordGuard as a service however.
interfixus 7y ago
No idea what's up and down in the actual case, but I can, anecdotally, counter your experience with a wholly positive one from the other side of the fence: I have a TorGuard account, and I use the VPN an awful lot - it's the default connection on the machine I'm currently writing on. Been using for a couple of years, and never once have I seen trouble or even inconvenience, save the obstacles a few sites choose to set up based an ip address. Nor with billing. They mail me an invoice. I pay. Stuff just works.

bitxbitxbitcoin 7y ago

Just a friendly reminder to the world that NordVPN is also the one that lies about being based in Panama :).

Aromasin 7y ago
Source? I can't find anything about them not being based there at all. EDIT: After some brief hunting I found a HN comment with some scattered information about them possibly being based in Lithuania [1]. Not sure what to think about that personally. [1] https://news.ycombinator.com/item?id=18609655 https://news.ycombinator.com/item?id=18609655
UpperBodyEimi 7y ago
Where are they based?
- safeplanet-fesa 7y ago
  Likely, in Lithuania, where they are subject to data retention laws, which means they are obliged to keep data for 6 month. I can suggest to search for "NordVPN Tesonet", the scandal that happened a year ago or so. The data mining possibility is horrible on its own, but Reddit and Hacker News users have discovered much more on the way. Everything is already said and exposed, hard to believe how much influence in general media they have that they could bury the whole story.

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

Tomspark 7y ago

Hey guys, Tom Spark here. I'm the video content creator that caused this whole thing. NordVPN hates my channel since I critique and criticize them a lot. They want to censor my channel to remove the bad reviews and so forth (ironic from a VPN company that is suppose to prevent censorship no?). To date, NordVPN is one of the lowest rated VPNs on my VPN tier list at http://vpntierlist.com/ http://vpntierlist.com/. They are also in the news a lot for various things and I make sure to cover it whereas other VPN affiliates don't (most VPN affiliates are aligned with 100% based comission VPNs like Nord). I summarized the entire story with 3 videos if anyone wants the full story. Or the latest take on Nord's blog post here (which I believe to be complete bull) :https://www.youtube.com/watch?v=icD3Bva7xtY https://www.youtube.com/watch?v=icD3Bva7xtY

knd775 7y ago
I'm not directly accusing you of anything, but you sort of come across as a shill or extreme fanboy of TorGuard. How can you give them 5s across the board? -Speed: During my testing with PIA and TorGuard, PIA was consistently 50% faster. -App: The TorGuard app is lacking in features and poorly designed. -Price: It's substantially more expensive than most providers. -Reputation: They've had not too great a reputation for a while now I do not believe that you are an objective party here.
- kristofferR 7y ago
  Yeah, to still give them 5 stars for reputation after this whole lawsuit fiasco, is absurd. The apps are mediocre at best, rated just 3.1/5: https://itunes.apple.com/us/app/torguard-anonymous-vpn-service/id988743799 https://itunes.apple.com/us/app/torguard-anonymous-vpn-servi..., so if nothing else his app score is clear evidence of him being impartial. According to comments on his review they've also added Google trackers/capchas to their login page, something you wouldn't see on a reputable provider.
  - Tomspark 7y ago
    ?

safeplanet-fesa 7y ago

I used to be one using and praising ProtonMail, but after the Tesonet scandal turned me around. The worst evidence for me was their responses, how they were constantly calling it a "smear campaign by PIA", often not providing any plausible explanations. Duh, PIA published it and put work into raising public awareness. They are competitors, they found your dirty laundry and published it, duuuuh. Whoever discovered it, doesn't matter, they couldn't respond to the actual facts, only repeating the annoying combination of words "smear campaign". I don't trust a single VPN provider and would rather trust my exit point to my ISP which is regulated by local laws, rather then trusting it to god know whom god knows where. I would be happy to see the issues of Tesonet and their links to NordVPN and ProtonMail/VPN raised again!

temptemptemp111 7y ago
I'm skeptical of NordVPN too - but can you say a little about why you signed up just to make these comments? ProtonMail is suspect as well. I would like to see independent analysis of their mobile and desktop clients - at least we can verify that they aren't doing anything besides data-mining/not deleting logs. The problem with running your own VPN is that paying for a VPS is not typically more private than paying for a VPN. And the functionality that NordVPN et al provides would take a lot of effort to reproduce manually. You'd have to have a VPS with lots of locations and launch your VPN OS image in the location you want - which would take extra time & effort each time.
protonmail 7y ago
Not sure if you saw it, but Proton published a response here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... The fact that hundreds of Twitter bots were used to spread the allegations is rather strong evidence that there was indeed a smear campaign. Details about this here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/

hartator 7y ago

From NordVPN response: > It all started when we received information that led us to finding a TorGuard server configuration file lying in the open on the internet. It's highly doubtful that's some random person will send some security vulnerabilities about a company to another unrelated company. It's more probable that NordVPN had its own team trying to hack or at least test Torguard defenses. That makes the DDoS allegations more believable.

kabacha 7y ago
> It's highly doubtful that's some random person will send some security vulnerabilities about a company to another unrelated company. When I had a small web-crawling/automation business we'd get quite few emails like that oferring all sorts of datasets and security holes for sale. We never responded (people already have a hate boner for web-crawlers lol). Maybe someone with more gray/black hat infosec knowledge could comment on plausability on this but honestly I wouldn't underestimate black hat sales skills :)

kaivi 7y ago

Maybe off topic, but if anyone from NordVPN is reading this: for the love of god fix your iOS and OS X clients, so they don't log out randomly. I can't even begin to describe how frustrating that is.

vortico 7y ago

>$75,000 Wouldn't this only just barely cover court/lawyer costs?

phonon 7y ago
That's the minimum to make it a Federal lawsuit. The damages, if any, would be determined later.

skippybobby 7y ago

You can clearly see that TG include stuff about Nord that aint related to the lawsuit, nor to the court itself, and thats clearly why - to make Nord look bad guys in this scenario, while all the claims sounds like bs. Torguard hasn’t even filled in the correct company name when they filed the suit first, which speaks for itself on how professional they are. Anyhow, how is that Nord the bad guy now and everyone forgets the fact that they just wanted to let torguard know about their own vulnerability to fix?

robertthebruce 7y ago
And how do you know the Micfo IP fraud is not related to NordVPN? They were using them extensively. Collective Seven (C7) is related to a very long list of VPNs, including Nord, yet NordVPN has denied knowing them. > Anyhow, how is that Nord the bad guy now and everyone forgets the fact that they just wanted to let torguard know about their own vulnerability to fix? It looks bad because they tried to force censorship in exchange for a non vulnerability. Torguard has a bounty program but instead Nord sent someone to the Torguard employee's house and tried to intimidate them into silencing a Youtuber. It appears Nord knew what they had was not a vulnerability but still wanted use it as leverage for taking down the Youtuber's videos. This is censorship at it's worst.

safeplanet-fesa 7y ago

NordVPN is one of the ugliest in the on its own shady VPN business. They did their best to slowly make the Tesonet scandal slide away. Here on HN some users provided extensive insights about their connections with the Lithuanian data mining company and convincingly demonstrated that NordVPN must be the most evil VPN honeypot and deceiver.

trymas 7y ago
Can you tell more about what is the "Tesonet scandal"? I've heard such shady stuff about NordVPN that I would never trust them with their data, also would never trust any other VPN provider. EDIT: I thing I've found it: https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 I was informed before not to use NordVPN for their (anecdotal) shady practices, but the fact that ProtonMail is in this crap too - I do not know who to trust anymore when I am buying "privacy" online.
- protonmail 7y ago
  ProtonMail is not involved and the story is really bogus. Proton happens to have an office in Lithuania (one of 6 globally) and was dragged in as a result, but otherwise there is no real connection as explained here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... ProtonVPN in particular has been vetted by third parties such as Mozilla, and is operated very transparently as outlined here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/ The location of Proton offices for example, has always been publicly disclosed, the directors of the Swiss parent company Proton Technologies AG, and the company's CERN roots, etc, are all in public record.

deleted 7y ago

[deleted]

sleepyburrito 7y ago

PIA has been caught orchestrating smearing campaign against nord in the past. It's funny to see how pias employee is all over this thread again, trying to undermine a competitor. Are you a messenger now for torguard now also?

rb666 7y ago

Why even use NordVPN when you can have AirVPN. Better in all ways...

matchcases 7y ago

Ohh, pias little troll army is having a feast here.

despera 7y ago

This whole drama (not of the highest quality) should be a big warning for all those naive people (trying hard not to call names) who seem to not completely understand the HUGE trust threats that _all_ VPN services entail. VPN services are black boxes. You have absolutely no idea what they doing in their black boxes despite all their claims. A nice post that sums everything up: https://schub.io/blog/2019/04/08/very-precarious-narrative.html https://schub.io/blog/2019/04/08/very-precarious-narrative.h...

trymas 7y ago
100% concur to your opinion. Anecdata, but from couple stories from people who worked/interviewed at VPN providers - I believe that in couple years we'll start see same horror stories of private data issues, like we are having with social network and internet ad businesses today. EDIT: apparently my anecdata is not anecdotal [0]. When it's race to the bottom for consumer pricing - your bandwith is resold (or at least there's capability to do that) for botnet purposes. [0] https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/ https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/
- despera 7y ago
  I'm sure we will, there have already been cases where claims about not keeping logs turned to be plain lies, sure why some wouldn't share their user's habits for further "analysis" for extra profit upon subscriptions. The plain fact is that you don't know what they are doing, it's impossible to know. If they ever find a way for an introspective verification/validation of configurations coupled with the connection itself (or whatever mumbo jumbo), then we can talk again about middle-men's trust.

crisopolis 7y ago

So pretty much NordVPN pokes TorGuard into suing and now... NordVPN gets to put TorGuard in a body bag and call it a day as they've always wanted. Mission Accomplished.