4 ms·

Just a general question about VPN services in general. When they advertise that they have hundreds of servers in a dozen or so countries, is it even possible to

Just a general question about VPN services in general. When they advertise that they have hundreds of servers in a dozen or so countries, is it even possible to think that they are able to secure all of that themselves? Surely some State actor with enough know-how is going to be able to hack into some of the servers, right?

diminoten 7y ago
None of these 3rd party VPNs are really meant to be hardened against state sponsored attacks, at least I wouldn't think myself secure from that level of sophistication. They're basically most valuable to mess around against adversaries that have little to no access to security resources, like your average ISP or forum moderator.
hug 7y ago
If you're using a third-party VPN service as the single way in which you are protecting your privacy, you're already in such a sorry state that it doesn't matter whether or not your VPN provider is compromised. If your threat model is such that you're concerned about TLAs or state-level actors targeting you, you're already in a world of hurt. If you are under the mistaken belief that the VPN provider is anywhere near as conscious of your security as you are, you're already living a bit of a fantasy. So the answer to your question is that it's not really possible to think that they're ultra-secure, but that ultra-security was never what they were selling.
closeparen 7y ago
Security effort scales with number of servers only if you’re doing something deeply wrong (like not using configuration management).
- _joe 7y ago
  That's only partially true. A big part of security is your relationship with the people providing you hosting. The compromises to nordvpn and others came from a rogue hosting company, for instance.
duskwuff 7y ago
> When they advertise that they have hundreds of servers in a dozen or so countries... ... they're often lying. In particular, servers in exotic locations are almost always the result of "creative" routing, and are physically located in a more standard country. https://restoreprivacy.com/vpn-server-locations/ https://restoreprivacy.com/vpn-server-locations/
- icelancer 7y ago
  I really like the methodology in this blog post. It's creative and low-tech, easy to replicate, and came to interesting, important conclusions.
- Semaphor 7y ago
  Mullvad is very open about their servers, which they rent and which they own [0]. Note that 31173 is their parent company. [0]: https://mullvad.net/en/servers/ https://mullvad.net/en/servers/
- codethief 7y ago
  Could anyone who's more familiar with routing than me explain how these "virtual locations" work at a technical level? As far as I understand the VPN companies in question don't maintain boxes at those locations and an Azerbaijani IP address for instance literally gets routed to a machine in the UK. How is this possible? I always thought that IP addresses were tied to the location assigned to them by ICANN / regional internet registries.
  - kuschku 7y ago
    You register as ISP with e.g. RIPE, buy some IP blocks from an ISP in the country you want to pretend to be in, and then announce them via BGP from your actual location. Due to IPv4 shortage, we're actually seeing a lot of chinese and european companies buying IP addresses in AFRINIC space, from african ISPs, and using them in their own countries.
deleted 7y ago
[deleted]
pheug 7y ago
Most of them just rent servers / VPS boxes, so ultimately your security depends also on whoever operates the servers themselves. NordVPN got recently powned through remote management software vulnerabilities in one of the datacenters they were renting from - https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/ https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-ha...

diminoten 7y ago

None of these 3rd party VPNs are really meant to be hardened against state sponsored attacks, at least I wouldn't think myself secure from that level of sophistication. They're basically most valuable to mess around against adversaries that have little to no access to security resources, like your average ISP or forum moderator.

hug 7y ago

If you're using a third-party VPN service as the single way in which you are protecting your privacy, you're already in such a sorry state that it doesn't matter whether or not your VPN provider is compromised. If your threat model is such that you're concerned about TLAs or state-level actors targeting you, you're already in a world of hurt. If you are under the mistaken belief that the VPN provider is anywhere near as conscious of your security as you are, you're already living a bit of a fantasy. So the answer to your question is that it's not really possible to think that they're ultra-secure, but that ultra-security was never what they were selling.

closeparen 7y ago

Security effort scales with number of servers only if you’re doing something deeply wrong (like not using configuration management).

_joe 7y ago
That's only partially true. A big part of security is your relationship with the people providing you hosting. The compromises to nordvpn and others came from a rogue hosting company, for instance.

duskwuff 7y ago

> When they advertise that they have hundreds of servers in a dozen or so countries... ... they're often lying. In particular, servers in exotic locations are almost always the result of "creative" routing, and are physically located in a more standard country. https://restoreprivacy.com/vpn-server-locations/ https://restoreprivacy.com/vpn-server-locations/

icelancer 7y ago
I really like the methodology in this blog post. It's creative and low-tech, easy to replicate, and came to interesting, important conclusions.
Semaphor 7y ago
Mullvad is very open about their servers, which they rent and which they own [0]. Note that 31173 is their parent company. [0]: https://mullvad.net/en/servers/ https://mullvad.net/en/servers/
codethief 7y ago
Could anyone who's more familiar with routing than me explain how these "virtual locations" work at a technical level? As far as I understand the VPN companies in question don't maintain boxes at those locations and an Azerbaijani IP address for instance literally gets routed to a machine in the UK. How is this possible? I always thought that IP addresses were tied to the location assigned to them by ICANN / regional internet registries.
- kuschku 7y ago
  You register as ISP with e.g. RIPE, buy some IP blocks from an ISP in the country you want to pretend to be in, and then announce them via BGP from your actual location. Due to IPv4 shortage, we're actually seeing a lot of chinese and european companies buying IP addresses in AFRINIC space, from african ISPs, and using them in their own countries.

deleted 7y ago

[deleted]

pheug 7y ago

Most of them just rent servers / VPS boxes, so ultimately your security depends also on whoever operates the servers themselves. NordVPN got recently powned through remote management software vulnerabilities in one of the datacenters they were renting from - https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/ https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-ha...