4 ms·
PureVPN IPv6 Leak
- outsideoftime 1y agoalso look up tunnel-crack if u want
- the8472 1y agonetwork namespaces provide a clean host/vpn split. https://blog.thea.codes/nordvpn-wireguard-namespaces/ https://blog.thea.codes/nordvpn-wireguard-namespaces/
- webstrand 1y agoI just built the same thing using `systemd-nspawn --directory=/ -b`. The nice part about using nspawn is that you have access to all of the normal network configuration tools like systemd-networkd to configure the devices and networks, rather than using a python script. It also provides a nice place for running services inside of the container, since process management is also included.
- IlikeKitties 1y agoI strongly suggest that you use something like Network Namespaces through Vopono[0] or Gluetun[1] if you use a commercial VPN for "privacy" or "security" aka torrenting and shitposting. Relying on these clients is always a gamble and if your software (Browser, Torrentclient, etc.) cannot know you public IP only the internal IP of the VPN you are also safe against some exploits and misconfigurations a desktop client won't protect you against. [0] https://github.com/jamesmcm/vopono https://github.com/jamesmcm/vopono [1] https://github.com/qdm12/gluetun https://github.com/qdm12/gluetun
- nikanj 1y agoI strongly suggest you disable ipv6, as nothing will break by disabling it but many things break with it enabled.
- indigo945 1y agoAlternatively, disable ipv4. The same statement holds true.
- ZiiS 1y agoUnfortunately this is not true, loads of cool techy stuff (Sentry, GitHub) etc still don't work properly on IPv6, less techy stuff really didn't care at all.
- zokier 1y agoYou can use nat64 to talk to legacy networks. Ipv6-only networks (with nat64 or 464xlat etc) are becoming increasingly popular. There is also this new concept called "ipv6-mostly network" that is getting rolled out: https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.html https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.ht...
- ta1243 1y agoLots of things will break if you disable ipv4, including my work provided zscaler windows laptop (and not break in the good way where it fails open when you block traffic to zscaler nodes on your router) Very little will break if you disable ipv6
- Varelion 1y agoWouldn't blocking IPv6 and using a kill-switch prevent leaking?
- IlikeKitties 1y agoNo, not in all cases. Imagine your Browser gets 0-dayed and just send all IPs it sees to an endpoint.
- Varelion 1y agoNoob here. If this happened, wouldn't any type of layering of network solutions ultimately result in this leaking all the same though?
- IlikeKitties 1y agoNo. The Browser or torrent prozess is sandboxed and can only see the VPN Network interface. The other interfaces are hidden.
- Denatonium 1y agoIn the case of PureVPN, the only way of preventing leaks is by switching to a different provider. There is definitive proof that they keep logs despite their claims to the contrary. I have linked to a federal criminal complaint where the FBI requested logs after the offense and was given them by PureVPN. The relevant portion is on page 22. https://www.justice.gov/archives/opa/press-release/file/1001841/dl https://www.justice.gov/archives/opa/press-release/file/1001...
- fulafel 1y agoBlock IPv4 as well and you're pretty solid.
- rasengan 1y agoSeparately, PureVPN is one of the providers you can’t trust [1]. [1] https://www.makeuseof.com/worst-vpns-you-shouldnt-trust/ https://www.makeuseof.com/worst-vpns-you-shouldnt-trust/
- lxgr 1y agoI'm not surprised, given that I received 140% cashback(!) on their 2 year plan a while ago. Unless the hope is that most users forget to cancel before it renews, I'm assuming that I'm paying with my personal information. It still does the trick for accessing bank and other websites from abroad (that somehow consider a VPN IP more trustworthy than a residential ISP in a Western European country, but that's a different story), but I wouldn't use it for anything sensitive. I also definitely wouldn't run their client locally, and their Wireguard configurations are annoyingly only valid for 15 minutes after creation. (Weirdly, there doesn't seem to be any limitation on IKEv2.)
- Sophira 1y agoGiven what you said about not using it for anything sensitive, I'm assuming you're not actually logging into your bank... right?
- lxgr 1y agoEverything is TLS-encrypted anyway these days, so the primary concern is metadata privacy. When it comes to that, I trust VPN providers about as much as ISPs (i.e. absolutely not).
- rasengan 1y agoVP.NET doesn't require any trust at all [1][2]. [1] https://vp.net/l/en-US/blog/Don%27t-Trust-Verify https://vp.net/l/en-US/blog/Don%27t-Trust-Verify [2] I work for VP.NET and can answer any questions regarding the technology as well!
- 1y ago
- pshirshov 1y agoI donwt know any single VPN provider apart from Mullvad with proper v6 implementation.
- ramon156 1y agoSolid dev + OSS ecosystem + Flat rates I'm satisfied!
- ffsm8 1y ago$5/month vs eg $2/month with a long running sub with e.g. PIA (Chinese owners) though... I wish mullvad provided long running subs with better prices then what they currently provide.
- bitxbitxbitcoin 1y agoWould love a source for Chinese owners of PIA. Last I knew, it was Israeli owners. -source, former employee.
- c420 1y agoYou are correct: "Kape Technologies is a United Kingdom-based cybersecurity software company. Kape owns VPN services and cybersecurity tools, including CyberGhost, Private Internet Access (PIA), ZenMate, ExpressVPN, and Intego." https://en.m.wikipedia.org/wiki/Teddy_Sagi#Kape_Technologies https://en.m.wikipedia.org/wiki/Teddy_Sagi#Kape_Technologies
- deleted 1y ago[deleted]
- ffsm8 1y agoYes, I missremembered. It was bought by Isreali after all. I dont think my point is affected by this however. And I feel quite illiterate right now. I somehow managed to misread both your comments twice
- Denatonium 1y agoFor the love of God, don't use PureVPN! They have been proven in court to log traffic, despite claiming not to.[1] [1] https://cyberinsider.com/vpn-logs-lies/ https://cyberinsider.com/vpn-logs-lies/
- patrakov 1y agoThey are one of the few VPN providers that give out public IPv4 addresses, and you can even get a static one. So, if you are using them for having a public IP, not for privacy, please continue doing so.
- lxgr 1y agoInteresting, do you know if they actually assign them to the VPN interface (rather than just passing through inbound connections to a public IP to the private IP of the VPN interface)? That could come in handy for hosting things behind double NAT.
- patrakov 1y agoThey assign it directly to the interface, and letting others connect to stuff behind CGNAT is indeed my use case. Two other VPNs working for this purpose are OVPN (+1 for them using WireGuard, but their Singapore node is slow) and SwissVPN (limited to only 30 Mbps by contract, but they do provide these contracted 30 Mbps).
- joecool1029 1y agoThere are better options for that. One of them: https://njal.la/ https://njal.la/ (this service was formerly known as IPredator and run by former piratebay/piratebyran people)
- baobun 1y agoFYI: https://xn--gckvb8fzb.com/njalla-has-silently-changed-a-word-of-caution/ https://xn--gckvb8fzb.com/njalla-has-silently-changed-a-word...
- xkcd1963 1y agoWhat about NordVPN and ExpressVPN are those somewhat trustworthy?
- mrweasel 1y agoGiven their need to advertise with pretty much any YouTube channel willing to take their money, I'd be inclined to question the quality the likes of NordVPN and SurfShark.
- bitxbitxbitcoin 1y agoDefine trustworthy? In my experience, no.
- baobun 1y agoIt boggles me how one can see them as anything but sus after tops 30 minutes of looking into it. You get that all those "top 5 vpn" sites and youtube recs are sponsored, right?
- AzzyHN 1y agoTrustworthy enough to shitpost behind? Sure. Trustworthy to break some actual laws behind? Absolutely not.
- jmyeet 1y agoI wouldn't trust either, for different reasons. Both of them really advertise too much (IMHO) to be trusted. They rely on introductory pricing and hoping people don't realize and get billed at a much higher rate, a model I personally hate. But ExpressVPN has an additional reason: ties between it, its founder and Israel. There's a BDS argument against right there but additionally, there are accusations that ExpressVPN traffic is or can be monitored by Israeli intelligence. That last one is a risk of many VPNs, which is why you have to be careful about who the owners are and where the company is incorporated. I personally prefer VPNs that are located in more privacy-focused jurisdictions (eg Iceland, Switzerland). Mullvad is a popular option on HN. I'm also relatively positive on PrivadoVPN (located in Switzerland). Some Redditors question the quality of the service. So far it's been fine for me.
- 1y ago
- anagogistis 1y agoHi, I'm the author of the blog post and just wanted to say thanks for the discussion. I agree that relying solely on desktop VPN clients (especially closed-source ones) is risky... The network namespaces approach is new to me, but it looks like a solid way to isolate traffic and avoid these kinds of leaks entirely. Thanks for the suggestions.
- deleted 1y ago[deleted]
- jmyeet 1y agoI'm surprised at how negative HN as a whole is on VPNs. The argument seems to go that VPNs don't really give you much privacy. I disagree. I don't think they give absolutely privacy but there are benefits. As soon as you use a service in another country, it greatly complicates anyone trying to pierce that veil. A US shield can be pierced by John Doe warrants, FISA warratns, pen registers and so on. Some of these options are open to average citizens who may want to dox you or simply report your activity to government agencies, which is more relevant now than it has been in many years. We've seen several websites pop up to dox people who don't show sufficient deference to Charlie Kirk's murder. We have an administration who now seeks to deport people, deny entry to visa holders and deny visas to people who criticize Israel. For so many people in the US, citizens and otherwise, an extra level of privacy has become essentially mandatory. The US ISP market is dominated by regional monopolies where you have no other option. ISPs monitor your traffic, not only to sell your data to data brokers but to decide if you're doing anything "inappropraite" like using a file-sharing service. How long before that extends to the content of your speech? I'm glad people are doing things like xposing IPv6 leaks (as in this post) and other weaknesses. Some here will taken this as further evidence that VPNs are of little or no value. I don't. I want to know who the good providers are.
- bongodongobob 1y agoIt's because the primary function of VPNs isn't privacy, it's to connect to a remote network and treat it as your LAN. Any privacy or security stuff is completely orthogonal.
- ashleyn 1y agoAs surveillance of social media ramps up, either by the government or by angry mobs, they're rapidly growing to be essential to use any unencrypted platform.
- varispeed 1y agoI encountered this with different VPN provider. Probably many more have this issue.
- dongcarl 1y agoIf you can't see your VPN's source code, you can almost safely assume that they're broken in some way.
- ses1984 1y agoIf you can see it you can also almost safely assume it’s broken in some way.
- rasengan 1y ago> If you can't see your VPN's source code, you can almost safely assume that they're broken in some way. This is definitely true insofar that you better be able to see client code. That said, since you cannot see what the server is running, even if they release their code, you will still end up with a trust actor or two (vpn operator or sometimes multiple vpn operators in double hop cases). That’s exactly the reason we introduced deterministic and verifiable VPN technology on https://VP.NET https://VP.NET which allows you to actually see the code the VPN servers are running. Instead of trust in a non deterministic human actor you can now trust deterministic and verifiable code. It is the end of privacy theater! [1] I am a co-founder of VP.NET
- majorchord 1y agoEven if you could, there's no way to guarantee it's the same code that's actually pushing your packets around. Even vp.net which says they use SGX to verify the code that is running on a box... yea you are verifying a box, somewhere, not necessarily the one forwarding your packets. And those packets can still be monitored/modified outside the system at some other part of the network anyways. And even if you could verify all that, eBPF swoops in and lets you modify code at runtime with no evidence trails.
- AAAAaccountAAAA 1y agoI have no idea why it seems to be so hard for VPN providers to get IPv6 right. The technology has been here for ages. Also, unlike physical ISPs, VPN providers have no other way to differentiate from each other but getting this sort of things right, so one could except them to be motivated, but no.
- MisterSandman 1y agoThey separate each other by spending money on YouTube ads and sponsorships and jacking up prices to offer 50%, no 70% no NINETY PERCENT DISCOUNT if you subscribe for 17 years using my promo code MisterSandman!
- mleonhard 1y agoVPN providers do not have reputations for making secure or reliable software. Here's a good privacy proxy (VPN) setup: Set up a second wifi router, enable the "Internet kill switch", and connect it with Wireguard to a reputable VPN service. I recommend GL.iNet routers and Mullvad. With this setup, one can move individual devices between the privacy wifi and identity-broadcasting wifi.
- anagogistis 1y agoUpdate: PureVPN confirmed both issues and published a security advisory. A patched Linux client is expected mid-October. https://www.purevpn.com/blog/security-advisory-linux-client-ipv6-leak-firewall-rule-reset/ https://www.purevpn.com/blog/security-advisory-linux-client-...