5 ms·

This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

by godelmachine 7y ago

readhn 7y ago
Im using PIA for 2 years now - pretty happy with the service.
- majora2007 7y ago
  Yeah been on PIA myself for 5 years. Amazing speeds and service. No issues at all and they have been in court twice where they showed they have no logs.
  - readhn 7y ago
    Its great - i use it on my work PC to reroute my personal traffic, on my families personal devices, when traveling abroad etc. That said, there is a no 100% guarantee so use it responsibly.
- qertoip 7y ago
  It's based in US.
  - readhn 7y ago
    So am I.
rf15 7y ago
Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be named and shamed, not NVPN.
- hellcow 7y ago
  > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” Not acceptable.
  - missosoup 7y ago
    Yes it is? Giving realtime public status updates makes your attacker privvy to your actions and how much you know. Fix first, publicly announce when safe to do so. Same reason why SWAT etc. don't want media crews covering their actions in real time. It's broadcasting your view of the situation and intent to the opponent.
  - stnmtn 7y ago
    What should they have done if they knew about a potential infrastructure weakpoint? How should they announce that to the public before fixing it?
- TallGuyShort 7y ago
  If you're making a living selling a secure channel, where the whole point is to be more secure then other channels, you better fucking secure that channel. You can't outsource the underlying hardware and then wash your hands of what happens.
- calimac 7y ago
  Users trust The VPN services expertise in managing all aspects of the network to be secure. Nord failed by not managing the provider relationship to the level of security they promise to their users in their marketing. I'm not saying it could or could not have been prevented. It is a fact that they did NOT live up to their promise made to their client users. There must be some independent certification of these VPN providers by some sort of industry association to restore confidence in this non-transperant product that promises protection.
SparkyMcUnicorn 7y ago
After reading their blog post about it [ https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach... ], I'm not as concerned. A compromise is a compromise, don't get me wrong, but it can happen to absolutely anyone. If you're paying ~$5/month for anonymous browsing with unlimited bandwidth, then you're probably not getting top tier security researchers running your servers.
deleted 7y ago
[deleted]
thenewnewguy 7y ago
Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government), specifically because they seek out traffic from people trying to hide - You get to pick the port/protocol/software you use, rather than being forced to accept the provider's ones - You can run other small servers you may need on the VPS as well
- lijogdfljk 7y ago
  But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?
  - jen_h 7y ago
    Some thoughts: 1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer. 2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time. 3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in). 4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them? 5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
morpheuskafka 7y ago
I would look at one of the cryptoanarchist aligned providers like Cryptostorm, Mullvad, or AirVPN. Of course, no one is immune to a hack but they don't have any shady connections or financial incentive to deprioritize security.
- i_am_nomad 7y ago
  That's good advice, but I'm not sure I fully understand - did NordVPN have such a financial incentive?

This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

readhn 7y ago

Im using PIA for 2 years now - pretty happy with the service.

majora2007 7y ago
Yeah been on PIA myself for 5 years. Amazing speeds and service. No issues at all and they have been in court twice where they showed they have no logs.
- readhn 7y ago
  Its great - i use it on my work PC to reroute my personal traffic, on my families personal devices, when traveling abroad etc. That said, there is a no 100% guarantee so use it responsibly.
qertoip 7y ago
It's based in US.
- readhn 7y ago
  So am I.

rf15 7y ago

Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be named and shamed, not NVPN.

hellcow 7y ago
> NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” Not acceptable.
- missosoup 7y ago
  Yes it is? Giving realtime public status updates makes your attacker privvy to your actions and how much you know. Fix first, publicly announce when safe to do so. Same reason why SWAT etc. don't want media crews covering their actions in real time. It's broadcasting your view of the situation and intent to the opponent.
- stnmtn 7y ago
  What should they have done if they knew about a potential infrastructure weakpoint? How should they announce that to the public before fixing it?
TallGuyShort 7y ago
If you're making a living selling a secure channel, where the whole point is to be more secure then other channels, you better fucking secure that channel. You can't outsource the underlying hardware and then wash your hands of what happens.
calimac 7y ago
Users trust The VPN services expertise in managing all aspects of the network to be secure. Nord failed by not managing the provider relationship to the level of security they promise to their users in their marketing. I'm not saying it could or could not have been prevented. It is a fact that they did NOT live up to their promise made to their client users. There must be some independent certification of these VPN providers by some sort of industry association to restore confidence in this non-transperant product that promises protection.

SparkyMcUnicorn 7y ago

After reading their blog post about it [ https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach... ], I'm not as concerned. A compromise is a compromise, don't get me wrong, but it can happen to absolutely anyone. If you're paying ~$5/month for anonymous browsing with unlimited bandwidth, then you're probably not getting top tier security researchers running your servers.

deleted 7y ago

[deleted]

thenewnewguy 7y ago

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government), specifically because they seek out traffic from people trying to hide - You get to pick the port/protocol/software you use, rather than being forced to accept the provider's ones - You can run other small servers you may need on the VPS as well

lijogdfljk 7y ago
But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?
- jen_h 7y ago
  Some thoughts: 1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer. 2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time. 3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in). 4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them? 5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.

morpheuskafka 7y ago

I would look at one of the cryptoanarchist aligned providers like Cryptostorm, Mullvad, or AirVPN. Of course, no one is immune to a hack but they don't have any shady connections or financial incentive to deprioritize security.

i_am_nomad 7y ago
That's good advice, but I'm not sure I fully understand - did NordVPN have such a financial incentive?