6 ms·
Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how
by cronix 5y ago
Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.
- mr-wendel 5y agoAfter that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
- pxeboot 5y agoDidn't Facebook already do this?
- the_other 5y agoI already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
- Enginerrrd 5y agoThis is why I don't trust VPN companies that advertise.
- kilroy123 5y agoWhich ones are good then?
- imwillofficial 5y agoPIA has been tested in court as not keeping your data. Other than that you're placing trust in others, depends on what you wanna keep secret.
- Tenoke 5y agoThat's from before it got sold to Kape who has had a horrible track record with VPNs.
- Nullabillity 5y agoThey're also ran by Andrew Lee/Rasengan, who killed Freenode about a month ago. So, uh, that's great.
- ipaddr 5y agoDepends on what you want it for. To pretend you are in the US for netflix or to evade the fbi. The ones that advertise are good for the first. Rolling your own fixes one issue and raises another.
- bserge 5y agoYour own, purchased using untraceable means (fake ID is the easiest... and likely most illegal).
- anoncake 5y agoIf you pay using the right method, Mullvad doesn't know your identity.
- mrzimmerman 5y agoCame here to promote Mullvad as well. Not that they can’t point back to your up address or some such but since you can login to the VPN using a unique identifier instead of an email address and password it’s a pretty decent way to decouple it from your PII.
- elliekelly 5y agoAnd you can pay with cash. I always feel a bit funny dropping $10 cash in the mail with no return address but so far it’s always made it into my account.
- phyalow 5y agoThey have your fingerprints now (and possibly your DNA from the stamp)!
- SahAssar 5y agoNo, I use SnailOnionCoin. It sends my cash through a number of intermediaries, each just getting a .onion adress explaining where to send it next. Every hop is also switched between cash in snailmail, western union and bitcoin to make it harder to trace the links and make sure that physical traces (like fingerprints) or legal traces (like the postal system or traditional financial transfers) don't make it to the final recipient.
- zenyc 5y agoIs this satire or a real thing? Because nothing comes up when I google it.
- 5y ago
- jchw 5y agoI think you can't really prove an entity to be trustworthy; you can only really prove that an entity is not. I trust Mullvad about as much as it's possible to trust a VPN company... but, that's probably as good of a recommendation as you can really get.
- disambiguation 5y agoplot twist: letsencrypt.org
- JackGreyhat 5y agoI seem to not get the twist. What am I missing?
- senectus1 5y agoI think its an insinuation that letsencrypt is a honeypot.
- kodah 5y agoIt's been long rumored that privacy-as-a-product companies are actually three letter agency honey pots. ProtonMail actually has some connections to NSA investment firms and some former NSA staff on their board. There could be good explanations here, and there could be bad explanations, however, we don't know the role each of these components play in the larger sum; we can only guess and speculate. In that way, an ambitious project that gives away certificates that were formerly worth a lot of money would be a pretty slick honeypot because now you could stow away private keys and have a copy of most of the encrypted webs certificates to decrypt in-flight communications.
- shkkmo 5y agoA CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a customer, atleast untill they get caught and have their root certs revoked by tech companies.
- ronsor 5y agoThat's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed certificate. You never give them your private key.
- raxxorrax 5y agoThis is why I mostly recommend a Russian VPN or one in a foreign country. Sure, your data might end up in the hands of Putins mobsters. Do you think they will share the data with your government? Unlikely... And even if a VPN company isn't compromised, there are so many legal loopholes that would allow government to access your data. Kitten on a tree can quickly become a matter of national security.