3 ms·
Block all plaintext traffic. Only allow TLS. Be transparent about what you log and what you don't. Publish results of third party audits.
by all_blue_chucks 6y ago
Block all plaintext traffic. Only allow TLS. Be transparent about what you log and what you don't. Publish results of third party audits.
- zelphirkalt 6y agoAlthough paying for an audit could be interpreted as conflict of interest on the auditing side. Perhaps the users should pay for an audit as in "Check this one for us!" Question is, how that could be organized. I guess the user community would have to unite for it andthe VPN provider would need to declare ahead of time, that they are fine with being audited by an independent party, paid by the customers.
- all_blue_chucks 6y agoReputable auditors care more about maintaining their reputation that pleasing a small client. Obviously nobody would trust an audit by the owner's cousin, but an established cybersecurity firm should be fine regardless of how it is funded.