24 ms·
UFO VPN claims zero-logs policy, leaks 20M user logs
- notyourwork 6y agoThe old saying trust but verify always seems to come up. Companies claim x and we find it to be untrue. They apologize, share statement they will do better and the cycle continues. Is anyone else tired of the tomfoolery?
- tremon 6y agoDo you have a suggestion on how to verify the claims of a company you only interact with over the Internet? (edit: not that I disagree with you, I honestly don't see a practical way to do that. It's not like security seals have proven their worth in pixels either)
- Enginerrrd 6y agoThe sensible thing to do is to assume a cynical mind. Unfortunately, with stuff like this, you'll probably be more often right then wrong, though you may never find out.
- tintor 6y agoSolution is "credit score"-like system evaluating companies, and keeping track of incidents like these.
- triceratops 6y ago@dang: can the title be changed to "UFO VPN claims zero-logs policy, leaks 20M user logs". So users don't have to click through to the story to find out which firm?
- dang 6y agoOk done. Edit: I also changed the URL from https://www.hackread.com/vpn-firm-zero-logs-policy-leaks-20-million-user-logs/ https://www.hackread.com/vpn-firm-zero-logs-policy-leaks-20-... to what seems to be the original source.
- triceratops 6y agoThanks!
- strombofulous 6y agoCan the title be updated to include the name of the "firm" (article says "Hong Kong-based VPN provider called UFO VPN")? @dang
- ornxka 6y agoI don't know why anybody ever cared about logging policies. How would you even know if they keep logs or don't, or what they do with them if they do?
- jliptzin 6y agoYou can’t possibly know. You have to just assume all VPN companies are logging your activity indefinitely regardless of what they say. Though I suppose you’d rather go with a VPN company that claims it doesn’t do any logging, over one that says it does.
- dhaavi 6y agoExactly. The only way is to make logs useless to begin with. See my comment earlier: https://news.ycombinator.com/edit?id=23881148 https://news.ycombinator.com/edit?id=23881148
- deleted 6y ago[deleted]
- thecleaner 6y agoI think that at this point it is far easier to just setup a socks proxy with an vloud based machine than to research which firms have shady practices and which dont. I went into a womrhole over NordVPN vs PIA vs ProtonVpn and then just went with a proxy server. Costs peanuts with the cloud compute ecosystem.
- gruez 6y ago>then just went with a proxy server. Costs peanuts with the cloud compute ecosystem. The problem with personally operated VPN servers is that all the traffic ties back to a single user: you. This is fine if you're on a malicious network and need secure exit node for your data, but for anonymity (eg. ad tracking, DMCA) it's objectively worse.
- jijji 6y agoif you want a vpn ur better off running squid on a $5/month vps box , less likely this kind of nonsense happens
- grensley 6y agoI wouldn't trust any VPN under China's sphere of influence.
- hangonhn 6y agoThat's actually not an entirely crazy idea if you're trying to hide from Western governments. Are you more worried about the Chinese government coming after you? Likewise, if someone in China is trying to hide from the Chinese government, it might not be a bad idea to use an USA based VPN. Maybe string up a bunch of VPNs in regions that are at least somewhat hostile to each other and it might be too hard to track an IP back to its source. I guess trust no government and use their hostility towards each other to your advantage? Just an idea prompted by your comment.
- messe 6y agoExactly. One really needs to consider their threat model when deciding on a VPN provider. A perfect system isn't always possible.
- grensley 6y agoYeah, it's like banking. You want it to be in a neutral country whose government has come to a clear understanding with the industry.
- maerF0x0 6y ago> That's actually not an entirely crazy idea if... Except that it gives them a direct avenue into your network for their own surveillance and other network attacks ... If you think comcast injecting their own JS into http pages is bad, wait you see what the d̶a̶r̶k̶ ̶a̶r̶m̶y̶ CPC could do with such power...
- vangelis 6y agoWhat's stopping any domestic TLAs from doing the same though?
- 6y ago
- orliesaurus 6y agoWhat's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!
- nullc 6y agoNo such thing. You would be better off renting an inexpensive VPS and running your own VPN on it. Public VPN services have to be the one of the greatest lemon markets to have ever existed: You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get. People realize this, so you end up getting a disproportionate number of customers that don't worry about you getting their data because they're only using the service to behave abusively... which drives up costs. So an honest provider has to deal with dishonest competition selling below cost and a customer base that is saturated with problem customers because good customers are savy enough to avoid VPNs.
- mindslight 6y agoYour proposed alternative does not address the threat model that most people have when looking for a "VPN".
- nullc 6y agoThe threat model you're referring to is, I assume, mostly DMCA warnings. (As in: You want your service to not get disconnected in response to them) It does address it, when you factor in an appropriate choice of non-US VPS provider.
- mindslight 6y agoNot just DMCA warnings, but full extortionary lawsuits. From what I can tell, these exist in most countries. Jurisdiction hopping won't protect you from a determined attacker. Most VPS providers generally insist on recording your identity, probably with government ID, to limit abuse that would otherwise fall onto them. Whereas VPN providers have already made the choice to weather mild abuse complaints. I have looked into bulletproof VPS providers. They're drastic overkill, expensive, and getting in bed with the wrong sorts of people.
- SAI_Peregrinus 6y agoAccording to The Register, UFO VPN is just white-labeleing a parent service[1]. The full list of compromised providers is thus UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. [1] https://www.theregister.com/2020/07/17/ufo_vpn_database/ https://www.theregister.com/2020/07/17/ufo_vpn_database/
- ffpip 6y agoNever buy a VPN with these kinda names. You can tell they are shady from their names and websites. UFO, Secure, Pure VPN, etc
- allarm 6y agoWhich name is better in your opinion? PIA? Nord? Express? All their web sites look alike as well.
- zelphirkalt 6y agoIf some of them are no good and their websites look the same, then is that not a good filter criteria?
- plumeria 6y agoWhat about ProtonVPN?
- merlinscholz 6y agoIMO, this https://www.privacytools.io/providers/vpn/ https://www.privacytools.io/providers/vpn/ is currently one of the best sources on deciding for a VPN provider. Or you could host your own on a cheap VPS. But, there are few reasons to actually use a VPN nowadays, there was a discussion on HN a few days back, but I cannot seem to find it at the moment. Edit: Found it: https://news.ycombinator.com/item?id=23566390 https://news.ycombinator.com/item?id=23566390
- deleted 6y ago[deleted]
- novok 6y agoI've come to the sad realization if you want anything approaching no logs, you're going to have to use something slow like tor, or you're going to have to do the illegal thing and make a botnet. VPNs are only useful for avoiding ISP / local network surveillance like comcast, your workplace, your school, airports, etc and to avoid DCMA scare letters. Making your own with a VPS is worse, since VPSs log on some level and directly forward the DCMA scare letters to you.
- StanislavPetrov 6y agoThey are also very useful for circumnavigating geolocation restrictions.
- solarkraft 6y agoWhat about chaining VPNs? Even at 2 they'd have to cooperate to unmask your traffic, right? Somewhere in the back of my mind is stored that minimaxir does this, but I couldn't confirm it with a quick search. Edit: I was actually thinking of mirimir.
- toyg 6y ago>What about chaining VPNs? You could even do it multiple times, like... 7. You would then be, basically, "behind 7 proxies". /s
- amscanne 6y agoProvider#1 only knows all traffic goes to provider#2. Provider#2 knows everywhere your traffic goes. They don’t know your IP, but you need to login, so they know who you are anyways.
- pbhjpbhj 6y agoI think you need 3 levels. First level gets you to the second level. 2nd gets access to web-based email and bitcoin or single-use credit card payment to get the third level, which accesses data. Obviously you use assumed identity. With only two layers you'd need to access emails, say, for account confirmation direct from your own system; with 3 you put a VPN in that gap. Do VPNs re-pack and modify the timing on packages they pass on to clients? It seems like they're need to if they're too avoid coordination attacks. I'm recalling how a research paper showed an extraordinary high number of pages visited (80%) over HTTPS could be identified using page size alone. If a TLA is watching all traffic into and out of a VPN's server can they pair upstream traffic to downstream clients at all?
- solarkraft 6y agoVPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that). If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).
- llsf 6y agoHow? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.
- dboat 6y agoWon't amazon cancel them when they keep getting copyright letters? Or do vpns have some other use I am not aware of.
- dave5104 6y agoIs your comment implying that VPNs are only used for copyright infringement? Primary use of VPNs I see is to get onto my workplace's network.
- gpm 6y agoSurely your company is not using a consumer provider like NordVPN or this UFO VPN company though?
- flywheel 6y agoI don't know of any company that would be using a public VPN service for anything related to work. Typically "work VPNs" are running on systems that the employer controls, set up by someone employed by the company, and meant solely for employees to connect to - there is no reason any company would want or need to use a public VPN provider for their corporate network VPN. It just doesn't make any sense to me why you would suggest it.
- hdjrkrmfkt 6y agoCan you chain two VPNs?
- bitxbitxbitcoin 6y agoYes you can.
- dhaavi 6y agoWhile you can, this is really hard. Let us do it for you. See my comment earlier: https://news.ycombinator.com/edit?id=23881148 https://news.ycombinator.com/edit?id=23881148
- noxer 6y agohttps://news.ycombinator.com/item?id=21326484 https://news.ycombinator.com/item?id=21326484 still valid
- chmod775 6y agoThis was necessarily going to happen at some point and I hope it serves as a cautionary tale to not blindly trust "no logs" claims.
- boogies 6y agoThis isn't the first time VPNs with those claims have turned out to have them, they've been used as court evidence IIRC. Edit: https://proprivacy.com/privacy-news/no-logs-ipvanish-hands-logs-homeland-security https://proprivacy.com/privacy-news/no-logs-ipvanish-hands-l...
- mywacaday 6y agoWhy would you trust a VPN when any TLA/CIA/NSA/FBI can set up 1/10/100 options relatively cheaply. Unless you go through TOR or use a false MAC address you have no guarantees, even then fingerprinting and fake TOR exits points are a serious risk if you are trying to be truly anonymous.
- motohagiography 6y agoKnow what's valuable? Internet traffic from people who think it's important enough to hide, and who have technical skills to get jobs with them. The value of privacy viewed this way would mean that a truly private VPN service would be hugely expensive, like the way a new Rolls Royce is priced at 50x that of what you need to get from A to B.
- outworlder 6y agoUnsecured Elasticsearch, once again. (https://www.theregister.com/2020/07/17/ufo_vpn_database/ https://www.theregister.com/2020/07/17/ufo_vpn_database/) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT GW). Use _something else_ to send traffic to them. If you are on AWS or similar (but not Azure I guess), add a load balancer to it. So now access would require creating a new load balancer, pointing to the servers in question, adding listeners on the desired ports, and configuring the appropriate security groups. Only then you can send external traffic. On the specific ports you configured on both listeners and security groups only. Do this everywhere and you are in a much better shape. You still need to configure servers correctly, but if you mess up, nothing happens, unless you mess up many other things in an error cascade.
- dharmab 6y agoAlso, don't use 0.0.0.0/0 in a security group rule! P.S. Azure has load balancers and security groups too- in fact their security groups are better than AWS's in some ways such as supporting thousands of rules instead of only 50.
- ashtonkem 6y agoAzure can even configure mutual authentication between the LB & the underlying servers, which would cause any direct server access to result in a 401[0]. 0 - For API servers. I'm not sure if you could configure this with services like Elasticsearch.
- kevinkeller 6y ago>Azure can even configure mutual authentication between the LB & the underlying servers You can achieve a similar effect in AWS, by declaring only the LB's security group as the source in servers' security group ingress rule. Any requests sent directly to the servers simply wouldn't connect.
- M2Ys4U 6y agoHow can you tell when VPN provider is lying when they say they don't collect logs? They say that they don't collect logs.
- dhaavi 6y agoThe only way is to make logs useless to begin with. See my comment earlier: https://news.ycombinator.com/edit?id=23881148 https://news.ycombinator.com/edit?id=23881148
- Mandatum 6y agoOeck claims no-logs and details how they've achieved that (they don't even have hard drives). Support is responsive, you'll be responded to by those who actually built the platform. They're planning support for WireGuard. Unfortunately they have admins in Australia which has some pretty hefty laws similar to those in the US (look at gag-orders issued, and recent responses to media outlets for publishing vetted and leaked data). You can find their intro post in Whirlpool forums. They configure a PXE and have a system in place for distributing the OS in each region (and thus each data center). For debugging issues they try to replicate things on a local environment and my assumption is if there's any networking issues, they likely have a node on the same data center they can remote to, to test connectivity issues - however functional issues require replication locally. No SSH access to the box. So I think for now, Oeck or Mullvad are good choices. I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack and video-document the entire process of compiling and shipping their hardware, as well as the systems in place for loading the OS to ensure no exfiltration data from malicious services or agents on the box. This could be done relatively cheaply - I'm surprised none of the VPN providers have yet. A fish-eye lens attached to a webcam on a rack would be cheap to install. It's the closest thing we have to proof a VPN server hasn't been owned without a zero-day. If you're using up-to-date services, a LEO, government or APT using a zero-day to own your server is really the only means of exfiltrating user data in this environment.
- throwwwaway 6y ago> I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack This is security theatre. Anyone wanting to surreptitiously access the server farm only has to stream an alternate video to defeat this.
- movedx 6y agoBut it still builds trust in the brand. No one is safe from a state actor.
- 6y ago
- deleted 6y ago[deleted]
- vmception 6y agoVPN providers are just internet resellers with a side business of affiliate marketing other VPN providers comparing “privacy” claims and acting unbiased I’m amazed at the smart people that fall for that The best test are court cases where investigators were stonewalled by a particular VPN provider If you dont want the US knowing something but dont mind China knowing something, Express VPN got you
- scoot_718 6y agoYou can't trust firms hosted in HK anymore. It's as tainted as China is.
- scalableUnicon 6y agoWith WireGuard, it is easy these days to setup a VPN on our own server(https://www.freecodecamp.org/news/how-to-set-up-a-vpn-server-at-home/ https://www.freecodecamp.org/news/how-to-set-up-a-vpn-server...). Obviously it won't give us anonymity, but it is a good choice for security when browsing from public wifi.
- kristopolous 6y agoEntrusting a third party to only play the role of protecting your privacy always sounds like a dangerously bad idea. They've got no dog in the fight.
- paulie_a 6y agoIf they promised no logs why did they take the extra steps to log. That's the opposite of a lazy mistake.
- crusty 6y agoThis feels like someone scuttling the ship. - VPN based in Hong Kong. - VPN claims to not keep logs but does (ie. willing to descieve customers and secretly compromise their security). - New national security law effecting Hong Kong speech and liberty. - VPN likely to be challenged to turn over user data to Chinese authorities in the relatively near future. - Hong Kongers acquiring VPN services in droves for the explicit purpose of avoiding Chinese state monitoring of their internet traffic and communications records. If I was working at UFO and saw the risks to my fellow citizens created not just by the company's poor security but their willingness to descieve customers I'd worry the company would quietly hand over whatever the Chinese authorities asked for - no "warrant canaries" or truth in advertising - and if probably look to throw a figurative grenade into their operations. If that meant data exposure, better now before they perfect the application of the new security laws then later when everyone feels comfortable and the CCP is just sucking up all of UFO's traffic and logs.
- HungryHarold 6y agoThere needs to be a serious rethink of VPN services
- dhaavi 6y agoWe did exactly that. See my comment earlier: https://news.ycombinator.com/edit?id=23881148 https://news.ycombinator.com/edit?id=23881148
- sys_64738 6y agoMore importantly is that all this internet traffic is routed through China. Explicit MITM attacks are a courtesy.
- neycoda 6y agoWhy does anyone think with the prevalence of "free" VPN that these companies aren't storing and selling the crap out of your info?
- neurostimulant 6y agoOn a reddit thread about this news, they mentioned that the company behind ufo vpn (dreamfii hk limited) is actually owned by lippo limited, which is owned by lippo group. I can't find any information on the web that back this though. But if this is true, this kind of shenanigans (saying they don't keep log but actually keep them anyway, then leaks it due to sheer incompetence) is not surprising considering lippo group's well known history of corporate malpractice and screwing up their customers and partners alike. How companies this shrewd (so shady and well known they became a meme) continue to survives (and thrives!) is beyond me. Maybe there is money in screwing people after all.
- LargoLasskhyfv 6y agoMust have had an encounter with an unidentified filing object...
- PeterWang01 11mo agoHello, I’m a tech executive at UFO VPN, and I want to begin by apologizing for the incident that occurred in 2020. During that period, we failed our users. The data exposure was real. It resulted from allowing a third-party SDK to emit runtime logs, combined with a misconfigured server-side logging system that was accessible without authentication. That architecture should never have existed, and the criticism we received at the time was entirely justified. I deeply regret that we put users in that position. I also understand that no explanation can undo the harm that was done. Still, once the severity of the issue was fully understood, it became critical to make fundamental changes and to be clear about what those changes were. All client-side and server-side connection logging was disabled, including debug and development logs. Sensitive fields were removed at the data-structure level so they cannot be recorded, even unintentionally. The logging pipeline was rebuilt to require authentication, with strict least-privilege access controls and encryption applied both in transit and at rest. Additional safeguards were added to the CI/CD pipeline so that any attempt to reintroduce connection-related logging is automatically blocked. Today, user connection data cannot be accessed through internal APIs for a simple reason: it is no longer collected. This does not make past mistakes acceptable, but it reflects the seriousness with which this failure has been treated. I am sharing this solely to take responsibility and to be transparent about what was learned. I am also willing to answer technical questions or listen to any concerns.