3 ms·
Incorporate in a country that has severe legal liability for breaking your word such as switzerland or sweden(currently UK) and then we'll see. Short of grantin
by badrabbit 7y ago
Incorporate in a country that has severe legal liability for breaking your word such as switzerland or sweden(currently UK) and then we'll see. Short of granting access to their hosting/IAM account how can I verify if something else other than the VPN terminator can access traffic logs?
This raises even more eyebrows for me, I hope they back this up some serious crypto,architectural design and audit goals/reqs. Even in AWS where a commenter said something like this is possibble, your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.
Ooh this feels like such a smoke and mirrors show! Will they also be adding this design change to freenode irc servers?
A VPN company takes over the largest irc network,for what profit? Freenode was already advertising PIA like crazy. And now getting cozy with a for-profit malware(read crimeware) operation related org that had since corrected their old ways?
Please prove exactly how you can guarantee mosconfigirations, previously unknown bugs,KVM console access(or iLO) can't be used to impant very useful backdoor?
Linux servers? Yeah...if it was me I'll deploy the verifiable server, get kvm/iLO and at the next scheduled reboot edit the grub menu and set init=/bin/sh,mount the main fs as root ,implant any undetectable changes and reboot.
If you want to regain trust do it in a way that either makes you criminally liable or a civil contract that states all company assets,funds,profit and personal assets/wealth of all involved owners will be redistributed to all unassociated customers and users (even free users and random freenode users) if you violate your promise to not log traffic in any way including Layer 3/4 logs, store logs that are correlations and transcriptions of observed user or traffic events, or interfere with traffic in anyway, or if any founders or associates have any ties at all with the UK government,GCHQ or any governmental body or person at all. And if you can also clearly "open source" youd revenue streams compleley and disclose any current or planned means to profit as well as promise to disclose any future talks and plans of this nature promptly then I think most of the allegations will lose ground in your favor.
- jlgaddis 7y ago> * your LBs and vpc/cloudtrail like logs can still contain traffic and related metadata details.* Yep, and you can learn a lot about what your users are doing by capturing Netflow data from the (router|switch) the VPN server is connected to. I've never tried but I imagine that with enough data (traffic) in your dataset, it might even be possible to get a pretty good idea of which (de/un)encrypted traffic flows correspond to which users.