7 ms·

All ProtonVPN apps are now open source and audited

216 points by BafS 7y ago

tmikaeld 7y ago
Client apps are open sourced, doesn't mention the server code. Great step in the right direction in any case.
- zenlot 7y ago
  Server side is owned by Tesonet and used for marketing. This open source move is just a smoke. All they're doing is selling your data via Tesonet.
  - LeoPanthera 7y ago
    > All they're doing is selling your info via Tesonet. [Citation needed]
    - protonmail 7y ago
      It's a false claim and pretty easy to verify. All our IPs are public info and can be checked. ProtonVPN was also audited by both Mozilla and the European Commission (and also partially financed by the EU). Not to mention it would be a huge GDPR violation and as a Swiss company that does business in the EU, we're obliged to adhere to GDPR. We also can't dodge our GDPR responsibility since our management team are well-known public figures (former CERN scientists with extensive peer-reviewed publication histories). More info here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/
      - jacekm 7y ago
        Actually I was always curious how their CERN work was related to cryptography and security. Would you mind posting a list of their publications please?
    - zenlot 7y ago
      Search around here for Tesonet in hn.algolia.com and you'll see. Plenty other forums too.
- mendelmaleh 7y ago
  Even if they released the server code, how would you verify that it is actually what is used in production, and if there is any other middleware etc...
GlitchMr 7y ago
> We’re happy to be the first VPN provider to open source apps on all platforms (Windows, macOS, Android, and iOS) and undergo an independent security audit. I believe Mullvad did that first. Both security audit and providing an open source application for Windows, Linux, macOS, Android and iOS. Of course, it's nice and all, a step in right direction, but they shouldn't claim they were first when they weren't.
- lame-robot-hoax 7y ago
  I think they may be claiming this, because technically Mullvad doesn’t have an iOS app, and their Android app is still in beta and recently released, and doesn’t have an audit done. Mullvad has had their Windows and Linux apps audited (which were all they offered at that time).
  - vinniejames 7y ago
    Depends on the definition of "all platforms" By strict definition, none have ALL platforms covered
    - lame-robot-hoax 7y ago
      All major* platforms.
  - eptcyka 7y ago
    If you check their git repository, it smells like there's an iOS app cooking.
- secfirstmd 7y ago
  As far as I know Psiphon3 did it first in 2014? https://psiphon.ca/assets/Psiphon-3-iSEC-Partners-v1.1-08-2014.pdf https://psiphon.ca/assets/Psiphon-3-iSEC-Partners-v1.1-08-20...
LegitShady 7y ago
Proton unfortunately has poor speeds where I live or I would consider them. It comes with proton email too...
- citilife 7y ago
  With ProtonVPN I've been able to hit 500-1000Mb/s easily on a regular basis. Perhaps your internet provider are blocking / throttling you?
  - Youden 7y ago
    The internet is a complicated beast. When ISPs connect to each other (e.g. Proton VPN to Comcast), they can't always directly reach each other so they have to go through intermediate networks to make it work. Sometimes there's congestion in those networks or a faulty switch or any number of things. ISPs that allow VPN providers tend to be some of the worst ISPs around (i.e. they're able to reach very little of the internet themselves), so when you see bad performance it's quite possible for it to be the VPN's ISP that's the problem, rather than your ISP. For example I have FTTH from a great ISP. Not only do they have one of the most extensive networks available in my country but they've also been happy to add direct peering to providers that I've asked for in the past. I'm easily able to saturate my gigabit connection to most of the world, even across the Atlantic. When I tried to connect to a VPN server in a city ~5km away resulted in a path traversing 3 different countries and about 5 different networks, resulting in pretty abysmal bandwidth and latency.
  - LegitShady 7y ago
    On other Vpns I can max out my 300mbit linen. On proton I can get about 50mbit. Functional but wastes 5/6ths of my capabilities.
prophesi 7y ago
This isn't revolutionary, or did we forget that OpenVPN (and when it's easier to use: Wireguard) is a thing? Well-audited, open-source, cross-platform, and most VPN providers offer an .ovpn config.
- maze-le 7y ago
  Not everyone has the resources or inclination to learn how to setup and maintain their own vpn servers. If they are only a single user on that machine, the anonymity of the service is also compromised. ---- That being said: Everyone who has the inclination should absolutely give it a try!
  - prophesi 7y ago
    I think you're confused. OpenVPN is both the server and the client. I'm arguing that you can simply download an OpenVPN client, get the .ovpn config from your VPN provider, and you're good to go. To clarify: VPN Providers are running their own OpenVPN servers, and this is likely what their apps are connecting to in the first place. This is why most of them offer .ovpn configs for you to use in your OpenVPN client.
    - maze-le 7y ago
      Ahh OK... well yes, that makes way more sense. I think it's a matter of convenience, its far simpler to download an app and let it "do its stuff" than to find a suitable client and feed it the correct config. What you describe is also a good setup. Good if you don't trust your VPN provider to deliver a secure app -- a level of trust that cannot always be assumed.
      - prophesi 7y ago
        Yeah, that's definitely fair. Figuring out how to import a config file can be enough friction. And you certainly wouldn't be able to easily switch which server the app is connecting to, which a VPN provider's app will have a slick UI for.
- 7y ago
trackofalljades 7y ago
This is a very good move on their part, and they have a great no-logs policy, but they do still restrict p2p in some countries which is a bummer for some potential users.
- freeAgent 7y ago
  I believe that move is more of a CYA to prevent clashes with the legal system in those countries which could result in fines, being unable to operate servers there at all, etc.
mikece 7y ago
I think they were planning to do this but accelerated efforts when PIA was acquired. I'll keep using PIA until my subscription runs out but will more than likely switch to ProtonVPN at that point.
- flatiron 7y ago
  Same here. I just use PIA tot torrent. Nobody cares about me. And I like their port forwarding api. Most other providers I need to log in every week or two and reset it up.
- krn 7y ago
  Mullvad has been open-source for a long time now[1], and unlike ProtonVPN it doesn't ask for an email address or any other personally identifiable information. [1] https://github.com/mullvad/mullvadvpn-app https://github.com/mullvad/mullvadvpn-app
deleted 7y ago
[deleted]
PopeDotNinja 7y ago
I'm a light VPN user, and I've been pretty happy with ProtonVPN's cheapest non-free plan. I will probably renew when my annual subscription is set to expire.
Zaskoda 7y ago
Ah shucks, seems we're all so excited we've crushed them. (web servers timing out)
say_it_as_it_is 7y ago
when are they releasing the perl cgi server?

216 points by BafS 7y ago

tmikaeld 7y ago

Client apps are open sourced, doesn't mention the server code. Great step in the right direction in any case.

zenlot 7y ago
Server side is owned by Tesonet and used for marketing. This open source move is just a smoke. All they're doing is selling your data via Tesonet.
- LeoPanthera 7y ago
  > All they're doing is selling your info via Tesonet. [Citation needed]
  - protonmail 7y ago
    It's a false claim and pretty easy to verify. All our IPs are public info and can be checked. ProtonVPN was also audited by both Mozilla and the European Commission (and also partially financed by the EU). Not to mention it would be a huge GDPR violation and as a Swiss company that does business in the EU, we're obliged to adhere to GDPR. We also can't dodge our GDPR responsibility since our management team are well-known public figures (former CERN scientists with extensive peer-reviewed publication histories). More info here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/
    - jacekm 7y ago
      Actually I was always curious how their CERN work was related to cryptography and security. Would you mind posting a list of their publications please?
  - zenlot 7y ago
    Search around here for Tesonet in hn.algolia.com and you'll see. Plenty other forums too.
mendelmaleh 7y ago
Even if they released the server code, how would you verify that it is actually what is used in production, and if there is any other middleware etc...

GlitchMr 7y ago

> We’re happy to be the first VPN provider to open source apps on all platforms (Windows, macOS, Android, and iOS) and undergo an independent security audit. I believe Mullvad did that first. Both security audit and providing an open source application for Windows, Linux, macOS, Android and iOS. Of course, it's nice and all, a step in right direction, but they shouldn't claim they were first when they weren't.

lame-robot-hoax 7y ago
I think they may be claiming this, because technically Mullvad doesn’t have an iOS app, and their Android app is still in beta and recently released, and doesn’t have an audit done. Mullvad has had their Windows and Linux apps audited (which were all they offered at that time).
- vinniejames 7y ago
  Depends on the definition of "all platforms" By strict definition, none have ALL platforms covered
  - lame-robot-hoax 7y ago
    All major* platforms.
- eptcyka 7y ago
  If you check their git repository, it smells like there's an iOS app cooking.
secfirstmd 7y ago
As far as I know Psiphon3 did it first in 2014? https://psiphon.ca/assets/Psiphon-3-iSEC-Partners-v1.1-08-2014.pdf https://psiphon.ca/assets/Psiphon-3-iSEC-Partners-v1.1-08-20...

LegitShady 7y ago

Proton unfortunately has poor speeds where I live or I would consider them. It comes with proton email too...

citilife 7y ago
With ProtonVPN I've been able to hit 500-1000Mb/s easily on a regular basis. Perhaps your internet provider are blocking / throttling you?
- Youden 7y ago
  The internet is a complicated beast. When ISPs connect to each other (e.g. Proton VPN to Comcast), they can't always directly reach each other so they have to go through intermediate networks to make it work. Sometimes there's congestion in those networks or a faulty switch or any number of things. ISPs that allow VPN providers tend to be some of the worst ISPs around (i.e. they're able to reach very little of the internet themselves), so when you see bad performance it's quite possible for it to be the VPN's ISP that's the problem, rather than your ISP. For example I have FTTH from a great ISP. Not only do they have one of the most extensive networks available in my country but they've also been happy to add direct peering to providers that I've asked for in the past. I'm easily able to saturate my gigabit connection to most of the world, even across the Atlantic. When I tried to connect to a VPN server in a city ~5km away resulted in a path traversing 3 different countries and about 5 different networks, resulting in pretty abysmal bandwidth and latency.
- LegitShady 7y ago
  On other Vpns I can max out my 300mbit linen. On proton I can get about 50mbit. Functional but wastes 5/6ths of my capabilities.

prophesi 7y ago

This isn't revolutionary, or did we forget that OpenVPN (and when it's easier to use: Wireguard) is a thing? Well-audited, open-source, cross-platform, and most VPN providers offer an .ovpn config.

maze-le 7y ago
Not everyone has the resources or inclination to learn how to setup and maintain their own vpn servers. If they are only a single user on that machine, the anonymity of the service is also compromised. ---- That being said: Everyone who has the inclination should absolutely give it a try!
- prophesi 7y ago
  I think you're confused. OpenVPN is both the server and the client. I'm arguing that you can simply download an OpenVPN client, get the .ovpn config from your VPN provider, and you're good to go. To clarify: VPN Providers are running their own OpenVPN servers, and this is likely what their apps are connecting to in the first place. This is why most of them offer .ovpn configs for you to use in your OpenVPN client.
  - maze-le 7y ago
    Ahh OK... well yes, that makes way more sense. I think it's a matter of convenience, its far simpler to download an app and let it "do its stuff" than to find a suitable client and feed it the correct config. What you describe is also a good setup. Good if you don't trust your VPN provider to deliver a secure app -- a level of trust that cannot always be assumed.
    - prophesi 7y ago
      Yeah, that's definitely fair. Figuring out how to import a config file can be enough friction. And you certainly wouldn't be able to easily switch which server the app is connecting to, which a VPN provider's app will have a slick UI for.
7y ago

trackofalljades 7y ago

This is a very good move on their part, and they have a great no-logs policy, but they do still restrict p2p in some countries which is a bummer for some potential users.

freeAgent 7y ago
I believe that move is more of a CYA to prevent clashes with the legal system in those countries which could result in fines, being unable to operate servers there at all, etc.

mikece 7y ago

I think they were planning to do this but accelerated efforts when PIA was acquired. I'll keep using PIA until my subscription runs out but will more than likely switch to ProtonVPN at that point.

flatiron 7y ago
Same here. I just use PIA tot torrent. Nobody cares about me. And I like their port forwarding api. Most other providers I need to log in every week or two and reset it up.
krn 7y ago
Mullvad has been open-source for a long time now[1], and unlike ProtonVPN it doesn't ask for an email address or any other personally identifiable information. [1] https://github.com/mullvad/mullvadvpn-app https://github.com/mullvad/mullvadvpn-app

deleted 7y ago

[deleted]

PopeDotNinja 7y ago

I'm a light VPN user, and I've been pretty happy with ProtonVPN's cheapest non-free plan. I will probably renew when my annual subscription is set to expire.

Zaskoda 7y ago

Ah shucks, seems we're all so excited we've crushed them. (web servers timing out)

say_it_as_it_is 7y ago

when are they releasing the perl cgi server?