7 ms·

Also: > ExpressVPN says in a statement that it knew the 'key facts' of the employment history of one of its executives, Daniel Gericke. On Tuesday Gericke was

Also: > ExpressVPN says in a statement that it knew the 'key facts' of the employment history of one of its executives, Daniel Gericke. On Tuesday Gericke was revealed in court records to have worked on the UAE's hacking and spying operation > https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hacking-project-raven-daniel-gericke https://www.vice.com/en/article/3aq9p5/expressvpn-uae-hackin... https://nitter.net/josephfcox/status/1438127822883729412 https://nitter.net/josephfcox/status/1438127822883729412

0-_-0 5y ago
"Daniel has a deep understanding of the tools and techniques used by the adversaries we aim to protect users against, and as such is a uniquely qualified expert to advise on defense against such threats. Our product and infrastructure have already benefited from that understanding in better securing user data,"
- penagwin 5y ago
  Yeah it's a tricky one isn't it? On one hand many of the best security researches are ex-state employees, and many of them go from that into the private sector. On the other hand it makes it sound like they are friendly with potential adversaries.
  - duped 5y ago
    I feel like the threat model for consumer VPNs doesn't include state actors
    - croshan 5y ago
      You don't? I don't think activists only use TOR, I'd imagine they layer a VPN on as well, they're not mutually exclusive.
      - fragmede 5y ago
        The threat model for "I want to watch Netflix in a different country than the one I'm in" is totally different from "I'm Edward Snowden and the CIA wants my ass". Consumer-grade VPNs protect against the first "threat" alright, but it's a totally different ball game to protect against an APT like the NSA/CIA, who will break into your VPN company's office in the middle of the night and replace all of the computer keyboards with exact replicas that have a keyloggers inside in order to get access to your data. See also: https://news.ycombinator.com/item?id=25914734 https://news.ycombinator.com/item?id=25914734
  - boramalper 5y ago
    People are also against to see an ex-spy employed by a company that promises (to some degree) to protect their customers from the abuses of such governments—there is also a moral angle to it. "Daniel has a deep understanding of the tools and techniques used by the adversaries" because, well, he was one of the adversaries. It's like a private security company employing a former criminal.
    - mindcrime 5y ago
      It's like a private security company employing a former criminal. I mean... would you hire Kevin Mitnick's company? Lots of people do (apparently, considering they've been in business this long), but yet he's a former "criminal". It really is a tricky analysis. Who knows hackers better than a former hacker? But how can you trust a "former" hacker? Hmm...
      - boramalper 5y ago
        I agree that the analysis is tricker though I disagree that Kevin Mitnick is an appropriate example—Mitnick is quite innocent in the scale of what Gericke’s employer (Signals Intelligence Agency [SIA]) has done[0][1], even if we were to exaggerate Mitnick’s crimes. [0] https://en.wikipedia.org/wiki/ToTok_(app)#Surveillance_tool_reports https://en.wikipedia.org/wiki/ToTok_(app)#Surveillance_tool_... [1] https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi...
        mindcrime 5y ago
        That's the reason for the quotes around "criminal" above. Mitnick turning "white hat" just happened to be the first (roughly) analogous example that popped to mind.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

0-_-0 5y ago

"Daniel has a deep understanding of the tools and techniques used by the adversaries we aim to protect users against, and as such is a uniquely qualified expert to advise on defense against such threats. Our product and infrastructure have already benefited from that understanding in better securing user data,"

penagwin 5y ago
Yeah it's a tricky one isn't it? On one hand many of the best security researches are ex-state employees, and many of them go from that into the private sector. On the other hand it makes it sound like they are friendly with potential adversaries.
- duped 5y ago
  I feel like the threat model for consumer VPNs doesn't include state actors
  - croshan 5y ago
    You don't? I don't think activists only use TOR, I'd imagine they layer a VPN on as well, they're not mutually exclusive.
    - fragmede 5y ago
      The threat model for "I want to watch Netflix in a different country than the one I'm in" is totally different from "I'm Edward Snowden and the CIA wants my ass". Consumer-grade VPNs protect against the first "threat" alright, but it's a totally different ball game to protect against an APT like the NSA/CIA, who will break into your VPN company's office in the middle of the night and replace all of the computer keyboards with exact replicas that have a keyloggers inside in order to get access to your data. See also: https://news.ycombinator.com/item?id=25914734 https://news.ycombinator.com/item?id=25914734
- boramalper 5y ago
  People are also against to see an ex-spy employed by a company that promises (to some degree) to protect their customers from the abuses of such governments—there is also a moral angle to it. "Daniel has a deep understanding of the tools and techniques used by the adversaries" because, well, he was one of the adversaries. It's like a private security company employing a former criminal.
  - mindcrime 5y ago
    It's like a private security company employing a former criminal. I mean... would you hire Kevin Mitnick's company? Lots of people do (apparently, considering they've been in business this long), but yet he's a former "criminal". It really is a tricky analysis. Who knows hackers better than a former hacker? But how can you trust a "former" hacker? Hmm...
    - boramalper 5y ago
      I agree that the analysis is tricker though I disagree that Kevin Mitnick is an appropriate example—Mitnick is quite innocent in the scale of what Gericke’s employer (Signals Intelligence Agency [SIA]) has done[0][1], even if we were to exaggerate Mitnick’s crimes. [0] https://en.wikipedia.org/wiki/ToTok_(app)#Surveillance_tool_reports https://en.wikipedia.org/wiki/ToTok_(app)#Surveillance_tool_... [1] https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi...
      - mindcrime 5y ago
        That's the reason for the quotes around "criminal" above. Mitnick turning "white hat" just happened to be the first (roughly) analogous example that popped to mind.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]