13 ms·

CryptoSeal (YC S11) Shutting Down Private VPN

205 points by Udo 13y ago

Udo 13y ago
I was just trying to sign in to my account, as I was greeted with this: "CryptoSeal Privacy Consumer VPN service terminated with immediate effect With immediate effect as of this notice, CryptoSeal Privacy, our consumer VPN service, is terminated. All cryptographic keys used in the operation of the service have been zerofilled, and while no logs were produced (by design) during operation of the service, all records created incidental to the operation of the service have been deleted to the best of our ability. Essentially, the service was created and operated under a certain understanding of current US law, and that understanding may not currently be valid. As we are a US company and comply fully with US law, but wish to protect the privacy of our users, it is impossible for us to continue offering the CryptoSeal Privacy consumer VPN product. Specifically, the Lavabit case, with filings released by Kevin Poulsen of Wired.com (https://www.documentcloud.org/documents/801182-redacted-pleadings-exhibits-1-23.html https://www.documentcloud.org/documents/801182-redacted-plea...) reveals a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device. Our system does not support recording any of the information commonly requested in a pen register order, and it would be technically infeasible for us to add this in a prompt manner. The consequence, being forced to turn over cryptographic keys to our entire system on the strength of a pen register order, is unreasonable in our opinion, and likely unconstitutional, but until this matter is settled, we are unable to proceed with our service. We encourage anyone interested in this issue to support Ladar Levison and Lavabit in their ongoing legal battle. Donations can be made at https://rally.org/lavabit https://rally.org/lavabit We believe Lavabit is an excellent test case for this issue. We are actively investigating alternative technical ways to provide a consumer privacy VPN service in the future, in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure) without compromising user privacy, but do not have an estimated release date at this time. To our affected users: we are sincerely sorry for any inconvenience. For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection, as well as a refund of your service balance, and free service for 1 year if/when we relaunch a consumer privacy VPN service. Thank you for your support, and we hope this will ease the inconvenience of our service terminating. For anyone operating a VPN, mail, or other communications provider in the US, we believe it would be prudent to evaluate whether a pen register order could be used to compel you to divulge SSL keys protecting message contents, and if so, to take appropriate action."
Beltiras 13y ago
Come to Iceland. Law is on your side here and the infrastructure is coming along.
- chmars 13y ago
  What's the legal situation in Iceland? Isn't it likely that Iceland has – as all functioning countries – a surveillance apparatus and is cooperating with the US? For the latter, the usual legal trick is not to spy on your own citizens but to ask a partner service for data about your own citizens … Strict privacy laws can be great, however, they are no protection from surveillance. Surveillance is usually excluded from privacy laws as far as countries are snoopy and not 'just' private entities.
  - Beltiras 13y ago
    The dept. of the Interior has been talking about expanded investigatory powers for police but those are aimed at when they can open an investigation without prior cause. There is no spy agency in Iceland. We are a nation of roughly 350k people. Last interior minister actually sent the FBI packing when they came to investigate something.
  - Zigurd 13y ago
    To get a handle on how bad domestic spying is in practical terms, consider that the US outspends the rest of the planet in military spending. Surveillance spending is likely to be roughly proportional. A small nation with low military spending per-capita could fall below the threshold of operating an effective surveillance state, just as they could fall below the threshold of operating a blue-water navy.
  - jluster 13y ago
    It is highly unlikely that our current government is colluding with the US. Transparency is too high and anti-American sentiment as well. Don't forget, we're in total about half the size of an average American suburb, everyone knows everyone, there's very little you can gain from spying as opposed to asking. Spying electronically on Icelanders is a useless and expensive pursuit, if you want to know anything you go downtown and sit around while your average Joe or Jane talk about it.
beaker52 13y ago
With every shut down in a similar vein, I weep and fear for the future.
- Udo 13y ago
  It may sound strange for me as a European to be saying this, but I worry that the second stage of this will be a massive exodus of talent and startups out of the US.
  - SeanDav 13y ago
    This would probably be a good thing. Right now the internet is way too US driven and focused. A more balanced, global distribution of talent would be far more beneficial.
    - Udo 13y ago
      At first glance it may seem that way, but I don't see how the privacy and human rights situation is all that different in, say, Europe and it's generally worse in places like India or China. Whenever I see European startup communities at work, they're really at their best when they're emulating US startup culture. Removing US influence may lead to an even more stagnant ecosystem in the long run.
    - chmars 13y ago
      I agree. And it might ease some of the pricing issue too. There are many plans for cloud services outside the US but there's usually a lack of know-how and competitive functionality/pricing. A current example: Clio, a cloud provider for lawyers, recently started to offer a server location in Ireland in order to comply with European privacy laws [1]. The price, however, is about 60% higher than in the US … Price comparison: US = 49 USD/month = about 36 EUR [2] EU = 49 GBP/month = about 58 EUR [3] [1] = http://www.goclio.com/blog/2013/10/clio-online-practice-management-platform-launches-in-europe/ http://www.goclio.com/blog/2013/10/clio-online-practice-mana... [2] = http://www.goclio.com/signup/ http://www.goclio.com/signup/ [3] = http://www.goclio.co.uk/signup/ http://www.goclio.co.uk/signup/
dingaling 13y ago
Perhaps I'm being daft, but I'm struggling to see the connection between SSL certs ( per the Lavabit scenario ) and a VPN service. Didn't they have an IPSec cert for each individual subscriber? If not.. I wouldn't have wanted to go anywhere near them if they were using one keypair for all traffic. Public-facing websites are usually dependent on a single server cert because they can't easily provide a separate client cert for everyone who visits. A private, subscription-based service should not be using that model and thus should not have encountered the 'Lavabit Paradox'. Neither should Lavabit, but I digress.
- Udo 13y ago
  The prospect of the government demanding all your encryption keys is probably just one of the threats. Apparently they shut down CS because they simply don't want to enable the security apparatus spying on their customers.
- rdl 13y ago
  The problem is a pen trap order, which is a very low legal bar, far lower than probable cause, can be applied to any single customer. Since we couldn't implement that effectively, we would be forced to give all of that customer's raw traffic to the government. It's entirely likely they would also compel an entire node or even the entire system if they felt that was more effective for their purposes in any way. If the bar set to do this were at search warrant level (probable cause of criminal activity), that would still kind of suck, but the bar for pen traps being so low by comparison totally invalidates our security model. All US providers (including "foreign" providers with US principals or US operations) are vulnerable to this specific problem right now. There are technical ways to deal with this, but it would take months to implement, and no one has done it before. I've got a bunch of talks scheduled for conferences over the next year on how to implement exactly this (and am working on the tech for it), but it's not going to be instantaneous. We didn't want to be in the position of screwing over even one customer in the interim. Until that stuff is in place, my recommendation is to use a non-US VPN provider. There, you're still at risk to local search warrants, but those are a relatively high legal standard in some jurisdictions. The problem in the US is that the lavabit case implies a much lower legal standard to effectively compel all traffic. It'll probably be a year or two before this plays itself out in the courts. Hopefully 6-9 months for a much stronger technical solution. I'm actually working with some pretty kickass legal people on v2. (as always, I Am Not A Lawyer; I Am Not Your Lawyer; This is not legal advice; Consult an attorney licensed in your jurisdiction for specific legal advice in your particular case.)
deleted 13y ago
[deleted]
- Udo 13y ago
  You literally signed up five minutes ago just to post these wild allegations.
  - mike-cardwell 13y ago
    To be fair, that was my first thought too. I find it difficult to believe they would close down if the service was successful and growing. I know this is exactly what Lavabit did, but I feel Lavabit is an exception to the rule in this respect. I have no evidence either way, just my gut feeling. Until I've seen evidence that it was anything other than a simple money related business decision, I'm going to assume it was so. I don't mean to make any accusations: This is just the way my brain works.
    - Udo 13y ago
      So if he wasn't trolling, why didn't cryptomaniac use his real account to say this? It's very sad that these kinds of drive-by accounts are so successful (he got at least two upvotes at the time I'm writing this) for what seems like a personal attack without any data to back up the claims. And regarding the actual content, it doesn't really make sense to me why a startup would lose face if they shut down a service that wasn't viable. They are expected to experiment. It happens all the time and nobody minds. Sure, it probably makes the decision easier to shut down if there aren't a lot of users, but let's not jump to conclusions.
      - mike-cardwell 13y ago
        > So if he wasn't trolling, why didn't cryptomaniac use his real account to say this? I did not make this claim, so feel no need to answer your question. > It's very sad that these kinds of drive-by accounts are so successful (he got at least two upvotes) for what seems like a personal attack without any data to back up the claims. I don't think he meant to express it as a statement of fact, but meant to suggest it as his strong oppinion. I just think it was worded badly. Lots of people don't sign up until they decide to make their first comment. > And it doesn't really make sense to my why a startup would lose face if they shut down a service that wasn't viable. They are expected to experiment. It happens all the time and nobody minds. Sure, it probably makes the decision easier to shut down if there aren't a lot of users, but let's not jump to conclusions. Many people are embarrased when their companies fail.
mike-cardwell 13y ago
If you're gonna publish something with a PGP signature. At least make sure it's valid: mike@glue:~$ wget -q -O - https://privacy.cryptoseal.com/ | gpg --verify gpg: Signature made Mon 07 Oct 2013 12:38:07 BST using DSA key ID D2E0301F gpg: BAD signature from "Ryan Lackey <rdl@icloud.com>" mike@glue:~$
- rdl 13y ago
  sigh, I think it got screwed up when someone put it on the website. And I'm currently in Asia for a conference and don't have my keys (intentionally...). it still meets the xkcd definition of a secure pgp message, at least.
  - mike-cardwell 13y ago
    Replace the newline char immediately following the string "we relaunch a" with a space instead, and then it verifies.
  - natch 13y ago
    I guess you didn't know about the fold command, either... cat my-aspergers-unformmatted-text-file.txt | fold -s > readable.txt
    - mike-cardwell 13y ago
      Useful to know. Thanks.
  - bifrost 13y ago
    Paste buffer fail or something. Fixed now.
- deleted 13y ago
  [deleted]
- yuvadam 13y ago
  Works here/now: $ wget -q -O - https://privacy.cryptoseal.com/ | gpg --verify gpg: Signature made Mon Oct 7 14:38:07 2013 EEST using DSA key ID D2E0301F gpg: Good signature from "Ryan Lackey <rdl@icloud.com>" Primary key fingerprint: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F
gonzo 13y ago
We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.) Amazon said they didn't want anything powered by FreeBSD in AWS. There are currently negotiations about running on a larger instance that supports the HVM, and avoids the 'Windows tax', but there are significant usage fees for that tier (today that´s the cluster compute and M3 instances) as well. We could release a variant of the AMI as a "public" AMI. It wouldn't be in AWS then, but it would be available. If your account is new enough, it would allow a completely free VPN service on Amazon's "free tier". It would also allow people to setup their own VPN service (OpenVPN and IPSEC are both fully supported.) Hosting on top of EC2 isn't perfect (there are possible key recovery attacks from others hosted on the same infrastructure), but, correctly configured, Law Enforcement would need more than a pen register order to obtain anything beyond the enclosing IP packet data. Since, in theory, you would be your own provider, the FBI (or an equivalent in other EC2 zones) would have a higher burden to install even a pen register. My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.
- easytiger 13y ago
  Before i got to the end of you comment I was going to suggest that anyone with an internet connection could do this. Indeed most home "nas devices" actually have VPN applications. I'm not familiar with more than a couple of commodity home wifi routers but i know some also carried this functionality. I guess the issue with needing a VPN is that you need one far away from where you are geographically. Maybe i have misunderstood the whole thing.
  - dismiss21x 13y ago
    Depends on what your goal is. Consumer VPNs have been used for an assortment of reasons. Some of these you would need a VPN server that is close-by, while others should be far away: 0) Remote access to small business office 1) Connect to home router to access home network 2) To avoid ISP throttling of YouTube, etc 3) Download torrents, usenet 4) Commit crimes (routed through unallied nations) 5) To watch Netflix or Hulu from Europe ...
- 13y ago
amirmc 13y ago
To the founders of CryptoSeal. When you first set up, did you consider not being a US headquartered company? If so, what were the overriding factors that made you stay US-based? I ask because in a recent blog post from Silent Circle (a secure comms company), they explicitly state "we are not a U.S firm" [1]. I'm beginning to think any company that wants to offer security products like this has to place their Global HQ outside the US's legal jurisdiction. I doubt it solves all the problems but it probably helps to some extent. [1] http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-year-silent-circles-first-anniversary/ http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-y...
- gonzo 13y ago
  Silent Circle "isn't a US company", but has their US HQ in Washington DC. They have software engineers in "Silicon Valley". What makes you think they're "outside the US' legal jurisdiction"?
  - amirmc 13y ago
    Apologies, I wasn't clear enough. What I'm trying to refer to is the legal jurisdiction of the Global HQ and what effect that has (if any) on receiving court orders like the one described in this discussion. Having wholly-owned subsidiaries in the territories in which you operate is a requirement and puts part of the company within that jurisdiction but I'm curious to know if having the parent company elsewhere offers some form of insulation (or not). Perhaps this is a question I should direct at the other company but I wondered if it was something that the CryptoSeal folks had considered.
- rdl 13y ago
  There are multiple concepts of jurisdiction. It does very little good to just "incorporate offshore" and still have US operations, US principals, etc. If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught. While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US. The silent circle guys are basically all US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.
rnts08 13y ago
Https://simple-vpn.com, why deal with us companies for security services?
- aluhut 13y ago
  http://www.simplevpn.net/ http://www.simplevpn.net/ ?
  - rnts08 13y ago
    No, actually https://simple-vpn.com https://simple-vpn.com, it's paid for with BTC for those who really care about anonymity and privacy. Seems like the service got hackernewsed though. :)
    - aluhut 13y ago
      Ah that explains the 502 :)
derstang 13y ago
What I don't understand is why I didn't get a notification of the shutdown. As a paying customer I shouldn't read about it on HN. I used the service primarily to shield myself in hotels/coffeeshops, but I know the NSA can get to me if they want to and I don't really care. I appreciate the high ground CryptoSeal is coming from, but from a customer standpoint I don't think this was done well.
- Zelphyr 13y ago
  If they let you know then the government knows and CryptoSeal runs the risk of the government compelling them by force of FISA court order to stay in business, turn over all customer data, and don't say anything about it.
  - oijaf888 13y ago
    Have any companies ever been compelled to stay in business? How does that even work, especially if the company (not sure if its applicable in this case) is losing money at the time? Does the government subsidize all of the operations at that point? Can they compel people not to quit their jobs in this case too?
    - atomatica 13y ago
      "'I could be arrested for this action,' Ladar Levison told NBC News about his decision to shut down his company, Lavabit LLC, in protest over a secret court order he had received from a federal court that is overseeing the investigation into Snowden." http://investigations.nbcnews.com/_news/2013/08/13/20008036-lavabitcom-owner-i-could-be-arrested-for-resisting-surveillance-order http://investigations.nbcnews.com/_news/2013/08/13/20008036-...
peterwwillis 13y ago
A VPN is just an access control mechanism for network services; it is for network service privacy. If you're worried about the privacy of your data, you should be using technology to protect your data at rest, such as PGP.
lnanek2 13y ago
If they were serious about running a privacy startup, they would move out of the US. Better luck next startup guys.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
- Klinky 13y ago
  You would be right to have concerns about future ventures by the creators of Lavabit or CryptoSeal, just like someone might have concern about a Google API service. At least Lavabit and CryptoSeal are giving legitimate and very real reasons why their services shut down. This is different then being told "it's a business decision" or just having it disappear with no reason given.
  - at-fates-hands 13y ago
    Or worse, not you tell you anything, and in a few years you find out someone's been monitoring all the VPN traffic, INCLUDING YOURS.

205 points by Udo 13y ago

Udo 13y ago

I was just trying to sign in to my account, as I was greeted with this: "CryptoSeal Privacy Consumer VPN service terminated with immediate effect With immediate effect as of this notice, CryptoSeal Privacy, our consumer VPN service, is terminated. All cryptographic keys used in the operation of the service have been zerofilled, and while no logs were produced (by design) during operation of the service, all records created incidental to the operation of the service have been deleted to the best of our ability. Essentially, the service was created and operated under a certain understanding of current US law, and that understanding may not currently be valid. As we are a US company and comply fully with US law, but wish to protect the privacy of our users, it is impossible for us to continue offering the CryptoSeal Privacy consumer VPN product. Specifically, the Lavabit case, with filings released by Kevin Poulsen of Wired.com (https://www.documentcloud.org/documents/801182-redacted-pleadings-exhibits-1-23.html https://www.documentcloud.org/documents/801182-redacted-plea...) reveals a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device. Our system does not support recording any of the information commonly requested in a pen register order, and it would be technically infeasible for us to add this in a prompt manner. The consequence, being forced to turn over cryptographic keys to our entire system on the strength of a pen register order, is unreasonable in our opinion, and likely unconstitutional, but until this matter is settled, we are unable to proceed with our service. We encourage anyone interested in this issue to support Ladar Levison and Lavabit in their ongoing legal battle. Donations can be made at https://rally.org/lavabit https://rally.org/lavabit We believe Lavabit is an excellent test case for this issue. We are actively investigating alternative technical ways to provide a consumer privacy VPN service in the future, in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure) without compromising user privacy, but do not have an estimated release date at this time. To our affected users: we are sincerely sorry for any inconvenience. For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection, as well as a refund of your service balance, and free service for 1 year if/when we relaunch a consumer privacy VPN service. Thank you for your support, and we hope this will ease the inconvenience of our service terminating. For anyone operating a VPN, mail, or other communications provider in the US, we believe it would be prudent to evaluate whether a pen register order could be used to compel you to divulge SSL keys protecting message contents, and if so, to take appropriate action."

Beltiras 13y ago

Come to Iceland. Law is on your side here and the infrastructure is coming along.

chmars 13y ago
What's the legal situation in Iceland? Isn't it likely that Iceland has – as all functioning countries – a surveillance apparatus and is cooperating with the US? For the latter, the usual legal trick is not to spy on your own citizens but to ask a partner service for data about your own citizens … Strict privacy laws can be great, however, they are no protection from surveillance. Surveillance is usually excluded from privacy laws as far as countries are snoopy and not 'just' private entities.
- Beltiras 13y ago
  The dept. of the Interior has been talking about expanded investigatory powers for police but those are aimed at when they can open an investigation without prior cause. There is no spy agency in Iceland. We are a nation of roughly 350k people. Last interior minister actually sent the FBI packing when they came to investigate something.
- Zigurd 13y ago
  To get a handle on how bad domestic spying is in practical terms, consider that the US outspends the rest of the planet in military spending. Surveillance spending is likely to be roughly proportional. A small nation with low military spending per-capita could fall below the threshold of operating an effective surveillance state, just as they could fall below the threshold of operating a blue-water navy.
- jluster 13y ago
  It is highly unlikely that our current government is colluding with the US. Transparency is too high and anti-American sentiment as well. Don't forget, we're in total about half the size of an average American suburb, everyone knows everyone, there's very little you can gain from spying as opposed to asking. Spying electronically on Icelanders is a useless and expensive pursuit, if you want to know anything you go downtown and sit around while your average Joe or Jane talk about it.

beaker52 13y ago

With every shut down in a similar vein, I weep and fear for the future.

Udo 13y ago
It may sound strange for me as a European to be saying this, but I worry that the second stage of this will be a massive exodus of talent and startups out of the US.
- SeanDav 13y ago
  This would probably be a good thing. Right now the internet is way too US driven and focused. A more balanced, global distribution of talent would be far more beneficial.
  - Udo 13y ago
    At first glance it may seem that way, but I don't see how the privacy and human rights situation is all that different in, say, Europe and it's generally worse in places like India or China. Whenever I see European startup communities at work, they're really at their best when they're emulating US startup culture. Removing US influence may lead to an even more stagnant ecosystem in the long run.
  - chmars 13y ago
    I agree. And it might ease some of the pricing issue too. There are many plans for cloud services outside the US but there's usually a lack of know-how and competitive functionality/pricing. A current example: Clio, a cloud provider for lawyers, recently started to offer a server location in Ireland in order to comply with European privacy laws [1]. The price, however, is about 60% higher than in the US … Price comparison: US = 49 USD/month = about 36 EUR [2] EU = 49 GBP/month = about 58 EUR [3] [1] = http://www.goclio.com/blog/2013/10/clio-online-practice-management-platform-launches-in-europe/ http://www.goclio.com/blog/2013/10/clio-online-practice-mana... [2] = http://www.goclio.com/signup/ http://www.goclio.com/signup/ [3] = http://www.goclio.co.uk/signup/ http://www.goclio.co.uk/signup/

dingaling 13y ago

Perhaps I'm being daft, but I'm struggling to see the connection between SSL certs ( per the Lavabit scenario ) and a VPN service. Didn't they have an IPSec cert for each individual subscriber? If not.. I wouldn't have wanted to go anywhere near them if they were using one keypair for all traffic. Public-facing websites are usually dependent on a single server cert because they can't easily provide a separate client cert for everyone who visits. A private, subscription-based service should not be using that model and thus should not have encountered the 'Lavabit Paradox'. Neither should Lavabit, but I digress.

Udo 13y ago
The prospect of the government demanding all your encryption keys is probably just one of the threats. Apparently they shut down CS because they simply don't want to enable the security apparatus spying on their customers.
rdl 13y ago
The problem is a pen trap order, which is a very low legal bar, far lower than probable cause, can be applied to any single customer. Since we couldn't implement that effectively, we would be forced to give all of that customer's raw traffic to the government. It's entirely likely they would also compel an entire node or even the entire system if they felt that was more effective for their purposes in any way. If the bar set to do this were at search warrant level (probable cause of criminal activity), that would still kind of suck, but the bar for pen traps being so low by comparison totally invalidates our security model. All US providers (including "foreign" providers with US principals or US operations) are vulnerable to this specific problem right now. There are technical ways to deal with this, but it would take months to implement, and no one has done it before. I've got a bunch of talks scheduled for conferences over the next year on how to implement exactly this (and am working on the tech for it), but it's not going to be instantaneous. We didn't want to be in the position of screwing over even one customer in the interim. Until that stuff is in place, my recommendation is to use a non-US VPN provider. There, you're still at risk to local search warrants, but those are a relatively high legal standard in some jurisdictions. The problem in the US is that the lavabit case implies a much lower legal standard to effectively compel all traffic. It'll probably be a year or two before this plays itself out in the courts. Hopefully 6-9 months for a much stronger technical solution. I'm actually working with some pretty kickass legal people on v2. (as always, I Am Not A Lawyer; I Am Not Your Lawyer; This is not legal advice; Consult an attorney licensed in your jurisdiction for specific legal advice in your particular case.)

deleted 13y ago

[deleted]

Udo 13y ago
You literally signed up five minutes ago just to post these wild allegations.
- mike-cardwell 13y ago
  To be fair, that was my first thought too. I find it difficult to believe they would close down if the service was successful and growing. I know this is exactly what Lavabit did, but I feel Lavabit is an exception to the rule in this respect. I have no evidence either way, just my gut feeling. Until I've seen evidence that it was anything other than a simple money related business decision, I'm going to assume it was so. I don't mean to make any accusations: This is just the way my brain works.
  - Udo 13y ago
    So if he wasn't trolling, why didn't cryptomaniac use his real account to say this? It's very sad that these kinds of drive-by accounts are so successful (he got at least two upvotes at the time I'm writing this) for what seems like a personal attack without any data to back up the claims. And regarding the actual content, it doesn't really make sense to me why a startup would lose face if they shut down a service that wasn't viable. They are expected to experiment. It happens all the time and nobody minds. Sure, it probably makes the decision easier to shut down if there aren't a lot of users, but let's not jump to conclusions.
    - mike-cardwell 13y ago
      > So if he wasn't trolling, why didn't cryptomaniac use his real account to say this? I did not make this claim, so feel no need to answer your question. > It's very sad that these kinds of drive-by accounts are so successful (he got at least two upvotes) for what seems like a personal attack without any data to back up the claims. I don't think he meant to express it as a statement of fact, but meant to suggest it as his strong oppinion. I just think it was worded badly. Lots of people don't sign up until they decide to make their first comment. > And it doesn't really make sense to my why a startup would lose face if they shut down a service that wasn't viable. They are expected to experiment. It happens all the time and nobody minds. Sure, it probably makes the decision easier to shut down if there aren't a lot of users, but let's not jump to conclusions. Many people are embarrased when their companies fail.

mike-cardwell 13y ago

If you're gonna publish something with a PGP signature. At least make sure it's valid: mike@glue:~$ wget -q -O - https://privacy.cryptoseal.com/ | gpg --verify gpg: Signature made Mon 07 Oct 2013 12:38:07 BST using DSA key ID D2E0301F gpg: BAD signature from "Ryan Lackey <rdl@icloud.com>" mike@glue:~$

rdl 13y ago
sigh, I think it got screwed up when someone put it on the website. And I'm currently in Asia for a conference and don't have my keys (intentionally...). it still meets the xkcd definition of a secure pgp message, at least.
- mike-cardwell 13y ago
  Replace the newline char immediately following the string "we relaunch a" with a space instead, and then it verifies.
- natch 13y ago
  I guess you didn't know about the fold command, either... cat my-aspergers-unformmatted-text-file.txt | fold -s > readable.txt
  - mike-cardwell 13y ago
    Useful to know. Thanks.
- bifrost 13y ago
  Paste buffer fail or something. Fixed now.
deleted 13y ago
[deleted]
yuvadam 13y ago
Works here/now: $ wget -q -O - https://privacy.cryptoseal.com/ | gpg --verify gpg: Signature made Mon Oct 7 14:38:07 2013 EEST using DSA key ID D2E0301F gpg: Good signature from "Ryan Lackey <rdl@icloud.com>" Primary key fingerprint: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F

gonzo 13y ago

We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.) Amazon said they didn't want anything powered by FreeBSD in AWS. There are currently negotiations about running on a larger instance that supports the HVM, and avoids the 'Windows tax', but there are significant usage fees for that tier (today that´s the cluster compute and M3 instances) as well. We could release a variant of the AMI as a "public" AMI. It wouldn't be in AWS then, but it would be available. If your account is new enough, it would allow a completely free VPN service on Amazon's "free tier". It would also allow people to setup their own VPN service (OpenVPN and IPSEC are both fully supported.) Hosting on top of EC2 isn't perfect (there are possible key recovery attacks from others hosted on the same infrastructure), but, correctly configured, Law Enforcement would need more than a pen register order to obtain anything beyond the enclosing IP packet data. Since, in theory, you would be your own provider, the FBI (or an equivalent in other EC2 zones) would have a higher burden to install even a pen register. My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.

easytiger 13y ago
Before i got to the end of you comment I was going to suggest that anyone with an internet connection could do this. Indeed most home "nas devices" actually have VPN applications. I'm not familiar with more than a couple of commodity home wifi routers but i know some also carried this functionality. I guess the issue with needing a VPN is that you need one far away from where you are geographically. Maybe i have misunderstood the whole thing.
- dismiss21x 13y ago
  Depends on what your goal is. Consumer VPNs have been used for an assortment of reasons. Some of these you would need a VPN server that is close-by, while others should be far away: 0) Remote access to small business office 1) Connect to home router to access home network 2) To avoid ISP throttling of YouTube, etc 3) Download torrents, usenet 4) Commit crimes (routed through unallied nations) 5) To watch Netflix or Hulu from Europe ...
13y ago

amirmc 13y ago

To the founders of CryptoSeal. When you first set up, did you consider not being a US headquartered company? If so, what were the overriding factors that made you stay US-based? I ask because in a recent blog post from Silent Circle (a secure comms company), they explicitly state "we are not a U.S firm" [1]. I'm beginning to think any company that wants to offer security products like this has to place their Global HQ outside the US's legal jurisdiction. I doubt it solves all the problems but it probably helps to some extent. [1] http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-year-silent-circles-first-anniversary/ http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-y...

gonzo 13y ago
Silent Circle "isn't a US company", but has their US HQ in Washington DC. They have software engineers in "Silicon Valley". What makes you think they're "outside the US' legal jurisdiction"?
- amirmc 13y ago
  Apologies, I wasn't clear enough. What I'm trying to refer to is the legal jurisdiction of the Global HQ and what effect that has (if any) on receiving court orders like the one described in this discussion. Having wholly-owned subsidiaries in the territories in which you operate is a requirement and puts part of the company within that jurisdiction but I'm curious to know if having the parent company elsewhere offers some form of insulation (or not). Perhaps this is a question I should direct at the other company but I wondered if it was something that the CryptoSeal folks had considered.
rdl 13y ago
There are multiple concepts of jurisdiction. It does very little good to just "incorporate offshore" and still have US operations, US principals, etc. If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught. While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US. The silent circle guys are basically all US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.

rnts08 13y ago

Https://simple-vpn.com, why deal with us companies for security services?

aluhut 13y ago
http://www.simplevpn.net/ http://www.simplevpn.net/ ?
- rnts08 13y ago
  No, actually https://simple-vpn.com https://simple-vpn.com, it's paid for with BTC for those who really care about anonymity and privacy. Seems like the service got hackernewsed though. :)
  - aluhut 13y ago
    Ah that explains the 502 :)

derstang 13y ago

What I don't understand is why I didn't get a notification of the shutdown. As a paying customer I shouldn't read about it on HN. I used the service primarily to shield myself in hotels/coffeeshops, but I know the NSA can get to me if they want to and I don't really care. I appreciate the high ground CryptoSeal is coming from, but from a customer standpoint I don't think this was done well.

Zelphyr 13y ago
If they let you know then the government knows and CryptoSeal runs the risk of the government compelling them by force of FISA court order to stay in business, turn over all customer data, and don't say anything about it.
- oijaf888 13y ago
  Have any companies ever been compelled to stay in business? How does that even work, especially if the company (not sure if its applicable in this case) is losing money at the time? Does the government subsidize all of the operations at that point? Can they compel people not to quit their jobs in this case too?
  - atomatica 13y ago
    "'I could be arrested for this action,' Ladar Levison told NBC News about his decision to shut down his company, Lavabit LLC, in protest over a secret court order he had received from a federal court that is overseeing the investigation into Snowden." http://investigations.nbcnews.com/_news/2013/08/13/20008036-lavabitcom-owner-i-could-be-arrested-for-resisting-surveillance-order http://investigations.nbcnews.com/_news/2013/08/13/20008036-...

peterwwillis 13y ago

A VPN is just an access control mechanism for network services; it is for network service privacy. If you're worried about the privacy of your data, you should be using technology to protect your data at rest, such as PGP.

lnanek2 13y ago

If they were serious about running a privacy startup, they would move out of the US. Better luck next startup guys.

deleted 13y ago

[deleted]

deleted 13y ago

[deleted]

Klinky 13y ago
You would be right to have concerns about future ventures by the creators of Lavabit or CryptoSeal, just like someone might have concern about a Google API service. At least Lavabit and CryptoSeal are giving legitimate and very real reasons why their services shut down. This is different then being told "it's a business decision" or just having it disappear with no reason given.
- at-fates-hands 13y ago
  Or worse, not you tell you anything, and in a few years you find out someone's been monitoring all the VPN traffic, INCLUDING YOURS.