There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens.
I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing.
I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards.
In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).
Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is.
Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.
how will they prove it in a year?
and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?
In other words, would you be alright if the VPN built a profile of your VPN identity? The corollary, I think, asks if you're interested in a VPN to separate your activities, or to thoroughly diffuse them for actual information loss.
There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start:
- What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities?
- Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic.
- Have they had data breaches in the past (for example, NordVPN)?
- Are there any high-profile cases of them refusing to provide logs to someone?
- What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts.
- Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims.
- Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches?
That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."
As usual, I think the reaction of PIA's corporate restructuring is a lot of hot air over nothing. Typical of most hot air, it is released to draw attention to the source and not convey any real concern.
That said, if you really need a third-party VPN, FoxyProxy's branded VPN service available through https://getfoxyproxy.org is probably pretty good odds. I've never used personally so I can't vouch all the way, but it's supporting an open-source project by someone who seems to really care about his users and has put more than a decade into supporting a great extension, so that puts it far ahead of most of 'em from the get-go.
What is "regular internet browsing"?
It's not just a speed problem. Within the Tor community I personally still see a lot of people saying that behaviors like these are selfish because they take up too many volunteer resources. Maybe it's a little unfair of me, maybe those people are misinformed -- but I interpret that as meaning that the community doesn't think Tor can scale to meet those demands.
With either a 3rd-party or a self-hosted VPN, you can reroute literally all of your network traffic from all of your devices without giving it any thought, and the only time you'll really need to get off is if you're accessing a blocked website or doing something that demands very low latency.
In regards to your specific list, that's above average internet user, in which case I think a better solution is diversifying your network connection methods. Trying to use one tool for that entire range of traffic centralizes it needlessly, and you'll get more effective privacy by avoiding that.
Furthermore, if you want more speed out of tor I'd argue step one is running a node and contributing and/or donating at least.
Also at most some latency. /pedantism
The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection -- then you at least know that it's $LOCAL_TELCO sniffing the packets.
Tor is excellent and it has uses, but I've had to explain to many people over the years that day-to-day browsing like checking email, checking bank accounts, etc., is far less safe through Tor than through a direct connection (at least for people in the US -- if you're using Tor for its intended purpose of thwarting oppressive regimes, crossing your fingers on the exit node lottery is probably preferable).
>The risk profile is somewhat lower now that HTTPS is prevalent, but it's still unnecessarily exposing at least one side of the conversation to literally anyone. Most of the time, you're better off just using your ordinary connection
I think this is simply wrong, and lacks any threat model at all. Why do you care that encrypted bits can be sniffed by an exit node? The node can't even determine the 2nd hop, much less the origin.
The point is that users should be cautious about what they do over Tor because exit nodes can eavesdrop on (and potentially manipulate) the conversation.
The onion mechanism isn't relevant here. It prevents peers from identifying each other within the onion, but it doesn't do anything to prevent the exit node from accessing the raw packets involved in the conversation -- indeed, the exit node must access those packets to proxy them. It's true that some of the traffic will be protected via HTTPS, but even encrypted packets can be made useful in various ways.
The reality is that you're introducing a random computer into your network path and that you're trusting that computer to proxy your connection without a) eavesdropping; or b) modifying contents. The prevalence of HTTPS may or may not be sufficient mitigation for some, but any analysis of the propriety of Tor to access non-onion sites is fundamentally incomplete if it doesn't acknowledge, contemplate, and address the implications of inviting a random computer to MITM the connection (as the Tor FAQ has done for at least the last 10 years: https://2019.www.torproject.org/docs/faq.html.en#CanExitNode...).
No, they can't. Unless you don't use TLS...which is addressed in the FAQ you linked. Who is it that can break TLS that you're concerned about? Again, without threat modeling this is all lacking a lot of context and purpose.
TLS will probably defeat script kiddies that are just after the "thrill" of voyeurism, but more advanced operators will make use of the attack surface you're offering them, even if they aren't ever able to decrypt the payloads (not necessarily a guarantee). There's lots of room to analyze and manipulate encrypted HTTPS traffic in interesting ways (SNI, non-secure cookies probably good starting points).
TLS depends on correct configuration on both the client and server-side to be effective (and an interested proxy could try to modify the handshake to downgrade the connection's security). Whole versions of SSL/TLS have been deprecated after fundamental flaws were discovered; things like Heartbleed, POODLE, and Debian's low-entropy key debacle were all real things that made TLS much less secure than expected. An exit node operator that knew about these flaws prior to disclosure could've been having a heyday while users just said "Welp if I use HTTPS Everywhere it'll be fine".
Even without bugs, when TLS is ostensibly working completely properly, the trust model is frequently hijacked. See the CACert wiki  for a list of several dozen well-known attacks on CAs, many of which allowed imposters -- on multiple occasions state-level actors -- to issue fake certificates for specific domains, which a malicious exit node could inject.
The incontrovertible point is that using exit nodes exposes some prime attack surface to literally anyone, and yes, that's still attack surface, even if you're 1000% sure that your encryption is so super-duper strong that literally no one will ever be able to break it.
The exposure is real, the risk is real even if not necessarily always immediate, and it needs to be considered along with the other factors. Any risk analysis that involves accessing clearnet resources via Tor exit nodes should contemplate this.
The risks you're detailing are likely insignificant for 99% of users right now. Using TOR doesn't imply a specific threat model, and that notion weakens tor security and anonymity as a whole.
I can't personally understand buying in to such a service for a timespan measured in years.
If things sour over the course of that time, I’m probably only out a few bucks over the annual payment price.
It seemed pretty clear to me.
Ostensibly the "paid" portion of the criteria is a proxy for incentive to not do shady things like show ads or distribute malware.
20 months later, PIA open sourced its iOS app, older versions of its browser extensions, and 2 Swift libraries. Everything else is still closed source.
This was a major concern from our new partners as well, as they have been asking us to release the code as well - we are all on the same page here.
While I can’t give an exact date, I’m confident that the rest of the code will be released in 2 weeks or less. Along with our QT/CPP cross platform application, we will also be open sourcing our search engine, private.sh!
Hope this helps and sorry again for the delay,
You can still open source in-progress software.
It will be interesting to see how much they accept criticisms on the subreddit about PIA.
Take moderation positions in a community where your profession, employment, or biases
could pose a direct conflict of interest to the neutral and user driven nature of reddit.
> Reddiquette is an informal expression of the values of many redditors, as written by redditors themselve
But I guess it makes sense for Reddit to move away from that rule. That's how you get big campaigns with companies like Adobe. Not by taking away their sub-reddits.
Personally I think I even prefer that though. Better than having heavily biased "community moderators", which is the case in way too many sub-reddits.
Redditors are basically never happy with anything. Their ideal world is some place with no rules except that everyone else is forced to read their comments. Unfortunately, such a place does not exist.
Many people try to reduce complex multi-variate situations into simple variable situations and then lambast people on other forums if their chosen variable turns out to be different.
I just saw an example of this last week in mobilereads forum. Unhappy with iBooks and the kindle apps I’ve been reliant on Marvin for quite a time. But the dev has vanished from the scene for last 2 years. I just investigated if creating a commercial replacement would be a good idea but good god, the one forum where people have been talking about Marvin can have extremely ultra specific needs for a very unreasonable price expectation. After reading that forum I’m not exactly surprised that the dev chose to abandon the goal post.
Edit: or are you talking about something else than r/peloton?
I’m not that into cycling, what’s this about?
Open discussion of Bitcoin is at r/btc. https://www.reddit.com/r/btc/comments/9lfjrb/frequently_aske...
For example how Liquid, a centralized sidechain that goes against the idea of cryptocurrencies, is promoted as a "solution" to many of Bitcoins problems. But any critique of it is banned.
It's obvious that the mods are somehow associated with Blockstream. Only a Blockstream employee such as yourself would disagree.
In fact, r/btc is controlled by for-profit entity (bitcoin,com which has little to nothing to do with Bitcoin the project) and has advertisements blasted all over the subreddit page.
This is in contrast to r/btc, which is absolutely indisputably run by Bitcoin,com (the business) employees.
Not apologizing for PIA - They definitely shouldn't be doing it if they're trying to advocate for privacy. But just stating it's extremely common practice and the default for most email services. I use it on my e-commerce websites so that I can send specific emails to people who have viewed a certain page, abandoned checkouts, opened a certain email but didn't convert, etc.
I wonder what will happen to Freenode now: https://freenode.net/news/pia-fn
Well, they're already pushing this cryptocurrency scheme https://freenode.net/news/spam-shake
-----BEGIN PGP PUBLIC KEY BLOCK-----
-----END PGP PUBLIC KEY BLOCK-----
Freenode is a non profit organization that benefits from support from Private Internet. It is not owned by Private Internet. We are serious fans of IRC and the open source community, so it makes sense for us to divert profits to orgs like freenode among others.
To be clear, we also donate to other orgs:
Our new merged company will continue to do the same as we are in fact the same company going forward - just much better resourced.
To be clear, this is a brand new site that was created in the last few days, they bought up the domain for 15k a few days ago (https://domainnamewire.com/2019/11/12/21-end-user-domain-nam...)
For the Pia engineer who ends up reading this.
I have bin a Pia user for 5+ years. I have recommended it to friends and family. Now I have to tell them all to cancel.
And no, I am not paid or otherwise compensated to write this, or affiliated with them other then being a customer.
[*] They even say: "Please avoid writing your name or address on the envelope."
Do they take any other cryptocurrencies, or would I have to convert some other coin into bitcoin to pay them?
OpenVPN is nice, since my OpenWRT router can be a client.
EDIT: I emailed Mullvad and received a reply within 15 minutes! and it answered my questions accurately! I think they win the customer service award for today :D
They have openvpn instructions for openwrt at https://mullvad.net/en/help/openwrt-routers-and-mullvad-vpn/
And their clients are open source: https://github.com/mullvad/mullvadvpn-app
(sorry for not replying earlier!)
So are AirVPN, Insorg and IVPN.
Edit: For background, see https://www.computerweekly.com/news/252466203/Top-VPNs-secre...
I'm not a customer of either, just been researching alternatives since tis news hit earlier this week.
someone from PIA's patent company was caught trying to smear other VPN's but forgot to hide his profile image.
Any article on the internet that uses a question mark in the headline is either clickbait or dealing in suppositions, not facts.
There are real privacy enthusiaists behind ipredator.
Looking for alternatives now. Is NordVPN any good?
Presumably, they'll partner with a vendor that they can audit, but who knows.
Having worked at Mozilla I'm confident lots of individuals would leak if forced to build backdoors :)
I trust Mozilla to not cooperate with anyone less powerful than Uncle Sam which is a lot more than most shady fly-by-night VPN operators.
If you're using your VPN as protection against your ISP, wifi provider (internet Cafe, school, workplace, home), or some other MITM you're better off with a service run by a serious company, with a lot to lose from a scandal and a long track record of not lying and being technically competent.
If you're looking to hide your browsing from the US government you should a) give up or b) definitely not use a commercial VPN.
1. Their Backdoor of Advertisements Plugins (Ref the USA network Ads for Mr. Robot)
2. Their Forcing DoH through CloudFlare
3. Their change to require OptOut instead of OptIn for most Privacy violating features (like User Telmentary data)
4. Their starting of the Mozilla Ministry of Truth strait out of an Orwell novel
5. Banning of Plugins due to Ideology
6. Their recent push for Online Censorship
That is just a start
Given all the shilling and backstabbing in the online VPN recommendation industry, it’s hard to trust any advice now, not even comments here. God knows who’s a shill.
But those geoblocks and the occasional need to anonymize activities... Really hard to solve. (I know Tor. Tor is too damn slow.)
Oh look, you're one of them. (pat on head)
Don't the Know Your Customer laws banks have to adhere to mean that anonymous cards are essentially a thing of the past?
Plus in many places you can bring in Change to a CoinStar can convert your coins to a Visa Gift card
Get ProtonVPN. Same owners as ProtonMail.
...but sounds like their IMAP is broken from googling. Not sure I can live with that.
That's another plus. You don't actually have to register an account with them, but instead their website generates a random number for you that you use to log in. All in all they appear to be very transparent.
I'm not sure there are any companies left to trust.
That being said I do want to mention, most VPN companies won’t sign a binding agreement not to log - whereas our partners at KAPE signed an entire binding mission statement which you can find here:
A business dedicated to privacy is completely incompetent if they can’t even use HTTPS.
I cancelled my sub minutes after learning about the news. I would hope the PIA engineer can see through what buyout propaganda they are being fed and see the writing on the wall.
Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is
https://github.com/microsoft/service-fabric/). After the free year, a minimal always-on VM costs about $13/mo.
Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP.
Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content).
Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead)
Fivth, some sites block you if you use cloud provider IPs
Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically).
Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss.
VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation.
For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.
Google will cooperate with big governments, but you can be confident they aren't owned by the Russian mafia.
The only differnce is how a VPN provider can be incompetent or malicious. It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious.
I guess it does depend on your threat model but I would say for most people who don't have specific threat in mind they should exclude highly sophisticated attackers much like how you don't secure your housr against sophisticated bank robbers that might pull a heist on you.
> It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious.
Yes, but as I argued in the comment you replied to the difference in maliciousness is effictively infinitesimal because the govt can get access to any VPN provider.
I disagree with your last statement completely. A company dependent on VPN revenue will be incentivized to do whatever they can to get and monetize VPN customers. A company that offers VPN services as a side operation that isn't financially key to their operations won't be incentivized to lie to gain users, cut costs to compete with other VPN operators, or use malware to monetize their user base.
Microsoft could not care less if you pay them a few dollars a month for a VPN. They're certainly not writing software to target people running VPNs on Azure and inject tracking and ads to make a minuscule profit. But - if news broke that they were abusing any Azure users - Microsoft would lose a significant amount of corporate and government business.
Can you name a single example of Microsoft exploiting anyone with malware? No, because the resulting reputational crisis would devastate their ability to sell their "cash cows".
Fsecure's infosec business is worth a minuscule fraction of Microsoft's businesses, and thus the potential losses from being exposed as a scam are much less.
In contrast, 57% of the top 150 free VPN apps on the Google Play Store contain code to get the user's last location, and a small number request permission to read SMS messages and take pictures https://www.bleepingcomputer.com/news/security/malware-user-...
Your comment on extradition isn't particularly relevant. Users abused by Microsoft could sue Microsoft in US court, and Microsoft would face significant legal and reputational penalties if they broke the law.
In contrast, while Finland and Switzerland do have strong privacy laws, that doesn't mean it's impossible for a "Finnish" or "Swiss" VPN provider to get away with violating user privacy. A criminal VPN provider could for example claim to operate in a country they didn't, or incorporate in a country while residing in a country less likely to prosecute them. Not saying I have evidence this happened, I am however saying that the fact that European countries in general care more about privacy doesn't make it impossible for a European company to get away with violating user privacy.
This summarizes my thoughts very well.
On which cloud provider do you share an outbound IP with others? AWS, Linode and Digital Ocean all assign a public IP per instance.
The bandwidth on Azure might be better, but the first tier on OVH, DigitalOcean and Scaleway begins at 3$/mo and you still have 100mbps.
No, it's not. Both have zero or very low amount of free egress (5GB max). After that you're paying $0.1 per GB of egress traffic.
It's $5 at Linode, and that's not run by a company known for spying on users.
Also see a recent news.yc discussion on cheaper hosting: https://news.ycombinator.com/item?id=21172818
AFAIK that option uses NATed ipv4, so it could dicey unless you know that you have ipv6 everywhere you go.
You lose the benefit of your traffic being aggregated with lots of other traffic.
I could simply not have asked for a better day for this to surface on HN :D
Original link appears to 404 for some reason: https://snoonet.org/updates/56-snoonet-joins-the-privateinte...
ycombinator article: https://news.ycombinator.com/item?id=14101538
Weird ad for PIA guys cryptocurrency scheme: https://freenode.net/news/spam-shake
Freenode's registration doesn't show any change in ownership since their acquisition: https://freenode.net/news/pia-fn https://beta.companieshouse.gov.uk/company/10308021/filing-h...
If you believe there are different parent companies involved, please link sources.
announces the proposed acquisition of LTMI Holdings
o Plus Ultra – a software that speeds up internet connections
o LibreBrowser – a completely private browser
o Private.sh – a private and encrypted search engine based on proprietary cryptography technology
Besides this document's omission, what leads you to think Freenode is not part of PIA?
Edit: I'm not trying to make an ad hominem here, but I see in an earlier comment you describe yourself as the CEO of irc.com, which is also a PIA project (in some sense - again, I don't know the legal relationship or if there's a separate entity). So it sounds like you know what you're talking about, and I hope you can help find or make public some material support for the claim that Freenode is unaffected by this.
Though, if PIA ever put malware in their installer it would be like hitting the self-destruct button.
That's one reason why I never use custom clients for VPN services. That is, no binaries.
I just get the OpenVPN PKI stuff, and use stock OpenVPN.
Well, only if you give them permission to. Just use a non-provider specific client and you're okay.
And about using stock clients, that's what I said :)
From openvpn.net or in Linus distros or in pfSense, for example.
I think you misunderstand how VPNs work.
They tunnel, not terminate traffic. It is effectively a NAT service, with extra steps.
Take the scenario of a TLS connection to www.example.com:443 [126.96.36.199:443]
Connection A: Direct to the internet through my ISP.
I'll make an outbound connection to 188.8.131.52:443, and the IP that the remote sees will be the public IP that my ISP has assigned me. All traffic on that TLS connection is encrypted and my ISP can't view the content.
Connection B: Using a VPN Service
I'll make an outbound connection to 184.108.40.206:443, and the IP that the remote sees will be the public IP that my VPN Service has assigned me. All traffic on that TLS connection is encrypted and neither my ISP or the VPN provider can view the content.
In both scenarios, the TLS Connection is direct to 220.127.116.11:443, and my client will and should verify that the presented certificate is for cn=www.example.com (or a SAN with that cn), and signed by one of the Root CAs that my computer/software trusts.
Couldn't those be MiTM'd?
It's your fault if you're trusting an unencrypted connection.
I don't tunnel 0/0 to them. You don't have to either. I only tunnel my BitTorrent traffic through them [...].
That alone tells you that Kape's (or rather, Crossrider's current owner) had nothing to do with their past actions, and could be therefore considered libel.
Moreover, post that someone linked with all the proof is pretty much a lot of FUD, and while I'm not happy with the sale, I fail to see any actual proof being brought up.
It's even more clear that the Crossrider "Adtech" (read Adware) was produced by the very same company Crossrider which is now called Kape. They are one in the same.
I'm not sure that follows. When you buy a company, one of the things you're acquiring is that company's reputation -- for better or worse.