Hacker News Reader

Comment by joshstrange | Hacker News Reader

Private Internet Access

> A pretty boring company. Extremely transactional. You get in and get out. It delivers its experience the way a utility company would. Sometimes, that may be a good thing. But in this case, since I have choice, I'd rather give my money to a company who would appreciate it a little more — perhaps put it to better use.

PIA might be very "transactional" but I like them and I've never had any issues with their service. I'm surprised it didn't get a better rating. I don't need a flashy VPN, a utility is exactly what I'm looking for.

View on HN

Given that he rates Vyrpr above PIA, when Vypr have had clear incidents of doing enough logging to identify which user has done something [1][2], and PIA do no logging [3], I'm not particularly inclined to trust this analysis on the basis of which app is more "fun" to use.

Disclaimer: I used to use Vyrpr, when I found out about the logging, I switched to PIA, which I use with Tunnelblick anyway instead of their app. Furthermore, I can only really go by what they say, as I don't have inside access to their systems.

[1]: https://www.reddit.com/r/torrents/comments/17g53i/if_you_tho... [2]: https://www.goldenfrog.com/copyright [3]: https://helpdesk.privateinternetaccess.com/hc/en-us/articles...

He doesn't rate Vyper above PIA:

Vyper: 8,2,0

PIA: 9,4,0

The stars are identified as being from his personal experience and he discusses the rationale behind them.

Since the entries on the site are ordered top-to-bottom based entirely on his subjective rating, ignoring the objective criteria, the list absolutely rates Vype higher, in both a figurative and literal sense, and in a way that implies that his 5-star ratings are far more important than the objective criteria.

PIA used to be fast, a year ago. Somehow at times they were faster than my underlying connection!

Now, they're _much_ slower. Surely it's not just me.

I have not noticed any change in speed. I did use an ISP at one point that would throttle high bandwidth VPN traffic pretty aggressively though.

Wow, surprising. I thought I'd see a lot of "me too" responses.

So maybe it _is_ just me, or my ISP throttles encrypted traffic, or ....

They connect on port 80 (HTTP instead of HTTPS) on startup. That's unacceptable for a privacy company.

> That's unacceptable for a privacy company.

Why?

The fact of a connection being established in port 80 is to do with how TCP/IP works. You aren't even claiming to understand what protocol is in use on port 80, not to mention whether the data is in the clear, what it is for, etc. This isn't analysis, it's... something far short of analysis that I can't think of a kind name for.

It's worse than that. Back when I used PIA a few years ago, they would pass your username and password around in the query string, completely plain-text. That was their session mechanism. I sent them an email explaining the problem and got a refund. Their security mistakes, and the fact that they are based in the US, disqualify them for me. I really wish people would recommend someone else.

I would be interested to know more about this; why they were doing it at the time and if it's still being done.

The use of port 80 is not really important; I'm not sure if the article's author is using "port 80" as shorthand for "unencrypted" but that's sloppy writing if so; you can certainly establish encrypted connections over port 80, of course. I used to do SSH on port 80 all the time to get around stupid firewalls...

Rasengan answers above the port 80 call is for non-sensitive data and is signed.

That, in and of itself, is not an issue. Your browsers, for example, download Certificate Revocation Lists over plain-text HTTP as well -- but they are digitally signed.

Reply on news.ycombinator.com