14 ms·

PIA open-sources and announces audit plans

281 points by rasengan 7y ago

perfectlyzero 7y ago
Interesting. Worth following the development on this one.
craftinator 7y ago
Wasn't PIA bought by an offshoot from a shady malware producing company called Kape? Isn't PIA's new CTO Mark Karpeles, one of the ringleaders of the Mt. Gox debacle, who stole millions of dollars and was convicted for it in Japan? Nothing says safety like malware and fellons in your VPN provider. Reddit thread with a decent timeline of events: https://www.reddit.com/r/PrivateInternetAccess/comments/e9fo3l/questionable_decisions/ https://www.reddit.com/r/PrivateInternetAccess/comments/e9fo...
- ShorsHammer 7y ago
  As a r/buttcoin regular I couldn't help but chuckle loudly in the office here reading this. Had to double check and laughed even more. The utter absurdity of it all. He actually seems like a decent guy who got in well over his head and did prison time for it in Japan, but as the saying goes "all publicity is good publicity", you literally can't do wrong in the corporate world. Patiently waiting for Elizabeth Holmes next endeavour.
  - craftinator 7y ago
    I may have been laying it on a little thick, but honestly, letting him become CTO of a major VPN provider... A whole sea of capable, professional tech leaders out there, and they choose a blockchain enthusiast with a criminal record and a history of incapability. I get the feeling that Kape wants someone in charge who won't say no to shady practices.
    - Cauchon 7y ago
      I get where you’re coming from. If I’m going to choose one VPN company to use, it won’t be one with him as CTO.
      - ShorsHammer 7y ago
        Exactly. It's almost like they are trying to filter out anyone with sense.
- Freeboots 7y ago
  Hah, I hadn't realized Karpeles was involved. That's a pretty wild CTO choice. After all that's happened, going open source is pretty much their only option.
  - craftinator 7y ago
    I can see how they can open source their client side applications, and I guess they can open source their server code, but I can't wrap my head around how we can verify what exactly they are running on their servers. Like, can we ssh into them with root access and poke around running processes? I just don't get it. Anyone have a clue how else that kind of verification can happen?
    - blibble 7y ago
      it's not possible and even if it was they could just configure their switches to mirror ports to send the traffic somewhere else for logging this entire thing is snake oil designed to fool people that don't know any better trust is earnt... and PIA hired Mark Karpeles, put him in charge of technology then later sold out to a malware firm if you insist on having a VPN: there's plenty of other firms that don't have these "attributes"
      - voisin 7y ago
        What alternatives do you suggest? I just cancelled my PIA subscription and am in the market.
        majewsky 7y ago
        I've heard good things about Mullvad and IPredator, both from Sweden. Generally you want to be looking for VPN providers that don't spend half their revenue on marketing.
        jcampbell1 7y ago
        I use Mullvad with the standard wireguard clients. Works much better than anything OpenVPN based. They are based in Sweden which seems like a reasonable jurisdiction.
- 55555 7y ago
  The biggest problem I have with this is that Mark Karpeles is, provably, a bad programmer...
  - Freeboots 7y ago
    Yeah, it's not just the fraud thing; Karpeles shit the bed on Mtgox multiple times. I actually kind of believe the narrative that it was incompetence more than malice, at least to start with.
- almostbasic 7y ago
  My name is Chris M and I am the CMO for Private Internet Access. PIA management has prepared the following statement regarding Mark Karpeles’s role at LTMH and we hope it addresses your doubts or concerns: In 2018, Mark Karpeles was appointed CTO of LTMH, which was the parent company of Private Internet Access prior to KAPE. However, Mark never had an operational role in PIA and subsequently never had access to any part of the PIA infrastructure nor any role in the planning or execution of the day-to-day operations of PIA. The role of CTO at PIA has been run collectively by Tommie P. (SvP Software, joined January 2017) handling the software development side and Gaurav G. (CIO, joined January 2015) handling the operational and infrastructure side of the business. Mark’s role at LTMH has predominantly been to manage development teams working on FutureFC, general R&D, and providing a broader perspective of the industry as a whole rather than PIA specific issues. His work is best summarized as a valued external consultant for specific discussions related to the advancement of our privacy and security efforts. As part of the merger with KAPE to become Private Internet, Mark currently has no operational role in the merged entity and is pursuing other endeavors.
  - Tenoke 7y ago
    Are all your execs now spreading misinformation in random HN threads? Was your CEO not enough? Making it sound like Mark Karpeles had no real association with PIA is disingenuous. > However, Mark never had an operational role in PIA and subsequently never had access to any part of the PIA infrastructure nor any role in the planning or execution of the day-to-day operations of PIA. You say this yet PIA says diferent in your official statement > Specifically, as many have wondered, he is working as the global CTO across LTM, reviewing technical architecture from an efficiency and security perspective and providing advice and guidance. https://www.privateinternetaccess.com/blog/2018/04/why-i-hired-mt-gox-ex-ceo-mark-karpeles-as-cto-of-london-trust-media/ https://www.privateinternetaccess.com/blog/2018/04/why-i-hir... Sure, maybe it's the parent company but based on how they were structured it seems likely that the CTO of LTM had a lot of influence. Moreover, he was hired as a CTO somewhere by the same people making the big decision at PIA.. Also we can look through your CEO's comments from 2 weeks about Mark. E.g. >You don’t know a person until you see them in the toughest of situations. Mark is a good man and a great developer who fought on the front lines and I’ve known for a long time. https://news.ycombinator.com/item?id=21684155 https://news.ycombinator.com/item?id=21684155 Seems like he trusts him.
- ghostpepper 7y ago
  This does seem conveniently timed, right after the controversy of a few weeks ago has died down. Hopefully wireguard will be accepted into the mainline kernel soon and it will become much easier for people to run their own VPNs. I will not be using PIA for the remainder of my subscription, and won't be renewing it. Previous discussion here: https://news.ycombinator.com/item?id=21679682 https://news.ycombinator.com/item?id=21679682
  - Tenoke 7y ago
    This looks like a PR move after their really bad recent press. Open Sourcing is just seen as easy guaranteed good PR even if it is just something less important (client).
  - Gustomaximus 7y ago
    I wonder more than coincidence if users started haemorrhaging. I turned of auto-renewal the day I saw that announcement and will be looking for a new VPN in ~4 months or so. Given most people with VPN's are likely privacy conscious, seems amazing a good percentage wont be doing the same given the groups reputation that took over.
  - charwalker 7y ago
    Same, moved to Windscribe but was torn between them and Mulvad. PIA lost me and they won't bring me back short of a full refund of my existing sub with them and with Windscribe. But I'd just take the money and move on anyway.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
stoicShell 7y ago
> We have begun reaching out to external auditors and, in tandem, are opening up our operations to review by our users. This allows you to verify with your own eyes, whenever you want. WYSIWYG. Technical side: color me very curious about that "our users" part. I can't wait to see what it entails. Business side: bold move, it may prove to be a blue-ocean-like strategy, if substantiated. Interesting. ____ Some rambling about access, transparency and "open"-things Most people don't know that under the terms of most democracies, in principle, any citizen has the right to go to any public office and request basically anything non-classified: documents, accounts, etc. The idea being that the State is but the expression of the sovereignty of the People. Obviously, no one believes for one minute that any 'normal' citizen will be granted access to most things. It's just an artefact of idealism you hear in law classes and political activism circles I suppose (and it's grey-ish-ly somewhat applicable at the lowest, local level). It would be interesting to see a new breed of "open-sourced" businesses granting access to customers (like States would to citizens), businesses whose value resides not in secret sauce — things like accounting, plumbing or VPN are probably "solved" matters of public knowledge. Because they can afford almost total transparency, they may as well weaponize it against rivals who can't — or won't. In markets where trust is anywhere from high-value to mission critical, this might just open wide a whole new blue ocean.
- LegitShady 7y ago
  Their business basically hinges on earning back the trust of their customers before the current subscriptions run out. Having their own vpn applications put them in advantageous position when they were trusted but now its a liability. I don't see it as weaponizing so much as turning the liability into a trust buyback.
  - dx87 7y ago
    I wonder if they knew they'd get the negative reception, and that's why they offered a discount on multi-year subscriptions earlier this year. I bought a multi-year contract before they raised their monthly price, and from what I've seen on their subreddit, so did a lot of other people.
- 7y ago
gruez 7y ago
>Verifiable Zero Access: Start! – We’re building an internal roadmap to create a transparent and verifiable infrastructure, in which no one, including ourselves, is permitted access to the servers through which VPN traffic flows. We will keep you abreast of all progress, and moreover, this will be a community-led effort. Verifiable Zero Access proves that we cannot log or monitor your traffic. Is this going to be "nobody can access it because we locked ourselves out (trust us)", or some sort of trusted computing solution that's cryptographically verifiable?
- AlexCoventry 7y ago
  I've heard it's possible to set something like that up on AWS, but of course Amazon could still access it.
  - rufius 7y ago
    That depends. If it’s “bring your own key” then there’s nothing they can do. That said - I’m not familiar enough with how they’d build that infra at scale to make it cost effective.
  - chucky_z 7y ago
    I set this up to force myself to stop SSHing to boxes all the time and trust in my own automation. It took some effort and setup is frustrating but it ended up being a net positive. I baked everything with Ansible and did last touch setup with user-data, and deployed it all with Terraform.
    - deleted 7y ago
      [deleted]
  - vorpalhex 7y ago
    I've built a system like this recently for a payments platform. Access _is_ possible but requires rebuilding the environment (and thus blowing everything away) as well as admin access.
fouc 7y ago
I remember taking a peek at the internal files of the PIA app in Mac back in 2013 and it looked like it was mainly ruby based? I guess it isn't anymore.
- danieloaks 7y ago
  Yeah moved away from Ruby a while back. Took a little while to stabilise but the new app is a lot better these days.
  - acodes 7y ago
    A wild D.O appears. Fun watching all this PIA stuff being discussed on HA.
yellow_lead 7y ago
> Open Sourcing the PIA Clients Love this trend of privacy companies open sourcing clients and not servers. (sarcasm)
- dastx 7y ago
  But the client is all that matters. If the client doesn't send them your IP address, there is no way for them to track you in any way, shape or form. Their servers would implode if they tried. It's impossible. Your system is private. Now be quiet and keep paying them. In case it needs to be said, that's all sarcasm.
  - johnpowell 7y ago
    If your IP was never sent wouldn't it be impossible for them to send you back the information you requested? edit :: I think I replied to comment that has been edited between when I hit "reply" and when my comment appeared.
    - 55555 7y ago
      Yes. This is why IP spoofing is useless for most anything two-way.
      - johnpowell 7y ago
        Blockchain could probably solve that problem..
    - penagwin 7y ago
      You is correct, he was being sarcastic I guess
    - Johnny555 7y ago
      There's an easy technical solution to that, you can just use a VPN service to hide your IP.... when you connect to your VPN service. It's VPN's all the way down... I'm mostly joking, but if you purchase the second VPN anonymously (gift card paid with cash, bitcoin, etc) this would do a pretty good job of ensuring your anonymity against most casual snooping. It's not going to hide you from the FBI, but it would prevent either VPN provider from tying your browsing activity back to you (unless they cooperate with each other).
knolax 7y ago
> Random Audited Truths (I smell a rat!) – We have begun reaching out to external auditors and, in tandem, are opening up our operations to review by our users. This allows you to verify with your own eyes, whenever you want. WYSIWYG. What if this gets used as cover to help exfiltrate data to their new parent company/third parties.
Havoc 7y ago
That sounds like an impossible promise. I wish them the best pulling it off though - would be amazing (and instantly copied) Worth pointing out that PIA is openvpn compatible so you don't need their client
- jordigh 7y ago
  > Worth pointing out that PIA is openvpn compatible so you don't need their client Yeah, I was wondering about this. If you don't trust their client... don't use it? They've always been quite forthcoming on how to connect via OpenVPN.
- magduf 7y ago
  >Worth pointing out that PIA is openvpn compatible so you don't need their client Are other VPN services not like this? How are you supposed to connect with Linux then? Any why would anyone who cares about privacy want to use a proprietary closed-source client?
etaioinshrdlu 7y ago
The same day the Orchid project launches, no less... https://www.orchid.com/ https://www.orchid.com/
- aldoushuxley001 7y ago
  so, what's the long and short on this project?
  - etaioinshrdlu 7y ago
    Decentralized, crypto token based network. Kind of like Tor with monetary incentives. It's a new internet! https://youtu.be/0dJPY50lpZA https://youtu.be/0dJPY50lpZA Discussed earlier... https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457
    - mirimir 7y ago
      Yeah, but the email I got said you need to buy OXT via Coinbase. And last I knew, Coinbase implements KYC. But maybe anonymous exchanges will start handling it. Edit: OK, I see that it says "...and elsewhere." So I'll wait and see how it goes. I'll need some way to get OXT from Bitcoin. And damn, it doesn't help that OXT also means the "Open Exploration Tool" for tracking Bitcoin.
      - somebodythere 7y ago
        It's an ERC20, which means they're generally tradable on uniswap.exchange (and this one is).
        mirimir 7y ago
        OK, thanks. I have a very picky Firefox config in this VM, and it loads just a blank page for https://uniswap.exchange/ https://uniswap.exchange/. However I did find https://masterthecrypto.com/uniswap/ https://masterthecrypto.com/uniswap/ so I could try it with Chrome. But not in this VM. So that gets me from ETH to OXT. Now I just need a way from BTC to ETH. And it's gotta be one that doesn't implement KYC. I will have nothing to do with that bullshit.
deleted 7y ago
[deleted]
mberning 7y ago
These guys sponsor the street beefs channel on youtube. I find the company and their guerrilla tactics fascinating.
CivBase 7y ago
> We encourage everyone NOT to trust, but instead, to verify. I love this. I also don't know how you could possibly make it work. > We’re building an internal roadmap... Keyword: Roadmap Translation: We haven't started on this, but it's something we think we want to do so we're going to start talking about it. > ...to create a transparent and verifiable infrastructure... How is a user supposed to verify the infrastructure? Do you mean you're going to hire a third-party auditor and ask users to trust their verification? I mean, that's better than nothing but it doesn't exactly enable everyone "not to trust, but instead, verify." In this scenario, the auditor is the only one doing the verification. > ...in which no one, including ourselves, is permitted access to the servers through which VPN traffic flows. Then how do you deploy the servers in the first place? How do you identify and handle hardware and software failures? How are you defining "access" such that this idea is possible?
- mirimir 7y ago
  It's not at all a new idea. Cryptohippie has been claiming something like this for over a decade.[0] > Cryptohippie USA, Inc. provides access to the Cryptohippie network, which is anonymous, thoroughly protected and globally distributed. This network creates anonymity and gives you very private access to standard Internet destinations. > Cryptohippie is unique: we don't require you to trust a single entity for your privacy. Our sales and network are run by separate companies in different jurisdictions. The sales company never sees network traffic and the network company never sees sales data. The network provider being Cryptohippie Inc., Panama.[1] And one of their services is "Anonymous Admin".[2] > System administrators are prime targets for blackmail, corruption and outside force, and are in a central position to undermine your communication and data security. > Cryptohippie Inc. operates an Anonymous Administrator pool that can be utilized to oversee critical enterprise infrastructure or administer highly sensitive information resources. > Anonymous Administrators can not be targeted by third parties. Not even Cryptohippie Inc. can give away their personal information or identity which could put them at risk of under force. > Using auditing and concurrent peer review processes, Anonymous Administrators are under your control and the risk of them becoming insider attackers is greatly reduced. > Only carefully tested, hand-picked specialists with a long standing relationship with Cryptohippie Inc. are available for client work. > Please be advised that Cryptohippie Inc. only facilitates the contact to the pool of administrators and helps with setting up processes for communication, auditing and payment escrow. We will not know what specific administrator works for your organization or what tasks you delegate to them. However, in case of conflict, we will mediate/arbitrate upon request. The argument, I gather, is that substantive acts require consensus of multiple anonymous admins. So rogue admins are not so much an issue. But still, as you say, how can users trust any of that? So yes, there is no "verify". That's why I recommend nested VPN chains. You just need to trust that most of the VPN services in your chain are not working together for an adversary. 0) https://secure.cryptohippie.com/products.php https://secure.cryptohippie.com/products.php 1) http://www.cryptohippie.net/ http://www.cryptohippie.net/ 2) http://www.cryptohippie.net/AnonAdmin.html http://www.cryptohippie.net/AnonAdmin.html Edit: About that "over a decade" comment, here's a snapshot from 2008: https://web.archive.org/web/20081006023454/http://cryptohippie.net/ https://web.archive.org/web/20081006023454/http://cryptohipp...
badrabbit 7y ago
Incorporate in a country that has severe legal liability for breaking your word such as switzerland or sweden(currently UK) and then we'll see. Short of granting access to their hosting/IAM account how can I verify if something else other than the VPN terminator can access traffic logs? This raises even more eyebrows for me, I hope they back this up some serious crypto,architectural design and audit goals/reqs. Even in AWS where a commenter said something like this is possibble, your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details. Ooh this feels like such a smoke and mirrors show! Will they also be adding this design change to freenode irc servers? A VPN company takes over the largest irc network,for what profit? Freenode was already advertising PIA like crazy. And now getting cozy with a for-profit malware(read crimeware) operation related org that had since corrected their old ways? Please prove exactly how you can guarantee mosconfigirations, previously unknown bugs,KVM console access(or iLO) can't be used to impant very useful backdoor? Linux servers? Yeah...if it was me I'll deploy the verifiable server, get kvm/iLO and at the next scheduled reboot edit the grub menu and set init=/bin/sh,mount the main fs as root ,implant any undetectable changes and reboot. If you want to regain trust do it in a way that either makes you criminally liable or a civil contract that states all company assets,funds,profit and personal assets/wealth of all involved owners will be redistributed to all unassociated customers and users (even free users and random freenode users) if you violate your promise to not log traffic in any way including Layer 3/4 logs, store logs that are correlations and transcriptions of observed user or traffic events, or interfere with traffic in anyway, or if any founders or associates have any ties at all with the UK government,GCHQ or any governmental body or person at all. And if you can also clearly "open source" youd revenue streams compleley and disclose any current or planned means to profit as well as promise to disclose any future talks and plans of this nature promptly then I think most of the allegations will lose ground in your favor.
- jlgaddis 7y ago
  > * your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.* Yep, and you can learn a lot about what your users are doing by capturing Netflow data from the (router|switch) the VPN server is connected to. I've never tried but I imagine that with enough data (traffic) in your dataset, it might even be possible to get a pretty good idea of which (de/un)encrypted traffic flows correspond to which users.
sudoaza 7y ago
I've been thinking for a while that is in VPNs own interest to do cross-audits of no-log policy between VPN providers.
Astropop 7y ago
This is a really awesome move by PIA. I have been waiting for them to open source for a while, so that's a good sign that this acquisition might actually be a good thing. How are you planning to choose auditors? Has anyone already agreed to be an auditor?
- deleted 7y ago
  [deleted]
3leggedcatman 7y ago
I thought it rather odd that Pakistan International Airlines would make their software open-source, so I clicked on the link and found out that PIA was something else entirely. Every time this happens to me I think of Ted Nelson. Sigh.
- jlgaddis 7y ago
  You could avoid this by looking at the domain name shown immediately after the link text, I suppose.
  - 3leggedcatman 7y ago
    I stand corrected.
JumpCrisscross 7y ago
Switched to Mullvad [0] after PIA was bought by a malware distributor [1][2] and hired Mark Karpeles as their CTO [3]. The network is faster. Wirecutter recommends them [4]. If you want it, the Mac app is stable and just works. And they support both OpenVPN and WireGuard. [0] https://mullvad.net/en/ https://mullvad.net/en/ [1] https://torrentfreak.com/private-internet-access-to-be-acquired-by-kape/ https://torrentfreak.com/private-internet-access-to-be-acqui... [2] https://restoreprivacy.com/cyberghost/ https://restoreprivacy.com/cyberghost/ [3] https://www.engadget.com/2018/04/22/mt-gox-chief-returns-as-cto-of-vpn-giant/ https://www.engadget.com/2018/04/22/mt-gox-chief-returns-as-... [4] https://thewirecutter.com/reviews/best-vpn-service/ https://thewirecutter.com/reviews/best-vpn-service/
- freehunter 7y ago
  Any reason not to recommend TunnelBear, which is Wirecutter's #1 recommendation? I don't use either of them so I don't have a horse in this race, just curious why you picked the #2 recommendation and not the #1.
  - mosselman 7y ago
    Country of origin maybe?
  - JumpCrisscross 7y ago
    No strong reason. Both good candidates, and both are better than PIA. I liked the e-mail-free sign-up and WireGuard support. It also seems marketed to moderately-technical users (setting up WireGuard on iOS is trivial). That makes it less likely to get acquired by scammers.
  - minxomat 7y ago
    TB was acquired by McAfee, if you trust them then good luck.
  - q-base 7y ago
    If you are into torrenting then they won't be good match either.
neurostimulant 7y ago
PIA Android client seems to be developed from a fork of OpenVPN Client for Android (ics-openvpn) [1] which is gpl-licensed. The About screen contains a link to the source code hosted on an S3 bucket [2] but it doesn't seem to be publicly accessible. Interestingly, despite being gpl-licensed, ics-openvpn seem to be commonly forked by commercial vpn companies to develop their own closed-sourced Android vpn client. The author is aware of this and post a faq [3] out of frustration. [1] https://github.com/schwabe/ics-openvpn https://github.com/schwabe/ics-openvpn [2] https://s3.amazonaws.com/privateinternetaccess/sources/android-v10464.zip https://s3.amazonaws.com/privateinternetaccess/sources/andro... [3] https://github.com/schwabe/ics-openvpn/blob/master/doc/README.txt https://github.com/schwabe/ics-openvpn/blob/master/doc/READM...
throwawaymanbot 7y ago
No great thing having a VPN thats solid, but the company can inject Items in to your traffic. (Which the parent company did before?)

281 points by rasengan 7y ago

Interesting. Worth following the development on this one.

Wasn't PIA bought by an offshoot from a shady malware producing company called Kape? Isn't PIA's new CTO Mark Karpeles, one of the ringleaders of the Mt. Gox debacle, who stole millions of dollars and was convicted for it in Japan? Nothing says safety like malware and fellons in your VPN provider. Reddit thread with a decent timeline of events: https://www.reddit.com/r/PrivateInternetAccess/comments/e9fo3l/questionable_decisions/ https://www.reddit.com/r/PrivateInternetAccess/comments/e9fo...

ShorsHammer 7y ago
As a r/buttcoin regular I couldn't help but chuckle loudly in the office here reading this. Had to double check and laughed even more. The utter absurdity of it all. He actually seems like a decent guy who got in well over his head and did prison time for it in Japan, but as the saying goes "all publicity is good publicity", you literally can't do wrong in the corporate world. Patiently waiting for Elizabeth Holmes next endeavour.
- craftinator 7y ago
  I may have been laying it on a little thick, but honestly, letting him become CTO of a major VPN provider... A whole sea of capable, professional tech leaders out there, and they choose a blockchain enthusiast with a criminal record and a history of incapability. I get the feeling that Kape wants someone in charge who won't say no to shady practices.
  - Cauchon 7y ago
    I get where you’re coming from. If I’m going to choose one VPN company to use, it won’t be one with him as CTO.
    - ShorsHammer 7y ago
      Exactly. It's almost like they are trying to filter out anyone with sense.
Freeboots 7y ago
Hah, I hadn't realized Karpeles was involved. That's a pretty wild CTO choice. After all that's happened, going open source is pretty much their only option.
- craftinator 7y ago
  I can see how they can open source their client side applications, and I guess they can open source their server code, but I can't wrap my head around how we can verify what exactly they are running on their servers. Like, can we ssh into them with root access and poke around running processes? I just don't get it. Anyone have a clue how else that kind of verification can happen?
  - blibble 7y ago
    it's not possible and even if it was they could just configure their switches to mirror ports to send the traffic somewhere else for logging this entire thing is snake oil designed to fool people that don't know any better trust is earnt... and PIA hired Mark Karpeles, put him in charge of technology then later sold out to a malware firm if you insist on having a VPN: there's plenty of other firms that don't have these "attributes"
    - voisin 7y ago
      What alternatives do you suggest? I just cancelled my PIA subscription and am in the market.
      - majewsky 7y ago
        I've heard good things about Mullvad and IPredator, both from Sweden. Generally you want to be looking for VPN providers that don't spend half their revenue on marketing.
      - jcampbell1 7y ago
        I use Mullvad with the standard wireguard clients. Works much better than anything OpenVPN based. They are based in Sweden which seems like a reasonable jurisdiction.
55555 7y ago
The biggest problem I have with this is that Mark Karpeles is, provably, a bad programmer...
- Freeboots 7y ago
  Yeah, it's not just the fraud thing; Karpeles shit the bed on Mtgox multiple times. I actually kind of believe the narrative that it was incompetence more than malice, at least to start with.
almostbasic 7y ago
My name is Chris M and I am the CMO for Private Internet Access. PIA management has prepared the following statement regarding Mark Karpeles’s role at LTMH and we hope it addresses your doubts or concerns: In 2018, Mark Karpeles was appointed CTO of LTMH, which was the parent company of Private Internet Access prior to KAPE. However, Mark never had an operational role in PIA and subsequently never had access to any part of the PIA infrastructure nor any role in the planning or execution of the day-to-day operations of PIA. The role of CTO at PIA has been run collectively by Tommie P. (SvP Software, joined January 2017) handling the software development side and Gaurav G. (CIO, joined January 2015) handling the operational and infrastructure side of the business. Mark’s role at LTMH has predominantly been to manage development teams working on FutureFC, general R&D, and providing a broader perspective of the industry as a whole rather than PIA specific issues. His work is best summarized as a valued external consultant for specific discussions related to the advancement of our privacy and security efforts. As part of the merger with KAPE to become Private Internet, Mark currently has no operational role in the merged entity and is pursuing other endeavors.
- Tenoke 7y ago
  Are all your execs now spreading misinformation in random HN threads? Was your CEO not enough? Making it sound like Mark Karpeles had no real association with PIA is disingenuous. > However, Mark never had an operational role in PIA and subsequently never had access to any part of the PIA infrastructure nor any role in the planning or execution of the day-to-day operations of PIA. You say this yet PIA says diferent in your official statement > Specifically, as many have wondered, he is working as the global CTO across LTM, reviewing technical architecture from an efficiency and security perspective and providing advice and guidance. https://www.privateinternetaccess.com/blog/2018/04/why-i-hired-mt-gox-ex-ceo-mark-karpeles-as-cto-of-london-trust-media/ https://www.privateinternetaccess.com/blog/2018/04/why-i-hir... Sure, maybe it's the parent company but based on how they were structured it seems likely that the CTO of LTM had a lot of influence. Moreover, he was hired as a CTO somewhere by the same people making the big decision at PIA.. Also we can look through your CEO's comments from 2 weeks about Mark. E.g. >You don’t know a person until you see them in the toughest of situations. Mark is a good man and a great developer who fought on the front lines and I’ve known for a long time. https://news.ycombinator.com/item?id=21684155 https://news.ycombinator.com/item?id=21684155 Seems like he trusts him.
ghostpepper 7y ago
This does seem conveniently timed, right after the controversy of a few weeks ago has died down. Hopefully wireguard will be accepted into the mainline kernel soon and it will become much easier for people to run their own VPNs. I will not be using PIA for the remainder of my subscription, and won't be renewing it. Previous discussion here: https://news.ycombinator.com/item?id=21679682 https://news.ycombinator.com/item?id=21679682
- Tenoke 7y ago
  This looks like a PR move after their really bad recent press. Open Sourcing is just seen as easy guaranteed good PR even if it is just something less important (client).
- Gustomaximus 7y ago
  I wonder more than coincidence if users started haemorrhaging. I turned of auto-renewal the day I saw that announcement and will be looking for a new VPN in ~4 months or so. Given most people with VPN's are likely privacy conscious, seems amazing a good percentage wont be doing the same given the groups reputation that took over.
- charwalker 7y ago
  Same, moved to Windscribe but was torn between them and Mulvad. PIA lost me and they won't bring me back short of a full refund of my existing sub with them and with Windscribe. But I'd just take the money and move on anyway.

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

stoicShell 7y ago

> We have begun reaching out to external auditors and, in tandem, are opening up our operations to review by our users. This allows you to verify with your own eyes, whenever you want. WYSIWYG. Technical side: color me very curious about that "our users" part. I can't wait to see what it entails. Business side: bold move, it may prove to be a blue-ocean-like strategy, if substantiated. Interesting. ____ Some rambling about access, transparency and "open"-things Most people don't know that under the terms of most democracies, in principle, any citizen has the right to go to any public office and request basically anything non-classified: documents, accounts, etc. The idea being that the State is but the expression of the sovereignty of the People. Obviously, no one believes for one minute that any 'normal' citizen will be granted access to most things. It's just an artefact of idealism you hear in law classes and political activism circles I suppose (and it's grey-ish-ly somewhat applicable at the lowest, local level). It would be interesting to see a new breed of "open-sourced" businesses granting access to customers (like States would to citizens), businesses whose value resides not in secret sauce — things like accounting, plumbing or VPN are probably "solved" matters of public knowledge. Because they can afford almost total transparency, they may as well weaponize it against rivals who can't — or won't. In markets where trust is anywhere from high-value to mission critical, this might just open wide a whole new blue ocean.

LegitShady 7y ago
Their business basically hinges on earning back the trust of their customers before the current subscriptions run out. Having their own vpn applications put them in advantageous position when they were trusted but now its a liability. I don't see it as weaponizing so much as turning the liability into a trust buyback.
- dx87 7y ago
  I wonder if they knew they'd get the negative reception, and that's why they offered a discount on multi-year subscriptions earlier this year. I bought a multi-year contract before they raised their monthly price, and from what I've seen on their subreddit, so did a lot of other people.
7y ago

gruez 7y ago

>Verifiable Zero Access: Start! – We’re building an internal roadmap to create a transparent and verifiable infrastructure, in which no one, including ourselves, is permitted access to the servers through which VPN traffic flows. We will keep you abreast of all progress, and moreover, this will be a community-led effort. Verifiable Zero Access proves that we cannot log or monitor your traffic. Is this going to be "nobody can access it because we locked ourselves out (trust us)", or some sort of trusted computing solution that's cryptographically verifiable?

AlexCoventry 7y ago
I've heard it's possible to set something like that up on AWS, but of course Amazon could still access it.
- rufius 7y ago
  That depends. If it’s “bring your own key” then there’s nothing they can do. That said - I’m not familiar enough with how they’d build that infra at scale to make it cost effective.
- chucky_z 7y ago
  I set this up to force myself to stop SSHing to boxes all the time and trust in my own automation. It took some effort and setup is frustrating but it ended up being a net positive. I baked everything with Ansible and did last touch setup with user-data, and deployed it all with Terraform.
  - deleted 7y ago
    [deleted]
- vorpalhex 7y ago
  I've built a system like this recently for a payments platform. Access _is_ possible but requires rebuilding the environment (and thus blowing everything away) as well as admin access.

fouc 7y ago

I remember taking a peek at the internal files of the PIA app in Mac back in 2013 and it looked like it was mainly ruby based? I guess it isn't anymore.

danieloaks 7y ago
Yeah moved away from Ruby a while back. Took a little while to stabilise but the new app is a lot better these days.
- acodes 7y ago
  A wild D.O appears. Fun watching all this PIA stuff being discussed on HA.

yellow_lead 7y ago

> Open Sourcing the PIA Clients Love this trend of privacy companies open sourcing clients and not servers. (sarcasm)

dastx 7y ago
But the client is all that matters. If the client doesn't send them your IP address, there is no way for them to track you in any way, shape or form. Their servers would implode if they tried. It's impossible. Your system is private. Now be quiet and keep paying them. In case it needs to be said, that's all sarcasm.
- johnpowell 7y ago
  If your IP was never sent wouldn't it be impossible for them to send you back the information you requested? edit :: I think I replied to comment that has been edited between when I hit "reply" and when my comment appeared.
  - 55555 7y ago
    Yes. This is why IP spoofing is useless for most anything two-way.
    - johnpowell 7y ago
      Blockchain could probably solve that problem..
  - penagwin 7y ago
    You is correct, he was being sarcastic I guess
  - Johnny555 7y ago
    There's an easy technical solution to that, you can just use a VPN service to hide your IP.... when you connect to your VPN service. It's VPN's all the way down... I'm mostly joking, but if you purchase the second VPN anonymously (gift card paid with cash, bitcoin, etc) this would do a pretty good job of ensuring your anonymity against most casual snooping. It's not going to hide you from the FBI, but it would prevent either VPN provider from tying your browsing activity back to you (unless they cooperate with each other).

knolax 7y ago

> Random Audited Truths (I smell a rat!) – We have begun reaching out to external auditors and, in tandem, are opening up our operations to review by our users. This allows you to verify with your own eyes, whenever you want. WYSIWYG. What if this gets used as cover to help exfiltrate data to their new parent company/third parties.

Havoc 7y ago

That sounds like an impossible promise. I wish them the best pulling it off though - would be amazing (and instantly copied) Worth pointing out that PIA is openvpn compatible so you don't need their client

jordigh 7y ago
> Worth pointing out that PIA is openvpn compatible so you don't need their client Yeah, I was wondering about this. If you don't trust their client... don't use it? They've always been quite forthcoming on how to connect via OpenVPN.
magduf 7y ago
>Worth pointing out that PIA is openvpn compatible so you don't need their client Are other VPN services not like this? How are you supposed to connect with Linux then? Any why would anyone who cares about privacy want to use a proprietary closed-source client?

etaioinshrdlu 7y ago

The same day the Orchid project launches, no less... https://www.orchid.com/ https://www.orchid.com/

aldoushuxley001 7y ago
so, what's the long and short on this project?
- etaioinshrdlu 7y ago
  Decentralized, crypto token based network. Kind of like Tor with monetary incentives. It's a new internet! https://youtu.be/0dJPY50lpZA https://youtu.be/0dJPY50lpZA Discussed earlier... https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457
  - mirimir 7y ago
    Yeah, but the email I got said you need to buy OXT via Coinbase. And last I knew, Coinbase implements KYC. But maybe anonymous exchanges will start handling it. Edit: OK, I see that it says "...and elsewhere." So I'll wait and see how it goes. I'll need some way to get OXT from Bitcoin. And damn, it doesn't help that OXT also means the "Open Exploration Tool" for tracking Bitcoin.
    - somebodythere 7y ago
      It's an ERC20, which means they're generally tradable on uniswap.exchange (and this one is).
      - mirimir 7y ago
        OK, thanks. I have a very picky Firefox config in this VM, and it loads just a blank page for https://uniswap.exchange/ https://uniswap.exchange/. However I did find https://masterthecrypto.com/uniswap/ https://masterthecrypto.com/uniswap/ so I could try it with Chrome. But not in this VM. So that gets me from ETH to OXT. Now I just need a way from BTC to ETH. And it's gotta be one that doesn't implement KYC. I will have nothing to do with that bullshit.

deleted 7y ago

[deleted]

mberning 7y ago

These guys sponsor the street beefs channel on youtube. I find the company and their guerrilla tactics fascinating.

CivBase 7y ago

> We encourage everyone NOT to trust, but instead, to verify. I love this. I also don't know how you could possibly make it work. > We’re building an internal roadmap... Keyword: Roadmap Translation: We haven't started on this, but it's something we think we want to do so we're going to start talking about it. > ...to create a transparent and verifiable infrastructure... How is a user supposed to verify the infrastructure? Do you mean you're going to hire a third-party auditor and ask users to trust their verification? I mean, that's better than nothing but it doesn't exactly enable everyone "not to trust, but instead, verify." In this scenario, the auditor is the only one doing the verification. > ...in which no one, including ourselves, is permitted access to the servers through which VPN traffic flows. Then how do you deploy the servers in the first place? How do you identify and handle hardware and software failures? How are you defining "access" such that this idea is possible?

mirimir 7y ago
It's not at all a new idea. Cryptohippie has been claiming something like this for over a decade.[0] > Cryptohippie USA, Inc. provides access to the Cryptohippie network, which is anonymous, thoroughly protected and globally distributed. This network creates anonymity and gives you very private access to standard Internet destinations. > Cryptohippie is unique: we don't require you to trust a single entity for your privacy. Our sales and network are run by separate companies in different jurisdictions. The sales company never sees network traffic and the network company never sees sales data. The network provider being Cryptohippie Inc., Panama.[1] And one of their services is "Anonymous Admin".[2] > System administrators are prime targets for blackmail, corruption and outside force, and are in a central position to undermine your communication and data security. > Cryptohippie Inc. operates an Anonymous Administrator pool that can be utilized to oversee critical enterprise infrastructure or administer highly sensitive information resources. > Anonymous Administrators can not be targeted by third parties. Not even Cryptohippie Inc. can give away their personal information or identity which could put them at risk of under force. > Using auditing and concurrent peer review processes, Anonymous Administrators are under your control and the risk of them becoming insider attackers is greatly reduced. > Only carefully tested, hand-picked specialists with a long standing relationship with Cryptohippie Inc. are available for client work. > Please be advised that Cryptohippie Inc. only facilitates the contact to the pool of administrators and helps with setting up processes for communication, auditing and payment escrow. We will not know what specific administrator works for your organization or what tasks you delegate to them. However, in case of conflict, we will mediate/arbitrate upon request. The argument, I gather, is that substantive acts require consensus of multiple anonymous admins. So rogue admins are not so much an issue. But still, as you say, how can users trust any of that? So yes, there is no "verify". That's why I recommend nested VPN chains. You just need to trust that most of the VPN services in your chain are not working together for an adversary. 0) https://secure.cryptohippie.com/products.php https://secure.cryptohippie.com/products.php 1) http://www.cryptohippie.net/ http://www.cryptohippie.net/ 2) http://www.cryptohippie.net/AnonAdmin.html http://www.cryptohippie.net/AnonAdmin.html Edit: About that "over a decade" comment, here's a snapshot from 2008: https://web.archive.org/web/20081006023454/http://cryptohippie.net/ https://web.archive.org/web/20081006023454/http://cryptohipp...

badrabbit 7y ago

Incorporate in a country that has severe legal liability for breaking your word such as switzerland or sweden(currently UK) and then we'll see. Short of granting access to their hosting/IAM account how can I verify if something else other than the VPN terminator can access traffic logs? This raises even more eyebrows for me, I hope they back this up some serious crypto,architectural design and audit goals/reqs. Even in AWS where a commenter said something like this is possibble, your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details. Ooh this feels like such a smoke and mirrors show! Will they also be adding this design change to freenode irc servers? A VPN company takes over the largest irc network,for what profit? Freenode was already advertising PIA like crazy. And now getting cozy with a for-profit malware(read crimeware) operation related org that had since corrected their old ways? Please prove exactly how you can guarantee mosconfigirations, previously unknown bugs,KVM console access(or iLO) can't be used to impant very useful backdoor? Linux servers? Yeah...if it was me I'll deploy the verifiable server, get kvm/iLO and at the next scheduled reboot edit the grub menu and set init=/bin/sh,mount the main fs as root ,implant any undetectable changes and reboot. If you want to regain trust do it in a way that either makes you criminally liable or a civil contract that states all company assets,funds,profit and personal assets/wealth of all involved owners will be redistributed to all unassociated customers and users (even free users and random freenode users) if you violate your promise to not log traffic in any way including Layer 3/4 logs, store logs that are correlations and transcriptions of observed user or traffic events, or interfere with traffic in anyway, or if any founders or associates have any ties at all with the UK government,GCHQ or any governmental body or person at all. And if you can also clearly "open source" youd revenue streams compleley and disclose any current or planned means to profit as well as promise to disclose any future talks and plans of this nature promptly then I think most of the allegations will lose ground in your favor.

jlgaddis 7y ago
> * your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.* Yep, and you can learn a lot about what your users are doing by capturing Netflow data from the (router|switch) the VPN server is connected to. I've never tried but I imagine that with enough data (traffic) in your dataset, it might even be possible to get a pretty good idea of which (de/un)encrypted traffic flows correspond to which users.

sudoaza 7y ago

I've been thinking for a while that is in VPNs own interest to do cross-audits of no-log policy between VPN providers.

Astropop 7y ago

This is a really awesome move by PIA. I have been waiting for them to open source for a while, so that's a good sign that this acquisition might actually be a good thing. How are you planning to choose auditors? Has anyone already agreed to be an auditor?

deleted 7y ago
[deleted]

3leggedcatman 7y ago

I thought it rather odd that Pakistan International Airlines would make their software open-source, so I clicked on the link and found out that PIA was something else entirely. Every time this happens to me I think of Ted Nelson. Sigh.

jlgaddis 7y ago
You could avoid this by looking at the domain name shown immediately after the link text, I suppose.
- 3leggedcatman 7y ago
  I stand corrected.

JumpCrisscross 7y ago

Switched to Mullvad [0] after PIA was bought by a malware distributor [1][2] and hired Mark Karpeles as their CTO [3]. The network is faster. Wirecutter recommends them [4]. If you want it, the Mac app is stable and just works. And they support both OpenVPN and WireGuard. [0] https://mullvad.net/en/ https://mullvad.net/en/ [1] https://torrentfreak.com/private-internet-access-to-be-acquired-by-kape/ https://torrentfreak.com/private-internet-access-to-be-acqui... [2] https://restoreprivacy.com/cyberghost/ https://restoreprivacy.com/cyberghost/ [3] https://www.engadget.com/2018/04/22/mt-gox-chief-returns-as-cto-of-vpn-giant/ https://www.engadget.com/2018/04/22/mt-gox-chief-returns-as-... [4] https://thewirecutter.com/reviews/best-vpn-service/ https://thewirecutter.com/reviews/best-vpn-service/

freehunter 7y ago
Any reason not to recommend TunnelBear, which is Wirecutter's #1 recommendation? I don't use either of them so I don't have a horse in this race, just curious why you picked the #2 recommendation and not the #1.
- mosselman 7y ago
  Country of origin maybe?
- JumpCrisscross 7y ago
  No strong reason. Both good candidates, and both are better than PIA. I liked the e-mail-free sign-up and WireGuard support. It also seems marketed to moderately-technical users (setting up WireGuard on iOS is trivial). That makes it less likely to get acquired by scammers.
- minxomat 7y ago
  TB was acquired by McAfee, if you trust them then good luck.
- q-base 7y ago
  If you are into torrenting then they won't be good match either.

neurostimulant 7y ago

PIA Android client seems to be developed from a fork of OpenVPN Client for Android (ics-openvpn) [1] which is gpl-licensed. The About screen contains a link to the source code hosted on an S3 bucket [2] but it doesn't seem to be publicly accessible. Interestingly, despite being gpl-licensed, ics-openvpn seem to be commonly forked by commercial vpn companies to develop their own closed-sourced Android vpn client. The author is aware of this and post a faq [3] out of frustration. [1] https://github.com/schwabe/ics-openvpn https://github.com/schwabe/ics-openvpn [2] https://s3.amazonaws.com/privateinternetaccess/sources/android-v10464.zip https://s3.amazonaws.com/privateinternetaccess/sources/andro... [3] https://github.com/schwabe/ics-openvpn/blob/master/doc/README.txt https://github.com/schwabe/ics-openvpn/blob/master/doc/READM...

throwawaymanbot 7y ago

No great thing having a VPN thats solid, but the company can inject Items in to your traffic. (Which the parent company did before?)