12 ms·
Hola VPN turns 10M users into exit nodes
- bifrost 11y agoThis is basically why you never want to use a proprietary client with any VPN service, you don't know what you're getting into at all. At least with PPtP/L2TP/OpenVPN based services you can use well known clients or OS vendor provided clients that are unlikely to have little goodies like this.
- NeutronBoy 11y agoHola explicitly say this is why they're able to offer the service for free http://hola.org/faq#in_how_is_free http://hola.org/faq#in_how_is_free dchuk beat me to it!
- deleted 11y ago[deleted]
- Moru 11y agoYes, now it says so. Didn't do that earlier :-)
- manghoti 11y agoactually it did. From the archive link provided by 8chan Hola's goal is to make the internet faster and fully accessible to everyone. Install Hola on your PC, phone or tablet to make your internet faster, more open and more anonymous. Hola lets you have unlimited access to information that is otherwise not available in your geography while protecting your online privacy. It also lets you stream videos faster than ever before. Hola is a collaborative internet -- it works by sharing the idle resources of its users for the benefit of all. The new version talks about luminati.
- joepie91_ 11y agoThis doesn't at all explain the associated risks in a manner that the average user can understand it. It's presented as a feature, rather than the risk it really is.
- voltagex_ 11y agoI'm not sure this will get seen but - is there an OpenVPN client for Windows that doesn't suck?
- imsofuture 11y agoViscosity is pretty good for Macs+Windows.
- toomuchtodo 11y agoViscosity is phenomenal. Its extremely inexpensive, and makes working with OpenVPN on the client side much less painful.
- webdigi 11y agoNever use proprietary clients if possible. Also on the VPN server side, you could investigate the option to create your own VPN server in a few minutes https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-private-secure-free-vpn-on-the-amazon-aws-cloud-in-10-minutes/ https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-pr...
- tiatia 11y agoGood luck with that in China mate!
- dchuk 11y agoThey explicitly state in their FAQ how this works and why their service is able to be free: http://hola.org/faq#in_how_is_free http://hola.org/faq#in_how_is_free They even have a non-free option that eliminates the VPN as a proxy feature. "Hola built a peer to peer overlay network for HTTP, which securely routes the sites you choose through other Hola users' devices and not through expensive servers. Hola never takes up valuable resources from these users, since it only uses a user as a proxy if that users' device is completely idle (meaning device is connected to electric power (not on battery), no mouse or keyboard activity is detected, and device is connected to the local network or Wifi (not on cellular)). This makes Hola the first VPN service without underlying operational costs. Although Hola doesn�t need to pay for bandwidth, we still need to pay the engineers who create, maintain and keep improving the free Hola service. Hola generates revenue by selling a commercial version of the Hola VPN service to businesses (through our Luminati brand). This is what allows us to keep Hola free for our users. Users who want to enjoy the Hola network without contributing their idle resources can do so by joining the Hola premium service for $5 per month (or $45 per year)."
- sergiotapia 11y agoAnd that somehow makes what they're doing OK?
- dchuk 11y agoI'm not sure I understand your logic here. They've come up with a clever way to create a sustainable, free vpn service, with the ability to easily opt-out for a still reasonable price. All the while clearly stating how it all works in their FAQ. What more do you want them to do?
- TylerE 11y agoWhat happens when the Feds are knocking on your door because someone routed kiddie pr0n or drug deals through your connection?
- 11y ago
- albertoleal 11y agoAnyone have VPN recommendations?
- mbubb 11y agoThis company looks interesting - https://www.tunnlr.com/ https://www.tunnlr.com/ I learned about them from http://devio.us/ http://devio.us/ (which is great when it works...) I did the trial for 1 day and tried them out. Have no pressing reason to continue for now but have filed them in the mental rolodex.
- nyolfen 11y agoi've been renting a cheap-as-dirt vps ($15/yr) and just using sshuttle[0] to proxy through it which works great for my circumstances (my school blocks nonstandard ports but is just dandy with 22) [0] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
- yc1010 11y agoYou could also setup tinyproxy (https://banu.com/tinyproxy/ https://banu.com/tinyproxy/) to proxy http/https via your linux VPS (and limit connections to only your ip) or even better just run socks5 thru ssh http://straightedgelinux.com/blog/howto/socks.html http://straightedgelinux.com/blog/howto/socks.html Tho I recommend using autossh to maintain the ssh tunnel which could be flaky at times http://www.debianadmin.com/autossh-automatically-restart-ssh-sessions-and-tunnels.html http://www.debianadmin.com/autossh-automatically-restart-ssh...
- mverwijs 11y agoAnd just in case you're in a network that does block access to port 22, use sslh to listen to port 443 and map all ssh traffic to port 22 (and all https traffic to httpd, and all openvpn traffic to 1194). One port (443) to rule them all!
- deleted 11y ago[deleted]
- asquabventured 11y ago
- Gladdyu 11y agoI doubt that if they sell their users as bots they will do anything about the network being used as a botnet and there is nothing you can do about it, especially considering the users 'responsible' won't even know what they are taking part in.
- ars 11y agoIt's not clear that part of the article is even true. They appear to just sell VPN server by the GB. I see nothing about a botnet in there, there is no traffic amplification or ability to run programs on the clients.
- cekanoni 11y agoyou obviously don't understand this :)
- yellowapple 11y agoThe point of that bit is that it's not only possible, but borderline-trivial, for a malicious application (e.g. spambot, DDoSbot, etc.) to hook into the API and flood a target using Hola users as endpoints; the article states that such an incident has already happened, and that 24-hour captchas have been instituted for all users as a result in an attempt to stifle future such attacks on 8chan.
- batuhanicoz 11y agoAnyone knows a better alternative to luminati.io? We've been using it in our company but it feels expensive. I thought this thread may be good place to ask for an alternative.
- Scoundreller 11y ago> We've been using it in our company but it feels expensive. I just looked up the cost and no kidding at $20/GB.
- tonyhb 11y agoSpin up VPS instances across multiple cities, countries and continents. Hook them up with Docker and connect them with Swarm. Label them with an IP/city/country/continent combination. Use Docker Swarm's affinity labelling to start instances in a particular city when needed. Additionally record the last IPs used and use Swarm to not deploy to those servers.
- batuhanicoz 11y agoWe scrape more than 120,000 web pages per day. Cost of spinning up VPS instances, maintaining the software needed (to automatically close/open new ones and provision them) could be higher than the 20$/GB pricing Luminati offers.
- tonyhb 11y agoI already have the tech after 3 years experience building this. I can rebuild it for you. Contact details in my profile.
- predius 11y agoI work for Scrapinghub which has a Proxy API which may work for you: http://scrapinghub.com/crawlera http://scrapinghub.com/crawlera Pricing is a lot less and we only use our own IPs.
- deleted 11y ago[deleted]
- cekanoni 11y agothat's sneaky and some one needs to point out for this!
- eyeareque 11y agoThis made me laugh--I wonder how many innocent people are going to have the FBI kick their doors down for things that past through their "exit nodes" that they hosted.
- stefantalpalaru 11y agoLet's hope there's safety in numbers.
- deleted 11y ago[deleted]
- yaeger 11y agoJudging by in what context I have read about Hola so far, I guess the biggest use case is to circumvent geo block to access things like Netflix. But yeah, ever since I learned that I am acting as an exit node for others I have stopped using the service as I do not want to be the one answering for stuff others have done in my name(IP).
- anc84 11y agoI wish it was the other way around, mass-spread sharing of internet access leading to it becoming the norm and people finally getting some privacy from mixing their connections.
- tombozi 11y agoWhat if a node messes with the response and returns fake data? Do they route the request over multiple nodes and compare the results? Then what if someone owns a lot of nodes?
- 8chan 11y agoHola's browser extension is proprietary. A friend of mine has been considering reverse engineering it but is not sure of the laws.
- tombozi 11y agoI assume they forward the requests to their own servers? In that case there isn't much to reverse engineer without access to their servers. Unless they use some kind of P2P system, which I doubt.
- signa11 11y agotheir updated faq says the following 'Hola built a peer to peer overlay network for HTTP, which securely routes the sites you choose through other Hola users' devices and not through expensive servers'. so it is a p2p system...
- prawnsalad 11y agoIt's a mix of both. Each peer connects to one of their servers which then acts as the middle-man for the traffic between users. The descriptions they use is incredibly incorrect in so many places. Reads like they have some marketing guys with a vague idea on how it works writing it up.
- milankragujevic 11y agoI've reverse engineered it a long time ago and are using their proxy clients (ZAgents as they refer to them internally) as proxies for clicking on my own ads. I have their username and password and a list of dyndns domains. Email me if you want the data.
- zodiakzz 11y agoYou seem rather high on the moral horse for someone hosting child/underage porn.
- zxcvcxz 11y agoSource that proves he's hosting such things? Are you arguing against anonymity on the internet altogether? IMO Mr. Brennan is a hero for taking on the risks associated with hosting an anonymous image board and not backing down in the face of people who time and time again continue to slander his name. I don't want to live in a world where people live in fear of hosting an anonymous image board.
- zodiakzz 11y agohttp://arstechnica.com/security/2015/01/8chan-domain-seized-over-allegations-of-child-abuse-content/ http://arstechnica.com/security/2015/01/8chan-domain-seized-... -------NSFW!----- https://8ch.net/ephe/ https://8ch.net/ephe/ "Teenagers ONLY! That means only 13+ But of course, 16 is the perfect age." https://8ch.net/nnmodels/ https://8ch.net/nnmodels/ "Young Models and Jailbait" https://8ch.net/phile/ https://8ch.net/phile/ "Show some <18 love" https://8ch.net/hebe/ https://8ch.net/hebe/ https://8ch.net/cuteboys/ https://8ch.net/cuteboys/
- zxcvcxz 11y agoThis is not "proof" of him knowingly hosting child pornography. Sites get accused of such things all the time and I personally believe there is a group of people who intentionally orchestrated this fiasco. I visited the 8chan links you posted and didn't see any child pornography. It seems to me like you're trying a little too hard to paint this guy as some kind of pedofile. I don't completely agree with the types of things being posted, but I didn't see anything illegal. Of course a site that allows anyone to create their own board is going to have some politically incorrect boards. Reddit has had similar problems and you can still find sub reddits for the same things there. I suppose you're against free speech completely then? For someone who claims to be anti-child porn you sure did find those links fast, almost like you had them bookmarked..
- chx 11y agoIsn't 8chan that enabled gamergate to continue? If so, anything bad happened to your site is actually beneficial.
- zxcvcxz 11y agoExplain what is wrong with gamergate. I don't game so I don't know. Seems to me reddit is the site you should be hating. Edit: Actually after thinking it over, it's free speech you should be against. It really sucks when sites host opinions you don't agree with doesn't it? I googled gamer gate and they seem to be against people exactly like you: People who want to shut down other peoples opinions that they don't agree with.
- albedoa 11y agoI googled gamer gate and they seem to be against people exactly like you Incredible that you just learned about GamerGate and are already an expert. Oh wait: https://news.ycombinator.com/item?id=9394472 https://news.ycombinator.com/item?id=9394472 And More: https://news.ycombinator.com/item?id=9394708 https://news.ycombinator.com/item?id=9394708 Heh: https://news.ycombinator.com/item?id=9556077 https://news.ycombinator.com/item?id=9556077
- zxcvcxz 11y agoSo are you saying SJWs have something to do with the gamergate thing?
- artichokeheart 11y agoGod how I do love that acronym. As soon as I see it I know to ignore anything the person using it says. It's like a giant flashing fuckwit sign.
- marssaxman 11y agoYes, exactly! It is meaningless as a term, lacking any referent, but oh so useful as a shibboleth: anyone who believes in it can be killfiled on sight.
- userbinator 11y agoSo far as I can tell, there is no way to tell if an IP has the Hola VPN software installed or not: no tell tale open port, no special header from Luminati, and no specific range. Then, immediately in the next paragraph: An attacker used the Luminati network to send thousands of legitimate-looking POST requests to 8chan's post.php in 30 seconds, representing a 100x spike over peak traffic and crashing PHP-FPM. How was that conclusion arrived at? Am I missing something here?
- theralphretort 11y ago"Ah, the user flooding himself (Bui) spilled the beans and told me how he did it voluntarily in IRC. Otherwise I'd have no clue." -Fredrick Brennan (8chan)
- darkengine 11y agoCopypaste is rate limited, he had this to say: https://twitter.com/HW_BEAT_THAT/status/603741442490642432 https://twitter.com/HW_BEAT_THAT/status/603741442490642432 "The user flooding himself (Bui) spilled the beans and told me how he did it voluntarily in IRC. Otherwise I'd have no clue."
- alexbecker 11y agoOne way to find out (not saying this is how it was done) would be to spin up a machine running Hola and see where the traffic goes.
- ajdlinux 11y agoAnyone like to recommend a browser-extension-based VPN tool that's a bit more respectful than Hola and is relatively cheap? (Of course I run my own VPN server using OpenVPN, but Hola is really convenient when I'm only trying to get an American IP to avoid Australian geoblocking - it's also easy for non-technical friends to use.)
- joelkesler 11y agoTunnelbear recently released a chrome plugin for their VPN service. I hear good things about it. (I personally use the application on my Mac)
- DonGateley 11y agoTunnlebear makes no claims relative to logging its users activities or about its responsiveness to requests for them. Beware.
- svintus 11y agoWe have a pretty clear and accessible privacy policy that addresses these issues in detail https://www.tunnelbear.com/privacy-policy/ https://www.tunnelbear.com/privacy-policy/ TL;DR: no logging
- DonGateley 11y agoThanks for the correction. It's improved considerably from when I was considering it.
- ultramancool 11y agoThis applies to any VPN service. They'll all fall to the legal demand to log, for a specific user at least, sooner or later. If you want anonymity, a VPN service is not the way to go.
- hiamnew 11y agoJust use Tor Browser, it's "extract and launch".
- milankragujevic 11y agoIf anyone cares for their proxy links, here are they: http://milankragujevic.com/uploads/hola/?ref=hackernews http://milankragujevic.com/uploads/hola/?ref=hackernews And the blog post: http://milankragujevic.com/post.php?id=72&ref=hackernews&cid=9615983 http://milankragujevic.com/post.php?id=72&ref=hackernews&cid...
- prawnsalad 11y agoI had also broken down the way this works a long while ago and found they have a lot more proxies than this. In some cases they just have a digitalocean VPS running somewhere to help beef up the network. It was only recently that they started requiring the user auth for the proxy access, earlier it was a free for all without any auth at all. Now they have the option to track which accounts are causing traffic on their network and potentially put a stop to them (not that is isn't difficult to get around)
- milankragujevic 11y agoYes, you can enumerate the number of proxies from 1 to 999 with a while(true) loop. However I just used their own api for this.
- imron 11y ago> or allows domains to pay them off for such a rejection. Thereby creating the world's largest extortion racket. Yeah, maybe not such a good idea to encourage that sort of business model.
- CRR1 11y agono need to uninstall. signup for a new account via this link and you get free premium which means you are off the exit node list http://hola.org/referral_signup?referrer_uid=basic%2Fg1635898%40trbvm.com&ref=my_account&medium=manual http://hola.org/referral_signup?referrer_uid=basic%2Fg163589... re-signup each month for a new account and a new month of premium
- CRR1 11y agono need to uninstall. signup for a new account via this link and you get free premium which means you are off the exit node list http://hola.org/referral_signup?referrer_uid=basic%2Fg1635898%40trbvm.com&ref=my_account&medium=manual http://hola.org/referral_signup?referrer_uid=basic%2Fg163589... re-signup each month for a new account and a new month of premium