14 ms·

Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

673 points by walterbell 1y ago

holyknight 1y ago
scary AF
WarOnPrivacy 1y ago
This link displays just the map, freed from it's painfully small frame. https://kumu.io/embed/9ced55e897e74fd807be51990b26b415#vpn-company-relationships https://kumu.io/embed/9ced55e897e74fd807be51990b26b415#vpn-c...
- schiffern 1y ago
  Anyone got this as a regular single image infographic or (better yet) a text-only bulleted outline?
  - moontear 1y ago
    There is an export button. Maybe it does what you want. Don't use the embed link from above, use this one: https://kumu.io/Windscribe/vpn-relationships https://kumu.io/Windscribe/vpn-relationships
plmpsu 1y ago
Just pay for and use Mullvad.
- Dylan16807 1y ago
  I did until they killed port forwarding.
  - bilegeek 1y ago
    OOC what's your current favored provider? AirVPN? Proton?
    - octo888 1y ago
      I tried Airvpn but the MacOS client is beyond trash. And the website just gives 2005 amateur PHP coder vibes. Not just the design. The session expiry is seems very long - I hadn't visited for a few days and I'm still logged in. I'd be surprised if it wasn't infinite.
      - mk89 1y ago
        On Mac you can just use OpenVPN/Wireguard and import one of the profiles you can generate through their website.
        octo888 1y ago
        Not for feature parity. And I find there's a good correlation between the quality of the apps and the overall quality of the company. No surprise that the Mullvad VPN app is excellent
      - baobun 1y ago
        For multiple reasons it's better and safer to avoid using official provider client in the first place, regardless of provider, and connect with a good wireguard/openvpn/whatever client.
        octo888 1y ago
        Not universally true. The Mullvad client has lots of additional features to enhance privacy. Killswitch, split tunnelling (you might otherwise disconnect the VPN to use a certain app, so it can overall improve privacy), Shadowsocks, Lockdown mode etc It's extremely high quality on MacOS in my experience. It's never crashed for example whereas Airvpn's crashes daily. It connects almost instantly. I don't think I've ever seen it give an error
      - MezzoDelCammin 1y ago
        AirVPNs main proposition isn't "we have a nice app / UX". It's "we give you the most configs / options". AFAIK they're currently one of very few that allow you to configure both port forwards and give you a stable config (keys) to run your own wireguard instance
  - mystraline 1y ago
    Yep. And I was on Proton for 3y, until the CEO were backing Trump and Vance on Reddit and other places. Their port forwarding was also painful as well, but it worked. Cancelled. PIA does the port forwarding nicely and stabily. No jank scripts to run every 60 seconds. Now evidently PIA is a bunch of scum capitalists. But in reality, who isn't? Mullvad? But they killed port forwarding for "abuse".
    - 0points 1y ago
      > the CEO were backing Trump and Vance on Reddit and other places Something happened, but THAT didn't. https://medium.com/@ovenplayer/does-proton-really-support-trump-a-deeper-analysis-and-surprising-findings-aed4fee4305e https://medium.com/@ovenplayer/does-proton-really-support-tr...
      - ashirviskas 1y ago
        > Given Proton’s outstanding track record and reputation thus far as a free, open-source, crowdfunded organization, owned by a non-profit and based in Switzerland (a country known for its neutrality), this topic is worth a deep dive. Either it was someone paid to write this, or if author really believes this, they are not someone I trust. Maybe the organization is non-profit (which I do not believe is practically true), it does not explain them sharing so much with Tesonet.
    - subtextminer 1y ago
      The Proton CEO is not "backing Trump and Vance." He wrote something positive about a narrow policy Trump supported that's favorable to little tech over big tech. That's it. It's certainly possible that someone you detest can still occasionally support a particular policy you think is good.
      - saurik 1y ago
        Particularly when dealing with someone like Trump, who has, on occasion, backed both sides of an issue, depending on the day of the week! ;P
- elorant 1y ago
  I do and I like them, but Cloudflare blocks their ips aggressively.
  - lyu07282 1y ago
    Reddit too, I wished they offered residential or dedicated and/or unlisted ips. But most of the time you just have to cycle through different ips to unblock.
    - dylan604 1y ago
      At this point in the cat/mouse game, wouldn't any set of IPs used by a VPN eventually be able to be sussed out by anyone interested?
      - lyu07282 1y ago
        Some vpn services offer dedicated residential IP addresses, meaning you get an IP from just a regular private ISP in some other country. It's admittedly a bit shady though, and more expensive ofc but that will unblock everything
  - octo888 1y ago
    There was a bumpy ride with CF a while ago but they seem fine now (still plenty of captchas, of course)
- ajjahs 1y ago
  [dead]
- 0x073 1y ago
  Just spin up a server with wireguard.
  - celaleddin 1y ago
    or with Tailscale (and configure the server as an exit node).
  - nerdsniper 1y ago
    This is the way (or Tailscale). Easier to move around between datacenters to find one with an ASN/IP that isn't blocked by the apps/websites you use. If you do want a more off-the-shelf solution, Mullvad is probably the best choice. All of the consumer VPNs (including Mullvad) get blocked by various services - I get degraded/intermittent connection to Google Maps on them. GCC countries block most of the well-known VPNs as well, if you ever travel to the Arabian/Persian Gulf region. My private datacenter VPN gets blocked only very, very rarely.
  - shj2105 1y ago
    WireGuard/udp commonly gets blocked on public wifi
  - CryptoBanker 1y ago
    That defeats the entire purpose of anonymously mingling your data with others’
- nerdsniper 1y ago
  By mailing cash, if you like. They don't care if they know who you are or not. They don't ask for your email address, you just log in with a randomly-assigned account number and a password.
- ct0 1y ago
  They dont port forward unfortunately
VonGuard 1y ago
Been saying it for YEARS: 95% of VPNs sell your data. It's where they make their money. It's absolutely insane the push-back I get when I say this online. I get downvoted to hell and back. Source: I bought this data from VPN companies... Hell, you can inject ads and surveys if you want!
- throwawayq3423 1y ago
  > Hell, you can inject ads and surveys if you want! So am I right in saying that the data that's encrypted by VPNS is only in transit? It then sits on a server in plain text, ready to be queried by third parties for money.
  - andrecarini 1y ago
    Yes, VPNs add encryption only between you and the VPN servers.
    - throwawayq3423 1y ago
      How were they able to convince anyone that that matters?
      - mrmuagi 1y ago
        People seem to use VPNs to avoid IP based issues, like Netflix or ip bans/associations, not sure anyone would use it for actual privacy -- at best its obsfucation.
        throwawayq3423 1y ago
        Isn't Netflix pretty good at detecting VPNs at this point?
- mr_mitm 1y ago
  How does that work with HTTPS being practically ubiquitous?
justapassenger 1y ago
Is there any other real world usecases for VPN nowadays other than: 1. Getting access to geolocked data 2. Torrenting "Linux ISOs" ?
- 0x073 1y ago
  Free wifi hotspots Nowadays most traffic is tls encrypted, but there are still metadata that can be collected.
  - gruez 1y ago
    >but there are still metadata that can be collected. That logic is questionable given how poorly "spying on public wifi users" scales. You either need to put a bunch of eavesdropping radios in a bunch of public places or somehow convince a bunch of small businesses to use your "free wifi" solution. Even if you do have access, it's hard to monetize the data, given that nearly every device does MAC randomization (so you can't track across different SSIDs) and iOS/windows rotates mac addresses for open/public networks. OTOH setting up metadata capture on a commercial VPN service is pretty straightforward, because you control all the servers.
    - baby_souffle 1y ago
      Doesn't pretty much every Starbucks location in the United States use a nationwide provider? Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet. If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment.
      - gruez 1y ago
        >Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet. Fingerprinting is overrated given that every iPhone 17 is identical to any other iPhone 17. If you leave system settings at stock, which most people do, there's very little to fingerprint. >Doesn't pretty much every Starbucks location in the United States use a nationwide provider? True, although mobile data is cheap and plentiful enough that I rarely bother using wifi at cafes or fast food places. The only time I use public wifi is if I'm staying long term, which basically only encompasses trains, airports, and hotels. Those are diverse enough that it's tough to build a complete profile. >If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment. I don't think I ever saw a place that was that guarded about their wifi. The closest I've seen is hotels requiring your room/last name, which would allow them to identify you, but at the same time I'm not sure how much information they can glean, other than that I'm logging into gmail or airbnb. Persistent monitoring that ISPs can do is far more useful.
zer0tonin 1y ago
I have to admit that discovering that ProtonVPN was actually just owned by Proton Technologies feels underwhelming.
- fuckyah 1y ago
  [dead]
- ashirviskas 1y ago
  Idk what's the official status, but it's Tesonet. Some fake debunking in the comments of this thread that is factually almost correct: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... EDIT: ProtonVPN app was "accidentally" signet by Tesonet. How do you think this could happen?
  - DyslexicAtheist 1y ago
    thanks, this reddit thread doesn't inspire confidence in proton's story :/ at all
  - jibcage 1y ago
    It’s not Tesonet, Proton is wholly self-owned and managed. Proton VPN was briefly sharing employees with Tesonet during initial app bringup, and that partnership is long over. Naturally due to competition and the huge importance of privacy in this space, people still bring this up, but Proton VPN does not and never will sell or share your data with anyone. Source: I am a Proton VPN employee.
    - mdavid626 1y ago
      What the hell is employee sharing?
      - fragmede 1y ago
        It's when your director goes and tells you not to tell anyone but to report to another building to another team for a month or three, and help them with whatever they ask, because you have a very specific set of skills. (In this case, setting up VPN backend infra.)
deleted 1y ago
[deleted]
octo888 1y ago
Are we allowed to discuss (edit: if it's not too political?) if Kape Technologies has any connections to Israeli security services, given the nature of VPNs and given the amount of data that can be trivially collected, and: "Being from Israel, Teddy Sagi had connections with the Israeli military intelligence sphere and was able to procure himself a real-life cyber spy [his co-founder] from the famed Unit 8200 (kinda like Israel’s version of the NSA)" [0] ? [0] https://windscribe.com/blog/what-is-kape-technologies/ https://windscribe.com/blog/what-is-kape-technologies/
- 0points 1y ago
  [flagged]
  - dang 1y ago
    I specifically put the OP in the second-chance pool (https://news.ycombinator.com/item?id=26998308 https://news.ycombinator.com/item?id=26998308), which is why it got re-upped (https://hnrankings.info/45469376/ https://hnrankings.info/45469376/). Rather an odd way to suppress discussion, no?
    - 0points 1y ago
      We do see your comments, you know? https://news.ycombinator.com/item?id=45476243 https://news.ycombinator.com/item?id=45476243 etc etc etc etc. As you yourself put it there, you are happy to have moderation abuse pointed out but when I do, you just ban me. Such a wasted potential and time to move on.
      - dang 1y ago
        We don't ban people for criticizing moderation. It's common, though, for people to make grand claims about being banned for that reason, when in fact we banned them for breaking the site guidelines or otherwise abusing the site. Since your account isn't banned, you must be talking about a different account. Why not link to it so readers can make up their own minds? https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22own%20minds%22%20-linkbait%20link&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
dboreham 1y ago
NSA presumably?
tacker2000 1y ago
I tried Proton but their VPN wasnt as good as NordVPNs… But if Nord is sketchy, what is the recommended one?
- Havoc 1y ago
  Depends on what you mean by "good". Fast/low latency is to some extent diagrammatically opposed to high quality privacy. The fastest route is always you to source. The more hops/mixers/proxies/things you add the worse the experience gets
- zelphirkalt 1y ago
  You will have to be a lot more specific than "wasn't as good as", to get a response that is helpful to you. What are you looking for in a VPN provider?
  - tacker2000 1y ago
    I wanted to watch some football world cup highlights video from a japanese TV channel site, which didnt work with Proton, but did with Nord, so I have been with them since then. This was during the 2022 WC though, so maybe Proton is better nowadays.
    - eloisant 1y ago
      I think they got better, I'm watching geofenced Japanese content all the time with Proton. In the past I occasionally had to select a different server from whatever it picks by default but I've always been able to watch my content.
- flexagoon 1y ago
  Mullvad, Proton, IVPN and sometimes Windscribe are generally considered the most trusted
- y-c-o-m-b 1y ago
  That's actually interesting. My yearly Proton subscription ended several months ago and I tried both NordVPN and ExpressVPN before switching back to Proton. The other two options had limited server locations and I wasn't a fan of the software/setup. There's also a weird shady vibe with how they do their advertising compared to Proton, can't quite put my finger on it though. Proton's software also seems to be more intuitive (although a bit clunky).
brikym 1y ago
Um, is it some intelligence agencies? > ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantzwe who later sold it to British-Israeli security software company Kape Technologies Close enough.
nerdsniper 1y ago
Note that all of these companies are also under the umbrella of Tesonet, a Lithuanian VC firm also headed by Tomas Okmanas (Tom Okman in TFA). Their flagship investments are Nord Security, Hostinger, Oxylabs, Surfshark, Decodo, Mediatech, and nexos.ai - all closely related business models around proxying. They don't seem to have Russian ties: "In 2022, CyberCare opened an office in Lviv, Ukraine. Although planning for the move started before the war, according to Dainius Vanagas, CEO of CyberCare, one of the reasons why it was followed through was a desire to help Ukraine rebuild."[0] They also donated money to help arm Ukraine. 0: https://en.wikipedia.org/wiki/Tesonet https://en.wikipedia.org/wiki/Tesonet
- pessimizer 1y ago
  [flagged]
  - verteu 1y ago
    Russiagate was not a "fictional narrative," as a cursory amount of research will reveal. > The Republican-led Senate Intelligence Committee investigation released their report in five volumes between July 2019 and August 2020. The committee concluded that the intelligence community assessment alleging Russian interference was "coherent and well-constructed", and that the assessment was "proper", learning from analysts that there was "no politically motivated pressure to reach specific conclusions".[11][12] The report found that the Russian government had engaged in an "extensive campaign" to sabotage the election in favor of Trump, which included assistance from some of Trump's own advisers.
  - IAmBroom 1y ago
    Our last President was haunted by completely unverified claims of business ties with Ukraine. Someone in UKR clearly tried to buy influence via his son, but all the force of Fox News and the GOP together couldn't produce one single sticky-note worth of evidence tying it to any success. Painting "armed invasion" as "Russian presence" is like calling "stabbing someone in an alley" a "medical procedure". We get it; you love Mother Russia.
- ashirviskas 1y ago
dongcarl 1y ago
We should really be moving towards a world of Multi-Party Relays rather than Single-Party VPN operators: https://www.privacyguides.org/articles/2024/11/17/where-are-all-the-mprs/#a-solution-multi-party-relays https://www.privacyguides.org/articles/2024/11/17/where-are-... With Multi-Party Relays you no longer have a trust a single entity not being malicious or compromised. Disclaimer: I run obscura.net, which does exactly this with Mullvad (our partner) as the Exit Hop.
- sporkxrocket 1y ago
  Can you control the geography of the exit node? I really like Private Relay but it doesn't get around geo restrictions because the IP is still in the same country you are.
  - dongcarl 1y ago
    Yes, you can with Obscura. That limitation of Private Relay is just an arbitrary limitation made by Apple.
    - anticensor 1y ago
      And so by design.
- FlynnLivesMattr 1y ago
  Hey Carl! This is the first I'm hearing of Obscura. After doing a deep dive into your product, it looks to be a very fascinating privacy tool. However, I'm concerned with your operating under US jurisdiction, as detailed by others here: https://discuss.grapheneos.org/d/20059-obscura-vpn-and-mullvad-partnership-american-juridisdiction https://discuss.grapheneos.org/d/20059-obscura-vpn-and-mullv... While I understand potentially not wanting to incorporate in the EU (with Chat Control on the horizon) nor Switzerland (due to their own non-EU-related privacy backslide), why still select the US, which historically other privacy tools have largely avoided? It feels like you're already shooting yourself in the foot, whereas you'd be good in the EU should Chat Control not pass. While it's great that you verifiably can't see a user's internet traffic, you're one US court order away from a forced compromising of the service for a user (or at least, giving up the connecting IP). Historically, EU court orders have been easier and more transparently fought by privacy tools. Non sequitur, it would be great if you prioritized accepting Monero as payment, like your exit hop Mullvad. Also, how much control do we have over the features Mullvad offers (e.g. DAITA, quantum resistance, DNS filters, IPv6, integration with Mullvad Browser)?
gregorvand 1y ago
Handy that while connected via ExpressVPN, this is blocked
- zImPatrick 1y ago
  what server are you connected to? Switzerland works just fine for me
  - gregorvand 1y ago
    it was one of the UK servers
aussieguy1234 1y ago
Why you probably don't need a VPN: https://stevesrantsnraves.blogspot.com/2024/09/why-you-probably-dont-need-vpn.html https://stevesrantsnraves.blogspot.com/2024/09/why-you-proba...
cchance 1y ago
Mullvad nuff said
- kovrik 1y ago
  They don't support port forwarding anymore though.
codazoda 1y ago
If you’re worried about your VPN provider but you can trust your VPS provider, try an SSH Tunnel. https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-privacy-on-the-go https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-priv...
- Theodores 1y ago
  Thanks for the link. How does this work on the server side? It gets packets on 8080 and then what? The article needs to explain the server config, even if it is just how to install ssh-server. I have tried setting up OpenVPN on my own VPS and I didn't get very far with it. I have also had to use OpenVPN in the day job and I much prefer just using ssh without some extravagant OpenVPN layer. My experience of failing to configure a VPN of my own (primarily for testing GeoIP) led me to try a few VPNs and the amount of junk adverts and whatnot made me wonder if it was time to fdisk my computer and start over due to the virus-vibes I was getting from a VPN. This was in the days before VPN adverts on lame YouTube channels, so I presume the product has improved since then. In theory, someone smarter than me can rent a VPS and get OpenVPN on there, or, better still, a remote desktop so that only the screen image goes over the internet from the VPS to the PC, X-Window style but better. This could be further obfuscated by using 443 and one's own special ROT13 'encryption'. Presumably a skilled person that knows what they are doing could get it all setup in an hour, to write concise instructions that 'civilians' can work through in pretty much the same time. If you were highly invested in porn, watching Netflix in foreign countries and with even worse stuff to hide, you would think that some investment in getting a proper VPN with your own VPS would be the way to go, but no. Cost isn't the problem if you are deeply into something worth hiding, so why do so few people roll their own VPN? The reality is that the typical product is marketed with FUD and the goal is to turn you into a 'sleeping giant'. A 'sleeping giant' is a customer that has a standing order or other payment arrangement that is for a service that is not used, and for that to not be noticed on bank statements. Everyone wants you to be a 'sleeping giant', including some 'worthy' charities, dating websites and every software subscription service. They aren't using FUD marketing though. The commercial VPNs have mastered the art of selling a product that deserves technical knowledge to understand to the masses, so you have got to respect the hustle.
onetokeoverthe 1y ago
[dead]
yegor 1y ago
Ohh cool, we made that map (I'm from Windscribe). If you spot any errors, let me know.
ComplexSystems 1y ago
TL;DR: you shouldn't assume your data or activity is in any way anonymous when using these services. These VPNs are useful for changing your region for streaming and not much else. Otherwise, the traffic being routed through these VPNs is basically much more likely to involve "questionable" activity than ordinary traffic - and when you send your traffic through it, you are basically highlighting it as such - and all of this is well-known and of extreme interest to anyone interested in snooping on or analyzing such "questionable" activity.
dkga 1y ago
I’m not a big expert on the VPN tech side, but it always seemed to me that the most logical option for those that actually understand about VPN is Proton, or am I missing something here?
- SOLAR_FIELDS 1y ago
  Im a happy Proton user myself but if someone wanted the absolute most secure and private and reputable VPN I would point them to Mullvad. The main reason I use Proton is because I use the other apps in their suite as well and I get the VPN in the package deal. The threat model is good enough for my use cases
  - 8cvor6j844qw_d6 1y ago
    Mullvad doesn't support port forwarding [1] for users that need it unlike proton vpn [2]. Although I have never needed it myself, which in that case Mullvad might be better since they require minimal registration details. [1]: https://mullvad.net/en/blog/removing-the-support-for-forwarded-ports https://mullvad.net/en/blog/removing-the-support-for-forward... [2]: https://protonvpn.com/support/port-forwarding https://protonvpn.com/support/port-forwarding
    - cakealert 1y ago
      unless you have a specific use case where you need to run a server through your vpn this isn't as much of a problem as you think it is. torrents for example have hole punching functionality built into uTP where reachable peers help unreachable peers connect to each other.
  - y-c-o-m-b 1y ago
    I am also a relatively happy proton user (now, but wasn't always this way). I second this. Based off the site, it looks like Mullvad passed a real world test too, Proton has not. I haven't tried Mullvad in a couple of years, but they were always reliable and fast. The only issue I had with Mullvad was getting connected to enough peers when torrenting, especially on older torrents where the pool of users is small. Proton's port forwarding feature did noticeably help with that. I do enjoy being able to pay a discounted yearly subscription price with Proton and their user interface is nice. There are some minor problems with split-tunneling in Proton though, sometimes it doesn't work and I haven't figured out why.
8cvor6j844qw_d6 1y ago
A long time ago, I have difficulty removing payment card information from ExpressVPN. Managed to contact support to remove it but they merely zeroed out (it shows 0 for the visible fields) the card details rather than truly removing payment information.
Ms-J 1y ago
Can anyone give info on who owns Trust.Zone VPN? The company saves all credentials and doesn't allow the user to generate anything, such as Wireguard private keys. The service is very likely logging everything, and already admits to logging bandwidth, which is severe enough. Wouldn't be surprised if this was a honeypot for logging Russian internet users, as it appears to cater to Eastern users.
- cess11 1y ago
  They hide who they are. If you look at their privacy policy: https://trust.zone/privacy https://trust.zone/privacy Then you'll notice that it does not tell you what entity they are or where it is incorporated. Elsewhere they claim to be incorporated as Trusted Solutions Ltd in Mahé in the Seychelles. https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-top-vpn-industry-news-websites https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-to... And this review claims they are an LLC. https://thebestvpn.com/reviews/trust-zone/ https://thebestvpn.com/reviews/trust-zone/ But when I search for this name in the local registry I get no results. https://www.registry.gov.sc/BizRegistration/WebSearchBusiness.aspx https://www.registry.gov.sc/BizRegistration/WebSearchBusines... The Seychelles kind of belong to the 'non-aligned' group of countries, and maintains decent relations with Russia, India, China and so on. They also advocate for a diminished US presence in the Indian Ocean. On the other hand, they're a member of the british Commonwealth and only got independence in 1976. Trust.Zone sure looks fishy but I can't tell from this whether they are surveillance for the UK, traffic to hide in for russian authorities and cyber crime groups or something else entirely. I'd avoid them unless I was already into grey or directly criminal activities and already had layers of protection and indirection in place.
  - Ms-J 1y ago
    The analysis is spot on. What in particular concerns me is the lack of any type of registration seemingly anywhere. I don't mind if a privacy focused VPN said they don't register at all in any country and stated the reasons as to why, but this company seems to have lied. "The Seychelles kind of belong to the 'non-aligned' group of countries, and maintains decent relations with Russia, India, China and so on. They also advocate for a diminished US presence in the Indian Ocean. On the other hand, they're a member of the british Commonwealth and only got independence in 1976." Seychelles is a great place to register for a privacy focused service but I agree with you that being a member state of the British commonwealth is concerning. Could you possibly recommend any place that would be better to register such as service? "Trust.Zone sure looks fishy but I can't tell from this whether they are surveillance for the UK, traffic to hide in for russian authorities and cyber crime groups or something else entirely. I'd avoid them unless I was already into grey or directly criminal activities and already had layers of protection and indirection in place." It gives the worst vibes possible for a supposed security service. Trust.Zone offers a free trial which I signed up for to test with a disposable VM. This is where I learned how they keep user credentials and other major privacy issues, such as the logging I mentioned in my last comment. The support also sent a very questionable reply to a ticket where they wanted to do screen sharing and run an arbitrary script on my server to "diagnose" the issue.
mjbale116 1y ago
Can someone explain to me why should I use a VPN when Tor is out there? It just seems to me odd that one would pipe their communications through a private company, that operates over a jurisdiction when said jurisdiction can compel the company in actions that may compromise my anonymity. From my perspective, its like shifting my trust from my ISP (an entity with way more oversight) to a pvt ltd. Isn't Tor as safe as it can get when surfing the web?
- kachapopopow 1y ago
  vpns are marketed as hiding you from less trustworthy companies or accessing region locked content.
- tsunagatta 1y ago
  From my understanding, they have different purposes. VPNs aren’t really about safety or anonymity, Tor is the way to go for those. VPNs are for if you don’t want your ISP specifically to see your traffic for some reason, or if you want your traffic to appear like it’s coming from a different geographical location with minimal latency hit. Edit: I should say, VPNs as a technology have far more applications than this, e.g. for accessing a secure intranet, but these are just the reasons you’d theoretically want to use a VPN service like Nord/Mullvad/etc.
- webstrand 1y ago
  VPNs are for when you want to obfuscate your traffic from your ISP, not the government. By passing your traffic through a private company _somewhere else_ to another private entity that has some vested interest in not reselling your data, you can prevent it from being easily mapped back to you. Also VPN is generally much faster and higher bandwidth than TOR.
  - deleted 1y ago
    [deleted]
- 8cvor6j844qw_d6 1y ago
  Tor is unbearably slow for daily general use.
tonetegeatinst 1y ago
Glad to see more zero trust confidential computing happening....but keep in mind its still vulnerable to attacks like Battering RAM which can fully breaks cutting-edge Intel SGX and AMD SEV-SNP confidential computing processor security technologies.
- walterbell 1y ago
  How is confidential computing applied to VPNs?
- MagicalTux 1y ago
  Battering RAM has been demonstrated to work well against Intel's "Scalable SGX" which is also known as SGX 2, and uses static encryption key to allow SGX to use more of the system's memory. For example at VP.NET we're using SGX 1, which uses AES-CTR for memory encryption which is not susceptible to memory reply attack, and comes with a limit of 512MB of ram. It's a lot of pain working with a very small memory allocation (especially nowadays where most machines come with 128GB+). batteringram.eu calls that "Client SGX" with a checkmark on "Read", but reading the actual paper it only mentions being able to know which areas of memory were written to (see 7.1). There might be applications where memory access pattern gives detail on the underlying work performed, but this is likely coarse (encryption is likely per page) and unlikely to yield to anything useful. This said we are also exploring other TEEs including Intel TDX, and having a wider array of options will give us the ability to instantly disable any technology for which we know security has been compromised.
  - MoonObserver 1y ago
    Intel TDX unfortunately suffers from the exact same vulnerability as Scalable SGX. The underlying root cause is the lack of randomized encryption; using a static-adversary encryption scheme (XTS) rather than a dynamic-adversary one. The result is that plaintext-ciphertext mappings are unchanged at a fixed memory address. While the choice of scheme might initially seem puzzling, it is due to a randomized encryption scheme requiring counters for each memory block, which has a prohibitive on-chip memory cost when scaling to hundreds of GBs of memory.
crossroadsguy 1y ago
At this point, the VPN industry is so rife with shady dealings, suspicious ownership structures, weird exits, questionable marketing/PR practices/pushes, and rumours that waters have been muddied sufficiently for every provider out there. It might have been by design as well. Who knows. I now believe that you know your use case and use VPN only for that, and decide whether you really need to pay with parts of your kidneys for a service that claims to be the "uber privacy bulwark of the season" (until proven otherwise, as it happens), and get done with it, and make sure "anonymity and privacy" are not the expectations unless you have gone to great lengths to ensure these two, and if that's the case, you won't be in the market for "list most private VPNs providers" at a search or LLM input box. If your needs are anonymity, a VPN is not going to solve it— in fact, relying on one might endanger you. Even for privacy, I'd be very careful in trusting a VPN (any VPN). So if you need a VPN for streaming content from other geographies, just get the one at the best cost that does the job well in your geography, without going through the rabbit hole of cryptographic verification, reputation spiral, etc.
- wongarsu 1y ago
  A VPN is always a risk. Still, there is a difference between using Mulvad or PrivateInternetAccess. The difference between risking that the service might do bad things with your data, and having high certainty that it does. And this article gives pretty good indications which category each service belongs to
  - kouru225 1y ago
    You’d put private internet access in the really bad category?
    - vincentpants 1y ago
      Yes. Very much so. PIA was purchased by a British-Israeli corporation called Kape Inc. which has been a known bad-actor in the past and is a giant red flag when looking for VPN options. (edited away the brevity)
- 1y ago
dackdel 1y ago
just use mullvad
braza 1y ago
Despite all the shenanigans related to their corporate structure, does someone really trust in those services in terms of real privacy? It's hard to believe that for USD 10/month you can have a high-trust VPN so that your ISP will never know who you are, and you can surf the internet untraceable from the IP perspective. I mean, that kind of infrastructure costs money, and the mechanics to make it happen must be very expensive, and it is hard to believe that this is very commoditized. It sometimes sounds like someone is selling a 2-cent pizza in Zürich: If you're paying that, maybe you're not ready to know what is inside.
userbinator 1y ago
Isn't it entirely unsurprising that those running a highly privacy-oriented service would themselves be rather mysterious? All it takes is an unattended machine for someone to boot another os on and grab the file If you're going to the trouble of using a VPN, that is not a very likely scenario, and ditto for other users(!) on your machine.
novoreorx 1y ago
Using a VPN for regular users is like jumping from one fire pit to another. The real way to escape censorship and privacy leaks is to increase your cognition, avoid blindly following KOLs, think independently when choosing tools
scyzoryk_xyz 1y ago
At least uh they sponsor a lot of great video entertainment content
throwaway-0001 1y ago
https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#map-JhhBFszt/conn-7bGIxPjj https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#map-J... Mulvad connected to malwarebytes ups I thought mullvad was clean
- la_oveja 1y ago
  seems like malwarebytes uses mullvad for its vpn service.
  - mantra2 1y ago
    Yes and they’re very transparent about it. https://mullvad.net/en/help/partnerships-and-resellers https://mullvad.net/en/help/partnerships-and-resellers
fuqukyle 1y ago
[flagged]
RyanShook 1y ago
Strange that this is a blog post by windscribe which follows many of the same practices as the VPN providers they criticize here. Were VPNs ever really providing privacy? The underlying business model is selling user data.
- daveidol 1y ago
  I'm curious to learn more about Windscribe. Do you have any more info you can share about their practices?
laylower 1y ago
So anyone else besides Airvpn and Mullvad is even worth considering?
- wsc981 1y ago
  You can setup a private VPN with Digital Ocean and a PiHole droplet. I guess it's a little bit less likely to be a honeypot. It also seems cheaper than any public VPN offering.
- eloisant 1y ago
  ProtonVPN
gorbypark 1y ago
I only ever use a VPN to access region blocked content and the occasional "linux iso" torrent..I tried Mullvad first, but they just don't play the game of cat and mouse with the streaming providers and all their IPs are pretty much blocked. I have about a 95% success rate with NordVPN (except for Amazon Prime video which have some sort of wizardry and always are able to detect VPNs). It's a shame because Mullvad has a deal with Tailscale where you can sign up for Mullvad through Tailscale and use any of their servers as a Tailscale exit node. It's super slick and nice since Tailscale has really decent apps for nearly everything (even Apple TV, etc) and I already have a decently sized Tailnet of all my devices / ssh accessible things.
- jiggunjer 1y ago
  But you can connect any machine to any vpn and have it be a tailscale exit node?
  - deleted 1y ago
    [deleted]
  - smileybarry 1y ago
    Well, yes, but being able to designate a VPN node as a Tailscale exit node directly means you don't need a random server in the middle for it. (Which is beneficial if you use it as an exit node for road warrior devices)
  - gorbypark 1y ago
    You can, but the issue is usability..when I'm watching TV, I want to just be able to flip open an app and say "I'm in London!" and watch BBC, then the same for Canada and etc. I don't want to be fiddling with a VPN and switching routes on some separate device / switching the entire wifi network or etc.
- smileybarry 1y ago
  I use ProtonVPN for bypassing media geoblocking, and they're fairly good, with some exceptions (BBC iPlayer works via browser but not the Apple TV app, local IPTV doesn't work on any Proton local servers). They have an Apple TV app so I just switch it on as needed, and it's restricted to just that Apple TV. (Without having to fiddle with a separate WiFi network etc.) IKEv2, OpenVPN and Wireguard work without their apps so I don't have to install their apps on non-sandboxed platforms (Windows, macOS).
pistolpete5 1y ago
[dead]
ARandomerDude 1y ago
> British-Israeli security software company Kape Technologies That doesn't sound good for privacy.
Nifty3929 1y ago
VPNs will become illegal or backdoored, because privacy is becoming illegal. This is not really a technology problem, it's a social and legislative one. Many of us are afraid of (other people's) privacy, so we vote for legislators that will make it illegal. The legislators stoke this fear of privacy because they want an excuse to deepen their control of discourse, and their own citizens. So really, everybody wins!

673 points by walterbell 1y ago

scary AF

This link displays just the map, freed from it's painfully small frame. https://kumu.io/embed/9ced55e897e74fd807be51990b26b415#vpn-company-relationships https://kumu.io/embed/9ced55e897e74fd807be51990b26b415#vpn-c...

schiffern 1y ago
Anyone got this as a regular single image infographic or (better yet) a text-only bulleted outline?
- moontear 1y ago
  There is an export button. Maybe it does what you want. Don't use the embed link from above, use this one: https://kumu.io/Windscribe/vpn-relationships https://kumu.io/Windscribe/vpn-relationships

plmpsu 1y ago

Just pay for and use Mullvad.

Dylan16807 1y ago
I did until they killed port forwarding.
- bilegeek 1y ago
  OOC what's your current favored provider? AirVPN? Proton?
  - octo888 1y ago
    I tried Airvpn but the MacOS client is beyond trash. And the website just gives 2005 amateur PHP coder vibes. Not just the design. The session expiry is seems very long - I hadn't visited for a few days and I'm still logged in. I'd be surprised if it wasn't infinite.
    - mk89 1y ago
      On Mac you can just use OpenVPN/Wireguard and import one of the profiles you can generate through their website.
      - octo888 1y ago
        Not for feature parity. And I find there's a good correlation between the quality of the apps and the overall quality of the company. No surprise that the Mullvad VPN app is excellent
    - baobun 1y ago
      For multiple reasons it's better and safer to avoid using official provider client in the first place, regardless of provider, and connect with a good wireguard/openvpn/whatever client.
      - octo888 1y ago
        Not universally true. The Mullvad client has lots of additional features to enhance privacy. Killswitch, split tunnelling (you might otherwise disconnect the VPN to use a certain app, so it can overall improve privacy), Shadowsocks, Lockdown mode etc It's extremely high quality on MacOS in my experience. It's never crashed for example whereas Airvpn's crashes daily. It connects almost instantly. I don't think I've ever seen it give an error
    - MezzoDelCammin 1y ago
      AirVPNs main proposition isn't "we have a nice app / UX". It's "we give you the most configs / options". AFAIK they're currently one of very few that allow you to configure both port forwards and give you a stable config (keys) to run your own wireguard instance
- mystraline 1y ago
  Yep. And I was on Proton for 3y, until the CEO were backing Trump and Vance on Reddit and other places. Their port forwarding was also painful as well, but it worked. Cancelled. PIA does the port forwarding nicely and stabily. No jank scripts to run every 60 seconds. Now evidently PIA is a bunch of scum capitalists. But in reality, who isn't? Mullvad? But they killed port forwarding for "abuse".
  - 0points 1y ago
    > the CEO were backing Trump and Vance on Reddit and other places Something happened, but THAT didn't. https://medium.com/@ovenplayer/does-proton-really-support-trump-a-deeper-analysis-and-surprising-findings-aed4fee4305e https://medium.com/@ovenplayer/does-proton-really-support-tr...
    - ashirviskas 1y ago
      > Given Proton’s outstanding track record and reputation thus far as a free, open-source, crowdfunded organization, owned by a non-profit and based in Switzerland (a country known for its neutrality), this topic is worth a deep dive. Either it was someone paid to write this, or if author really believes this, they are not someone I trust. Maybe the organization is non-profit (which I do not believe is practically true), it does not explain them sharing so much with Tesonet.
  - subtextminer 1y ago
    The Proton CEO is not "backing Trump and Vance." He wrote something positive about a narrow policy Trump supported that's favorable to little tech over big tech. That's it. It's certainly possible that someone you detest can still occasionally support a particular policy you think is good.
    - saurik 1y ago
      Particularly when dealing with someone like Trump, who has, on occasion, backed both sides of an issue, depending on the day of the week! ;P
elorant 1y ago
I do and I like them, but Cloudflare blocks their ips aggressively.
- lyu07282 1y ago
  Reddit too, I wished they offered residential or dedicated and/or unlisted ips. But most of the time you just have to cycle through different ips to unblock.
  - dylan604 1y ago
    At this point in the cat/mouse game, wouldn't any set of IPs used by a VPN eventually be able to be sussed out by anyone interested?
    - lyu07282 1y ago
      Some vpn services offer dedicated residential IP addresses, meaning you get an IP from just a regular private ISP in some other country. It's admittedly a bit shady though, and more expensive ofc but that will unblock everything
- octo888 1y ago
  There was a bumpy ride with CF a while ago but they seem fine now (still plenty of captchas, of course)
ajjahs 1y ago
[dead]
0x073 1y ago
Just spin up a server with wireguard.
- celaleddin 1y ago
  or with Tailscale (and configure the server as an exit node).
- nerdsniper 1y ago
  This is the way (or Tailscale). Easier to move around between datacenters to find one with an ASN/IP that isn't blocked by the apps/websites you use. If you do want a more off-the-shelf solution, Mullvad is probably the best choice. All of the consumer VPNs (including Mullvad) get blocked by various services - I get degraded/intermittent connection to Google Maps on them. GCC countries block most of the well-known VPNs as well, if you ever travel to the Arabian/Persian Gulf region. My private datacenter VPN gets blocked only very, very rarely.
- shj2105 1y ago
  WireGuard/udp commonly gets blocked on public wifi
- CryptoBanker 1y ago
  That defeats the entire purpose of anonymously mingling your data with others’
nerdsniper 1y ago
By mailing cash, if you like. They don't care if they know who you are or not. They don't ask for your email address, you just log in with a randomly-assigned account number and a password.
ct0 1y ago
They dont port forward unfortunately

VonGuard 1y ago

Been saying it for YEARS: 95% of VPNs sell your data. It's where they make their money. It's absolutely insane the push-back I get when I say this online. I get downvoted to hell and back. Source: I bought this data from VPN companies... Hell, you can inject ads and surveys if you want!

throwawayq3423 1y ago
> Hell, you can inject ads and surveys if you want! So am I right in saying that the data that's encrypted by VPNS is only in transit? It then sits on a server in plain text, ready to be queried by third parties for money.
- andrecarini 1y ago
  Yes, VPNs add encryption only between you and the VPN servers.
  - throwawayq3423 1y ago
    How were they able to convince anyone that that matters?
    - mrmuagi 1y ago
      People seem to use VPNs to avoid IP based issues, like Netflix or ip bans/associations, not sure anyone would use it for actual privacy -- at best its obsfucation.
      - throwawayq3423 1y ago
        Isn't Netflix pretty good at detecting VPNs at this point?
mr_mitm 1y ago
How does that work with HTTPS being practically ubiquitous?

justapassenger 1y ago

Is there any other real world usecases for VPN nowadays other than: 1. Getting access to geolocked data 2. Torrenting "Linux ISOs" ?

0x073 1y ago
Free wifi hotspots Nowadays most traffic is tls encrypted, but there are still metadata that can be collected.
- gruez 1y ago
  >but there are still metadata that can be collected. That logic is questionable given how poorly "spying on public wifi users" scales. You either need to put a bunch of eavesdropping radios in a bunch of public places or somehow convince a bunch of small businesses to use your "free wifi" solution. Even if you do have access, it's hard to monetize the data, given that nearly every device does MAC randomization (so you can't track across different SSIDs) and iOS/windows rotates mac addresses for open/public networks. OTOH setting up metadata capture on a commercial VPN service is pretty straightforward, because you control all the servers.
  - baby_souffle 1y ago
    Doesn't pretty much every Starbucks location in the United States use a nationwide provider? Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet. If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment.
    - gruez 1y ago
      >Despite the randomized Mac address, you can still fingerprint devices using all the usual tricks when they connect to the authentication and authorization page before you allow them to access the broader internet. Fingerprinting is overrated given that every iPhone 17 is identical to any other iPhone 17. If you leave system settings at stock, which most people do, there's very little to fingerprint. >Doesn't pretty much every Starbucks location in the United States use a nationwide provider? True, although mobile data is cheap and plentiful enough that I rarely bother using wifi at cafes or fast food places. The only time I use public wifi is if I'm staying long term, which basically only encompasses trains, airports, and hotels. Those are diverse enough that it's tough to build a complete profile. >If the receipt had a passcode on it, you've got a link between all of your browser fingerprint, radio fingerprint and payment detail fingerprint and possibly customer loyalty provided at time of payment. I don't think I ever saw a place that was that guarded about their wifi. The closest I've seen is hotels requiring your room/last name, which would allow them to identify you, but at the same time I'm not sure how much information they can glean, other than that I'm logging into gmail or airbnb. Persistent monitoring that ISPs can do is far more useful.

zer0tonin 1y ago

I have to admit that discovering that ProtonVPN was actually just owned by Proton Technologies feels underwhelming.

fuckyah 1y ago
[dead]
ashirviskas 1y ago
Idk what's the official status, but it's Tesonet. Some fake debunking in the comments of this thread that is factually almost correct: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/ https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... EDIT: ProtonVPN app was "accidentally" signet by Tesonet. How do you think this could happen?
- DyslexicAtheist 1y ago
  thanks, this reddit thread doesn't inspire confidence in proton's story :/ at all
- jibcage 1y ago
  It’s not Tesonet, Proton is wholly self-owned and managed. Proton VPN was briefly sharing employees with Tesonet during initial app bringup, and that partnership is long over. Naturally due to competition and the huge importance of privacy in this space, people still bring this up, but Proton VPN does not and never will sell or share your data with anyone. Source: I am a Proton VPN employee.
  - mdavid626 1y ago
    What the hell is employee sharing?
    - fragmede 1y ago
      It's when your director goes and tells you not to tell anyone but to report to another building to another team for a month or three, and help them with whatever they ask, because you have a very specific set of skills. (In this case, setting up VPN backend infra.)

deleted 1y ago

[deleted]

octo888 1y ago

Are we allowed to discuss (edit: if it's not too political?) if Kape Technologies has any connections to Israeli security services, given the nature of VPNs and given the amount of data that can be trivially collected, and: "Being from Israel, Teddy Sagi had connections with the Israeli military intelligence sphere and was able to procure himself a real-life cyber spy [his co-founder] from the famed Unit 8200 (kinda like Israel’s version of the NSA)" [0] ? [0] https://windscribe.com/blog/what-is-kape-technologies/ https://windscribe.com/blog/what-is-kape-technologies/

0points 1y ago
[flagged]
- dang 1y ago
  I specifically put the OP in the second-chance pool (https://news.ycombinator.com/item?id=26998308 https://news.ycombinator.com/item?id=26998308), which is why it got re-upped (https://hnrankings.info/45469376/ https://hnrankings.info/45469376/). Rather an odd way to suppress discussion, no?
  - 0points 1y ago
    We do see your comments, you know? https://news.ycombinator.com/item?id=45476243 https://news.ycombinator.com/item?id=45476243 etc etc etc etc. As you yourself put it there, you are happy to have moderation abuse pointed out but when I do, you just ban me. Such a wasted potential and time to move on.
    - dang 1y ago
      We don't ban people for criticizing moderation. It's common, though, for people to make grand claims about being banned for that reason, when in fact we banned them for breaking the site guidelines or otherwise abusing the site. Since your account isn't banned, you must be talking about a different account. Why not link to it so readers can make up their own minds? https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22own%20minds%22%20-linkbait%20link&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

dboreham 1y ago

NSA presumably?

tacker2000 1y ago

I tried Proton but their VPN wasnt as good as NordVPNs… But if Nord is sketchy, what is the recommended one?

Havoc 1y ago
Depends on what you mean by "good". Fast/low latency is to some extent diagrammatically opposed to high quality privacy. The fastest route is always you to source. The more hops/mixers/proxies/things you add the worse the experience gets
zelphirkalt 1y ago
You will have to be a lot more specific than "wasn't as good as", to get a response that is helpful to you. What are you looking for in a VPN provider?
- tacker2000 1y ago
  I wanted to watch some football world cup highlights video from a japanese TV channel site, which didnt work with Proton, but did with Nord, so I have been with them since then. This was during the 2022 WC though, so maybe Proton is better nowadays.
  - eloisant 1y ago
    I think they got better, I'm watching geofenced Japanese content all the time with Proton. In the past I occasionally had to select a different server from whatever it picks by default but I've always been able to watch my content.
flexagoon 1y ago
Mullvad, Proton, IVPN and sometimes Windscribe are generally considered the most trusted
y-c-o-m-b 1y ago
That's actually interesting. My yearly Proton subscription ended several months ago and I tried both NordVPN and ExpressVPN before switching back to Proton. The other two options had limited server locations and I wasn't a fan of the software/setup. There's also a weird shady vibe with how they do their advertising compared to Proton, can't quite put my finger on it though. Proton's software also seems to be more intuitive (although a bit clunky).

brikym 1y ago

Um, is it some intelligence agencies? > ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantzwe who later sold it to British-Israeli security software company Kape Technologies Close enough.

nerdsniper 1y ago

Note that all of these companies are also under the umbrella of Tesonet, a Lithuanian VC firm also headed by Tomas Okmanas (Tom Okman in TFA). Their flagship investments are Nord Security, Hostinger, Oxylabs, Surfshark, Decodo, Mediatech, and nexos.ai - all closely related business models around proxying. They don't seem to have Russian ties: "In 2022, CyberCare opened an office in Lviv, Ukraine. Although planning for the move started before the war, according to Dainius Vanagas, CEO of CyberCare, one of the reasons why it was followed through was a desire to help Ukraine rebuild."[0] They also donated money to help arm Ukraine. 0: https://en.wikipedia.org/wiki/Tesonet https://en.wikipedia.org/wiki/Tesonet

pessimizer 1y ago
[flagged]
- verteu 1y ago
  Russiagate was not a "fictional narrative," as a cursory amount of research will reveal. > The Republican-led Senate Intelligence Committee investigation released their report in five volumes between July 2019 and August 2020. The committee concluded that the intelligence community assessment alleging Russian interference was "coherent and well-constructed", and that the assessment was "proper", learning from analysts that there was "no politically motivated pressure to reach specific conclusions".[11][12] The report found that the Russian government had engaged in an "extensive campaign" to sabotage the election in favor of Trump, which included assistance from some of Trump's own advisers.
- IAmBroom 1y ago
  Our last President was haunted by completely unverified claims of business ties with Ukraine. Someone in UKR clearly tried to buy influence via his son, but all the force of Fox News and the GOP together couldn't produce one single sticky-note worth of evidence tying it to any success. Painting "armed invasion" as "Russian presence" is like calling "stabbing someone in an alley" a "medical procedure". We get it; you love Mother Russia.
ashirviskas 1y ago

dongcarl 1y ago

We should really be moving towards a world of Multi-Party Relays rather than Single-Party VPN operators: https://www.privacyguides.org/articles/2024/11/17/where-are-all-the-mprs/#a-solution-multi-party-relays https://www.privacyguides.org/articles/2024/11/17/where-are-... With Multi-Party Relays you no longer have a trust a single entity not being malicious or compromised. Disclaimer: I run obscura.net, which does exactly this with Mullvad (our partner) as the Exit Hop.

sporkxrocket 1y ago
Can you control the geography of the exit node? I really like Private Relay but it doesn't get around geo restrictions because the IP is still in the same country you are.
- dongcarl 1y ago
  Yes, you can with Obscura. That limitation of Private Relay is just an arbitrary limitation made by Apple.
  - anticensor 1y ago
    And so by design.
FlynnLivesMattr 1y ago
Hey Carl! This is the first I'm hearing of Obscura. After doing a deep dive into your product, it looks to be a very fascinating privacy tool. However, I'm concerned with your operating under US jurisdiction, as detailed by others here: https://discuss.grapheneos.org/d/20059-obscura-vpn-and-mullvad-partnership-american-juridisdiction https://discuss.grapheneos.org/d/20059-obscura-vpn-and-mullv... While I understand potentially not wanting to incorporate in the EU (with Chat Control on the horizon) nor Switzerland (due to their own non-EU-related privacy backslide), why still select the US, which historically other privacy tools have largely avoided? It feels like you're already shooting yourself in the foot, whereas you'd be good in the EU should Chat Control not pass. While it's great that you verifiably can't see a user's internet traffic, you're one US court order away from a forced compromising of the service for a user (or at least, giving up the connecting IP). Historically, EU court orders have been easier and more transparently fought by privacy tools. Non sequitur, it would be great if you prioritized accepting Monero as payment, like your exit hop Mullvad. Also, how much control do we have over the features Mullvad offers (e.g. DAITA, quantum resistance, DNS filters, IPv6, integration with Mullvad Browser)?

gregorvand 1y ago

Handy that while connected via ExpressVPN, this is blocked

zImPatrick 1y ago
what server are you connected to? Switzerland works just fine for me
- gregorvand 1y ago
  it was one of the UK servers

aussieguy1234 1y ago

Why you probably don't need a VPN: https://stevesrantsnraves.blogspot.com/2024/09/why-you-probably-dont-need-vpn.html https://stevesrantsnraves.blogspot.com/2024/09/why-you-proba...

cchance 1y ago

Mullvad nuff said

kovrik 1y ago
They don't support port forwarding anymore though.

codazoda 1y ago

If you’re worried about your VPN provider but you can trust your VPS provider, try an SSH Tunnel. https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-privacy-on-the-go https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-priv...

Theodores 1y ago
Thanks for the link. How does this work on the server side? It gets packets on 8080 and then what? The article needs to explain the server config, even if it is just how to install ssh-server. I have tried setting up OpenVPN on my own VPS and I didn't get very far with it. I have also had to use OpenVPN in the day job and I much prefer just using ssh without some extravagant OpenVPN layer. My experience of failing to configure a VPN of my own (primarily for testing GeoIP) led me to try a few VPNs and the amount of junk adverts and whatnot made me wonder if it was time to fdisk my computer and start over due to the virus-vibes I was getting from a VPN. This was in the days before VPN adverts on lame YouTube channels, so I presume the product has improved since then. In theory, someone smarter than me can rent a VPS and get OpenVPN on there, or, better still, a remote desktop so that only the screen image goes over the internet from the VPS to the PC, X-Window style but better. This could be further obfuscated by using 443 and one's own special ROT13 'encryption'. Presumably a skilled person that knows what they are doing could get it all setup in an hour, to write concise instructions that 'civilians' can work through in pretty much the same time. If you were highly invested in porn, watching Netflix in foreign countries and with even worse stuff to hide, you would think that some investment in getting a proper VPN with your own VPS would be the way to go, but no. Cost isn't the problem if you are deeply into something worth hiding, so why do so few people roll their own VPN? The reality is that the typical product is marketed with FUD and the goal is to turn you into a 'sleeping giant'. A 'sleeping giant' is a customer that has a standing order or other payment arrangement that is for a service that is not used, and for that to not be noticed on bank statements. Everyone wants you to be a 'sleeping giant', including some 'worthy' charities, dating websites and every software subscription service. They aren't using FUD marketing though. The commercial VPNs have mastered the art of selling a product that deserves technical knowledge to understand to the masses, so you have got to respect the hustle.

onetokeoverthe 1y ago

[dead]

yegor 1y ago

Ohh cool, we made that map (I'm from Windscribe). If you spot any errors, let me know.

ComplexSystems 1y ago

TL;DR: you shouldn't assume your data or activity is in any way anonymous when using these services. These VPNs are useful for changing your region for streaming and not much else. Otherwise, the traffic being routed through these VPNs is basically much more likely to involve "questionable" activity than ordinary traffic - and when you send your traffic through it, you are basically highlighting it as such - and all of this is well-known and of extreme interest to anyone interested in snooping on or analyzing such "questionable" activity.

dkga 1y ago

I’m not a big expert on the VPN tech side, but it always seemed to me that the most logical option for those that actually understand about VPN is Proton, or am I missing something here?

SOLAR_FIELDS 1y ago
Im a happy Proton user myself but if someone wanted the absolute most secure and private and reputable VPN I would point them to Mullvad. The main reason I use Proton is because I use the other apps in their suite as well and I get the VPN in the package deal. The threat model is good enough for my use cases
- 8cvor6j844qw_d6 1y ago
  Mullvad doesn't support port forwarding [1] for users that need it unlike proton vpn [2]. Although I have never needed it myself, which in that case Mullvad might be better since they require minimal registration details. [1]: https://mullvad.net/en/blog/removing-the-support-for-forwarded-ports https://mullvad.net/en/blog/removing-the-support-for-forward... [2]: https://protonvpn.com/support/port-forwarding https://protonvpn.com/support/port-forwarding
  - cakealert 1y ago
    unless you have a specific use case where you need to run a server through your vpn this isn't as much of a problem as you think it is. torrents for example have hole punching functionality built into uTP where reachable peers help unreachable peers connect to each other.
- y-c-o-m-b 1y ago
  I am also a relatively happy proton user (now, but wasn't always this way). I second this. Based off the site, it looks like Mullvad passed a real world test too, Proton has not. I haven't tried Mullvad in a couple of years, but they were always reliable and fast. The only issue I had with Mullvad was getting connected to enough peers when torrenting, especially on older torrents where the pool of users is small. Proton's port forwarding feature did noticeably help with that. I do enjoy being able to pay a discounted yearly subscription price with Proton and their user interface is nice. There are some minor problems with split-tunneling in Proton though, sometimes it doesn't work and I haven't figured out why.

8cvor6j844qw_d6 1y ago

A long time ago, I have difficulty removing payment card information from ExpressVPN. Managed to contact support to remove it but they merely zeroed out (it shows 0 for the visible fields) the card details rather than truly removing payment information.

Ms-J 1y ago

Can anyone give info on who owns Trust.Zone VPN? The company saves all credentials and doesn't allow the user to generate anything, such as Wireguard private keys. The service is very likely logging everything, and already admits to logging bandwidth, which is severe enough. Wouldn't be surprised if this was a honeypot for logging Russian internet users, as it appears to cater to Eastern users.

cess11 1y ago
They hide who they are. If you look at their privacy policy: https://trust.zone/privacy https://trust.zone/privacy Then you'll notice that it does not tell you what entity they are or where it is incorporated. Elsewhere they claim to be incorporated as Trusted Solutions Ltd in Mahé in the Seychelles. https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-top-vpn-industry-news-websites https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-to... And this review claims they are an LLC. https://thebestvpn.com/reviews/trust-zone/ https://thebestvpn.com/reviews/trust-zone/ But when I search for this name in the local registry I get no results. https://www.registry.gov.sc/BizRegistration/WebSearchBusiness.aspx https://www.registry.gov.sc/BizRegistration/WebSearchBusines... The Seychelles kind of belong to the 'non-aligned' group of countries, and maintains decent relations with Russia, India, China and so on. They also advocate for a diminished US presence in the Indian Ocean. On the other hand, they're a member of the british Commonwealth and only got independence in 1976. Trust.Zone sure looks fishy but I can't tell from this whether they are surveillance for the UK, traffic to hide in for russian authorities and cyber crime groups or something else entirely. I'd avoid them unless I was already into grey or directly criminal activities and already had layers of protection and indirection in place.
- Ms-J 1y ago
  The analysis is spot on. What in particular concerns me is the lack of any type of registration seemingly anywhere. I don't mind if a privacy focused VPN said they don't register at all in any country and stated the reasons as to why, but this company seems to have lied. "The Seychelles kind of belong to the 'non-aligned' group of countries, and maintains decent relations with Russia, India, China and so on. They also advocate for a diminished US presence in the Indian Ocean. On the other hand, they're a member of the british Commonwealth and only got independence in 1976." Seychelles is a great place to register for a privacy focused service but I agree with you that being a member state of the British commonwealth is concerning. Could you possibly recommend any place that would be better to register such as service? "Trust.Zone sure looks fishy but I can't tell from this whether they are surveillance for the UK, traffic to hide in for russian authorities and cyber crime groups or something else entirely. I'd avoid them unless I was already into grey or directly criminal activities and already had layers of protection and indirection in place." It gives the worst vibes possible for a supposed security service. Trust.Zone offers a free trial which I signed up for to test with a disposable VM. This is where I learned how they keep user credentials and other major privacy issues, such as the logging I mentioned in my last comment. The support also sent a very questionable reply to a ticket where they wanted to do screen sharing and run an arbitrary script on my server to "diagnose" the issue.

mjbale116 1y ago

Can someone explain to me why should I use a VPN when Tor is out there? It just seems to me odd that one would pipe their communications through a private company, that operates over a jurisdiction when said jurisdiction can compel the company in actions that may compromise my anonymity. From my perspective, its like shifting my trust from my ISP (an entity with way more oversight) to a pvt ltd. Isn't Tor as safe as it can get when surfing the web?

kachapopopow 1y ago
vpns are marketed as hiding you from less trustworthy companies or accessing region locked content.
tsunagatta 1y ago
From my understanding, they have different purposes. VPNs aren’t really about safety or anonymity, Tor is the way to go for those. VPNs are for if you don’t want your ISP specifically to see your traffic for some reason, or if you want your traffic to appear like it’s coming from a different geographical location with minimal latency hit. Edit: I should say, VPNs as a technology have far more applications than this, e.g. for accessing a secure intranet, but these are just the reasons you’d theoretically want to use a VPN service like Nord/Mullvad/etc.
webstrand 1y ago
VPNs are for when you want to obfuscate your traffic from your ISP, not the government. By passing your traffic through a private company _somewhere else_ to another private entity that has some vested interest in not reselling your data, you can prevent it from being easily mapped back to you. Also VPN is generally much faster and higher bandwidth than TOR.
- deleted 1y ago
  [deleted]
8cvor6j844qw_d6 1y ago
Tor is unbearably slow for daily general use.

tonetegeatinst 1y ago

Glad to see more zero trust confidential computing happening....but keep in mind its still vulnerable to attacks like Battering RAM which can fully breaks cutting-edge Intel SGX and AMD SEV-SNP confidential computing processor security technologies.

walterbell 1y ago
How is confidential computing applied to VPNs?
MagicalTux 1y ago
Battering RAM has been demonstrated to work well against Intel's "Scalable SGX" which is also known as SGX 2, and uses static encryption key to allow SGX to use more of the system's memory. For example at VP.NET we're using SGX 1, which uses AES-CTR for memory encryption which is not susceptible to memory reply attack, and comes with a limit of 512MB of ram. It's a lot of pain working with a very small memory allocation (especially nowadays where most machines come with 128GB+). batteringram.eu calls that "Client SGX" with a checkmark on "Read", but reading the actual paper it only mentions being able to know which areas of memory were written to (see 7.1). There might be applications where memory access pattern gives detail on the underlying work performed, but this is likely coarse (encryption is likely per page) and unlikely to yield to anything useful. This said we are also exploring other TEEs including Intel TDX, and having a wider array of options will give us the ability to instantly disable any technology for which we know security has been compromised.
- MoonObserver 1y ago
  Intel TDX unfortunately suffers from the exact same vulnerability as Scalable SGX. The underlying root cause is the lack of randomized encryption; using a static-adversary encryption scheme (XTS) rather than a dynamic-adversary one. The result is that plaintext-ciphertext mappings are unchanged at a fixed memory address. While the choice of scheme might initially seem puzzling, it is due to a randomized encryption scheme requiring counters for each memory block, which has a prohibitive on-chip memory cost when scaling to hundreds of GBs of memory.

crossroadsguy 1y ago

At this point, the VPN industry is so rife with shady dealings, suspicious ownership structures, weird exits, questionable marketing/PR practices/pushes, and rumours that waters have been muddied sufficiently for every provider out there. It might have been by design as well. Who knows. I now believe that you know your use case and use VPN only for that, and decide whether you really need to pay with parts of your kidneys for a service that claims to be the "uber privacy bulwark of the season" (until proven otherwise, as it happens), and get done with it, and make sure "anonymity and privacy" are not the expectations unless you have gone to great lengths to ensure these two, and if that's the case, you won't be in the market for "list most private VPNs providers" at a search or LLM input box. If your needs are anonymity, a VPN is not going to solve it— in fact, relying on one might endanger you. Even for privacy, I'd be very careful in trusting a VPN (any VPN). So if you need a VPN for streaming content from other geographies, just get the one at the best cost that does the job well in your geography, without going through the rabbit hole of cryptographic verification, reputation spiral, etc.

wongarsu 1y ago
A VPN is always a risk. Still, there is a difference between using Mulvad or PrivateInternetAccess. The difference between risking that the service might do bad things with your data, and having high certainty that it does. And this article gives pretty good indications which category each service belongs to
- kouru225 1y ago
  You’d put private internet access in the really bad category?
  - vincentpants 1y ago
    Yes. Very much so. PIA was purchased by a British-Israeli corporation called Kape Inc. which has been a known bad-actor in the past and is a giant red flag when looking for VPN options. (edited away the brevity)
1y ago

dackdel 1y ago

just use mullvad

braza 1y ago

Despite all the shenanigans related to their corporate structure, does someone really trust in those services in terms of real privacy? It's hard to believe that for USD 10/month you can have a high-trust VPN so that your ISP will never know who you are, and you can surf the internet untraceable from the IP perspective. I mean, that kind of infrastructure costs money, and the mechanics to make it happen must be very expensive, and it is hard to believe that this is very commoditized. It sometimes sounds like someone is selling a 2-cent pizza in Zürich: If you're paying that, maybe you're not ready to know what is inside.

userbinator 1y ago

Isn't it entirely unsurprising that those running a highly privacy-oriented service would themselves be rather mysterious? All it takes is an unattended machine for someone to boot another os on and grab the file If you're going to the trouble of using a VPN, that is not a very likely scenario, and ditto for other users(!) on your machine.

novoreorx 1y ago

Using a VPN for regular users is like jumping from one fire pit to another. The real way to escape censorship and privacy leaks is to increase your cognition, avoid blindly following KOLs, think independently when choosing tools

scyzoryk_xyz 1y ago

At least uh they sponsor a lot of great video entertainment content

throwaway-0001 1y ago

https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#map-JhhBFszt/conn-7bGIxPjj https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#map-J... Mulvad connected to malwarebytes ups I thought mullvad was clean

la_oveja 1y ago
seems like malwarebytes uses mullvad for its vpn service.
- mantra2 1y ago
  Yes and they’re very transparent about it. https://mullvad.net/en/help/partnerships-and-resellers https://mullvad.net/en/help/partnerships-and-resellers

fuqukyle 1y ago

[flagged]

RyanShook 1y ago

Strange that this is a blog post by windscribe which follows many of the same practices as the VPN providers they criticize here. Were VPNs ever really providing privacy? The underlying business model is selling user data.

daveidol 1y ago
I'm curious to learn more about Windscribe. Do you have any more info you can share about their practices?

laylower 1y ago

So anyone else besides Airvpn and Mullvad is even worth considering?

wsc981 1y ago
You can setup a private VPN with Digital Ocean and a PiHole droplet. I guess it's a little bit less likely to be a honeypot. It also seems cheaper than any public VPN offering.
eloisant 1y ago
ProtonVPN

gorbypark 1y ago

I only ever use a VPN to access region blocked content and the occasional "linux iso" torrent..I tried Mullvad first, but they just don't play the game of cat and mouse with the streaming providers and all their IPs are pretty much blocked. I have about a 95% success rate with NordVPN (except for Amazon Prime video which have some sort of wizardry and always are able to detect VPNs). It's a shame because Mullvad has a deal with Tailscale where you can sign up for Mullvad through Tailscale and use any of their servers as a Tailscale exit node. It's super slick and nice since Tailscale has really decent apps for nearly everything (even Apple TV, etc) and I already have a decently sized Tailnet of all my devices / ssh accessible things.

jiggunjer 1y ago
But you can connect any machine to any vpn and have it be a tailscale exit node?
- deleted 1y ago
  [deleted]
- smileybarry 1y ago
  Well, yes, but being able to designate a VPN node as a Tailscale exit node directly means you don't need a random server in the middle for it. (Which is beneficial if you use it as an exit node for road warrior devices)
- gorbypark 1y ago
  You can, but the issue is usability..when I'm watching TV, I want to just be able to flip open an app and say "I'm in London!" and watch BBC, then the same for Canada and etc. I don't want to be fiddling with a VPN and switching routes on some separate device / switching the entire wifi network or etc.
smileybarry 1y ago
I use ProtonVPN for bypassing media geoblocking, and they're fairly good, with some exceptions (BBC iPlayer works via browser but not the Apple TV app, local IPTV doesn't work on any Proton local servers). They have an Apple TV app so I just switch it on as needed, and it's restricted to just that Apple TV. (Without having to fiddle with a separate WiFi network etc.) IKEv2, OpenVPN and Wireguard work without their apps so I don't have to install their apps on non-sandboxed platforms (Windows, macOS).

pistolpete5 1y ago

[dead]

ARandomerDude 1y ago

> British-Israeli security software company Kape Technologies That doesn't sound good for privacy.

Nifty3929 1y ago

VPNs will become illegal or backdoored, because privacy is becoming illegal. This is not really a technology problem, it's a social and legislative one. Many of us are afraid of (other people's) privacy, so we vote for legislators that will make it illegal. The legislators stoke this fear of privacy because they want an excuse to deepen their control of discourse, and their own citizens. So really, everybody wins!