5 ms·

Most Internet anonymity software leaks users’ details

53 points by Libertatea 11y ago

higherpurpose 11y ago
Apparently the DNS hijacking issue is a little outdated (applies up to OpenVPN 2.0.9). At least with AirVPN it seems you can prevent IPv6 address leaking with the Network Lock feature. https://airvpn.org/topic/14231-ipv6-leakage-and-dns-hijacking/#entry27633 https://airvpn.org/topic/14231-ipv6-leakage-and-dns-hijackin...
- dogma1138 11y ago
  It's really doesn't matter which VPN protocol or client you use its more about how the OS responds to IPv6 router and other service discovery requests. Some OS's will grant IPv6 priority routing, and virtually all of them will issue DNS requests on both IPv6 and IPv4 if a DNS server is also configured on the IPv6 interface. The DNS hijacking happens because a DNS request sent over IPv6 to a DNS server doesn't have to be for a AAAA entry, you can request simple A entries with DNS6. Since the attacker is on the same network his replies to your DNS requests would usually arrive much faster unless the entry is cached so they can return anything they want and they'll get their first :) In that link you've posted the OP basically suggests that AirVPN client (which is i assume an OpenVPN preconfigured client) will configure the IPv6 address settings on the host with either real or dummy IPv6 routes to mitigate against these attacks.
Aoyagi 11y ago
Speaking of which, have there been any checks of Telegram or Tox regarding leaking and such?
- zz1 11y ago
  Of course, Telegram is just plain awful, and rather than a leak, it is a free flow.
Matt3o12_ 11y ago
I can't agree with many facts in that article: > "[VPNs are] used by around 20 per cent of European internet users they encrypt users’" I think it is more like 2%. I don't know anyone but me who uses a VPN. I'd even say that if I picked 100 people I know, less then 20% know what a VPN is. Furthermore, the article makes IPv6 sound bad. If I didn't know what IPv6 and VPNs are, I might think it IPv6 is bad, too. I'm also interested in knowing which VPN softwares they tested. While I'm certain that old VPN Softwares leak IPv6 IPs, I can't say that for all VPN softwares I use: OpenVPN (on Linux and Tunnelblick on Mac) and Mac's built-in VPN software (which supports L2TP over IPsec and PPTP). It is really a shame, though, that my VPN provider does not support IPv6, yet. The only thing that really leaks my real IP is WebRTC. Thanks to WebRTC, everyone can see my real IP address and I can't disable in google chrome. If you want to check what information your VPN is leaking, checkout: https://ipleak.net/ https://ipleak.net/
- learnstats2 11y ago
  > I'd even say that if I picked 100 people I know, less then 20% know what a VPN is. I think you significantly underestimate VPN usage. Many jobs, including large public service employers, require connection to a VPN.
  - dogma1138 11y ago
    That's to access corporate resources, the article was specifically talking about general purpose VPN providers which people use to avoid various restrictions. So yeah the chance that 20% of internet users in the EU use some sort of a privacy oriented VPN service is nill. IPv6 has always had many issues, it's entire auto discovery mechanism is a big big security gap.
    - ikeboy 11y ago
      See http://www.statista.com/statistics/301212/vpn-proxy-usage-age/ http://www.statista.com/statistics/301212/vpn-proxy-usage-ag... and http://digiday.com/publishers/vpn-hide-ip-address-distort-analytics/ http://digiday.com/publishers/vpn-hide-ip-address-distort-an...
worklogin 11y ago
I once posted to /r/tor (or /r/onions, I forget) that the Tor Browser Bundle leaks the current browser window size ( instead of providing a universal value) thus increasing uniqueness on tools like Panopticlick. Firefox, for the same value, provides screen resolution, not window resolution.
- kiiski 11y ago
  It seems like the Tor Browser at least pops up a message saying you should leave the window to its original size when you maximize it. It still lets you do it.

53 points by Libertatea 11y ago

Apparently the DNS hijacking issue is a little outdated (applies up to OpenVPN 2.0.9). At least with AirVPN it seems you can prevent IPv6 address leaking with the Network Lock feature. https://airvpn.org/topic/14231-ipv6-leakage-and-dns-hijacking/#entry27633 https://airvpn.org/topic/14231-ipv6-leakage-and-dns-hijackin...

dogma1138 11y ago
It's really doesn't matter which VPN protocol or client you use its more about how the OS responds to IPv6 router and other service discovery requests. Some OS's will grant IPv6 priority routing, and virtually all of them will issue DNS requests on both IPv6 and IPv4 if a DNS server is also configured on the IPv6 interface. The DNS hijacking happens because a DNS request sent over IPv6 to a DNS server doesn't have to be for a AAAA entry, you can request simple A entries with DNS6. Since the attacker is on the same network his replies to your DNS requests would usually arrive much faster unless the entry is cached so they can return anything they want and they'll get their first :) In that link you've posted the OP basically suggests that AirVPN client (which is i assume an OpenVPN preconfigured client) will configure the IPv6 address settings on the host with either real or dummy IPv6 routes to mitigate against these attacks.

Aoyagi 11y ago

Speaking of which, have there been any checks of Telegram or Tox regarding leaking and such?

zz1 11y ago
Of course, Telegram is just plain awful, and rather than a leak, it is a free flow.

Matt3o12_ 11y ago

I can't agree with many facts in that article: > "[VPNs are] used by around 20 per cent of European internet users they encrypt users’" I think it is more like 2%. I don't know anyone but me who uses a VPN. I'd even say that if I picked 100 people I know, less then 20% know what a VPN is. Furthermore, the article makes IPv6 sound bad. If I didn't know what IPv6 and VPNs are, I might think it IPv6 is bad, too. I'm also interested in knowing which VPN softwares they tested. While I'm certain that old VPN Softwares leak IPv6 IPs, I can't say that for all VPN softwares I use: OpenVPN (on Linux and Tunnelblick on Mac) and Mac's built-in VPN software (which supports L2TP over IPsec and PPTP). It is really a shame, though, that my VPN provider does not support IPv6, yet. The only thing that really leaks my real IP is WebRTC. Thanks to WebRTC, everyone can see my real IP address and I can't disable in google chrome. If you want to check what information your VPN is leaking, checkout: https://ipleak.net/ https://ipleak.net/

learnstats2 11y ago
> I'd even say that if I picked 100 people I know, less then 20% know what a VPN is. I think you significantly underestimate VPN usage. Many jobs, including large public service employers, require connection to a VPN.
- dogma1138 11y ago
  That's to access corporate resources, the article was specifically talking about general purpose VPN providers which people use to avoid various restrictions. So yeah the chance that 20% of internet users in the EU use some sort of a privacy oriented VPN service is nill. IPv6 has always had many issues, it's entire auto discovery mechanism is a big big security gap.
  - ikeboy 11y ago
    See http://www.statista.com/statistics/301212/vpn-proxy-usage-age/ http://www.statista.com/statistics/301212/vpn-proxy-usage-ag... and http://digiday.com/publishers/vpn-hide-ip-address-distort-analytics/ http://digiday.com/publishers/vpn-hide-ip-address-distort-an...

worklogin 11y ago

I once posted to /r/tor (or /r/onions, I forget) that the Tor Browser Bundle leaks the current browser window size ( instead of providing a universal value) thus increasing uniqueness on tools like Panopticlick. Firefox, for the same value, provides screen resolution, not window resolution.

kiiski 11y ago
It seems like the Tor Browser at least pops up a message saying you should leave the window to its original size when you maximize it. It still lets you do it.