4 ms·

Shouldn't some non-trivial % of VPN companies popular on the market be run by intelligence agencies by various countries as a honey pot operation? Or is the ide

Shouldn't some non-trivial % of VPN companies popular on the market be run by intelligence agencies by various countries as a honey pot operation? Or is the idea that intelligence agencies have better means to monitor internet traffic?

CyanBird 5y ago
I mean, supposedly that's exactly what happens with tor, nsa and friends run many, many exit nodes and scrap info from there, to such a level that people are worried that it is possible (or plausible) that they can/could identify users through different fingerprints, maybe not for something that would hold in court, but enough that it could make you a person of interest for them to see if they can deploy some of their malware packages As for intelligence agencies, famously ProtonMail which works from Switzerland operates in a country with information sharing partnerships with the 5eyes, yet they are not all too concerned about it, nor interested on having their server-side software audited, so that to me raises eyebrows In the past we have had the cryptoag scandal and BCCI which was an entire huge international bank with branches all over the world which basically only existed to be a front to CIA money laundering.... I personally believe that these guys are now operating with Deutsche bank and Cryptocurrencies which is just what would make sense for them as Deutsche bank is a corruption ridden company and Crypto is can be obfuscated so much as to be basically nontraceable I have personally moved away from ProtonMail, I have 0 sources but they give me too much of a bad cryptoag vibe/honeypot, sad as it is, if you want secure email you must self host it which can be quite a pain in the arse, but these are the costs to have peace of mind As for their VPN I would not use it, I don't like that ProtonMail centralized so many "privacy things" into a single point of failure
zinekeller 5y ago
Actually, skip all of that: social engineering is still the best way, even NSA has stated that. Assuming that social engineering is hard (for example, the target are computers operating machinery), while Windows is... not bulletproof, most applications (especially in-house apps) tends to be nothing more than a wooden gate, and therefore it's more expedient to do that than monitoring encrypt communications (obviously, it's has some benefits but it also has a lot of chaff, so it's better to have a wiretap directly).

CyanBird 5y ago

I mean, supposedly that's exactly what happens with tor, nsa and friends run many, many exit nodes and scrap info from there, to such a level that people are worried that it is possible (or plausible) that they can/could identify users through different fingerprints, maybe not for something that would hold in court, but enough that it could make you a person of interest for them to see if they can deploy some of their malware packages As for intelligence agencies, famously ProtonMail which works from Switzerland operates in a country with information sharing partnerships with the 5eyes, yet they are not all too concerned about it, nor interested on having their server-side software audited, so that to me raises eyebrows In the past we have had the cryptoag scandal and BCCI which was an entire huge international bank with branches all over the world which basically only existed to be a front to CIA money laundering.... I personally believe that these guys are now operating with Deutsche bank and Cryptocurrencies which is just what would make sense for them as Deutsche bank is a corruption ridden company and Crypto is can be obfuscated so much as to be basically nontraceable I have personally moved away from ProtonMail, I have 0 sources but they give me too much of a bad cryptoag vibe/honeypot, sad as it is, if you want secure email you must self host it which can be quite a pain in the arse, but these are the costs to have peace of mind As for their VPN I would not use it, I don't like that ProtonMail centralized so many "privacy things" into a single point of failure

zinekeller 5y ago

Actually, skip all of that: social engineering is still the best way, even NSA has stated that. Assuming that social engineering is hard (for example, the target are computers operating machinery), while Windows is... not bulletproof, most applications (especially in-house apps) tends to be nothing more than a wooden gate, and therefore it's more expedient to do that than monitoring encrypt communications (obviously, it's has some benefits but it also has a lot of chaff, so it's better to have a wiretap directly).