4 ms·
Selling user's bandwidth is shady, but consistent with VPN usage (i.e. traffic routing). You can present it as "hey, that's our actual business model, we just f
by BoppreH 11y ago
Selling user's bandwidth is shady, but consistent with VPN usage (i.e. traffic routing). You can present it as "hey, that's our actual business model, we just forgot to tell you guys" and maybe get away with it.
But this:
Hola [...] installs its own code-signing certificate on
the user’s system.
Hola contains a built-in console (“zconsole”) that is not
only constantly active but also has powerful functions
including the ability to kill running processes, download
a file and run it whilst bypassing anti-virus software plus
read and write content to any IP address or device.
This is going so far into shady territory it becomes indistinguishable from actual malware. This is Lenovo/Superfish all over again.
- ChrisArgyle 11y agoI suppose the lesson here is don't use "free" services until you fully understand the provider's business model.
- psykovsky 11y agoSo, basically any VC backed, SV based startup?
- ChrisArgyle 11y agoWell I understand their business model. Given valuation is a function of MAU: 1) Boost MAU by any means necessary 2) Pray 3) Monetize/get acquired
- psykovsky 11y agoThat's the business model of VC's and Founders, not the companies. The company business model will only be established on 3, if they monetize. Selling to the bigger fool not included, ofcourse.
- cmdrfred 11y agoMaybe the lesson is when the sign says "Free Pork"(Bandwidth) ask where it came from?
- madeofpalk 11y ago> This is Lenovo/Superfish all over again. Completely different. Superfish, I'm willing to believe, was just incompetence/indifference. If Hola really is installing a backdoor with high privileges, then that's deliberate malice.
- chimeracoder 11y ago> Superfish, I'm willing to believe, was just incompetence/indifference. If Hola really is installing a backdoor with high privileges, then that's deliberate malice. But that's what Superfish was as well. Why are you willing to give Superfish a free pass on doing the same thing?
- rev_bird 11y agoNot sure, but I think I might be on madeofpalk's team on this one too: Superfish was ostensibly doing it to feed data into targeted advertising; Hola has no such (marginally) benevolent excuse.
- chimeracoder 11y agoFirst, I fundamentally disagree that targeted advertising is in any way benevolent, even marginally. Though that's a debate for another thread. However, they knew full well what they consequences of this mechanism would be[0]. I find it impossible to believe that there was no person at any point along the chain who knew that MITMing all connections would be a security vulnerability[1]. And if that somehow managed to be the case, that makes them even less credible in my mind, since they're an OEM. They really have no excuse. [0] I mean, seriously, just look at the name "Superfish". That's not a catchy phrase invented to publicize the vulnerability, like "Heartbleed" and "Shellshock". That's the actual name of the company whose product Lenovo bought. [1] https://news.ycombinator.com/item?id=9078536 https://news.ycombinator.com/item?id=9078536
- onli 11y agoThere is quite a difference between the security issues of MITM HTTPS and installing a control console. The first is a potential security issue that might lead to something bad, the seconds is already one of those bad things that might happen. Given that this console is as exploitable as it sounds.
- Kronopath 11y agoAlright, let's talk specifics. 1. Is the Hola Chrome extension vulnerable to these kinds of issues? 2. How can you remove/fix these issues? Is uninstalling Hola enough?