16 ms·

This article and articles like this miscast Kape in an incorrect light. To be clear, in the past the company was known as CrossRider and provided a developer SD

This article and articles like this miscast Kape in an incorrect light. To be clear, in the past the company was known as CrossRider and provided a developer SDK that could be used to integrate with browsers. Unfortunately, CrossRider didn't do enough to prevent malware (like platforms these days and their fake news) and the platform was used by some bad people for bad purposes. When the new management team of CrossRider took over, they immediately ceased to engage in the previous business and focused on the opposite due to the insights they gained watching nefarious developers abuse their platform. With the focus on security and privacy, they changed their name to Kape and further the new company will be called Private Internet as it will be purely focused on privacy. The merger between Kape and PIA affords PIA the resources needed to bring privacy to the mainstream. The company can now be decentrally owned by the people, and public reporting requirements are much stronger than those for private companies. Couple this with a new random audit program we are going to launch and its as transparent as it gets, and it's exactly the direction we at PIA want to go, where our users no longer need to just trust us, instead our actions are and will continue to be verified. Ultimately, the choice of VPN is yours, but transparency is verification and with most VPN companies being incredibly secretive about their operations, who is behind it, and where they are located, what they do with their funds, etc. I stand behind the move to bring more transparency to privacy. The company has always practiced sustainable karma - wherein we do what's best for the people/what people want, and that allows us to make a living doing what we love; that's not going to change. Sincerely, Andrew - Co Founder PIA

juanbyrge 7y ago
Sure, nothing has changed yet. That's how it goes with acquisitions. But people (including myself) are more concerned about the future. At some point in the future there will pressure from within Kape to increase revenues. And at that point I don't want my browsing data to be sold to advertisers and marketing agencies.
- rasengan 7y ago
  The merger agreement includes a written guarantee to never log. I don't think there is any other VPN that has that, and I _know_ that many other VPNs will not sign that with us.
  - liability 7y ago
    The idea of suing a shell corp of an intelligence agency for breach of contract seems laughable. Maybe they aren't that, but why should anybody without personal knowledge of the situation trust that they aren't? This is the sort of scenario where 'better safe than sorry' overrules giving the benifit of the doubt.
    - rasengan 7y ago
      That is a great question - all of our information is public whereas most other VPN companies go out of their way to hide where they are located and who they are. Verification and transparency are more important than trust.
      - icebraining 7y ago
        How can users verify that PIA doesn't log?
        w0uld 7y ago
        You can only infer that as the result of court case demanding logs. And even then, it would have to be born out of the discovery process that PIA was truthful, in my opinion. Yet that only gives you comfort that they hadn't maintained logs up to that point. You have no guarantees from that point forward, which is what we're all concerned about. We aren't concerned about PIA's past operations, but rather what this new partnership means for their future behavior. I realize your question is most likely rhetorical, but I felt the need to articulate my concerns.
        dd36 7y ago
        Or they claim no logs in court cases while making them anyways. Thereby creating cover.
        nickpsecurity 7y ago
        "You can only infer that as the result of court case demanding logs. " You can't be sure. In the Lavabit case, Lavabit argued giving up the key protecting all their users... compromising them to the FBI... would cost them customers due to damaged reputation and privacy. The FBI argued they could do it without telling them. Then, Lavabit would still look private with no financial harm. The judge agreed. That proposal and the judge agreeing changed how I looked at a lot of companies' claims about law enforcement. I already assumed this would happen with Patriot Act requests by FBI/NSA partnership given they'd be hit with secrecy orders. I didn't see a judge straight up telling a privacy company to defraud all of its customers. I figured the order would be more narrow than that. Now, I have a blanket recommendation to avoid U.S. for privacy tech over both secret government (Patriot Act stuff) and regular, court system.
mkl 7y ago
Hi Andrew, you may want to tidy up your HN "about" info if you're speaking on behalf of the company.
- mkl 7y ago
  Note to everyone else: The about has been changed now, as my advice was taken.
- stedaniels 7y ago
  For the untidied version: https://web.archive.org/web/20190330095314/https://news.ycombinator.com/user?id=rasengan https://web.archive.org/web/20190330095314/https://news.ycom...
mirimir 7y ago
I've recommended PIA for years. But no longer. I just don't trust Kape.
- rasengan 7y ago
  Thank you for your recommendations. We are working on and hope to go beyond the world of trust. We are now, the most transparent VPN as there are requirements to be transparent when you are a public company. We don't want people to be stuck with having to blindly believe in and trust us like other VPNs. Don't trust. Verify.
  - mirimir 7y ago
    Actually, I do my best to hedge relying on trust. But Kape is just way too beyond the pale. Perhaps it's unfair, but the association with Israeli intelligence, and so indirectly with NGO Group and the NSA, is just too much.
    - rasengan 7y ago
      In the security and cryptography community I think you'd be hard pressed to find people without similar backgrounds. I think being exposed to how insecure the world is and to what levels drives people to secure the world and empowers people to provide privacy and security to people. Some people whistleblow, while others develop software, and many lecture and teach people.
      - user982 7y ago
        > Some people whistleblow, while others develop software, and many lecture and teach people. And most have no problems with what they saw or did, and many used the contacts and knowledge gained from that background to further their civilian careers in the field and continue to maintain those connections and shared goals therewith.
        LMYahooTFY 7y ago
_joe 7y ago
Changing of ownership fundamentally resets the trust we all had in PIA, which was due to you having proven in court you deliver on what you declare. And in the VPN world, trust is fundamental. I am still surprised you didn't see this coming.
- sneak 7y ago
  > And in the VPN world, trust is fundamental. Why do you say this? Isn't it generally believed that most/all large VPN services are monitored specifically by the governments of the countries in which they operate?
  - icelancer 7y ago
    ...no?
    - sneak 7y ago
      Why would VPN providers be excluded from national governments' internet surveillance systems? If anything, I'd think they'd get extra scrutiny.
    - Razengan 7y ago
      How can we verify that?
      - icelancer 7y ago
        You can't generally prove someone isn't beating their wife. https://en.wikipedia.org/wiki/Loaded_question https://en.wikipedia.org/wiki/Loaded_question
        Razengan 7y ago
        When the concern is our privacy and secrecy, isn’t it better to err on the side of caution than trust naively? What if it were a matter of health? Should we trust before verifying? Would it still be a “loaded” question?
SanchoPanda 7y ago
Thanks for speaking up here. The point on this now being a public company with mandated reporting is interesting. And I found the supplemental presentation decks interesting as well. [1] One thing that stood out to me is that while public, it's still controlled by one person [2], is there a plan to broaden that and be accountable to more people? [1] https://investors.kape.com/reports-and-presentations/2019 https://investors.kape.com/reports-and-presentations/2019 [1a] Slide 5 had interesting stats on PIA for anyone interested here -https://investors.kape.com/~/media/Files/K/Kape-IR/reports-and-presentations/2019/pop-ir-presentation.pdf https://investors.kape.com/~/media/Files/K/Kape-IR/reports-a... [2] https://investors.kape.com/significant-shareholders https://investors.kape.com/significant-shareholders [2a] unikmind gets listed as Teddy Sagi on ownership reporting forms
- rasengan 7y ago
  Great question! That’s part of the plan.
NeedMoreTea 7y ago
Trust and ethics are important. A company that is identified as using questionable ethics in business, for an extended period, is not automatically "reset to neutral" by airdropping in a new management team and a rebrand. Honestly? That sounds more like a move to bury the bad news, which has a long and effective history, just as the day a story goes public does - The Friday News Dump, Thanksgiving News Dump, etc. So, for this PIA user, Kape are in significant negative territory that needs making up to even hit neutral again. Transparency is verification, but it is critical you like what you see. With the newly formed Kape link, owned by Teddy Sagi with extensive links to other online advertising companies, mobile advertising and online gambling. Nothing good for humanity is done by his investments. No, don't like what I see at all. With the reputation PIA had I'm actually really surprised you chose to be associated with such a stable as Sagi's. My sub is due for renewal shortly into the New Year. It won't be.
- ActorNightly 7y ago
  I honestly want to agree with HN on this, but then Im reminded of the constant support for Apple on here, despite the fact that they have violated user trust on numerous occasions, while PIA has not. So I did some checking: * Teddy Sagi is a entrepreneur. To say that he is an ex spy is a gross misstatement. Yes, he worked as a developer in Israeli SIGINT program - so do a lot of developers who work for any number of government contractors in US with security clearances working in SIGINT. Does that make them all spies? If you wanna believe in the conspiracy that all the Unit 8200 graduates who have gone on to found Silicon Valley Companies are still state sponsored, then man, you gotta start boycotting all your popular software (and some hardware), cause Apple, Microsoft, Oracle, and Facebook all have a hand in buying these startups. * Crossmark, the company that Kape originaly was, had malware which is the equivalent of ad supported app on your mobile device - it was bundled with some software (much like Oracle used to bundle Adware with the Java installer), and injected browser traffic, while sending user information back, perhaps for better targeting This is a far cry from actual nefarious malware. Bad? Yes. * Kape technologies is under the lead of a new CEO that was responsible for transforming the company away from Crossrider towards cybersecurity. Again, if you want to believe in a conspiracy theory, that is your choice. * All other Teddys ventures since Kape are in the advertising space. There is a concern that can be made that perhaps advertising is going to sneak in to PIA, but lets cross that bridge if it actually happens. TLDR, pretty much the expected overblown response, which is sadly becoming the standard for HN. By all means, vote with your wallet, but try to keep your voting consistent. Personally, given the web of investors and ownership that surrounds modern tech companies, I do not see any glaring red flags here.
donmcronald 7y ago
So a company that was so badly associated with malware they had to rebrand thought buying a privacy focused VPN company would be a good fit? Regardless of how they’ve changed, the internet never forgets and it’s incredible no one involved considered the optics of selling a VPN company to a company associated with malware. IMO you’re likely 100% above board here and they’re a reformed company, but it doesn’t matter. It looks bad.
smsm42 7y ago
Thank you for taking time to explain your position. I can appreciate the need for resources and why you think this deal is the right thing to do for your company. I've trusted you company enough to use it for years and buy a multi-year subscription. Unfortunately, given the track record of Kape, I can't trust the bundle of Kape+PIA the way I trusted PIA alone. Maybe in the following years this trust will be accumulated, but right now, due to Kape history, it's below zero, drugged down by Kape's past. I understand all about new management and stuff, but adware alone is a business shady enough that steering clear of it in matters like VPN seems to be a basic prudence. And when malware added to the mix... as I said, trust level becomes negative. Good luck in your future work, hopefully your new combined company will accumulate the trust again, but I'll be using some other solution for now.
- rasengan 7y ago
  If you think a platform is responsible for what their developers do with it, then I understand. However, Kape was never directly involved in adware other than providing SDKs that let developers create positive and negative things. To say Kape was involved in adware would be akin to saying the Wright Bros killed millions of people - because they made planes which people used to kill people (which is simply untrue). Even the original article notes this ever so briefly so as not to show Kape positively. Thank you for your trust until now, and given the long track record and relationship, I hope you can verify my statements as well. Our future work will always be the same work we have been doing, so whether now or later, I'm confident we will re-earn your trust again, and hope you'll give us the opportunity.
  - deleted 7y ago
    [deleted]
  - jeltz 7y ago
    Did CrossRider have any honest users? From the little I can find on the Internet it seems like a toolkit for building adware with little to no honest uses.
    - 7y ago
Tenoke 7y ago
>The merger between Kape and PIA affords PIA the resources needed to bring privacy to the mainstream. You were one of the most, if not the most successful VPN provider for years. Did you really need more resources? For what? The main benefit of PIA is the expectation for extra privacy. No matter how you look at it, selling to Kape is a strong signal that's not a priority. Similar, for hiring Karpeles to do your security (like he hasnt lost us enough already).
- rasengan 7y ago
  > Did you really need more resources? For what? Yes, to bring freedom thru privacy to people, The coming battle against privacy and free speech is by far the strongest and worst yet; the narrative and our voices are quickly getting quashed. Without the ability to communicate privately and speak freely, at best democracy is at risk; and at worst, humanity, or what it has meant to be human until now, itself may be at risk. Divided we are not stronger. > Similar, for hiring Karpeles to do your security (like he hasnt lost us enough already). Cryptocurrency has come a long way, and without MtGox and Mark at the beginning, it may not have been able to make such strides. I prefer a battle hardened individual over a clean track record of no experience. Failure is the fastest and strongest way to learn and grow stronger. Overall, I appreciate your words and concerns, but I believe we are strategically moving in the right direction to the world's benefit. Time will tell.
  - Tenoke 7y ago
    >Yes, to bring freedom thru privacy to people, The coming battle against privacy and free speech is by far the strongest and worst yet; the narrative and our voices are quickly getting quashed. >Without the ability to communicate privately and speak freely, at best democracy is at risk; and at worst, humanity, or what it has meant to be human until now, itself may be at risk. >Divided we are not stronger I was hoping for a real response, rather than the same empty marketing speak. Of course, the real response is likely 'I wanted to cash out', so I understand why you can't deliver something more convincing.
  - sumedh 7y ago
    So what exactly is the gameplan, how are you going to change the world by selling your stake?
mirimir 7y ago
Your argument about Kape is persuasive. And I do want to "trust" (as much as I ever do) PIA. It's one of the few that's actually been tested by criminal investigation of a user. And it did, in fact, retain no logs. I've also been impressed by London Trust Media projects. And I appreciate that increased resources are a good thing. So anyway, I do wish y'all well.
- rasengan 7y ago
  Thank you. Your trust will not be misplaced, and we will strive to maximize our transparency as always.
tcd 7y ago
Yet PIA has LIED about making their desktop source code public. Where's the link to the GitHub repo? You are proven liars. (Thanks for the flag, doesn't change the facts, prove me wrong ;) )
teddyuk 7y ago
What does "The company can now be decentrally owned by the people" even mean?
DyslexicAtheist 7y ago
> This article and articles like this miscast Kape in an incorrect light. correct. Focusing on the founder's alleged ties is a distraction. The real story story is "all VPN's are snake oil". The fact that he peddles this should really stand for itself (regardless of his backstory).
hncommenter13 7y ago
This may be ancient history, but I believe this understates Crossrider's active role in the adware/malware that was being widely installed. Per this research from Google and other academics [1][2], Crossrider was one of the largest "affiliates" of Superfish and other ad-injector malware. To my understanding, Crossrider was essentially a distributor: they delivered installs, recruited advertisers, and brokered deals with software publishers, knowing that they would be adding malware/adware to the downloaded bundles that would persist on users' machines. And knowing that some users (most or all, really) didn't realize what was happening. Rather than being a mere bystander, if the researchers are correct and per the HN thread below [3], Crossrider was an active--and essential--participant in the "Download Valley" ecosystem. It may or may not be relevant to today's Kape, but we should at least be honest about what these guys were doing in the past. It was ugly. They weren't the only ones, but they were clearly not on the side of the angels. (Worse, YC funded one of their competitors called InstallMonetizer.) [1] https://pdfs.semanticscholar.org/8914/94e6d2a9e96985ccca1c44aa4d8e63f30a63.pdf https://pdfs.semanticscholar.org/8914/94e6d2a9e96985ccca1c44... [2] https://www.ieee-security.org/TC/SP2015/papers-archived/6949a151.pdf https://www.ieee-security.org/TC/SP2015/papers-archived/6949... [3] https://news.ycombinator.com/item?id=9120593 https://news.ycombinator.com/item?id=9120593 (edit: spacing)
- rhizome 7y ago
  >It may or may not be relevant to today's Kape, but we should at least be honest about what these guys were doing in the past. Yep, "consider the source." It's weird how people will strongly imply that reputation doesn't (or shouldn't) be a factor when the internet is involved, that even criminals should be able to fail upward.
allanmacgregor 7y ago
Andrew, on your responses you mentioned several times transparency, do the best for the people and give people what they want. As a VPN provider, your reputation and the trust of your customers is vital; in the spirit of transparency I would like to know: - Change in customer churn since announcement - Change in new customer signup I really hope you and your team forecasted potential backlash as part of the merger with Kape and have a plan of action to recover.
ben_jones 7y ago
The bottom line is, in 2019 if any of my relatives asked me which VPN to use I would first outline the history of VPNs as a vector for malware/adware and explain to them the supreme level of trust you must have with a VPN provider as a MITM to ALL your internet activity. Only then would I highlight the benefits of VPNs in regards to internet freedoms and circumventing bad content blocks where users want to pay to access content but are arbitrarily denied. VPNs are not the type of consumer product you EVER want to have acquired by ANYBODY. Not by Google, or Facebook, a US company, a Russian company, a Japanese company, NOBODY. Was this not extremely obvious when the deal started to form? You've made a lot of promises that nothing will change, but those are empty promises given the history of post-acquired companies, as well as the vpn market as a whole. You have a lot of work to do following up on those promises, and until you do you will not have the same level of trust as you once did.
- mikorym 7y ago
  > I would first outline the history of VPNs as a vector for malware/adware and explain to them the supreme level of trust you must have with a VPN provider I'm not your great-grandfather, but I also didn't really know (or think of) this. I kinda always thought about VPNs as intranets. I also assumed that browsers are easy enough to hack that you don't need to do a full MITM on the entire network. I also assumed most normal people don't use VPNs. What would the most common attack vector through a VPN be? My guess would be targeting people that use pirate streaming sites / streaming through proxy IP.
  - ben_jones 7y ago
    I believe the most common case would be selling the user traffic, assuming the VPN knows who you are (through billing for example although given your traffic their are a variety of ways even if you did an anonymous signup), they could then say "Hey Ben reads a lot of technical blogs and spends a lot of time on console.cloud.google.com, Triplebyte you should plaster him with ads because that will totally work".
  - everdrive 7y ago
    It modifies who your targets are. You can try to attack people with malicious websites, but in that scenario you can only attack people who manage to visit your malicious site. (this example should be considered to include advertising iframes and such.) A VPN provider, however, has a captive audience and can be certain who they are attacking.
acollins1331 7y ago
Thanks for confirming that PIA is full of shit with this comment. Mullvad never looked better.
kemonocode 7y ago
I hope you understand why people are extremely reluctant on forgiving and forgetting, especially involving something as sensitive as a VPN which, in some cases, can truly be a matter of life or death.
- rasengan 7y ago
  I absolutely do, and I have always known. In particular, it’s been humbling to see the reaction on HN and I appreciate the amount of trust and love the community has had for us. I understand we are held to a different standard than other VPNs who hide their locations and ownership and are constantly caught logging - and I appreciate it. Hacker News, we won’t let you down.
Pigo 7y ago
PIA was the first, that I was able to find at the time, that had an fully functioning android app for your service. I've used PIA ever since whenever I needed VPN services. Like every service I use, I plan to take into account what I learn about them and then watch and see what they do.
harshreality 7y ago
Here's an idea or two. Wireguard. Stop sitting on your hands complaining about how wireguard isn't mature, and support it with the generic native apps (now there's even a (beta) windows client). The network address selection issue requires engineering effort, but wireguard itself is most likely not going to address that soon, because it's designed to be a minimal vpn codebase, so why don't you engineer a solution yourself? Or use NAT like nordvpn apparently does. Explicit stock OpenVPN support. You kind of do this, but it's still difficult or off-putting for non-technical users to figure out which config to grab and how to install the stock client. On your setup page, make sure you're providing a link to the stock (windows) openvpn client and install instructions for Mac and major linux distros, so that people who don't trust your binary blob installer can use the generic one (minus all the fancy stuff like pretty config for auto-selection of endpoint, showing port number, DNS and kill switch things). Make sure to provide sample configs that are up to date and usable. Nobody has to trust your software if you make it easy to use a generic client instead. I realize Wireguard is tricky because it doesn't have ephemeral net address selection built into the protocol, but can you please just get that support done? What is your dev team doing if they're not doing that? They don't have to maintain openvpn, unless continually tweaking the custom UI is their prime focus. I'm tired of OpenVPN's instability and risk from its gigantic codebase. I don't care if wireguard has lurking bugs that make it insecure against the NSA. The NSA is not my threat model. You can support wireguard while cautioning everyone that you don't trust it as much as openvpn, and then let them make the choice based on how much they trust you, how much they trust wireguard, and how much they trust Matthew Green's audit of openvpn.
- rasengan 7y ago
  We have financially supported wire guard for some time and have followed its development closely while being in communication with its developer. We do have explicit stock OpenVPN support. While your adversary might not be the NSA, it’s our duty to only use battle hardened, time proven systems because as others noted, privacy can be life and death. We aren’t going to falter on it. We never have. And we never will. NordVPN plays fast and loose as we see by their masked headquarter location, hidden hacks, and other not so above board actions. It’s exactly what I would never want in a VPN to be clear.
nickpsecurity 7y ago
"The merger between Kape and PIA affords PIA the resources needed" I'm one of those people who understand the importance of reputation and integrity. One bad deal might ruin mine forever. You needed resources to expand your privacy business. Did you try and fail to partner with reputable businesses such as Mozilla, get funding from governments/foundations, etc? Did you try to get with amoral companies whose background or business wasn't harmful to privacy? And, after that, settle for the one company that was interested which could damage your brand? I have a feeling you didn't since I'm sure there's plenty of companies, non-profits, or cooperatives that might have worked with you who don't have that background. Although I can't prove that, I see investments and partnerships all the time with organizations that raise less eyebrows. That you went with that company will undermine trust. I'm no longer recommending PIA. I do appreciate that, before this change, your company went as far as defending its users' rights when FBI was after them. I'll still give you credit for that. Edit re hiring security people: You also keep justifying hiring con men for second chances or doing business with intelligence assets like there were no other alternatives. I've met all kinds of security professionals and cryptographic researchers who haven't taken malicious contracts or damaged others [that I'm aware of]. Quite a few have turned down work because they're ideologically opposed to it or just don't harm others. I'm one of those. So, my next bit of skepticism is that you really couldn't find anyone better than folks like Karpeles. You could've asked here or at Black Hat and probably got a ton of candidates who might be more trustworthy with your customers' privacy.
- rasengan 7y ago
  We actually did reach out to many groups including some of those you mentioned. You would be surprised to find that “non profit” doesn’t always mean “for the public good.” As for others that were willing to partner with us, they wouldn’t sign a no log pact so I had no interest to work with them. It’s shocking how many private VPNs are shadily logging and/or selling your data.
  - codezero 7y ago
    Why don’t you out them? You haven’t had much trouble slinging mud on HN in the past, and to be clear, it has been appreciated.
baobabKoodaa 7y ago
Andrew, will you be offering refunds to your customers who have paid for your service and will no longer be able to use it because of the acquisition?
C14L 7y ago
Maybe. But I won't risk it.
- dorkinspace 7y ago
  That is exactly where I'm at also. I have recommended PIA to countless others. I will now wait and see if PIA is still the tool that it was before the acquisition. Unfortunately for PIA, Kape has done nothing to gain my trust and has done multiple things to erode it. This is an uphill battle for PIA. Good luck!
Krasnol 7y ago
> The merger between Kape and PIA affords PIA the resources needed to bring privacy to the mainstream. What does that even mean? As for VPNs, you have been mainstream. There was no other VPN service more recommended on reddit. Even here you've made a relevant impact on recommendations. How does that not provide enough funds? What have you done with all that money and why exactly do you need more?
JumpCrisscross 7y ago
> I stand behind the move to bring more transparency to privacy How do management's economic incentives change through this deal? How much are you cashing out now versus riding into the combined entity?
craftinator 7y ago
How do we verify that PIA is adhering to it's stated policy? Like, what is the actual process for that? Is there a link you can post that instructs us in this verification?

juanbyrge 7y ago

Sure, nothing has changed yet. That's how it goes with acquisitions. But people (including myself) are more concerned about the future. At some point in the future there will pressure from within Kape to increase revenues. And at that point I don't want my browsing data to be sold to advertisers and marketing agencies.

rasengan 7y ago
The merger agreement includes a written guarantee to never log. I don't think there is any other VPN that has that, and I _know_ that many other VPNs will not sign that with us.
- liability 7y ago
  The idea of suing a shell corp of an intelligence agency for breach of contract seems laughable. Maybe they aren't that, but why should anybody without personal knowledge of the situation trust that they aren't? This is the sort of scenario where 'better safe than sorry' overrules giving the benifit of the doubt.
  - rasengan 7y ago
    That is a great question - all of our information is public whereas most other VPN companies go out of their way to hide where they are located and who they are. Verification and transparency are more important than trust.
    - icebraining 7y ago
      How can users verify that PIA doesn't log?
      - w0uld 7y ago
        You can only infer that as the result of court case demanding logs. And even then, it would have to be born out of the discovery process that PIA was truthful, in my opinion. Yet that only gives you comfort that they hadn't maintained logs up to that point. You have no guarantees from that point forward, which is what we're all concerned about. We aren't concerned about PIA's past operations, but rather what this new partnership means for their future behavior. I realize your question is most likely rhetorical, but I felt the need to articulate my concerns.
        dd36 7y ago
        Or they claim no logs in court cases while making them anyways. Thereby creating cover.
        nickpsecurity 7y ago
        "You can only infer that as the result of court case demanding logs. " You can't be sure. In the Lavabit case, Lavabit argued giving up the key protecting all their users... compromising them to the FBI... would cost them customers due to damaged reputation and privacy. The FBI argued they could do it without telling them. Then, Lavabit would still look private with no financial harm. The judge agreed. That proposal and the judge agreeing changed how I looked at a lot of companies' claims about law enforcement. I already assumed this would happen with Patriot Act requests by FBI/NSA partnership given they'd be hit with secrecy orders. I didn't see a judge straight up telling a privacy company to defraud all of its customers. I figured the order would be more narrow than that. Now, I have a blanket recommendation to avoid U.S. for privacy tech over both secret government (Patriot Act stuff) and regular, court system.

mkl 7y ago

Hi Andrew, you may want to tidy up your HN "about" info if you're speaking on behalf of the company.

mkl 7y ago
Note to everyone else: The about has been changed now, as my advice was taken.
stedaniels 7y ago
For the untidied version: https://web.archive.org/web/20190330095314/https://news.ycombinator.com/user?id=rasengan https://web.archive.org/web/20190330095314/https://news.ycom...

mirimir 7y ago

I've recommended PIA for years. But no longer. I just don't trust Kape.

rasengan 7y ago
Thank you for your recommendations. We are working on and hope to go beyond the world of trust. We are now, the most transparent VPN as there are requirements to be transparent when you are a public company. We don't want people to be stuck with having to blindly believe in and trust us like other VPNs. Don't trust. Verify.
- mirimir 7y ago
  Actually, I do my best to hedge relying on trust. But Kape is just way too beyond the pale. Perhaps it's unfair, but the association with Israeli intelligence, and so indirectly with NGO Group and the NSA, is just too much.
  - rasengan 7y ago
    In the security and cryptography community I think you'd be hard pressed to find people without similar backgrounds. I think being exposed to how insecure the world is and to what levels drives people to secure the world and empowers people to provide privacy and security to people. Some people whistleblow, while others develop software, and many lecture and teach people.
    - user982 7y ago
      > Some people whistleblow, while others develop software, and many lecture and teach people. And most have no problems with what they saw or did, and many used the contacts and knowledge gained from that background to further their civilian careers in the field and continue to maintain those connections and shared goals therewith.
      - LMYahooTFY 7y ago

_joe 7y ago

Changing of ownership fundamentally resets the trust we all had in PIA, which was due to you having proven in court you deliver on what you declare. And in the VPN world, trust is fundamental. I am still surprised you didn't see this coming.

sneak 7y ago
> And in the VPN world, trust is fundamental. Why do you say this? Isn't it generally believed that most/all large VPN services are monitored specifically by the governments of the countries in which they operate?
- icelancer 7y ago
  ...no?
  - sneak 7y ago
    Why would VPN providers be excluded from national governments' internet surveillance systems? If anything, I'd think they'd get extra scrutiny.
  - Razengan 7y ago
    How can we verify that?
    - icelancer 7y ago
      You can't generally prove someone isn't beating their wife. https://en.wikipedia.org/wiki/Loaded_question https://en.wikipedia.org/wiki/Loaded_question
      - Razengan 7y ago
        When the concern is our privacy and secrecy, isn’t it better to err on the side of caution than trust naively? What if it were a matter of health? Should we trust before verifying? Would it still be a “loaded” question?

SanchoPanda 7y ago

Thanks for speaking up here. The point on this now being a public company with mandated reporting is interesting. And I found the supplemental presentation decks interesting as well. [1] One thing that stood out to me is that while public, it's still controlled by one person [2], is there a plan to broaden that and be accountable to more people? [1] https://investors.kape.com/reports-and-presentations/2019 https://investors.kape.com/reports-and-presentations/2019 [1a] Slide 5 had interesting stats on PIA for anyone interested here -https://investors.kape.com/~/media/Files/K/Kape-IR/reports-and-presentations/2019/pop-ir-presentation.pdf https://investors.kape.com/~/media/Files/K/Kape-IR/reports-a... [2] https://investors.kape.com/significant-shareholders https://investors.kape.com/significant-shareholders [2a] unikmind gets listed as Teddy Sagi on ownership reporting forms

rasengan 7y ago
Great question! That’s part of the plan.

NeedMoreTea 7y ago

Trust and ethics are important. A company that is identified as using questionable ethics in business, for an extended period, is not automatically "reset to neutral" by airdropping in a new management team and a rebrand. Honestly? That sounds more like a move to bury the bad news, which has a long and effective history, just as the day a story goes public does - The Friday News Dump, Thanksgiving News Dump, etc. So, for this PIA user, Kape are in significant negative territory that needs making up to even hit neutral again. Transparency is verification, but it is critical you like what you see. With the newly formed Kape link, owned by Teddy Sagi with extensive links to other online advertising companies, mobile advertising and online gambling. Nothing good for humanity is done by his investments. No, don't like what I see at all. With the reputation PIA had I'm actually really surprised you chose to be associated with such a stable as Sagi's. My sub is due for renewal shortly into the New Year. It won't be.

ActorNightly 7y ago
I honestly want to agree with HN on this, but then Im reminded of the constant support for Apple on here, despite the fact that they have violated user trust on numerous occasions, while PIA has not. So I did some checking: * Teddy Sagi is a entrepreneur. To say that he is an ex spy is a gross misstatement. Yes, he worked as a developer in Israeli SIGINT program - so do a lot of developers who work for any number of government contractors in US with security clearances working in SIGINT. Does that make them all spies? If you wanna believe in the conspiracy that all the Unit 8200 graduates who have gone on to found Silicon Valley Companies are still state sponsored, then man, you gotta start boycotting all your popular software (and some hardware), cause Apple, Microsoft, Oracle, and Facebook all have a hand in buying these startups. * Crossmark, the company that Kape originaly was, had malware which is the equivalent of ad supported app on your mobile device - it was bundled with some software (much like Oracle used to bundle Adware with the Java installer), and injected browser traffic, while sending user information back, perhaps for better targeting This is a far cry from actual nefarious malware. Bad? Yes. * Kape technologies is under the lead of a new CEO that was responsible for transforming the company away from Crossrider towards cybersecurity. Again, if you want to believe in a conspiracy theory, that is your choice. * All other Teddys ventures since Kape are in the advertising space. There is a concern that can be made that perhaps advertising is going to sneak in to PIA, but lets cross that bridge if it actually happens. TLDR, pretty much the expected overblown response, which is sadly becoming the standard for HN. By all means, vote with your wallet, but try to keep your voting consistent. Personally, given the web of investors and ownership that surrounds modern tech companies, I do not see any glaring red flags here.

donmcronald 7y ago

So a company that was so badly associated with malware they had to rebrand thought buying a privacy focused VPN company would be a good fit? Regardless of how they’ve changed, the internet never forgets and it’s incredible no one involved considered the optics of selling a VPN company to a company associated with malware. IMO you’re likely 100% above board here and they’re a reformed company, but it doesn’t matter. It looks bad.

smsm42 7y ago

Thank you for taking time to explain your position. I can appreciate the need for resources and why you think this deal is the right thing to do for your company. I've trusted you company enough to use it for years and buy a multi-year subscription. Unfortunately, given the track record of Kape, I can't trust the bundle of Kape+PIA the way I trusted PIA alone. Maybe in the following years this trust will be accumulated, but right now, due to Kape history, it's below zero, drugged down by Kape's past. I understand all about new management and stuff, but adware alone is a business shady enough that steering clear of it in matters like VPN seems to be a basic prudence. And when malware added to the mix... as I said, trust level becomes negative. Good luck in your future work, hopefully your new combined company will accumulate the trust again, but I'll be using some other solution for now.

rasengan 7y ago
If you think a platform is responsible for what their developers do with it, then I understand. However, Kape was never directly involved in adware other than providing SDKs that let developers create positive and negative things. To say Kape was involved in adware would be akin to saying the Wright Bros killed millions of people - because they made planes which people used to kill people (which is simply untrue). Even the original article notes this ever so briefly so as not to show Kape positively. Thank you for your trust until now, and given the long track record and relationship, I hope you can verify my statements as well. Our future work will always be the same work we have been doing, so whether now or later, I'm confident we will re-earn your trust again, and hope you'll give us the opportunity.
- deleted 7y ago
  [deleted]
- jeltz 7y ago
  Did CrossRider have any honest users? From the little I can find on the Internet it seems like a toolkit for building adware with little to no honest uses.
  - 7y ago

Tenoke 7y ago

>The merger between Kape and PIA affords PIA the resources needed to bring privacy to the mainstream. You were one of the most, if not the most successful VPN provider for years. Did you really need more resources? For what? The main benefit of PIA is the expectation for extra privacy. No matter how you look at it, selling to Kape is a strong signal that's not a priority. Similar, for hiring Karpeles to do your security (like he hasnt lost us enough already).

rasengan 7y ago
> Did you really need more resources? For what? Yes, to bring freedom thru privacy to people, The coming battle against privacy and free speech is by far the strongest and worst yet; the narrative and our voices are quickly getting quashed. Without the ability to communicate privately and speak freely, at best democracy is at risk; and at worst, humanity, or what it has meant to be human until now, itself may be at risk. Divided we are not stronger. > Similar, for hiring Karpeles to do your security (like he hasnt lost us enough already). Cryptocurrency has come a long way, and without MtGox and Mark at the beginning, it may not have been able to make such strides. I prefer a battle hardened individual over a clean track record of no experience. Failure is the fastest and strongest way to learn and grow stronger. Overall, I appreciate your words and concerns, but I believe we are strategically moving in the right direction to the world's benefit. Time will tell.
- Tenoke 7y ago
  >Yes, to bring freedom thru privacy to people, The coming battle against privacy and free speech is by far the strongest and worst yet; the narrative and our voices are quickly getting quashed. >Without the ability to communicate privately and speak freely, at best democracy is at risk; and at worst, humanity, or what it has meant to be human until now, itself may be at risk. >Divided we are not stronger I was hoping for a real response, rather than the same empty marketing speak. Of course, the real response is likely 'I wanted to cash out', so I understand why you can't deliver something more convincing.
- sumedh 7y ago
  So what exactly is the gameplan, how are you going to change the world by selling your stake?

mirimir 7y ago

Your argument about Kape is persuasive. And I do want to "trust" (as much as I ever do) PIA. It's one of the few that's actually been tested by criminal investigation of a user. And it did, in fact, retain no logs. I've also been impressed by London Trust Media projects. And I appreciate that increased resources are a good thing. So anyway, I do wish y'all well.

rasengan 7y ago
Thank you. Your trust will not be misplaced, and we will strive to maximize our transparency as always.

tcd 7y ago

Yet PIA has LIED about making their desktop source code public. Where's the link to the GitHub repo? You are proven liars. (Thanks for the flag, doesn't change the facts, prove me wrong ;) )

teddyuk 7y ago

What does "The company can now be decentrally owned by the people" even mean?

DyslexicAtheist 7y ago

> This article and articles like this miscast Kape in an incorrect light. correct. Focusing on the founder's alleged ties is a distraction. The real story story is "all VPN's are snake oil". The fact that he peddles this should really stand for itself (regardless of his backstory).

hncommenter13 7y ago

This may be ancient history, but I believe this understates Crossrider's active role in the adware/malware that was being widely installed. Per this research from Google and other academics [1][2], Crossrider was one of the largest "affiliates" of Superfish and other ad-injector malware. To my understanding, Crossrider was essentially a distributor: they delivered installs, recruited advertisers, and brokered deals with software publishers, knowing that they would be adding malware/adware to the downloaded bundles that would persist on users' machines. And knowing that some users (most or all, really) didn't realize what was happening. Rather than being a mere bystander, if the researchers are correct and per the HN thread below [3], Crossrider was an active--and essential--participant in the "Download Valley" ecosystem. It may or may not be relevant to today's Kape, but we should at least be honest about what these guys were doing in the past. It was ugly. They weren't the only ones, but they were clearly not on the side of the angels. (Worse, YC funded one of their competitors called InstallMonetizer.) [1] https://pdfs.semanticscholar.org/8914/94e6d2a9e96985ccca1c44aa4d8e63f30a63.pdf https://pdfs.semanticscholar.org/8914/94e6d2a9e96985ccca1c44... [2] https://www.ieee-security.org/TC/SP2015/papers-archived/6949a151.pdf https://www.ieee-security.org/TC/SP2015/papers-archived/6949... [3] https://news.ycombinator.com/item?id=9120593 https://news.ycombinator.com/item?id=9120593 (edit: spacing)

rhizome 7y ago
>It may or may not be relevant to today's Kape, but we should at least be honest about what these guys were doing in the past. Yep, "consider the source." It's weird how people will strongly imply that reputation doesn't (or shouldn't) be a factor when the internet is involved, that even criminals should be able to fail upward.

allanmacgregor 7y ago

Andrew, on your responses you mentioned several times transparency, do the best for the people and give people what they want. As a VPN provider, your reputation and the trust of your customers is vital; in the spirit of transparency I would like to know: - Change in customer churn since announcement - Change in new customer signup I really hope you and your team forecasted potential backlash as part of the merger with Kape and have a plan of action to recover.

ben_jones 7y ago

The bottom line is, in 2019 if any of my relatives asked me which VPN to use I would first outline the history of VPNs as a vector for malware/adware and explain to them the supreme level of trust you must have with a VPN provider as a MITM to ALL your internet activity. Only then would I highlight the benefits of VPNs in regards to internet freedoms and circumventing bad content blocks where users want to pay to access content but are arbitrarily denied. VPNs are not the type of consumer product you EVER want to have acquired by ANYBODY. Not by Google, or Facebook, a US company, a Russian company, a Japanese company, NOBODY. Was this not extremely obvious when the deal started to form? You've made a lot of promises that nothing will change, but those are empty promises given the history of post-acquired companies, as well as the vpn market as a whole. You have a lot of work to do following up on those promises, and until you do you will not have the same level of trust as you once did.

mikorym 7y ago
> I would first outline the history of VPNs as a vector for malware/adware and explain to them the supreme level of trust you must have with a VPN provider I'm not your great-grandfather, but I also didn't really know (or think of) this. I kinda always thought about VPNs as intranets. I also assumed that browsers are easy enough to hack that you don't need to do a full MITM on the entire network. I also assumed most normal people don't use VPNs. What would the most common attack vector through a VPN be? My guess would be targeting people that use pirate streaming sites / streaming through proxy IP.
- ben_jones 7y ago
  I believe the most common case would be selling the user traffic, assuming the VPN knows who you are (through billing for example although given your traffic their are a variety of ways even if you did an anonymous signup), they could then say "Hey Ben reads a lot of technical blogs and spends a lot of time on console.cloud.google.com, Triplebyte you should plaster him with ads because that will totally work".
- everdrive 7y ago
  It modifies who your targets are. You can try to attack people with malicious websites, but in that scenario you can only attack people who manage to visit your malicious site. (this example should be considered to include advertising iframes and such.) A VPN provider, however, has a captive audience and can be certain who they are attacking.

acollins1331 7y ago

Thanks for confirming that PIA is full of shit with this comment. Mullvad never looked better.

kemonocode 7y ago

I hope you understand why people are extremely reluctant on forgiving and forgetting, especially involving something as sensitive as a VPN which, in some cases, can truly be a matter of life or death.

rasengan 7y ago
I absolutely do, and I have always known. In particular, it’s been humbling to see the reaction on HN and I appreciate the amount of trust and love the community has had for us. I understand we are held to a different standard than other VPNs who hide their locations and ownership and are constantly caught logging - and I appreciate it. Hacker News, we won’t let you down.

Pigo 7y ago

PIA was the first, that I was able to find at the time, that had an fully functioning android app for your service. I've used PIA ever since whenever I needed VPN services. Like every service I use, I plan to take into account what I learn about them and then watch and see what they do.

harshreality 7y ago

Here's an idea or two. Wireguard. Stop sitting on your hands complaining about how wireguard isn't mature, and support it with the generic native apps (now there's even a (beta) windows client). The network address selection issue requires engineering effort, but wireguard itself is most likely not going to address that soon, because it's designed to be a minimal vpn codebase, so why don't you engineer a solution yourself? Or use NAT like nordvpn apparently does. Explicit stock OpenVPN support. You kind of do this, but it's still difficult or off-putting for non-technical users to figure out which config to grab and how to install the stock client. On your setup page, make sure you're providing a link to the stock (windows) openvpn client and install instructions for Mac and major linux distros, so that people who don't trust your binary blob installer can use the generic one (minus all the fancy stuff like pretty config for auto-selection of endpoint, showing port number, DNS and kill switch things). Make sure to provide sample configs that are up to date and usable. Nobody has to trust your software if you make it easy to use a generic client instead. I realize Wireguard is tricky because it doesn't have ephemeral net address selection built into the protocol, but can you please just get that support done? What is your dev team doing if they're not doing that? They don't have to maintain openvpn, unless continually tweaking the custom UI is their prime focus. I'm tired of OpenVPN's instability and risk from its gigantic codebase. I don't care if wireguard has lurking bugs that make it insecure against the NSA. The NSA is not my threat model. You can support wireguard while cautioning everyone that you don't trust it as much as openvpn, and then let them make the choice based on how much they trust you, how much they trust wireguard, and how much they trust Matthew Green's audit of openvpn.

rasengan 7y ago
We have financially supported wire guard for some time and have followed its development closely while being in communication with its developer. We do have explicit stock OpenVPN support. While your adversary might not be the NSA, it’s our duty to only use battle hardened, time proven systems because as others noted, privacy can be life and death. We aren’t going to falter on it. We never have. And we never will. NordVPN plays fast and loose as we see by their masked headquarter location, hidden hacks, and other not so above board actions. It’s exactly what I would never want in a VPN to be clear.

nickpsecurity 7y ago

"The merger between Kape and PIA affords PIA the resources needed" I'm one of those people who understand the importance of reputation and integrity. One bad deal might ruin mine forever. You needed resources to expand your privacy business. Did you try and fail to partner with reputable businesses such as Mozilla, get funding from governments/foundations, etc? Did you try to get with amoral companies whose background or business wasn't harmful to privacy? And, after that, settle for the one company that was interested which could damage your brand? I have a feeling you didn't since I'm sure there's plenty of companies, non-profits, or cooperatives that might have worked with you who don't have that background. Although I can't prove that, I see investments and partnerships all the time with organizations that raise less eyebrows. That you went with that company will undermine trust. I'm no longer recommending PIA. I do appreciate that, before this change, your company went as far as defending its users' rights when FBI was after them. I'll still give you credit for that. Edit re hiring security people: You also keep justifying hiring con men for second chances or doing business with intelligence assets like there were no other alternatives. I've met all kinds of security professionals and cryptographic researchers who haven't taken malicious contracts or damaged others [that I'm aware of]. Quite a few have turned down work because they're ideologically opposed to it or just don't harm others. I'm one of those. So, my next bit of skepticism is that you really couldn't find anyone better than folks like Karpeles. You could've asked here or at Black Hat and probably got a ton of candidates who might be more trustworthy with your customers' privacy.

rasengan 7y ago
We actually did reach out to many groups including some of those you mentioned. You would be surprised to find that “non profit” doesn’t always mean “for the public good.” As for others that were willing to partner with us, they wouldn’t sign a no log pact so I had no interest to work with them. It’s shocking how many private VPNs are shadily logging and/or selling your data.
- codezero 7y ago
  Why don’t you out them? You haven’t had much trouble slinging mud on HN in the past, and to be clear, it has been appreciated.

baobabKoodaa 7y ago

Andrew, will you be offering refunds to your customers who have paid for your service and will no longer be able to use it because of the acquisition?

C14L 7y ago

Maybe. But I won't risk it.

dorkinspace 7y ago
That is exactly where I'm at also. I have recommended PIA to countless others. I will now wait and see if PIA is still the tool that it was before the acquisition. Unfortunately for PIA, Kape has done nothing to gain my trust and has done multiple things to erode it. This is an uphill battle for PIA. Good luck!

Krasnol 7y ago

> The merger between Kape and PIA affords PIA the resources needed to bring privacy to the mainstream. What does that even mean? As for VPNs, you have been mainstream. There was no other VPN service more recommended on reddit. Even here you've made a relevant impact on recommendations. How does that not provide enough funds? What have you done with all that money and why exactly do you need more?

JumpCrisscross 7y ago

> I stand behind the move to bring more transparency to privacy How do management's economic incentives change through this deal? How much are you cashing out now versus riding into the combined entity?

craftinator 7y ago

How do we verify that PIA is adhering to it's stated policy? Like, what is the actual process for that? Is there a link you can post that instructs us in this verification?