11 ms·
FreePN: Open-source peer-to-peer VPN service
- api 6y agoIf its P2P it means it uses other peoples' nodes as your exit node, sort of like Tor but without the onions. That's risky. What happens to me if someone does something illegal via my connection? How could I prove it wasn't me? Maybe I could win in court by citing my use of something like this, but I really don't want to be dragged into court in the first place even if I end up walking out.
- ignoramous 6y agoLantern [0] and Pisphon.ca do so, too, since it is an effective anti-censorship deterrent. Also, industry leaders like NordVPN and ExpressVPN may engage in P2P routing especially to unblock services like Netflix and Disney+ [1]. HolaVPN unapologetically does this too [2]. All of this is discounting the new-age dVPNs like Orchid (not quite the Tor replacement that was promised [3]) and Mysterium [4]. [0] https://archive.is/lDXR4 https://archive.is/lDXR4 [1] https://news.ycombinator.com/item?id=21664692 https://news.ycombinator.com/item?id=21664692 [2] https://news.ycombinator.com/item?id=9614993 https://news.ycombinator.com/item?id=9614993 [3] https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457 [4] https://news.ycombinator.com/item?id=14331049 https://news.ycombinator.com/item?id=14331049
- oefrha 6y agoRouting traffic for specific domains with known legal content is questionable practice, but at least it’s safe from the specific concern here (until someone finds an exploit, maybe a bad domain parser or something). Routing arbitrary traffic is plain risky, it is entirely conceivable to be arrested for it, or at least be searched, whether you can explain it away later or not. “Other providers are doing it too” hardly makes it any less risky.
- qeternity 6y agoAll it takes is for someone to make a threat of violence in the comments section of a known service, or to post links to abusive material.
- RealStickman_ 6y agoMy thoughts exactly. How ironic that you'd need another VPN to be safe enough for daily use.
- risyachka 6y agoShouldn't prosecutors prove that it was you and not someone else?
- detaro 6y ago"Should", yes. (Details obviously depend on jurisdiction) For that, they get a warrant to search your home and for your computers to be confiscated to do the forensic analysis on them. You might get them back after a few years if nothing can be proven. They also might tie you into it for knowingly supporting it by installing such a VPN, some places make you responsible for everything happening through your connection by default. See the "fun" people operating TOR exit nodes have for what can happen.
- risyachka 6y agoTrue, but there is a big difference in operating an exit node and using a VPN. Millions have VPNs installed. These is only a small amount of exit notes, and millions use VPN. I'd argue that the chance of being accused because someone used your connection in p2p VPN is less than when someone will use your wifi to do something illegal.
- _jal 6y agoThe more relevant question is, what does this software offer that would make it worth taking on this risk? For whatever values of 'this risk' you evaluate running this code to carry. Arguing semantics with a prosecutor might be your idea of a good time, but that seems to me like the sort of thing I could do without. In any case, they may call this a VPN, but it isn't a VPN in the sense that term is normally used, and it certainly isn't even vaguely similar to that VPN connection you make to the office.
- chii 6y agoWhy can't anyone who join be incorporated as a utilities provider, and shed the responsibility of monitoring the traffic (and the legality of it) to the initiator of said traffic? I mean, ISPs do this don't they? Telephone networks do this don't they?
- Fnoord 6y agoThis seems like a decent tool to use in an oppressed, non-free country. Except Tor (or Whonix or Tails), WireGuard, or ZeroTier are a better option. All of these allow better management (and therefore control) of routes. There is a very good reason Usenet does not require uploading, and P2P protocols like BitTorrent are used with a VPN. It provides a reasonable enough protection against a civil actor such as RIAA and MPAA while a determined actor (with more control over the used networks can dig up the data trail. Ie. police in case of serious crimes such as CP. On a somewhat related note what was the name of the end of 90s pseudonymous network where you had to buy a 'nym' and could renew it for money?
- api 6y agoThis actually uses ZeroTier under the hood. It uses ZT as the transport, encryption, and network virtualization layer and then does P2P exit node stuff on top of that. ZT would be useful for this from an oppressed country because it is used by a ton of businesses. You would just look like you were accessing a corporate ZeroTier DVPN from home, which is pretty common these days. That's better in some ways than Tor. The problem with Tor is if you use it naked then it can be obvious that you're using Tor. Even in countries like the USA I've always been concerned that using Tor might put you in some kind of database. In a very non-free country I'd be really worried about using Tor naked, meaning without running it over something more mundane looking like ZT or Wireguard.
- illuminati1911 6y agoWhat's the catch?
- CyanBird 6y agoYou are the exit node for other people's browsing, which can be rather scary
- sJ646U9k6c6gME9 6y agoIt’s clearly not made for people who don’t want their dog shot by fed bois.
- hansvm 6y agoOh thanks, that makes sense. I was trying to figure out what the upside was for this, but I forgot about the 1-on-1 potential with the feds. It's pretty hard to get in touch with them otherwise.
- dmqctx 6y agoIt's actually not that difficult. Our business had a massive illegal purchase attempted by a shady character. Googled FBI location closest to me. Actually got a human to answer and discussed how we should proceed. Surprised me much.
- cryptoquick 6y agoSo, wait... Let me get this straight-- This is a p2p VPN, so, it basically routes other people's potentially illegal activities through your own IP address, so you can do the same over other people's IP addresses? And they don't even mention that fact on the front page? Talk about disingenuous... Like, goddamn, VPNs aren't THAT expensive. Not compared to, IDK, a lawyer, or missing a day of work because you're in a jail cell, trying to explain to some cop that you installed a program on your computer that let other people you don't know do random stuff on the internet over your internet connection without your own knowledge or involvement, and you aren't complicit in any way...
- eightails 6y agoThey tried to promote the launch of this service on a bunch of linux-related subreddits 6 months ago, and I wasn't much of a fan of the concept or the way they advertised it, in skipping over the p2p nature of the system. Their answer to the question of 'what happens when a bad actor has their illegal activity routed through my connection' seemed illogical. They claimed that as more people signed up, the proportion of bad actors would decrease [0], which makes no sense to me. Also, I'm not entirely sure what methods they have taken to stop a bad actor from collecting packets from other users that are routed through the bad actors exit node. The worst thing IMO is the way it's being presented and marketed. The impression the website gives is that its just like all other VPNs but free, which is very misleading. [0] https://www.reddit.com/r/Ubuntu/comments/f5y6qg/update_launching_free_fast_anonymous_vpn_w/fi2jxja/ https://www.reddit.com/r/Ubuntu/comments/f5y6qg/update_launc...
- viraptor 6y agoThe main page copy seems misleading bordering on malicious: > No bandwidth caps. No throttling. Stream all day, and download away. Yes, no caps on the tunneled connection. But it will happily use up your home connection data caps with both your own and other people's traffic. Then once you run an exit for long enough, your home network will get tor-like treatment from many CAPTCHAs and you'll be blocked from anything on cloudflare. > FreePN never logs your IP or tracks your activity. (...) FreePN shields your data from prying eyes, giving you peace of mind. FreePN doesn't log. But anyone running FreePN is welcome to do just that. It's a perfect tool for that monitoring too. Tor browser at least has lots of extra protections. This one does not, so settig up a tunnel-to-tunnel routing node means you can listen to a lot of interesting things. (Without the liability of being a true exit node)
- RL_Quine 6y ago> Then once you run an exit for long enough, your home network will get tor-like treatment from many CAPTCHAs and you'll be blocked from anything on cloudflare. That'll take a matter of minutes. It doesn't take much to get on googles shitlist as soon as you do any sort of bot activity against their services. I manage to get on it by just searching humanly!
- jmarbach 6y agoIt looks like this will help protect your privacy when configured properly, however, it may be more difficult to accomplish one of the key values VPN users seek: navigating around censorship walls. Does anyone know if it's possible to specify the location of your exit node in the network?
- woodruffw 6y agoThis appears to be the main repository for their "VPN" daemon: https://github.com/freepn/fpnd https://github.com/freepn/fpnd Some observations: * It's not actually a virtual private network, at least by the traditional definition. They route HTTP(S) and DNS traffic only; other protocols (presumably) get routed in the clear. * IPv6 isn't supported at all. * I might be missing it, but I can't find any cryptographic design documents or a threat model anywhere. A quick repo search doesn't even bring up any cryptographic primitives, which makes me wonder about malicious peers. It's good to have more competition in this space, so I'd like to be wrong (or eventually wrong, feature-wise) about all of the above. But if I'm right, this is roughly the same as using a SOCKS proxy (and maybe a bit worse, if any other peer can futz with your traffic).
- woodruffw 6y agoSome other sketchy bits, from a very quick perusal: * Shelling out[1] to some tool that may be responsible for all of the heavy networking bits[2] * Falling back on a non-monotonic clock but calling it monotonic[3] * Another sketchy shellout[4] that calls a bunch of scripts with trivial interpolation/injection bugs[5]. It's not clear if the arguments passed to those scripts are remotely controllable, but it's sketchy. [1]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9c6c5c8f347821625/node_tools/node_funcs.py#L241 https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9... [2]: https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne [3]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9c6c5c8f347821625/node_tools/timing_funcs.py#L12 https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9... [5]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9c6c5c8f347821625/bin/ping_gateway.sh https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9...
- anderspitman 6y agoTo be fair, ZeroTier isn't just "some tool". It has a solid reputation. The founder (api) is actually here in the thread.
- woodruffw 6y ago
- anderspitman 6y agoI have a project I want to do that would involve a lot of YouTube scraping. But they'll throttle you if they detect it. This led me down the rabbit hole into the world of residential proxy services. Some of them[0] advertise up to 40 million IPs. I can't imagine many of the owners of those IPs know what they're being used for. It would be cool if there was a reputable open source project that would let people share/buy residential proxy usage, but at the end of the day there's no way to guarantee people aren't doing horrible things with your IP. [0]: https://smartproxy.com/ https://smartproxy.com/
- oefrha 6y ago> I can't imagine many of the owners of those IPs know what they're being used for. They don’t. For instance, Luminati, possibly the best known player in this market, uses HolaVPN users as exit nodes.[1] [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
- anderspitman 6y agoThanks for the link. I figured something like that had to be the case. I can't really think of a legitimate way to get access to that many IPs.
- MattGaiser 6y agoI periodically see ads on Kijiji (Craigslist for Canada) offering you 50 bucks for your internet connection. If that is the going rate, 50 million I enormously expensive.
- ev1 6y agoThe boxes have the ability to try to DHCP-release-renew your IP to get a new one after being banned for spam/fraud/DDoS/etc. However, this is not how these residential proxies are sold- mass market ones with millions of IPs are generally botnet/hacked/malware/extension malicious author sellout/etc./ There are not actually millions of botnet user, they just try to make themselves look big. Like they say AT&T has a /8? So they get 1 botnet hacked PC on AT&T broadband and say "wow we have a /8 worth of proxies!!"). Criminals not known for their truthfulness. The ones that ask you $20-50/m and to plug something into your network is generally used for fraud, account hijackings and maintenance (getting a stable IP for stuff like a credit card checkout or paypal account to use for more than a few days for fraud, long term social media abuse, similar) instead of mass market ban evasion.
- bawolff 6y agoHmm. Dont see any white paper or design docs on their website. Did i miss it. At a glance sounds like a reinvention of Tor, but less secure.
- yjftsjthsd-h 6y ago> At a glance sounds like a reinvention of Tor, but less secure. ...and with every client also acting as an exit node, which is kinda a big deal.
- bawolff 6y agoIts not just that though. There are lots of privacy attacks on this kind of system that you have to be careful to avoid. How easy is it in this system to force a specific user to use you as their exit node during a targeted attack? Given the state of their website, i am going to guess pretty easy.
- ian-bateman 6y agoThere are a lot more technical details on the project README page here!: https://github.com/freepn/fpnd/blob/master/README.rst https://github.com/freepn/fpnd/blob/master/README.rst
- eps 6y agoThis is really shallow. You are trying to cater to a privacy-minded audience yet you provide literally no information on how the whole thing works. I don't think you fully understand how crucial a very detailed technical spec is for the adoption of a tool like this. The first question with any P2P project is if I have any control over other people's traffic that passes through my system. No mention of this anywhere, leave alone a detailed discussion. I saw your replies here on this subject and they are ultimately... inane if you pardon the bluntness. I realize that you mean well, but you are exceptionally naive in terms of how quickly a system like this will be abused to a very severe degree.
- liotier 6y agoIt is Tor - if my teenage self had designed it in the late 90's
- zwilliamson 6y agoAnyone else getting "NetworkError when attempting to fetch resource. Please refresh and try again." when trying to sign up for email notifications for MacOS?
- ian-bateman 6y agoAh that's been happening sometimes with the email input - thanks for the heads up though. Site's getting hugged right now, so that might be the issue!
- growthtalk47 6y agoI think this is early, but great idea. The founders definitely have a big vision to bring to reality.
- alcover 6y agoFunny how this praise is made from an account created mere minutes before.. Could be covert self-advertising of course - but it made me think it could also be from an adverse party : You see a competitor being talked about in a thread, you create novelty accounts grossly marvelling at their product.
- RL_Quine 6y agoThey posted twice, with a minute in-between, both with glowing reviews. https://i.imgur.com/fTfgcyN.png https://i.imgur.com/fTfgcyN.png My reply was instantly flagged of course.
- deleted 6y ago[deleted]
- RL_Quine 6y agoYou forgot to switch accounts before posting the second comment.
- piracy1 6y agoWait, so the idea is basically, don't trust ur ISP? Have you tried Craig from Bosnia?
- ian-bateman 6y agoFreePN is intended (long-term) to be a general purpose privacy-protection tool.
- piracy1 6y agoMore seriously, I do think it's an interesting start, I think it creates a platform that you can use to test out some interesting ideas. Good luck with it.
- dhaavi 6y agoHaha! Made my day.
- alvarlagerlof 6y agoThe comments here make me wonder it this so actually made by some malicious state.
- ian-bateman 6y agoWe're a private company based in SF actually!
- viraptor 6y agoSo... yes or no? /s
- ian-bateman 6y agoHi Ian from FreePN here - This is all very unexpected actually! (No one from FreePN made the post here!) We've been doing some early market testing in a few Linux communities on Reddit, but full disclosure, the product is currently in an early-alpha stage (it’s only available on Ubuntu and Gentoo Linux currently, and very much under construction). We have big ambitions for the project, but it is still very early days. Love hearing the feedback from everyone here — some very valid criticisms from a lot of folks — and on a lot of points that have been brought up here, we actually have plans to address. A few bullet points on where we are as an organization / project: — the marketing copy isn’t set in stone — I’ve been working on the site a bunch recently & it’s very much in flux (we’ve been posting in a few Linux communities to see what the response looks like) — when we posted a few months ago about the project, in all honesty, it was a demand test to see if this would be something worth pursuing — but we’ve been trying to take the feedback from those posts to heart in our development process — we market ourselves as a VPN, but to be clear we _are_ a dVPN (distributed VPN). The peer-to-peer VPN wording on our site is mostly for the sake of simplicity. I’d point most folks to our project README on GitHub for more in-depth technical details. — right now FreePN is structured as a 1-to-1 peer connection, but we eventually plan to build in multi-tenant peer support as well as optional multi-hop routing (similar to Tor) and selective whitelisting of domains so that as a peer you can elect to categorically block certain types of sites — say torrenting. These blocklists would draw from open-source category site-lists like Fortiguard. — we do currently only route web traffic (+ DNS) — so only traffic on ports 80 and 443 is being routed (optionally port 53) — we don’t currently support IPv6 (though we have plans to add support in the future) — we don’t log traffic (you can see in the repo), and while peers logging traffic is a potential concern, that’s only true if you’re using non-HTTPS connections (we have plans to bake in something similar to HTTPS Everywhere, automatically upgrading connections). As far as our vision for the product — our goal for FreePN is to eventually become a ‘privacy all-in-one’. We started FreePN because we care deeply about internet privacy — but trying to protect yourself online practically is a very technical and time-consuming endeavor (basically — it’s really hard to protect your privacy online, and we’re trying to make it easy). In terms of features, we’re working on building in ad-blocking as our next major milestone. I’ll do my best to respond to everyone’s questions and concerns here this evening / in the morning & tomorrow as I’m able!
- aero-glide 6y agoHow does this compare with SoftEther VPN gate? That's decentralized too
- ian-bateman 6y ago(Hopefully) it's a bit easier to use than SoftEther! Also, unlike SoftEther, we don't depend on volunteers for our network - the network is largely made up of the users themselves!
- dhaavi 6y agoIf anyone of the FreePN guys is still lurking around: What is your business model? I understand that you don't need servers, because your users supply that part, but who pays for development, support, and all that stuff?
- dhaavi 6y agoSomeone else asked the same question, following up there: https://news.ycombinator.com/item?id=24798097 https://news.ycombinator.com/item?id=24798097
- noodlesoups 6y agoSo they're injecting their own ads into sites?
- rntksi 6y agoI think this project is piggybacking on ZeroTier. ZeroTier is actually quite good. I've used it successfully in/for enterprise-grade services.
- reyqn 6y agoYeah they don't even give it credit when it's basically a glorified wrapper around it.
- FreshFries 6y agoFor people who are even considering this as a nice service: setup a tor exit node and let it run for a week or so (takes time before it will actually route traffic through your new node) and experience the no more Netflix, captchas left and right and possible issues with your ISP & local law enforcement. If you for a minute think this / your IP address will not be misused to scrape, grief, DDoS, up & download "questionable content", you are very wrong.
- parliament32 6y agoBut this isn't a VPN, it's just a glorified p2p "residential proxy" service (only forwards HTTP/S traffic and optionally DNS). And when you run this you become an exit node for other people. Scary stuff.