8 ms·

More interesting to me is that one of the named persons, Daniel Gericke, is the CIO of ExpressVPN [1] which sold yesterday, the same day that the DoJ came to th

More interesting to me is that one of the named persons, Daniel Gericke, is the CIO of ExpressVPN [1] which sold yesterday, the same day that the DoJ came to this prosecution agreement (!), for just under $1 billion. [2] [1]: https://www.cnet.com/tech/services-and-software/expressvpn-cio-among-three-facing-1-6-million-doj-fine-project-raven/ https://www.cnet.com/tech/services-and-software/expressvpn-c... [2]: https://www.techradar.com/news/expressvpn-to-join-kape-in-largest-deal-ever-in-vpn-industry https://www.techradar.com/news/expressvpn-to-join-kape-in-la...

tyingq 5y ago
Hah. Anticipated bail money, perhaps :)
- joe_the_user 5y ago
  Double hah, original headline: "Three Former U.S. Intelligence Community and Military Personnel Agree to Pay More Than $1.68 Million to Resolve Criminal Charges" - That billion more than covers. Given the circumstances, the settlement is a bit paltry.
nostromo 5y ago
It's crazy to me how many unscrupulous actors there are in the VPN space where you really really need to trust your provider. I don't trust my ISP much at all, but I still trust them more than almost any VPN provider.
- downWidOutaFite 5y ago
  I don't trust any security-oriented software of any kind.
- latchkey 5y ago
  Why would you want to trust your VPN provider? That's like saying: "you really really need to trust a Bitcoin miner" I'd hope the VPN service is built and operated in a way that doesn't require trust, but provides the same level of security. edit: Since there is confusion in the responses. I'd prefer to trust no-one.
  - HappySweeney 5y ago
    How would you verify there are no logs kept?
    - latchkey 5y ago
      Inverse is true as well. How do you prove it?
      - jonfw 5y ago
        You can't prove it, which is why you want to find a VPN provider you can trust
      - cblconfederate 5y ago
        Someone can steal their logs
  - whoknew1122 5y ago
    But then you have to trust that the VPN service is built and operated the way they say it is. Or have we already forgot about Zoom's "end-to-end encryption?"
  - BenoitEssiambre 5y ago
    I don't think VPNs go that far. Wouldn't that be more like Tor type of security?
  - kbenson 5y ago
    There's always trust involved. You have to trust the DNS infrastructure, you have to trust your ISP, you have to trust the VPN provider. You don't have to trust them completely, but you have to trust them at least somewhat. We take steps to reduce the amount of trust required, such as splitting that trust across many parties, so any one party hopefully can't betray us enough that it matters or that we don't notice, but there's still a lot of trust. For example, we use SSL certificates and certificate authorities that are known ahead of time to protect from problems on the network, but that requires you trust your OS and/or your browser, which is generally how you receive those certificate authorities. If I'm able to get my own CA on your system and trusted, and I can see your traffic, it doesn't matter whether you're using HTTPS connections. A VPN provider might say they're not keeping logs, or that their servers are not beholden to a third party and traffic is not being analyzed, but ultimately all you have is their word on that. Ultimately, the only thing different between you connecting to the NSA and routing all your traffic (even if your traffic is mostly encrypted) through them so they can look at it and a VPN provider is that you trust the VPN provider when they say they aren't the NSA and they aren't looking at your traffic.
- midnightGhost 5y ago
  I'm in the same boat. Though I actually do trust my VPN provider Mullvad. Highly talked about, based in Switzerland, and Mozilla also uses them for their VPN service. Edit: Sorry. Not Switzerland. Sweden. For some reason thought Switzerland.
  - croes 5y ago
    Switzerland, home of the Crypto AG. Switzerland lost its reputation as a secure privacy haven.
    - scns 5y ago
      The mail service that handed over data of a customer to a foreign government and changed the privacy statement on their site is based there too IIRC. The name eludes me know, surely several readers can provide it.
      - TacticalCoder 5y ago
        protonmail? Although I take it they are still to be trusted more than most.
      - woko 5y ago
        There are several issues with your statement. > The mail service that handed over data of a customer to a foreign government First, ProtonMail can only hand over meta-data, because data is encrypted. Second, "ProtonMail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities." > and changed the privacy statement on their site The privacy policy was not misleading if you read it carefully. It was not "changed" as in removing a lie from the statement. At best, it was clarified to ensure *everyone* would correctly understand it in the future. It is accessible at https://protonmail.com/privacy-policy https://protonmail.com/privacy-policy What may have been misleading was the marketing message on the homepage. If you pondered each word of the one-sentence marketing message, you could have guessed that the expression "by default" was there for a purpose. Companies do not add useless words for marketing, they do it to avoid false advertisement. However, this is not the same thing as the privacy policy. And ProtonMail stated that they would fix that: "we will be making updates to our website to better clarify ProtonMail’s obligations in cases of criminal prosecution". Quotes are taken from: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
- beermonster 5y ago
  And likewise, although I don’t trust Cloud service providers all that much… I’d sooner spin up my own VM and run strongSwan or WireGuard than use a VPN provider.
  - aborsy 5y ago
    Now you have to trust your VM provider, mostly US providers, that actually mention they collect some data and traffic to improve their services and comply with law.
    - beermonster 5y ago
      This is true. But you can’t have an internet connection without trusting at least somebody ?
  - throwaway675309 5y ago
    Wouldn't it just be a different type of vector in terms of being able to nail you though? Since the VM company (unlike a VPN such as mullvad) makes zero promises with respect to keeping logs, if you visited badsite.com, then later the FBI raids badsite.com, sees a VM company IP address, subpoenas your VM company who says that your particular VM was leasing that specific IP at time XX:XX:XX, then you're done. Further, mullvad gives you several relatively anonymous means of purchasing a VPN, whereas the vast majority of VM companies (digital ocean, linode) will require and store all manner of personally identifiable information about you.
    - beermonster 5y ago
      > Wouldn't it just be a different type of vector in terms of being able to nail you though? Quite. Depends on your threat model and what you’re using the VPN for in the first place.
- intricatedetail 5y ago
  If VPNs really protected from anything they would be illegal. At best you can slightly avoid being targeted by advertisers. I assume any system I use is compromised already.
- simorley 5y ago
  I no more trust VPN providers than I do online pdf converters. I wonder how many people submit their sensitive documents to these online services to convert their documents to pdf.
  - kwertyoowiyop 5y ago
    I’m going to start an online Excel proofreader and logic checker. Should be interesting! /JK
  - Aerroon 5y ago
    If the only way they know how to make their document into a PDF is an online converter and they need the document as PDF them that's what they're going to do. It really doesn't help that exporting documents as a PDF was an arcane process for a long time.
    - Ziomislaw 5y ago
      press print document, select pdf, confirm - done! arcane?
      - mtVessel 5y ago
        How quickly we forget the dark days before PDF print drivers.
      - Aerroon 5y ago
        For a lot of people? Yes, this is not intuitive. If a user wants to "save a file" then why do they have to press the "print" button and select a "printer" that's not actually a printer? Saving/exporting as a PDF should be something you select in the same menu as saving a file normally. Or at least something very close an obvious. Also, back when a lot of people first used computers the option to print as pdf might not have been available for them.
- arthur_sav 5y ago
  The US has spent considerable time and money to add backdoors to any piece of software & hardware that exists out there. So, i'd imagine, VPNs to be high on the list because of their nature. I would not trust VPNs for any kind of serious privacy, at least not the popular ones. Maybe some small niche VPNs can fly under the radar.
  - SahAssar 5y ago
    Anyone expecting real privacy would use a VPN paid with SnailOnionCoin over a double-TOR homomorphic tunnel on tails.
- mensetmanusman 5y ago
  ISPs send emails immediately if someone uses your IP address to download a BBC episode.
homarp 5y ago
"ExpressVPN Knew 'Key Facts' of Executive Who Worked for UAE Spy Unit" - https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hacking-project-raven-daniel-gericke https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hackin...
eternalban 5y ago
"former citizen Daniel Gericke". Which country does he pledge his allegiance to now?
ramijames 5y ago
https://www.softether.org/ https://www.softether.org/ it's not that hard to set up your own VPN.

tyingq 5y ago

Hah. Anticipated bail money, perhaps :)

joe_the_user 5y ago
Double hah, original headline: "Three Former U.S. Intelligence Community and Military Personnel Agree to Pay More Than $1.68 Million to Resolve Criminal Charges" - That billion more than covers. Given the circumstances, the settlement is a bit paltry.

nostromo 5y ago

It's crazy to me how many unscrupulous actors there are in the VPN space where you really really need to trust your provider. I don't trust my ISP much at all, but I still trust them more than almost any VPN provider.

downWidOutaFite 5y ago
I don't trust any security-oriented software of any kind.
latchkey 5y ago
Why would you want to trust your VPN provider? That's like saying: "you really really need to trust a Bitcoin miner" I'd hope the VPN service is built and operated in a way that doesn't require trust, but provides the same level of security. edit: Since there is confusion in the responses. I'd prefer to trust no-one.
- HappySweeney 5y ago
  How would you verify there are no logs kept?
  - latchkey 5y ago
    Inverse is true as well. How do you prove it?
    - jonfw 5y ago
      You can't prove it, which is why you want to find a VPN provider you can trust
    - cblconfederate 5y ago
      Someone can steal their logs
- whoknew1122 5y ago
  But then you have to trust that the VPN service is built and operated the way they say it is. Or have we already forgot about Zoom's "end-to-end encryption?"
- BenoitEssiambre 5y ago
  I don't think VPNs go that far. Wouldn't that be more like Tor type of security?
- kbenson 5y ago
  There's always trust involved. You have to trust the DNS infrastructure, you have to trust your ISP, you have to trust the VPN provider. You don't have to trust them completely, but you have to trust them at least somewhat. We take steps to reduce the amount of trust required, such as splitting that trust across many parties, so any one party hopefully can't betray us enough that it matters or that we don't notice, but there's still a lot of trust. For example, we use SSL certificates and certificate authorities that are known ahead of time to protect from problems on the network, but that requires you trust your OS and/or your browser, which is generally how you receive those certificate authorities. If I'm able to get my own CA on your system and trusted, and I can see your traffic, it doesn't matter whether you're using HTTPS connections. A VPN provider might say they're not keeping logs, or that their servers are not beholden to a third party and traffic is not being analyzed, but ultimately all you have is their word on that. Ultimately, the only thing different between you connecting to the NSA and routing all your traffic (even if your traffic is mostly encrypted) through them so they can look at it and a VPN provider is that you trust the VPN provider when they say they aren't the NSA and they aren't looking at your traffic.
midnightGhost 5y ago
I'm in the same boat. Though I actually do trust my VPN provider Mullvad. Highly talked about, based in Switzerland, and Mozilla also uses them for their VPN service. Edit: Sorry. Not Switzerland. Sweden. For some reason thought Switzerland.
- croes 5y ago
  Switzerland, home of the Crypto AG. Switzerland lost its reputation as a secure privacy haven.
  - scns 5y ago
    The mail service that handed over data of a customer to a foreign government and changed the privacy statement on their site is based there too IIRC. The name eludes me know, surely several readers can provide it.
    - TacticalCoder 5y ago
      protonmail? Although I take it they are still to be trusted more than most.
    - woko 5y ago
      There are several issues with your statement. > The mail service that handed over data of a customer to a foreign government First, ProtonMail can only hand over meta-data, because data is encrypted. Second, "ProtonMail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities." > and changed the privacy statement on their site The privacy policy was not misleading if you read it carefully. It was not "changed" as in removing a lie from the statement. At best, it was clarified to ensure *everyone* would correctly understand it in the future. It is accessible at https://protonmail.com/privacy-policy https://protonmail.com/privacy-policy What may have been misleading was the marketing message on the homepage. If you pondered each word of the one-sentence marketing message, you could have guessed that the expression "by default" was there for a purpose. Companies do not add useless words for marketing, they do it to avoid false advertisement. However, this is not the same thing as the privacy policy. And ProtonMail stated that they would fix that: "we will be making updates to our website to better clarify ProtonMail’s obligations in cases of criminal prosecution". Quotes are taken from: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
beermonster 5y ago
And likewise, although I don’t trust Cloud service providers all that much… I’d sooner spin up my own VM and run strongSwan or WireGuard than use a VPN provider.
- aborsy 5y ago
  Now you have to trust your VM provider, mostly US providers, that actually mention they collect some data and traffic to improve their services and comply with law.
  - beermonster 5y ago
    This is true. But you can’t have an internet connection without trusting at least somebody ?
- throwaway675309 5y ago
  Wouldn't it just be a different type of vector in terms of being able to nail you though? Since the VM company (unlike a VPN such as mullvad) makes zero promises with respect to keeping logs, if you visited badsite.com, then later the FBI raids badsite.com, sees a VM company IP address, subpoenas your VM company who says that your particular VM was leasing that specific IP at time XX:XX:XX, then you're done. Further, mullvad gives you several relatively anonymous means of purchasing a VPN, whereas the vast majority of VM companies (digital ocean, linode) will require and store all manner of personally identifiable information about you.
  - beermonster 5y ago
    > Wouldn't it just be a different type of vector in terms of being able to nail you though? Quite. Depends on your threat model and what you’re using the VPN for in the first place.
intricatedetail 5y ago
If VPNs really protected from anything they would be illegal. At best you can slightly avoid being targeted by advertisers. I assume any system I use is compromised already.
simorley 5y ago
I no more trust VPN providers than I do online pdf converters. I wonder how many people submit their sensitive documents to these online services to convert their documents to pdf.
- kwertyoowiyop 5y ago
  I’m going to start an online Excel proofreader and logic checker. Should be interesting! /JK
- Aerroon 5y ago
  If the only way they know how to make their document into a PDF is an online converter and they need the document as PDF them that's what they're going to do. It really doesn't help that exporting documents as a PDF was an arcane process for a long time.
  - Ziomislaw 5y ago
    press print document, select pdf, confirm - done! arcane?
    - mtVessel 5y ago
      How quickly we forget the dark days before PDF print drivers.
    - Aerroon 5y ago
      For a lot of people? Yes, this is not intuitive. If a user wants to "save a file" then why do they have to press the "print" button and select a "printer" that's not actually a printer? Saving/exporting as a PDF should be something you select in the same menu as saving a file normally. Or at least something very close an obvious. Also, back when a lot of people first used computers the option to print as pdf might not have been available for them.
arthur_sav 5y ago
The US has spent considerable time and money to add backdoors to any piece of software & hardware that exists out there. So, i'd imagine, VPNs to be high on the list because of their nature. I would not trust VPNs for any kind of serious privacy, at least not the popular ones. Maybe some small niche VPNs can fly under the radar.
- SahAssar 5y ago
  Anyone expecting real privacy would use a VPN paid with SnailOnionCoin over a double-TOR homomorphic tunnel on tails.
mensetmanusman 5y ago
ISPs send emails immediately if someone uses your IP address to download a BBC episode.

homarp 5y ago

"ExpressVPN Knew 'Key Facts' of Executive Who Worked for UAE Spy Unit" - https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hacking-project-raven-daniel-gericke https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hackin...

eternalban 5y ago

"former citizen Daniel Gericke". Which country does he pledge his allegiance to now?

ramijames 5y ago

https://www.softether.org/ https://www.softether.org/ it's not that hard to set up your own VPN.