25 ms·

Rejecting data demands, ExpressVPN removes VPN servers in India

231 points by noufalibrahim 4y ago

DarthNebo 4y ago
Wonder whether the government of India makes any demarcation between corporate VPN or personal VPNs? Or is it just consumer VPN services that need to comply. Everything from cloud vendors, ZScaler, Cisco AnyConnect are technically offering access to private networks with a mix of public internet &/or intranet
- gbil 4y ago
  Usually such laws target consumer VPNs but I don't have more insights on this specific case
  - tendstofortytwo 4y ago
    Here's the specific order: https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.... Bottom of page 3 says: > Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be: > a. Validated names of subscribers/customers hiring the services > b. Period of hire including dates > c. IPs allotted to / being used by the members > d. Email address and IP address and time stamp used at the time of registration / on-boarding > e. Purpose for hiring services > f. Validated address and contact numbers > g. Ownership pattern of the subscribers / customers hiring services Seems to me like it would target all of them. But I just searched for "VPN", didn't read the full document yet.
    - pmontra 4y ago
      What's an ownership pattern?
- padheyam 4y ago
  After much hullabaloo from the industry, government has clarified that this order does not apply to corporate VPNs.
  - randombits0 4y ago
    And BAM! I’m a corporation! Hey Sai, wanna be in my corporation?
night-rider 4y ago
What if you spin up a VPS based in India and install OpenVPN/Wireguard on it? Surely they can’t demand logs of a box you operate yourself?
- 0des 4y ago
  They'd tell the provider not you
- Renaud 4y ago
  What makes you think you can operate in a country without obeying its laws, however detrimental to privacy they are ?
  - hirako2000 4y ago
    I got some for you: - principles, and going as far as extending freedom even if you personally already benefit from it - civil desobedience is a thing, even though some stances are questionable. And, I thought the debate for more needs of privacy, and given the threats have been proven to even come from governments (snowden/NSA, pegasus), was settled, visibly it isn't if even on HN such argument is given in the context of such a clear subject. The overstepping body there is the government, not the busines imo.
  - Aperocky 4y ago
    > With a recent data law introduced in India requiring all VPN providers to store user information for at least five years By not being a VPN provider? A private VPN isn't hard to make.
  - antihero 4y ago
    Disregard for laws. Can be good, can be bad, but never underestimate the empowerment of disobedience.
- wonderbore 4y ago
  Yeah but what’s the point? A single-user VPN means all traffic is already attributable to them. If the intent is just to access the Indian web, then sure. I’m sure there are plenty other non-privacy-aware VPNs that let you do that though.
dncornholio 4y ago
> Rest assured, our users will still be able to connect to VPN servers that will give them Indian IP addresses and allow them to access the internet as if they were located in India. These “virtual” India servers will instead be physically located in Singapore and the UK. Wondering why anyone is still using ip-based geolocation. The most popular use for VPN's is mocking your location to Steam and Netflix. Could be these players allow mock locations because it gives them revenue..
- hirako2000 4y ago
  Cat and mouse game seem to be nowhere near its end. And totally agree, businesses will happily play it forever. Why geo ip? Naivety/ignorance coupled with the outdated business logic that segmenting audiences to skim customers to the max will continue to be the winning strategy. It rarely come from within IT brainstorming, those in denial or sticking to short sighted green are the business strategists also being vaguely sold that controlling can be done (and to some degree yes it can be so long as consumers bases don't in their majority adopt privacy measures and moan when being unlegitimately denied access) On the more forgiving side, it does help easily monitor kiddy attacks altogether, if there is no market in Takjistan, why bother looking at false vs true positives coming from there, dumb scripts are dumb but can still be costly for the network management team.
- kevincox 4y ago
  It seems pretty clear to me at least for the Netflix case. - Content providers care because they want to sell exclusive per-region licenses. - Netflix doesn't really care, in fact the may benefit from more content available to their users. The end result is that Netflix will do the bare minimum to keep the content providers satisfied. Steam is more of a concern because they have different prices per region. But IIRC they use your billing address, not your IP location which is harder to spoof.
  - manquer 4y ago
    That is also true for Netflix and they do care. Indian monthty subscription is much lower priced and starts ~2$ than U.S. that costs like $20[1] Geolocation is largely a feature in products and in licensing because there is big purchasing power difference between rich and poor countries. Netflix has been more tolerant in the past of region bypass than others for the same reason they didn't crackdown on password sharing but won't be in the future. [1] The actual prices we pay might vary in both countries depending on promotion and tie ups etc, but these are list prices of which those components would be applied.
lapser 4y ago
> With virtual locations, the registered IP address matches the country you have chosen to connect to, while the server is physically located in another country. How does this work then? How can you have a Indian IP address, while the server is located in the UK?
- stevewatson301 4y ago
  Fake WHOIS records, you can typically populate anything there. Some geolocation providers blindly trust the values that you put in there (for example, Maxmind); others do triangulation based on trace routes and ping times to deduce if the advertised location is actually correct (ipinfo, DB-IP).
- netsharc 4y ago
  How does Geo-location from IP work anyway? From my knowledge it's just figuring out the ISP the IP-block is assigned to, and finding out the address of the ISP. But technically a computer anywhere in the world can have any IP? Or since I don't know anything about routing: are there routing rules that would think "This is an Indian IP, I'm going to forward this data towards India"?
  - jaywalk 4y ago
    Any computer can't have any IP, but the routing rules have nothing to do with physical location. Routers advertise to their neighbors the IP block(s) that they serve. As a super high level example, your ISP's core router would advertise to other ISP's routers that it serves 10.123.x.x IPs, so any IP address in that block gets sent to that router. Then within your ISP, the router in your area would advertise that it serves 10.123.45.x, so it receives packets for IPs in that more specific block from the core router. So your IP would have to be within the 10.123.45.x block, because that's what the router serving you is assigned.
  - petercooper 4y ago
    I think it goes deeper than that. Even here in the UK with its heavily centralized PoPs it's possible for geolocation tools to narrow a consumer down to a specific town (my cable connection tends to get geolocated to a big town 20 miles from me though) so I assume databases of locations of PoPs are maintained somewhere too.
0daystock 4y ago
> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?
- sodality2 4y ago
  Non-persistence of any data is a positive in terms of data at rest, how is that not a defense against surveillance? Regardless of the fact that it's not verifiable, assuming it were true, would it not be a good thing?
  - 0daystock 4y ago
    How is an anonymous, non-attributable, non-verifiable statement, from a company trying to sell you a product, worth anything? Why assume it's true when it is so contrary to even basic common sense, for anyone who has ever stood up a LAMP stack?
    - sodality2 4y ago
      I don't mean to assume it's true to validate their advertising. For the sake of argument, if a server uses only a RAM disk, is that an improvement over having disks? Of course a network can still have sneaky equipment in between but that is still possible without RAM disks, so is it not beneficial to have a RAM disk? Please note that I am not arguing in favor of their advertising or to say that it is successfully avoiding surveillance. But, do you believe that no-disk boot, assuming it actually takes place, is a positive thing, or not? I admit I misconstrued your original comment to be a criticism of the technology rather than the fact that this VPN company advertises as such. Nonetheless I do think no-disk-boot is not useless as a technology and if you have any disagreement I would love to hear it, as someone who uses a VPN (not expressVPN) that says they use the same setup.
      - 0daystock 4y ago
hklwarp 4y ago
ExpressVPN now belongs to Kape Technologies, which has a colorful history: https://www.cnet.com/tech/services-and-software/what-is-kape-technologies-what-you-need-to-know-about-the-parent-company-of-cyberghost-vpn/ https://www.cnet.com/tech/services-and-software/what-is-kape... https://www.reuters.com/technology/kape-technologies-buys-expressvpn-936-mln-2021-09-13/ https://www.reuters.com/technology/kape-technologies-buys-ex...
- cloutchaser 4y ago
  If you want a decent sized paid VPN service, you are basically choosing between Nord and Kape now. Pepsi and Coca cola.
  - WaxProlix 4y ago
    Mullvad?
    - cloutchaser 4y ago
      "decent sized" Lots of small coke companies exist too, to use my analogy again.
      - 2OEH8eoCRo0 4y ago
        Mullvad is not small.
        jchw 4y ago
        True that. IIRC Mullvad was literally the world’s largest Wireguard deployment until Cloudflare did Warp. Just because people haven’t heard of it doesn’t mean it’s small. They just don’t advertise on shitty podcasts, so it doesn’t have the same brand recognition.
        scoopertrooper 4y ago
        Would you accept RC Cola? - A loyal Mullvad customer
55555 4y ago
VPN providers sell a highly commoditized product and so anything they can do to get good publicity is worth it.
gumby 4y ago
I use a VPN service specifically to get around region locking. ExpressVPN has been pretty good in this regard though lately Netflix has stopped working. When I'm in a hotel or otherwise need to use a local wifi I use the VPN client to connect back to one of my own machines, not that I care a lot if Kape can see my traffic.
lizardactivist 4y ago
Owned by Kape, and only accepts data demands when they come from the U.S. or Israel. When it comes to VPNs, stick to the ones that are wholly owned, based, and operated in the EU.
deostroll 4y ago
Suppose a GoI website is geo-blocked such that only the citizens of India can access it. Now that a global vpn company has removed its servers out of India, does it mean its customers (while using that vpn service) is blocked from accessing the said website? Or is there some other implication here? Curious to know.
- EwanToo 4y ago
  They'll register (or purchase) IP address blocks that are marked as Indian in the various GeoIP databases, then assign those IP addresses to servers hosted outside India.
noufalibrahim 4y ago
I'm not very clued in about this but I had a question. I'm not sure about the privacy angle but if you spin up a node on a cloud provider, install a VPN on it, do your thing and then destroy it, wouldn't it serve just as well as any of these? Apart from the technical complexity of this, how different is it from using a commercial VPN provider?
- potamic 4y ago
  You lose anonymity. Your cloud provider would have all your details and most certainly have a log of all IPs used by you. If someone came looking for an IP, they would trace it back to you.
  - noufalibrahim 4y ago
    Thank you.

231 points by noufalibrahim 4y ago

Wonder whether the government of India makes any demarcation between corporate VPN or personal VPNs? Or is it just consumer VPN services that need to comply. Everything from cloud vendors, ZScaler, Cisco AnyConnect are technically offering access to private networks with a mix of public internet &/or intranet

gbil 4y ago
Usually such laws target consumer VPNs but I don't have more insights on this specific case
- tendstofortytwo 4y ago
  Here's the specific order: https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.... Bottom of page 3 says: > Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be: > a. Validated names of subscribers/customers hiring the services > b. Period of hire including dates > c. IPs allotted to / being used by the members > d. Email address and IP address and time stamp used at the time of registration / on-boarding > e. Purpose for hiring services > f. Validated address and contact numbers > g. Ownership pattern of the subscribers / customers hiring services Seems to me like it would target all of them. But I just searched for "VPN", didn't read the full document yet.
  - pmontra 4y ago
    What's an ownership pattern?
padheyam 4y ago
After much hullabaloo from the industry, government has clarified that this order does not apply to corporate VPNs.
- randombits0 4y ago
  And BAM! I’m a corporation! Hey Sai, wanna be in my corporation?

night-rider 4y ago

What if you spin up a VPS based in India and install OpenVPN/Wireguard on it? Surely they can’t demand logs of a box you operate yourself?

0des 4y ago
They'd tell the provider not you
Renaud 4y ago
What makes you think you can operate in a country without obeying its laws, however detrimental to privacy they are ?
- hirako2000 4y ago
  I got some for you: - principles, and going as far as extending freedom even if you personally already benefit from it - civil desobedience is a thing, even though some stances are questionable. And, I thought the debate for more needs of privacy, and given the threats have been proven to even come from governments (snowden/NSA, pegasus), was settled, visibly it isn't if even on HN such argument is given in the context of such a clear subject. The overstepping body there is the government, not the busines imo.
- Aperocky 4y ago
  > With a recent data law introduced in India requiring all VPN providers to store user information for at least five years By not being a VPN provider? A private VPN isn't hard to make.
- antihero 4y ago
  Disregard for laws. Can be good, can be bad, but never underestimate the empowerment of disobedience.
wonderbore 4y ago
Yeah but what’s the point? A single-user VPN means all traffic is already attributable to them. If the intent is just to access the Indian web, then sure. I’m sure there are plenty other non-privacy-aware VPNs that let you do that though.

dncornholio 4y ago

> Rest assured, our users will still be able to connect to VPN servers that will give them Indian IP addresses and allow them to access the internet as if they were located in India. These “virtual” India servers will instead be physically located in Singapore and the UK. Wondering why anyone is still using ip-based geolocation. The most popular use for VPN's is mocking your location to Steam and Netflix. Could be these players allow mock locations because it gives them revenue..

hirako2000 4y ago
Cat and mouse game seem to be nowhere near its end. And totally agree, businesses will happily play it forever. Why geo ip? Naivety/ignorance coupled with the outdated business logic that segmenting audiences to skim customers to the max will continue to be the winning strategy. It rarely come from within IT brainstorming, those in denial or sticking to short sighted green are the business strategists also being vaguely sold that controlling can be done (and to some degree yes it can be so long as consumers bases don't in their majority adopt privacy measures and moan when being unlegitimately denied access) On the more forgiving side, it does help easily monitor kiddy attacks altogether, if there is no market in Takjistan, why bother looking at false vs true positives coming from there, dumb scripts are dumb but can still be costly for the network management team.
kevincox 4y ago
It seems pretty clear to me at least for the Netflix case. - Content providers care because they want to sell exclusive per-region licenses. - Netflix doesn't really care, in fact the may benefit from more content available to their users. The end result is that Netflix will do the bare minimum to keep the content providers satisfied. Steam is more of a concern because they have different prices per region. But IIRC they use your billing address, not your IP location which is harder to spoof.
- manquer 4y ago
  That is also true for Netflix and they do care. Indian monthty subscription is much lower priced and starts ~2$ than U.S. that costs like $20[1] Geolocation is largely a feature in products and in licensing because there is big purchasing power difference between rich and poor countries. Netflix has been more tolerant in the past of region bypass than others for the same reason they didn't crackdown on password sharing but won't be in the future. [1] The actual prices we pay might vary in both countries depending on promotion and tie ups etc, but these are list prices of which those components would be applied.

lapser 4y ago

> With virtual locations, the registered IP address matches the country you have chosen to connect to, while the server is physically located in another country. How does this work then? How can you have a Indian IP address, while the server is located in the UK?

stevewatson301 4y ago
Fake WHOIS records, you can typically populate anything there. Some geolocation providers blindly trust the values that you put in there (for example, Maxmind); others do triangulation based on trace routes and ping times to deduce if the advertised location is actually correct (ipinfo, DB-IP).
netsharc 4y ago
How does Geo-location from IP work anyway? From my knowledge it's just figuring out the ISP the IP-block is assigned to, and finding out the address of the ISP. But technically a computer anywhere in the world can have any IP? Or since I don't know anything about routing: are there routing rules that would think "This is an Indian IP, I'm going to forward this data towards India"?
- jaywalk 4y ago
  Any computer can't have any IP, but the routing rules have nothing to do with physical location. Routers advertise to their neighbors the IP block(s) that they serve. As a super high level example, your ISP's core router would advertise to other ISP's routers that it serves 10.123.x.x IPs, so any IP address in that block gets sent to that router. Then within your ISP, the router in your area would advertise that it serves 10.123.45.x, so it receives packets for IPs in that more specific block from the core router. So your IP would have to be within the 10.123.45.x block, because that's what the router serving you is assigned.
- petercooper 4y ago
  I think it goes deeper than that. Even here in the UK with its heavily centralized PoPs it's possible for geolocation tools to narrow a consumer down to a specific town (my cable connection tends to get geolocated to a big town 20 miles from me though) so I assume databases of locations of PoPs are maintained somewhere too.

0daystock 4y ago

> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?

sodality2 4y ago
Non-persistence of any data is a positive in terms of data at rest, how is that not a defense against surveillance? Regardless of the fact that it's not verifiable, assuming it were true, would it not be a good thing?
- 0daystock 4y ago
  How is an anonymous, non-attributable, non-verifiable statement, from a company trying to sell you a product, worth anything? Why assume it's true when it is so contrary to even basic common sense, for anyone who has ever stood up a LAMP stack?
  - sodality2 4y ago
    I don't mean to assume it's true to validate their advertising. For the sake of argument, if a server uses only a RAM disk, is that an improvement over having disks? Of course a network can still have sneaky equipment in between but that is still possible without RAM disks, so is it not beneficial to have a RAM disk? Please note that I am not arguing in favor of their advertising or to say that it is successfully avoiding surveillance. But, do you believe that no-disk boot, assuming it actually takes place, is a positive thing, or not? I admit I misconstrued your original comment to be a criticism of the technology rather than the fact that this VPN company advertises as such. Nonetheless I do think no-disk-boot is not useless as a technology and if you have any disagreement I would love to hear it, as someone who uses a VPN (not expressVPN) that says they use the same setup.
    - 0daystock 4y ago

hklwarp 4y ago

ExpressVPN now belongs to Kape Technologies, which has a colorful history: https://www.cnet.com/tech/services-and-software/what-is-kape-technologies-what-you-need-to-know-about-the-parent-company-of-cyberghost-vpn/ https://www.cnet.com/tech/services-and-software/what-is-kape... https://www.reuters.com/technology/kape-technologies-buys-expressvpn-936-mln-2021-09-13/ https://www.reuters.com/technology/kape-technologies-buys-ex...

cloutchaser 4y ago
If you want a decent sized paid VPN service, you are basically choosing between Nord and Kape now. Pepsi and Coca cola.
- WaxProlix 4y ago
  Mullvad?
  - cloutchaser 4y ago
    "decent sized" Lots of small coke companies exist too, to use my analogy again.
    - 2OEH8eoCRo0 4y ago
      Mullvad is not small.
      - jchw 4y ago
        True that. IIRC Mullvad was literally the world’s largest Wireguard deployment until Cloudflare did Warp. Just because people haven’t heard of it doesn’t mean it’s small. They just don’t advertise on shitty podcasts, so it doesn’t have the same brand recognition.
      - scoopertrooper 4y ago
        Would you accept RC Cola? - A loyal Mullvad customer

55555 4y ago

VPN providers sell a highly commoditized product and so anything they can do to get good publicity is worth it.

gumby 4y ago

I use a VPN service specifically to get around region locking. ExpressVPN has been pretty good in this regard though lately Netflix has stopped working. When I'm in a hotel or otherwise need to use a local wifi I use the VPN client to connect back to one of my own machines, not that I care a lot if Kape can see my traffic.

lizardactivist 4y ago

Owned by Kape, and only accepts data demands when they come from the U.S. or Israel. When it comes to VPNs, stick to the ones that are wholly owned, based, and operated in the EU.

deostroll 4y ago

Suppose a GoI website is geo-blocked such that only the citizens of India can access it. Now that a global vpn company has removed its servers out of India, does it mean its customers (while using that vpn service) is blocked from accessing the said website? Or is there some other implication here? Curious to know.

EwanToo 4y ago
They'll register (or purchase) IP address blocks that are marked as Indian in the various GeoIP databases, then assign those IP addresses to servers hosted outside India.

noufalibrahim 4y ago

I'm not very clued in about this but I had a question. I'm not sure about the privacy angle but if you spin up a node on a cloud provider, install a VPN on it, do your thing and then destroy it, wouldn't it serve just as well as any of these? Apart from the technical complexity of this, how different is it from using a commercial VPN provider?

potamic 4y ago
You lose anonymity. Your cloud provider would have all your details and most certainly have a log of all IPs used by you. If someone came looking for an IP, they would trace it back to you.
- noufalibrahim 4y ago
  Thank you.