6 ms·
Seven 'no log' VPN providers accused of leaking 2TB of user data
- jolux 6y agoI stopped trusting VPNs that weren’t hosted by me years ago. Wireguard is simple enough that any reason to is rapidly diminishing.
- pen2l 6y ago> If you wanted to see what the most paranoid, security-conscious people are connecting to, and you wanted to install software on their systems that is designed to read all their network traffic and then redirect it through a single choke point, then setting up a VPN service with a huge advertising budget would be a great way to do it. https://www.youtube.com/watch?v=WVDQEoe6ZWY https://www.youtube.com/watch?v=WVDQEoe6ZWY
- mindslight 6y agoSecurity conscious people aren't installing proprietary VPN trapware, nor routing all of their traffic out one VPN.
- jolux 6y agoWhat are “security conscious” people doing instead, out of curiosity?
- zeepzeep 6y agoTOR
- yjftsjthsd-h 6y agoI suppose the traditional paranoid answer is TOR.
- mindslight 6y agoRunning generic OpenVPN/Wireguard/TOR/etc, and segmenting traffic by purpose/nym.
- jolux 6y agoSure, that's what I recommend. Wireguard specifically.
- sverhagen 6y agoI assumed this was meant to target a particular cross-section of people that were security conscious, yet not tech savvy.
- Dylan16807 6y agoOther than wanting an IP that's not directly tied to you?
- jolux 6y agoNot sure what you mean by “directly,” there are going to be strong financial ties to any VPN provider one chooses, and as such, they are no better than running your own in a lot of circumstances.
- adrianN 6y agoIf the VPN provider doesn't keep logs, you have plausible deniability that it was in fact your traffic coming out of that exit node.
- jolux 6y agoHow can I trust they don’t keep logs?
- wutwutwutwut 6y agoSame way you trust hey.com not share all your email with everyone publicly. By building some kind of trust, describing how they work, their policies, being clear about how they make money and so on.
- jolux 6y agoI don’t know of any VPN provider as trustworthy as DHH and Basecamp.
- wutwutwutwut 6y agoThat's not relevant.
- 6y ago
- thekyle 6y agoLots of use cases aren't covered by a self-hosted VPN. Public VPN servers allow you to blend in with other traffic coming from a shared IP giving you plausible deniability for things like piracy.
- jolux 6y agoMy use case is not piracy.
- arsome 6y agoA few other major use cases I've used them for: - Scraping, when my scraper gets blocked from the real estate site, wallpaper site, etc, I click next IP, change my UA and I'm ready to go for another round. You can play cat and mouse all day without worrying about all your IPs getting banned. - Avoiding DDoS attacks, if you're doing something that makes you likely to become the victim of a DDoS attack, like say, joining a script kiddie's botnet IRC server, not giving a crap if your public IP gets dropped is pretty handy. - GeoIP bypasses, allows you to work around everything from region locked content to discriminatory pricing - Country-wide and default blockades, many countries censor the internet only in minor and weak ways, blocking things like BitTorrent tracker websites by domain or IP that commercial VPNs will trivially bypass
- judge2020 6y agoAn legitimate users still wonder why using a VPN makes the internet harder to use in terms of being on blacklists and having low IP reputation.
- harshitaneja 6y agoWhat is the benefit of self-hosted VPN? No, security benefit I know of, unless you primarily consume HTTP or other unencrypted communication and even then it saves you from MITM or other attacks between you and your VPN server and not till the content server. Anonymity is only a benefit in public VPNs.
- jolux 6y agoIf what you want is anonymity, VPNs are the wrong tool, as evinced by these leaks. My main use case is privacy on unsecured networks such as that of coffee shops.
- Semaphor 6y ago> VPNs are the wrong tool, as evinced by these leaks. Are they? So far every leak I’ve read of, has been by pretty shady companies. This seems more like evidence that if you buy a pacemaker from aliexpress (or in the case of NordVPN from Wirecard or Theranos), you might die from it failing.
- deleted 6y ago[deleted]
- yjftsjthsd-h 6y agoMy ISP has been quite open about selling my information. Therefore, I'm fond of encrypting everything they see, including destination IPs, DNS, and non-TLS traffic; a VPN is a simple solution. EDIT: To clarify, I know my ISP's spying on me. Therefore, in some models, trading that against a VPN service that might be spying on me in the same way could be a favorable trade. YMMV.
- bouncycastle 6y agoHang on... If you use a self-hosted VPN through a VPS, the hosting company that's providing the VPS could still log ir MITM traffic from the VPS. So you still need to trust someone, no?
- DarkWiiPlayer 6y agoIf you have an encrypted channel to the VPN server, it'd be quite difficult to extract any meaningful data from it.
- kdrag0n 6y agoThe hosting provider can still monitor egress, which is what's more valuable anyway. Hypothetically, they could also snapshot the RAM for deferred analysis, though that's usually more trouble than it's worth. You have to trust someone in the end.
- DarkWiiPlayer 6y agoWell, if you want 100% security, you have to build your own internet. But hosting your own VPN is reasonably safe, unless you have reasons to believe a government-sized entity is specifically targetting you, in which case, yeah, just don't use the internet.
- bouncycastle 6y agoWell, that's what VPNs were designed for in the first place - building your own private network! However, it's a misconception that VPNs provide privacy for browsing the public internet. As we see, there are many weakness.
- deleted 6y ago[deleted]
- a012 6y ago> It appears seven Hong-Kong-based VPN providers – UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN – all share a common entity, which provides a white-labelled VPN service. > VPNmentor created an account with one of the providers, and spotted that new account in the logs, specifically "an email address, location, IP address, device, and the servers we connected to." VPNmentor alerted the providers involved to get the cluster removed from public view, as well as HK-CERT, though it seems no action was taken to immediately rectify the situation.
- Pinkydas 6y agoNice
- Pinkydas 6y agoFavourite
- KindOne 6y agoDiscussion 2 days ago (222+ comments): https://news.ycombinator.com/item?id=23876146 https://news.ycombinator.com/item?id=23876146 "UFO VPN claims zero-logs policy, leaks 20M user logs" Title is also slightly misleading, multiple sources have 1.2TB, not 2TB.
- system2 6y agoReally doesn't matter how many tb to be honest, I don't even look at the number. Even 1 kb is more than enough.
- KMag 6y agoWell, except that 1 kb is still consistent with "no log", as if they're businesses, they need to keep track of which user names/pseudonyms have paid. A 1 kb leak isn't okay, but at least it's potentially consistent with their promises to their users.
- system2 6y agoYou are missing my point. Any kind of leak means they are logging regardless of the leak size.
- KMag 6y agoMy point is that if the leak is a grand total of "1kb of user logs", it may not be the sort of log you're assuming. If the leak is a 1 kb list of valid usernames and password hashes, how does prove they were violating their "no log" policy? It just proves they were doing access control, which we knew anyway.
- nieve 6y agoIt's the data breach equivalent of the cryptography rule that a break never gets better and usually gets worse. A canary in a coal mine, basically - if 1kb has been leaked you can safely assume a lot more has since that's not an amount that any attacker would bother with under normal circumstances. If they do care it's because they expended a penetration on targeting few or one individuals max and we almost certainly wouldn't see the results. If I saw a dump of 10 email addresses from Hacker News it would be imprudent assume that somehow an attacker had made it in as an admin and yet only accessed those. It would be outright foolish to assume that if there were 10 addresses the damage is inherently less than 10.
- chias 6y agoNever forget how VPN actually works: https://i.redd.it/ginexp6ezoa31.jpg https://i.redd.it/ginexp6ezoa31.jpg
- system2 6y agoIt made me laugh hard, so true. I wish there was a better way.
- Polylactic_acid 6y agoOnion routing is a better way. Not bullet proof but its a whole lot better than a vpn.
- deleted 6y ago[deleted]
- jb775 6y ago> UFO also claimed its logs were kept for traffic-performance monitoring only When your product's sole purpose is to provide privacy, there's no excuse in the world good enough to knowingly retain logs like this. There needs to be a class-action lawsuit to curb douchebag businesses like this.
- gHosts 6y agoAs Bruce Schneier says.... Data is the toxic waste of the modern era... you just know sooner or later it's going to leak. Don't collect it if you don't need it. Destroy it as soon as possible if you do.
- raverbashing 6y ago"No, no, but GDPR bad!!11 We care about your privacy that's why we collect all the data we can, sell it to everybody and store your passwords in plaintext" As said by several ad-supported businesses and especially ad-networks.
- DarkWiiPlayer 6y ago99% of critizism against GDPR I've seen is either about how it's poorlt implemented (but still a good idea in principle) or about cookie banners (which are note ven GDPRs fault though); I don't think I've ever seen anybody complain that the whole concept of GDPR is bad.
- manicdee 6y agoThat's part of the joke.
- tolbish 6y agoSo the conclusion we are to draw is that VPNs are for the naive, and that if you really get security, you self-host or go VPN-less (what is the alternative, exactly?) Isn't the major benefit of a VPN the added hoop websites have to jump through in order to build visitor profiles?
- yjftsjthsd-h 6y ago> So the conclusion we are to draw is that VPNs are for the naive Bit more nuanced than that, but it's certainly a field full of liars and scams. > and that if you really get security, you self-host Really depends on what your goal is; self-hosting can, for instance, pin you personally to a single static IP. But for some things, yeah it can be better. > or go VPN-less (what is the alternative, exactly?) TOR, I expect. > Isn't the major benefit of a VPN the added hoop websites have to jump through in order to build visitor profiles? That can be one benefit, yes. It doesn't have to be a silver bullet, but you do want to be clear on what benefits you expect to get from your particular solution.
- throwaway42343 6y agoI've always thought VPN was a bit pointless: a browser fingerprint already has far more bits of information compared to your IP address.
- stevekemp 6y agoSometimes they're useful to do IP-based ACLs, or to evade geoip restrictions for media-consumption etc. Hiding IP addresses, and pretending you're anonymous, is only one use for VPNs (and a poor one for that matter).
- system2 6y agoAnyone who is using VPN probably(?) knows about browsers too? I have not met a single non-tech field person using VPN.
- snovv_crash 6y agoMaybe you're not concerned about the website you're visiting tracking you, but rather someone along the way figuring out which websites you're visiting.
- yjftsjthsd-h 6y agoReally depends on your threat model; some of us distrust our ISP more than websites that we use.
- BjoernKW 6y agoFor me, the main benefit of a VPN is security on public WiFi networks. Is it perfectly secure? No, but I trust a business I’m paying a regular amount to quite a bit more than a random free public WiFi provider, who is not only able to siphon off data but also has a lot more incentive to do so.
- heidar 6y agoWith even DNS using TLS on some newer browsers nowadays, the risks of using a public wifi are disappearing.
- konart 6y agoThere is no such thing as legal VPN provider that does not store logs.
- Dylan16807 6y agoWhy?
- konart 6y agoBecause you won't be able to operate in any country that have an agency that monitors cyber-whatever stuff. FBI\NSA\FSB you name it. https://news.ycombinator.com/item?id=23895064 https://news.ycombinator.com/item?id=23895064 Sort of proves me wrong but I'm still sceptical.
- yjftsjthsd-h 6y agoDon't know why you'd think that? https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...
- minxomat 6y agoRemember to pay PIA with ATM or other anonymous BTC and don’t use your real email address. The account emails are always used in PIA cases and they can’t protect you if that email can be traced back to you.
- konart 6y agoBecause I live in Russia I guess. The article tells me about how court of law operates in the US but does not really proves me wrong. Was the FBI give the access to PIA's servers to check things out? From what I understand PIA was just able to "prove" that they can't give FBI what they wanted and the court was "well, sorry fellas". Does this proves that they don't really have logs? Not really. I guess I'd trust them more than others, sure. But I still inclined to treat any service as a possible leak source.
- hartror 6y agoWhat a surprise, a database technology that previously has made security a premium feature is unsecured.
- niftylettuce 6y agoIf you need an email provider that doesn't store logs nor read your emails, check out our GitHub or site @ https://forwardemail.net https://forwardemail.net.
- deleted 6y ago[deleted]
- davvolun 6y agoWhy is this marked as a dupe, when the "original" doesn't mention the other 6 VPNs leaking data? Yes, UFO VPN's leak in this article is based on the "original" article, but I looked at this to see if it included any VPNs I use, and I never clicked on the UFO VPN article because I don't use UFO VPN.
- mnm1 6y agoI wonder if these vpn providers can be prosecuted under the cfaa for not following their own tos. It would stand to reason that if users can be prosecuted thus, the provider can be too. Or no one can be.