3 ms·

Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be

• hellcow 7y ago
  > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” Not acceptable.
  • missosoup 7y ago
    Yes it is? Giving realtime public status updates makes your attacker privvy to your actions and how much you know. Fix first, publicly announce when safe to do so. Same reason why SWAT etc. don't want media crews covering their actions in real time. It's broadcasting your view of the situation and intent to the opponent.
  • stnmtn 7y ago
    What should they have done if they knew about a potential infrastructure weakpoint? How should they announce that to the public before fixing it?
• TallGuyShort 7y ago
  If you're making a living selling a secure channel, where the whole point is to be more secure then other channels, you better fucking secure that channel. You can't outsource the underlying hardware and then wash your hands of what happens.
• calimac 7y ago
  Users trust The VPN services expertise in managing all aspects of the network to be secure. Nord failed by not managing the provider relationship to the level of security they promise to their users in their marketing. I'm not saying it could or could not have been prevented. It is a fact that they did NOT live up to their promise made to their client users. There must be some independent certification of these VPN providers by some sort of industry association to restore confidence in this non-transperant product that promises protection.