5 ms·

Doesn't their business location in the US negate the need to be cracked?

drdaeman 13y ago
Based on their sites, I believe they're UK-based company (and US endpoints are just endpoints, in case someone wants to have US-located exit to access US-only services), so it makes somehow reasonably harder (but not impossible) to correlate between the client and their traffic. Still, I don't see any significant difference between NSA and GHCQ, except that we have (thanks to Snowden) some details of former's operations leaked, but the latter's remain secret (or I didn't pay enough attention to the news, maybe).
- IvyMike 13y ago
  We're still talking about PIA? Definitely US-based. From https://www.privateinternetaccess.com/pages/contact-us https://www.privateinternetaccess.com/pages/contact-us "Q: Where are you located? A: We are located in the US. Being in the US is optimal for VPN Privacy services since the US is one of the few countries that does not have a mandatory data retention policy. Countries in the EU are forced to log, even though some claim they do not."
  - floatboth 13y ago
    IPredator: "There are no traffic logs, we do not look into your traffic." http://www.wilderssecurity.com/showthread.php?t=331316 http://www.wilderssecurity.com/showthread.php?t=331316 – "Sweden - Data retention law going into effect in May 2012, but (presumably) not applicable to VPNs"
r0h1n 13y ago
They don't store any user logs (I have no reason to suspect they'd lie about that). So there's not much stored data to break. Which means the focus will be on breaking their traffic encryption protocols.
- eli 13y ago
  Not necessarily. There's no need to break the encryption or have logs if the NSA can monitor all the traffic going in and out of the proxy server. They just have to correlate your incoming encrypted connection with the outgoing unencrypted data to remove the layer of anonymity. I'd frankly be a little surprised if they weren't doing this or something like it. I would guess that using PIA makes you less secure against NSA snooping since it makes you more of a target and provides weak anonymity.
  - r0h1n 13y ago
    > I would guess that using PIA makes you less secure against NSA snooping since it makes you more of a target and provides weak anonymity. So you're saying not using encryption and VPN services is a safer choice as regards Internet usage today? You seem to be going against the grain of most of what's been discussed around privacy & Internet surveillance on HN recently.
    - eli 13y ago
      I wouldn't make a blanket statement like that. Depends what VPN and how you're using it and what you're doing on the internet and (in particular) what threat you're trying to protect yourself against. PIA will do a good job of protecting the contents of your messages from someone sniffing your wifi hotspot, but is useless against someone with the ability to monitor all internet traffic. The data leaving the PIA proxy is just as unencrypted as it would be if you weren't using a VPN, except your attempt to secure it will likely draw extra attention. There's strong evidence [1] that the NSA has special rules that allow enhanced collection and analysis of encrypted traffic. [1] "...the NSA is allowed to hold onto communications solely because you use encryption." https://www.eff.org/deeplinks/2013/06/depth-review-new-nsa-documents-expose-how-americans-can-be-spied-without-warrant https://www.eff.org/deeplinks/2013/06/depth-review-new-nsa-d...
- dwiel 13y ago
  If your adversary includes the NSA, you have to consider the possibility that the NSA has required that they store logs and not tell anyone about it.

Based on their sites, I believe they're UK-based company (and US endpoints are just endpoints, in case someone wants to have US-located exit to access US-only services), so it makes somehow reasonably harder (but not impossible) to correlate between the client and their traffic. Still, I don't see any significant difference between NSA and GHCQ, except that we have (thanks to Snowden) some details of former's operations leaked, but the latter's remain secret (or I didn't pay enough attention to the news, maybe).

IvyMike 13y ago
We're still talking about PIA? Definitely US-based. From https://www.privateinternetaccess.com/pages/contact-us https://www.privateinternetaccess.com/pages/contact-us "Q: Where are you located? A: We are located in the US. Being in the US is optimal for VPN Privacy services since the US is one of the few countries that does not have a mandatory data retention policy. Countries in the EU are forced to log, even though some claim they do not."
- floatboth 13y ago
  IPredator: "There are no traffic logs, we do not look into your traffic." http://www.wilderssecurity.com/showthread.php?t=331316 http://www.wilderssecurity.com/showthread.php?t=331316 – "Sweden - Data retention law going into effect in May 2012, but (presumably) not applicable to VPNs"

r0h1n 13y ago

They don't store any user logs (I have no reason to suspect they'd lie about that). So there's not much stored data to break. Which means the focus will be on breaking their traffic encryption protocols.

eli 13y ago
Not necessarily. There's no need to break the encryption or have logs if the NSA can monitor all the traffic going in and out of the proxy server. They just have to correlate your incoming encrypted connection with the outgoing unencrypted data to remove the layer of anonymity. I'd frankly be a little surprised if they weren't doing this or something like it. I would guess that using PIA makes you less secure against NSA snooping since it makes you more of a target and provides weak anonymity.
- r0h1n 13y ago
  > I would guess that using PIA makes you less secure against NSA snooping since it makes you more of a target and provides weak anonymity. So you're saying not using encryption and VPN services is a safer choice as regards Internet usage today? You seem to be going against the grain of most of what's been discussed around privacy & Internet surveillance on HN recently.
  - eli 13y ago
    I wouldn't make a blanket statement like that. Depends what VPN and how you're using it and what you're doing on the internet and (in particular) what threat you're trying to protect yourself against. PIA will do a good job of protecting the contents of your messages from someone sniffing your wifi hotspot, but is useless against someone with the ability to monitor all internet traffic. The data leaving the PIA proxy is just as unencrypted as it would be if you weren't using a VPN, except your attempt to secure it will likely draw extra attention. There's strong evidence [1] that the NSA has special rules that allow enhanced collection and analysis of encrypted traffic. [1] "...the NSA is allowed to hold onto communications solely because you use encryption." https://www.eff.org/deeplinks/2013/06/depth-review-new-nsa-documents-expose-how-americans-can-be-spied-without-warrant https://www.eff.org/deeplinks/2013/06/depth-review-new-nsa-d...
dwiel 13y ago
If your adversary includes the NSA, you have to consider the possibility that the NSA has required that they store logs and not tell anyone about it.