Hacker News Reader

Comment by ignoramous | Hacker News Reader

We thought about the trust aspect of it (we have gone through numerous VPN related threads here on news.yc and r/privacy and this has been one of the top concerns). Here's how we plan to convince folks (in our own naive way) we mean business (do serveral or all among):

1. OpenSource vpn server and client, with ability to Cloud-SSH to the server and view what's running.

2. Hands-off, one-click, spin up VPN servers on a VPS of your choice under your control, Streistand/Algo style [0][1], but find a way to provide support (think AWS marketplace).

3. Make privacy-centric commitment legally binding as part of EULA/ToS (is this sufficient?).

4. Run client-side only VPN (like intra, blockada, netguard). The idea is you're still able to analyse traffic and add blacklists client-side, without having to pay for or run a VPN server.

Thoughts?

[0] https://github.com/StreisandEffect/streisand

[1] https://github.com/trailofbits/algo

View on HN

Sounds a bit like what Google / Alphabet / Jigsaw are already doing with Outline, but I still think there’s major opportunity there for a transparent and decentralized one-click service. Especially when you add in #4.

For some reason, Outline is still mega-targeted at journalists and activists when it could be so much more — it’s been an absolute joy to use so far, and being powered by Shadowsocks certainly doesn’t hurt.

https://getoutline.org/en/home

Thanks. Yes, you're right. Not just Jigsaw (who are excellent, and I've been recommending their DNS app, intra, on news.yc for as long as I can remember), there are multiple other companies in this space (SecureMix, TheGuardianApp, KeepSafe, CopperheadOS, Proton mail/VPN, AdGuard), but not everyone is quite doing what I have in mind related to fighting trackers and censorship with a focus on 'one click and you're done' kind of simplicity (?)

I hope to get something ready to show you guys here on news.yc in may be 3 to 6 months from now.

Sounds like something HN readers will like, but which also would be completely commercially unviable.

True. That's the part where we might need to think hard: A business plan. We haven't thought that far yet, tbh.

Our intention is to: Put the control of the mobile device back in the hands of the consumer and empower them with simple but powerful tools. Think keybase, Stripe, or pre-2014 WhatsApp in terms of UX.

Mobile VPN is key part of that vision, including building other apps around it.

A lot of things triggered this:

1. The prism/carrier-iq snafu from 7yrs back.

2. The uptick in government censorship prevelant in multiple nations (India, Turkey, Pakistan, Russia, etc).

3. Rise of app-economy and the relentless tracking behaviour that entails, esp from Facebook.

4. pi-hole and it's elegant solution to shut out trackers. Though I first saw this solution impl by Sam Hocevar (one of the VLC devs) in 2002 (?): http://sam.zoy.org/writings/internet/doubleclick.html

5. Not very many firms developing products like DuoSecurity did but for the end-consumer. There's a few I could find, like SecureMix (glasswire developer), Objective-See (LuLu Firewall), Jigsaw (primarily for journalists?), Purism, and KeepSafe.

Filtering, Adblocking, VPNs are commercially viable. More of a B2B play than B2C though

Another way would be using some trusted computing technology [1] to do that. This would be a good use case for some kind of remote attestation. (Shameless pug: I did my Ph.D. thesis on this, so if you want to discuss this point, cloudflareatvernizzisdotit ;-) )

[1] https://en.wikipedia.org/wiki/Trusted_Computing

Reply on news.ycombinator.com