11 ms·

So is hola vpn: https://www.theregister.com/2015/06/10/hola_gets_holes_poked_in_client_lulzsec/ https://www.theregister.com/2015/06/10/hola_gets_holes_poked...

• moffkalast 3y ago
  Yeah, Nord is for example infamous for pimping out their users as scraping proxies: https://oxylabs.io/pricing/residential-proxy-pool https://oxylabs.io/pricing/residential-proxy-pool
  • jvanderbot 3y ago
    I don't know why, but I did not expect a completely public, normal looking pricing page for something this nefarious-seeming.
  • sim7c00 3y ago
    luminati.io, similar for hola. guess they rebranded now as that one redirects :p but its still the same. this should be illegal really...
  • KomoD 3y ago
    Nord as in NordVPN? Source in that case please?
    • moffkalast 3y ago
      https://www.techradar.com/news/judge-orders-mediation-after-jury-orders-oxylabs-to-pay-dollar75m-in-latest-episode-of-proxy-wars https://www.techradar.com/news/judge-orders-mediation-after-... http://web.archive.org/web/20191128170008/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 http://web.archive.org/web/20191128170008/https://medium.com... It's pretty well known.
      • KomoD 3y ago
        Skimmed it and I don't see anything about Nord making their users into proxies, second link is questionable (since its deleted and you linked to an archive)
        • internetter 3y ago
          > Aside from its link to Oxylabs, Tesonet also advertises itself as a creator and investor of a number of online services, including NordVPN, Hostinger and others. Where else would they get the 100 million users?
          • KomoD 3y ago
            Yeah I saw that part but it does not mean they are using the users from NordVPN for Oxylabs, there's nothing explicitly showing so.
            • girvo 3y ago
              I'll be honest, the fact that they're directly linked to Oxylabs alone is enough to deter me. I can't see how else they'd get 100 million+ residential customers on Oxylabs side... sure, I'm not going to go around claiming I have direct proof, but that's more than enough for me to not use their services.
          • wswope 3y ago
            Why don't you try installing Nord in a VM and monitoring traffic yourself, instead of taking low-quality blogspam Medium articles at face value? If they're truly hijacking end user clients, why don't you point to the section of their open source client that's responsible for that? https://github.com/NordSecurity/nordvpn-linux https://github.com/NordSecurity/nordvpn-linux Easy enough to prove.
            • KomoD 3y ago
              Exactly, I'd love to see some proper proof other than "the parent company owns a residential proxy service"
  • klelatti 3y ago
    Gosh. "We are a market-leading web intelligence collection platform, driven by the highest business ethics" I think that's a bit debatable!
    • greyface- 3y ago
      I own some IPv4 space and get constant spam from these companies with pitches like "monetize your IP addresses". It's funny how upset they get when you respond and use the word "botnet" to describe their operation, or suggest that the traffic they generate is illegitimate.
      • klelatti 3y ago
        I think it's known as 'touching a nerve'!
      • sokoloff 3y ago
        It’s difficult to get a person to understand something when their income depends on them not understanding it. —Upton Sinclair
    • sim7c00 3y ago
      business ethics. these words seem contradictory haha. not to say theres no ethical businesses, but it just sounds funny to me :D
      • earleybird 3y ago
        There are no ethical businesses. A lawn mower can give you a nicely manicured lawn or a trip to the ER. The lawn mower doesn't care.
        • moffkalast 3y ago
          It would take quite a while to drive to the ER on a lawn mower. You're supposed to call the ambulance /s
        • 3y ago
  • codedokode 3y ago
    And why is there need for scraping proxies? Because greedy capitalists do not allow to scrape their sites.
    • kortilla 3y ago
      It has nothing to do with greedy capitalists. I don’t want anyone scraping my site at all. I don’t charge anything for it.
      • codedokode 3y ago
        Let's take as an example a website which compares prices in different stores and shows which has the cheapest price. You can do it manually, but using automation it is faster and more convenient. Is doesn't make sense to read websites manually when you can use a script or a language model. Obviously for consumer it is better to be able to scrape sites. It is only those store owners (greedy capitalists) who do not want consumer to know that their prices are inflated. Another thing is looking for some information, it is better just to have a language model go around the web and summarize the data for you rather than read someone's site with white letters on black background and weird font.
    • dewey 3y ago
      It's not uncommon that companies ask other companies to scrape their site as they don't have the tech resources to build an API / integration for whatever they want to have.
    • sim7c00 3y ago
      if u run a small site and ppl scrape it aggresively that can rack up ur bills.depending on where u host ur site. ofcourse not an issue for billion dollar companies, but a line needs to be drawn somewhere. also, whats the purpose of the scraping? usually its greedy capatalist purposes, so.then ur point is a bit moot, dont u think?
      • codedokode 3y ago
        Let's say someone makes a site that compares prices in different stores. It needs a lot of scraping, but is useful for consumers. Obviously, the only ones who are against it will be the store owners.
  • noizejoy 3y ago
    > While the lawsuit names Lithuania-based Teso LT, UAB as a defendant rather than “Tesonet”, this is as a result of a corporate restructuring several years ago. Aside from its link to Oxylabs, Tesonet also advertises itself as a creator and investor of a number of online services, including NordVPN, Hostinger and others.[0] [0] https://www.techradar.com/news/judge-orders-mediation-after-jury-orders-oxylabs-to-pay-dollar75m-in-latest-episode-of-proxy-wars https://www.techradar.com/news/judge-orders-mediation-after-...
  • dhdhhdd 3y ago
    Nord offers OpenVPN configs. Those configs don't seem to allow nat/routing from Nord VPN network? I never looked into that, but always used Nord VPN via the official OpenVPN client.
    • Timber-6539 3y ago
      While old OpenVPN configurations still work, NordVPN stopped providing username and password for OpenVPN configs in the account dashboard.
• sim7c00 3y ago
  hola redirects things like web scrapers over their infra. once worked for a lead generation startup (i am so sorry..) where one of their services reached out to ask if i wanted to send traffic over their network. sad this is some legal loophole. (sad for them and probarbly us, we didnt do scraping :)))
• cookiengineer 3y ago
  Once you dig into how the Kape Technologies holding is linked to the same people of the NSO Group scandals, well, good luck finding a VPN that didn't sell out their customers.
  • littlestymaar 3y ago
    Is there anything wrong with Mullvad?
    • NavinF 3y ago
      They don't support port forwarding which eliminates the main use cases for VPNs: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
      • verandaguy 3y ago
        It eliminates your main use cases for VPNs (and while it's a shame that the feature is being pulled, port forwarding has always been ripe with abuse). I formerly worked in the consumer VPN space (an older, but once quite big player), and use cases go from content access (including everything from getting US Netflix from Germany, to sidestepping national firewalls), to general-purpose paranoia about IP logging by websites. There are also lots of cases that get marketed a bit too liberally by companies like Nord, Express, and the hydra that is Kape, like that VPNs can add meaningful security to submitting payment information online; this is despite the fact that it's harder than ever to MITM payment sites. It's generally agreed that the state of public Wi-Fi combined with evolving web standards and sky-high HTTPS adoption makes VPNs largely, though definitely not completely obsolete for protecting yourself against someone sniffing traffic at Starbucks. Having said all that: if you need a VPN and a lack of port-forwarding isn't a dealbreaker, I wholeheartedly recommend Mullvad. My former company never worked with them directly but our team had immense respect for their integrity, ethics, and approach to developing a quality product.
    • cookiengineer 3y ago
      Honestly it's hard to tell, but Mullvard seems to be one of the last options. The problem I have with all the "checks" that press foundations do is that none of them seem to know what they're talking about in regards to what tech is trustworthy and audited, and what is not. I found a nice article about it, skimmed through it and seems to be true and reflect my own research that I did for my cyber defense network [1] [1] https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/ https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-2...
• ajnin 3y ago
  It's not the same thing, Hola was found to use clients as exit nodes, which is definitely an abuse of client trust, resources, and potentially exposing them to major legal trouble or otherwise, but I don't think that can be considered a botnet, whereas the VPN app in question here is pulling lists of URLs from control sites and then directly sending requests to them, so it operates in the C&C fashion of a botnet.
  • berkle4455 3y ago
    > Hola was found to use clients as exit nodes Hola is ran by luminati/bright data which absolutely are pure scum scam botnet-enabling shitbag company.
    • lll-o-lll 3y ago
      Yes, but it is a different type of scum. We need to correctly categorise the scum or it’ll be chaos!
      • poink 3y ago
        I couldn’t disagree more. Scum is scum. The people who can discern the difference are few and far between, and we shouldn’t muddy the waters between different types of scum for the already-overwhelmed layperson. Most people exclusively care about scum vs. not scum, and all but vuln-dev level sources shouldn’t distinguish. Maybe HN fell on the savvy side of this at one point, but it was so long ago…
        • dtjb 3y ago
          I appreciate the specificity, especially on a forum of tech-inclined users and collapsible comments.
          • poink 3y ago
            If you’re “tech-inclined” enough to understand the difference, how does it alter your behavior?
• sspiff 3y ago
  Does anyone have any indication of ProtonVPN doing something fishy? I always considered them fairly trustworthy and they offer a free option.
  • augusto-moura 3y ago
    Never heard of anything, and as a paid user, they never let me down either. Is the only VPN (and email provider) I actually trust
  • vGPU 3y ago
    https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://encryp.ch/blog/disturbing-facts-about-protonmail/
    • mu53 3y ago
      These days, is there a single email provider out there that wouldn't do that?
      • vGPU 3y ago
        Almost certainly not.
    • protonmail 3y ago
      This article has long been debunked: http://web.archive.org/web/20210728130935/https://serpentsec.1337.cx/i-was-asked-to-review-an-article-from http://web.archive.org/web/20210728130935/https://serpentsec...
• geek_at 3y ago
  Back in the day the "privacy tool" of choice were anonymous proxies. I wrote an article in 2013 about why free proxies are free [1] and got so much feedback from people who had never thought about that. This was back in the HTTP only days (very shortly before the Snowden leaks) and it was a good way to make money because your proxy could just replace all ads on all sites with your Google ads and you could see all communication. Insane from today's view In 2015 I did a followup post where I analyzed the existing proxies for any manipulation of the original site and found that 80% of the free proxies did in fact change something [2] [1] https://blog.haschek.at/2013/05/why-free-proxies-are-free-js-infection.html https://blog.haschek.at/2013/05/why-free-proxies-are-free-js... [2] https://blog.haschek.at/2015-analyzing-443-free-proxies/ https://blog.haschek.at/2015-analyzing-443-free-proxies/
  • stef25 3y ago
    That was one of my first personal projects over 20 years ago now. Didn't get much clicks on my ads though. And once you look in your logs to see what people are searching for, you'll quickly come to the conclusion you don't want to run that kind of service anymore.