5 ms·

NordVPN has killed their warrant canary

111 points by bearbearbear 5y ago

mashpoe 5y ago
Anyone who knows anything about VPN services knows that they don't stop people from looking in on what you're doing; they only stop people other than the provider from doing so. Most if not all of the big VPN providers collect data and give it to law enforcement, which isn't exactly news to us. Tom Scott had a pretty good video on what VPNs can actually deliver on, despite the claims of many sponsored content creators. He lost his VPN sponsorship because he pointed out, among other things, that you don't actually have guaranteed privacy with these services.
- andreareina 5y ago
  My read is that it was more about the stuff he was calling out as legitimate[1] use-cases (which iirc included piracy). ETA: I'm surprised these providers are even able to market with the use-case of evading geo-locking without getting sued (tbc I'm against drm in general and geo-locking in particular) [1] from the standpoint of, "is this a good reason to use a vpn", not "does society/the law consider this a legitimate thing to do"
  - ipaddr 5y ago
    I doubt it is against the laws where the provider is located. Geo-locking isn't a law. It might have been part of the tpp that the US never signed. Certain marketplaces don't allow vpn advertising or wording like that. In reality they act as a Canadian store selling drugs to the US customers at a discount.
BaconPackets 5y ago
It's mind boggling that selling VPN services became a thing. Was I the NSA or any state level actor, selling a VPN service as a front seems the best thing to do to cast a pretty wide net.
- DarylZero 5y ago
  People do it to hide their location from Netflix. Don't think they care about NSA.
  - just_steve_h 5y ago
    Yeah but Netflix is better than most (possibly not better than the NSA but likely on a par with them) at determining which users are coming in via VPN.
    - ugjka 5y ago
      I had a VPN buster bot on an IRC channel I was moderating because of some persistent troll who kept switching between every VPN that is out there. Apart from using a deny list that you can find on Github, you just look at the size of the subnet the IP is coming from in WHOIS output. VPN IP adresses are part of very small subnets unlike legit ISP ip addresses that come from wide subnets https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go (it is not pretty, i know, but it worked)
      - deleted 5y ago
        [deleted]
  - blitzar 5y ago
    People think they are hiding from the NSA, the CIA, the FBI, the sherrifs department and the criminals trying to steal your banking details.
  - antifa 5y ago
    IDK about most people, I just don't want my ISP to know about my torrents.
    - bradknowles 5y ago
      I don’t want my ISP (AT&T) fucking with my web traffic and inserting their own ads, throttling access to sites they don’t like (such as Netflix) because those sites compete with company-owned assets or partners that they would like to force everyone to use. Yes, AT&T has been shown to be doing all these things.
dzhiurgis 5y ago
NordVPN is incorporated in Caymans, while actual dev team is in Lithuania (Tesonet). They also sell “ethically” sourced residential proxies via Oxylabs :)
user764743 5y ago
>"From day one of our operations, we have never provided any customer data to law enforcement.. We never, for a second, logged user VPN traffic," Dutch ISP KPN was the target of a blackmail attempt in October 2017 by an ex-employee who was using NordVPN. According to a lecture given by KPN's cert team members at BalCCon 2019, NordVPN gave out everything they had including logs to law enforcement. Pretty sure someone can find the court documents about it.
egberts1 5y ago
“…not comply…”. (we may be forced) It is a tri-state legalistic term: didn’t, forced to, complied with.
AndrewThrowaway 5y ago
It is surprising for me how people can't imagine a scenario where: Some government agency (KGB, FBI, CSI, whatever) comes to VPN, secure mail, etc provider; Informs that some "enemy of the state" is using the service; Demands to overtake the service, install some software etc; Or else CEO of the service is also an "enemy of the state". From this moment this service is not only "not secure" but directly allows access to your email data, leaks all the keys, passwords, browsing history, logs whatever they want etc. Yeah VPN will allow you cheat Netflix. Never trust any service to not comply to some government agency.
- c0balt 5y ago
  The only real way out is quitting the country iirc like lavabit. Though even then it's either too late or not in accordance with shareholders for most companies.
- scubbo 5y ago
  Most people can imagine that scenario. The problem is that there is literally no other alternative. You either use a VPN (which _might_ be compromised), or you don't (in which case your traffic is even less protected).
- dTal 5y ago
  Hm, how does the VPN leak email data, passwords etc? Those things should never be passed in cleartext anyway, so I don't see how they can intercept anything except the metadata of what IP addresses you connect you, provided they aren't MITMing SSL somehow.
danlugo92 5y ago
https://torguard.net/ https://torguard.net/ ^ VPN Payable in Bitcoin

111 points by bearbearbear 5y ago

Anyone who knows anything about VPN services knows that they don't stop people from looking in on what you're doing; they only stop people other than the provider from doing so. Most if not all of the big VPN providers collect data and give it to law enforcement, which isn't exactly news to us. Tom Scott had a pretty good video on what VPNs can actually deliver on, despite the claims of many sponsored content creators. He lost his VPN sponsorship because he pointed out, among other things, that you don't actually have guaranteed privacy with these services.

andreareina 5y ago
My read is that it was more about the stuff he was calling out as legitimate[1] use-cases (which iirc included piracy). ETA: I'm surprised these providers are even able to market with the use-case of evading geo-locking without getting sued (tbc I'm against drm in general and geo-locking in particular) [1] from the standpoint of, "is this a good reason to use a vpn", not "does society/the law consider this a legitimate thing to do"
- ipaddr 5y ago
  I doubt it is against the laws where the provider is located. Geo-locking isn't a law. It might have been part of the tpp that the US never signed. Certain marketplaces don't allow vpn advertising or wording like that. In reality they act as a Canadian store selling drugs to the US customers at a discount.

BaconPackets 5y ago

It's mind boggling that selling VPN services became a thing. Was I the NSA or any state level actor, selling a VPN service as a front seems the best thing to do to cast a pretty wide net.

DarylZero 5y ago
People do it to hide their location from Netflix. Don't think they care about NSA.
- just_steve_h 5y ago
  Yeah but Netflix is better than most (possibly not better than the NSA but likely on a par with them) at determining which users are coming in via VPN.
  - ugjka 5y ago
    I had a VPN buster bot on an IRC channel I was moderating because of some persistent troll who kept switching between every VPN that is out there. Apart from using a deny list that you can find on Github, you just look at the size of the subnet the IP is coming from in WHOIS output. VPN IP adresses are part of very small subnets unlike legit ISP ip addresses that come from wide subnets https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go (it is not pretty, i know, but it worked)
    - deleted 5y ago
      [deleted]
- blitzar 5y ago
  People think they are hiding from the NSA, the CIA, the FBI, the sherrifs department and the criminals trying to steal your banking details.
- antifa 5y ago
  IDK about most people, I just don't want my ISP to know about my torrents.
  - bradknowles 5y ago
    I don’t want my ISP (AT&T) fucking with my web traffic and inserting their own ads, throttling access to sites they don’t like (such as Netflix) because those sites compete with company-owned assets or partners that they would like to force everyone to use. Yes, AT&T has been shown to be doing all these things.

dzhiurgis 5y ago

NordVPN is incorporated in Caymans, while actual dev team is in Lithuania (Tesonet). They also sell “ethically” sourced residential proxies via Oxylabs :)

user764743 5y ago

>"From day one of our operations, we have never provided any customer data to law enforcement.. We never, for a second, logged user VPN traffic," Dutch ISP KPN was the target of a blackmail attempt in October 2017 by an ex-employee who was using NordVPN. According to a lecture given by KPN's cert team members at BalCCon 2019, NordVPN gave out everything they had including logs to law enforcement. Pretty sure someone can find the court documents about it.

egberts1 5y ago

“…not comply…”. (we may be forced) It is a tri-state legalistic term: didn’t, forced to, complied with.

AndrewThrowaway 5y ago

It is surprising for me how people can't imagine a scenario where: Some government agency (KGB, FBI, CSI, whatever) comes to VPN, secure mail, etc provider; Informs that some "enemy of the state" is using the service; Demands to overtake the service, install some software etc; Or else CEO of the service is also an "enemy of the state". From this moment this service is not only "not secure" but directly allows access to your email data, leaks all the keys, passwords, browsing history, logs whatever they want etc. Yeah VPN will allow you cheat Netflix. Never trust any service to not comply to some government agency.

c0balt 5y ago
The only real way out is quitting the country iirc like lavabit. Though even then it's either too late or not in accordance with shareholders for most companies.
scubbo 5y ago
Most people can imagine that scenario. The problem is that there is literally no other alternative. You either use a VPN (which _might_ be compromised), or you don't (in which case your traffic is even less protected).
dTal 5y ago
Hm, how does the VPN leak email data, passwords etc? Those things should never be passed in cleartext anyway, so I don't see how they can intercept anything except the metadata of what IP addresses you connect you, provided they aren't MITMing SSL somehow.

danlugo92 5y ago

https://torguard.net/ https://torguard.net/ ^ VPN Payable in Bitcoin