3 ms·

Every time the VPN service industry is discussed on HN there is a barrage of comments that use keywords like “honeypot”, “snake oil”, and “shady”. I’m not denyi

by kfreds 6y ago

Every time the VPN service industry is discussed on HN there is a barrage of comments that use keywords like “honeypot”, “snake oil”, and “shady”. I’m not denying that the industry has problems, but in this thread I’d like to focus on how we can improve it. Please tell me - What makes a VPN provider trustworthy, and how do you _know_? Personally I believe a trustworthy provider is _characterized_ by consistent actions that show transparency, honesty, and conscientiousness. Nevertheless, such consistent action doesn’t actually prove trustworthiness. A good VPN honeypot, or reseller of your network traffic, is publicly indistinguishable from a trustworthy one. So what can the users do? What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? What do we need to build? We all recognize that VPN providers are in a great position of power over their users. How do we tilt the scales in the users’ favor? What are _strong_ signals of trustworthiness? Disclosure: I co-founded Mullvad.

maxisme 6y ago
Sorry to go on a tangent (I believe it is word of mouth and actions of the company like you say): What is the deal with Mullvad and Firefox? Are they completely using your services but with their name on it? Would you rather a client directly or through Firefox (bit cheaper now in $ )?
- kfreds 6y ago
  Thank you. To quote https://fpn.firefox.com/vpn https://fpn.firefox.com/vpn - “The VPN is built by Firefox and runs on a global network of servers powered by our partner Mullvad using the WireGuard® protocol.“ Regarding using us directly or through Mozilla, I think both are good options. If you pay directly to us we will put your money to good use. Same goes for Mozilla. And they are not mutually exclusive. You could also sign up directly with us AND set up a monthly donation to Mozilla for Firefox development :)
all_blue_chucks 6y ago
Block all plaintext traffic. Only allow TLS. Be transparent about what you log and what you don't. Publish results of third party audits.
- zelphirkalt 6y ago
  Although paying for an audit could be interpreted as conflict of interest on the auditing side. Perhaps the users should pay for an audit as in "Check this one for us!" Question is, how that could be organized. I guess the user community would have to unite for it andthe VPN provider would need to declare ahead of time, that they are fine with being audited by an independent party, paid by the customers.
  - all_blue_chucks 6y ago
    Reputable auditors care more about maintaining their reputation that pleasing a small client. Obviously nobody would trust an audit by the owner's cousin, but an established cybersecurity firm should be fine regardless of how it is funded.
t-writescode 6y ago
I'll give my opinion on this based on the two VPNs I've used: TunnelBear and Private Internet Access. Yes... LTT pointed me to them. Reason for TunnelBear: independent audit. They had had an audit that went through their system and, at least how I understood it, confirmed what they had said they were doing. Reason for PIA: they had a history of being questioned by authorities and providing nothing - because they had nothing. The latter is why I continue to trust Apple more than Google, too.
vpnwire 6y ago
Thank you for being here and starting this conversation. I've joined several popular VPN services this year in my work on VPN Wire, and Mullvad's signup flow was by far the most enjoyable. Not only because there's no email required (a little disorienting, but very refreshing), but also because, unlike the experience on many of your competitors' sites, I didn't feel pressured to buy/commit every step of the way. User-friendly site design, in other words, is a positive signal. I personally regard audits and pentests as strong positive signals. For example, PwC's audit of NordVPN's no logs policy was a positive for me. As someone in the industry, I'm curious if you feel the same. Open source software and public APIs are very nice to see. > What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? Other than audits, I don't have a good answer to this one. I would love to hear some technical solutions, and hope other people reply! And as an aside, kudos on running a very speedy network :) https://vpnwire.co https://vpnwire.co
- kfreds 6y ago
  Hi! Thanks for the feedback. That’s great to hear. Audits are good and definitely have a place. There’s much more that can be done. I agree open source is also an important one. We’ve tried to identify strong signals of trustworthiness together with a few other services here: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns/ https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns... A technical solution Mullvad is working on is something we call System Transparency. You can read more about that here: https://mullvad.net/blog/2019/6/3/system-transparency-future/ https://mullvad.net/blog/2019/6/3/system-transparency-future...

by kfreds 6y ago

maxisme 6y ago

Sorry to go on a tangent (I believe it is word of mouth and actions of the company like you say): What is the deal with Mullvad and Firefox? Are they completely using your services but with their name on it? Would you rather a client directly or through Firefox (bit cheaper now in $ )?

kfreds 6y ago
Thank you. To quote https://fpn.firefox.com/vpn https://fpn.firefox.com/vpn - “The VPN is built by Firefox and runs on a global network of servers powered by our partner Mullvad using the WireGuard® protocol.“ Regarding using us directly or through Mozilla, I think both are good options. If you pay directly to us we will put your money to good use. Same goes for Mozilla. And they are not mutually exclusive. You could also sign up directly with us AND set up a monthly donation to Mozilla for Firefox development :)

all_blue_chucks 6y ago

Block all plaintext traffic. Only allow TLS. Be transparent about what you log and what you don't. Publish results of third party audits.

zelphirkalt 6y ago
Although paying for an audit could be interpreted as conflict of interest on the auditing side. Perhaps the users should pay for an audit as in "Check this one for us!" Question is, how that could be organized. I guess the user community would have to unite for it andthe VPN provider would need to declare ahead of time, that they are fine with being audited by an independent party, paid by the customers.
- all_blue_chucks 6y ago
  Reputable auditors care more about maintaining their reputation that pleasing a small client. Obviously nobody would trust an audit by the owner's cousin, but an established cybersecurity firm should be fine regardless of how it is funded.

t-writescode 6y ago

I'll give my opinion on this based on the two VPNs I've used: TunnelBear and Private Internet Access. Yes... LTT pointed me to them. Reason for TunnelBear: independent audit. They had had an audit that went through their system and, at least how I understood it, confirmed what they had said they were doing. Reason for PIA: they had a history of being questioned by authorities and providing nothing - because they had nothing. The latter is why I continue to trust Apple more than Google, too.

vpnwire 6y ago

Thank you for being here and starting this conversation. I've joined several popular VPN services this year in my work on VPN Wire, and Mullvad's signup flow was by far the most enjoyable. Not only because there's no email required (a little disorienting, but very refreshing), but also because, unlike the experience on many of your competitors' sites, I didn't feel pressured to buy/commit every step of the way. User-friendly site design, in other words, is a positive signal. I personally regard audits and pentests as strong positive signals. For example, PwC's audit of NordVPN's no logs policy was a positive for me. As someone in the industry, I'm curious if you feel the same. Open source software and public APIs are very nice to see. > What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? Other than audits, I don't have a good answer to this one. I would love to hear some technical solutions, and hope other people reply! And as an aside, kudos on running a very speedy network :) https://vpnwire.co https://vpnwire.co

kfreds 6y ago
Hi! Thanks for the feedback. That’s great to hear. Audits are good and definitely have a place. There’s much more that can be done. I agree open source is also an important one. We’ve tried to identify strong signals of trustworthiness together with a few other services here: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns/ https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns... A technical solution Mullvad is working on is something we call System Transparency. You can read more about that here: https://mullvad.net/blog/2019/6/3/system-transparency-future/ https://mullvad.net/blog/2019/6/3/system-transparency-future...