Hacker News Reader

Comment by cyberpunk | Hacker News Reader

Had a quick skim; it seems at a glance like someone from TorGuard badmouthed NordVPN on a youtube comment (sigh), so NordVPN apparently in response threatened to disclose "trade secret information obtained by NordVPN regarding TorGuard’s systems" it obtained via a hosting provider TorGuard used which is owned by the NordVPN people. This apparently involved some pretty sketchy stuff like sending people to the house of a TG employee to intimidate them.

Whoops.

What kind of 'trade secret information' could a vpn provider be blackmailed with though? What kind of information could you gleam as the owner of a 'service provider' for such a use? I'm suffering from an apparent lack of imagination here.

Either way, this looks pretty messy and as a NordVPN user, I'm surprised how amateurish this all seems.

View on HN

Reading the parent pdf vs Nord's response [0] I'm slightly more inclined to believe Nords version of events here...

0: https://nordvpn.com/blog/torguard-lawsuit/

NordVPN is good at spinning stories, but quite frankly they have been caught in too many lies to ever trust again [1].

[1] https://news.ycombinator.com/item?id=18609655

If you take two seconds to read the responses to that link, the claims made in the post are almost entirely baseless.

The OP here is a co-founder of PIA, and IIRC he was behind a lot of the ProtonVPN and NordVPN controversy that is being cited in the link he provided. So basically, he's providing proof that he created a year ago.

> So basically, he's providing proof that he created a year ago.

I was able fact-check his claims, since I am from the city where Tesonet is based, and found none of them to be completely false or baseless. It turned out to be an open secret in the local tech community[1].

[1] https://i0.wp.com/vpnscam.com/wp-content/uploads/2018/08/201...

From what I remember, that PDF was also created by the same guy and shared on several sites. ProtonVPN at least came forward with a chain of evidence for why there would be a connection, even a weak one, but I don't recall NordVPN saying much at the time. Still, the fact that the co-founder of a VPN company is trying to dig up dirt on other VPN companies doesn't make me trust his at all, it just seems shady.

> Still, the fact that the co-founder of a VPN company is trying to dig up dirt on other VPN companies doesn't make me trust his at all, it just seems shady.

I think it's a normal practice in every industry to try to find out who your competitors really are. Whether that information should be made public or not is a different question, but it doesn't make it inherently false. Instead of naively believing in carefully crafted rebuttals, people should try to verify the facts by themselves.

Their response is certainly better written and does have something about the ring of truth to it.

Even taking into account the insanity of legalese that lawsuit was... wordy, at best. Poorly organized and repetitive would also apply.

I'm not sure, their response could be fabricated too. I'm interested in if Torguard has any evidence of them physically approaching their employee.

> Within an hour of this in-person and unannounced visit, the same TorGuard contractor received unsolicited correspondence from an employee at NordVPN. This correspondence stated that NordVPN had received certain of TorGuard’s confidential and trade secret information and requested to set up an instant message chat to discuss this with TorGuard.

Also, according to both parties they communicated with each other with evidence. So all either party has to do to claim their innocence is submit the emails/communications they claimed to have.

---

The DDOS part I'm very weary about. What evidence does torguard have that NordVPN was the one carrying out the DDOS attacks? I'll admit I haven't thoroughly examined the entire document, but they don't really seem to state how they know NordVPN was behind the attacks, they just list the dates they were attacked. Given the nature of DDOS attacks, they could be from anyone.

What if I told you that a lot of these "VPN providers" were shell companies built to explicitly facilitate access and tools for crime / espionage with the premise of having users there as cover.

Oh trust me, I'm well aware of "VPN providers". Just checkout luminati.io . See how they offer an SDK so "You can offer the user a choice between advertisements or a bit of background data usage"? I asked, and they are only interested in partners with 100k active users a month. Right, like a legitimate company with that many users is going to use luminati.

Or oxylabs.io who I think owns luminati?

I'm also aware that many of the VPNs are owned by the same parent companies.

And also that VPNs are ridiculously over marketed. They don't "add security" for most people, they just move who you're trusting from your ISP to the VPN company. Right, like I want to trust a company registered in Panama with no other existence outside of this year not to sell my data.

---

tl;dr - I don't trust any of them. If I want a "VPN" I just ssh-tunnel into a VPS from an established company that I purchase with a different account. Could the VPS provider do fishy stuff? Sure, but I trust them a lot more then these "VPN" providers.

Stick with the big players, PIA, airvpn. I trust those two.

At the end of the day they're mostly just fancy OpenVPN profiles. The entire space is fishy AF IMO.

I'm thankful that linustechtips seems to evaluate their VPN sponsors at least. I believe they dropped tunnelbear in favor of PIA because of similar concerns.

Tunnelbear was acquired and all sponsorship dropped, he actually mentioned it on one of the derbauer overclocking posts from Computex this past week.

PIA has cross pollination with IP blocks owned by Micfo subsidiaries as well. They're all like 2 degrees away from each other.

More on how luminati and other "residential ip" providers work here: https://medium.com/@xianghangmi/resident-evil-understanding-...

Wow, very interesting read. Thanks for bringing this to light.

Looks like Luminati is also explicitly getting developers to put a luminati proxy client into their apps and have users opt into using that instead of getting fed advertisements.

https://luminati.io/faq

Between your link, and the luminati faq's, I definitely have more questions then when I started looking at these articles.

Luminati didn't start off like that. They started by burying what they were doing in a "free" vpn.

I asked, and they are only interested in partners with 100k active users a month. They REALLY REALLY wanted to talk to me over skype. Right, like a legitimate company with that many users is going to use luminati.

The use case of luminati is almost entirely grey/black hat. Their history is laughably sketchy. Unless anybody knows of any apps that use the SDK and ask for permission, I suspect that FAQ page is just for show. Again you have to be a big player to even use it, it's not a stretch to believe they don't "enforce" the consent rule.

Wow, that's a good read.

+1 on ssh + vps. People will say it isn't as anonymous as the shared vpn's and while that is somewhat true, it is still more than sufficient to remove your home IP from logs. Short of scary letters and warrants to the VPS provider, people won't really know who you are. You can also automate the rebuilding of proxy nodes to get new IP's, as most VPS providers have an API for automated rebuilds.

Exactly this.

For non-state actors my "data" is gone. You'd need a warrant to get data from my VPS provider, so for most of the common threats I'm pretty anonymous to non-state actors.

Maybe you don't want your employer to see everything you search? Interestingly for programmers the ssh-tunnel is perfectly explainable, especially if you do most of your browsing in the clearnet, and only some over your ssh-tunnel.

If your threat model includes state actors (doing something illegal hmmmm?) then I would recommend doing something a bit different, but for what most people are using services like Nord for ssh + vps should be fine.

EDIT: If yall are torrenting then just get a 10$/mo seedbox, you'll thank me later.

Are there any high quality VPS providers that have a way to sign up and pay anonymously with Monero (or similar), manage via tor browser, etc?

This here is assuming you don't have a nation state actively trying to track you down. Otherwise see [0]

One option is to use basically any provider + prepaid visa cards. Just access the website over tor or a VPN you semi trust. Sure it's technically traceable but not without a lot of trouble.

Keep in mind that once the VPS provider is issued a subpoena they still have access to your connecting computer's IP. They then have to issue a subpoena to your ISP for your account information. The only way to hide your IP is to use a proxy or a vpn... Oh wait, yeah that's the issue. See [0]

I personally just recommend using whatever you'd like, Vultr, DO, scaleway, etc. Feralhosting isn't anonymous but they uh... don't care what you really use it for cough torrents cough.

[0] If you're REALLY trying to be fully anonymous then you'll need to put on your blackhat. I would start with planting a raspberry pi in a business, library, coffeeshop, etc. You can use that IP as a starting point. You won't want to use only that one IP most likely, so you're going to need more proxies/servers, most common method is botnets. This really isn't worth the trouble to 99.9999% of people.

Edit: I guess I'm estimating there are ~7,000 people in the world who it's worth the trouble to do.... Actually that might be accurate, cool! :D

I've tried using prepaid cards with VPS providers and only found one that still took them (as of a couple years ago). Most won't take gift cards (prepaid visa) any more.

Hmm I was wondering if that was the case nowadays.

Honestly I don't think the extra step is worth it since the VPS will still know your origin IP in the event of a subpoena anyway.

You could try https://privacy.com but ironically I doubt it'll help much in terms of privacy. (I use privacy for convenience, as it essentially mitigates your card numbers being leaked - they're locked to the vender and you can impose spending limits)

Unfortunately I doubt there's many people who want 100% privacy that you'd want as customers if you're a VPS provider. I know Vultr accepts crypto but you have to prove your identity first (still great if you're a crypto advocate as privacy isn't the only benefit).

Otherwise you're stuck with resellers and grey-market providers. You could try "bulletproof" hosts from various uh-greyhat-forums but trusting those is very mehhhhh.

If I were taking such measures, I would just park near a coffee shop and use their wifi, using hardware I paid cash for and periodically changing my MAC address.

VPS providers can log connections and you won't really know how long they retain the data until it matters.

Wouldn't Tor hide your ip from the VPS provider even if they're subpoena'd?

EDIT: I realized this question might be confusing in this context. I'm not talking about torrenting large files (which you wouldn't want to do over Tor). I'm just wondering if it's possible to run a VPS with 100% anonymity.

IIRC can't an SSH tunnel leak your browsing through DNS leaks, or am I misunderstanding? I thought you usually want to use an actual VPN protocol like Wireguard.

socks4 leaks DNS requests, socks5 can tunnel them as well.

Oxylabs and Luminati are competitors. They don’t own them.

>What if I told you that a lot of these "VPN providers" were shell companies built to explicitly facilitate access and tools for crime / espionage with the premise of having users there as cover.

Interesting. I mean, Tor was was originally developed by the Navy as an OSINT tool, and later released because an "anonymity" network only used by the Navy isn't very useful.

More and more often non-state actors are doing what used to be in the purview of intelligence services, so it passes the sniff test.

But without specific evidence all I'll say is "plausible, but unconfirmed" :)

Not something that many HN posters will be familiar with, but if you're a holder of significant pieces of ARIN or RIPE IP space, you'll inevitably be approached by a number of suspicious looking companies that want to "rent" your ipv4 space (by the /24 block) for VPN/proxy usage.

The end result if you actually fall for their bullshit is that your IP space will be listed in every RBL until the end of time, and will have a bottom 5% rank in every IP space reputation/antifraud system until the heat death of the universe.

Every time I've been approached by these clowns, I've spent a cursory 3 to 5 minutes trying to find an actual business behind it (names of real humans, street address that isn't just a mailbox, location of real ISP infrastructure equipment at some real IX points) and failed to find anything resembling a legitimate ISP.

I'm just curious, do you own/work for a company with a bunch of ip addresses? Or did you buy them for a homelab?

Also, is there an "affordable" way to own an IP?

The former. Second question, not really, and you never own an IP, you just have permission from Arin, ripe, apnic, etc to use it.

On the DDoS...

I'm more inclined to say they don't know who it was, but pointing fingers, and Black Friday to maximize the potential damages reward.

The legal case also says "unknown individual"; so they could be a run-of-the-mill reporter or something.

A lot of what Torguard is saying in the case is pretty benign. An email from header can be faked, trade secrets, if left on the open web... aren't really secret anymore.

Nord isnt in a clean place either. Their response is making claims that the legal case doesnt even touch.

Regarding the DDoS part, the claim seems to be that the attacks were based on the secret information NordVPN possessed:

"35. The DDoS attacks directed against TorGuard were based upon the Information— the nature and way they occurred and were timed made it patently obvious that the attacker had obtained the Information from Collective 7 and was utilizing it as a roadmap for DDoS attacks."

See that's the first part of the story to me were both stories make a bit of sense. Nord says they discovered a configuration file with IP addresses that still worked.

If those were infrastructure IP's, and not otherwise public, that would certainly make more sense as to how Torguard believes Nord was responsible.

I know they used the timing like Black Friday as evidence that it was a competitor carrying out the attacks, but they have lots of competitors, so I was really confused as to how they settled on Nord as the attacker.

The NordVPN blog post leaves me with many questions.

1) Someone supposedly "gave" them the URL. They do not state how they found it, or how it was related to TorGuard. So who gave it to them? The Collective 7 hosting company? It appears Collective 7 was selling "Residential Solutions for VPN Providers":

http://web.archive.org/web/20171215024207/http://collectives...

2) Did they ask TorGuard to censor Youtuber "Tom spark reviews"? It seems he is critical of them: https://www.youtube.com/channel/UCXJWKuGh0qedrYviGEJmlWw

Tom Spark was also doxxed by the ProtonMail Reddit rep for posting videos they did not like: https://old.reddit.com/r/ProtonVPN/comments/96m5vc/is_it_tru...

Found the link here: https://medium.com/@gaetanosabin/did-nordvpn-and-protonmail-...

So it doesn't surprise me that NordVPN (Proton) wants this Youtube Streamer's videos and blog taken down.

Shouldn't NordVPN and Proton uphold user privacy and fight against internet censorship? They are doing the exact opposite here and that is very troubling.

But how did NordVPN find a vulnerability in their trash-talking competition in the first place? What were they poking at and whey were they poking it?

Exactly...

I always was a little sketched out by Torguard... much like how Wikileaks piggybacked on Wikipedia, the fact they put "Tor" in their name despite not being affiliated with Tor squicked me out a bit.

Note that Wikileaks was originally a wiki, though the name may have also intentionally echoed Wikimedia projects.

https://torguard.net/faq.php

Is TorGuard related in any way to the “tor” project?

Answer: No, The reference to "tor" in TorGuard relates to "torrents" and guarding one’s privacy when using bitorrent. We are not related in any way to the “tor” project however the company does support through donations.

Burying an entry in a FAQ does not change the fact people may not read said FAQ. Tor predates Torguard. It's perfectly possible people may be misled, especially since both are "privacy tools"

Nobody comes off looking particularly good here. If these corporations are going to act like grade schoolers calling each other names on the playground, I'm inclined to not use either of them.

I used NordVPN for about a year a couple of years ago and I found their quality of service unsatisfactory. I've been using ProtonVPN for about a year now and I've been very satisfied. But that's just my personal experience and YMMV.

> On or about May 17, 2019 an unknown individual appeared unannounced at the personal residence of a TorGuard contractor, asking to speak with him about his relationship with TorGuard and the VPN industry

This whole thing sounds sketchy AF for NordVPN. While not technically illegal, just approaching a competitor's employee unsolicited at their home (!?) has red flags all over the place.

mind you telling about some privacy company that they have 'trade secrets' which should be exposed is a low blow under the belt... if you have some critical information for its users privacy, then share it... (being privacy advocates and a VPN service themselves.. it would be responsible.) with that in mind, it just sounds like someone with bad temper with too much responsibilities as usually these things turn out to be...

They never mentioned that the secrets revolved around user's privacy

> What kind of 'trade secret information' could a vpn provider be blackmailed with though?

According to TorGuard's blog post they stole information from an install script that was allegedly used at C7 hosting:

https://torguard.net/blog/when-bug-bounties-border-on-blackm...

An installer script could easily give an attacker insight into internal TorGuard IP addresses that would otherwise be hidden.

My guess is these internal IP addresses from whatever was stolen were targeted with DDOS.

> What kind of 'trade secret information' could a vpn provider be blackmailed with though?

That's easy. A VPN provider has access to all kinds of juicy information, such as who their customers are and what they are up to online.

They may have been compromised already, they may sell user data. There are all kinds of things that could be going on that would definitely be stuff they could be blackmailed with.

Whether any of that is the case remains to be seen.

They have definitely been compromised. You can buy lifetime accounts on the darknet for a dime a dozen with suspiciously not-real-person email addresses and passwords. Other VPN services and accounts for sale are much more expensive and you can usually tell at a glance that the credentials were stolen from a real user.

Edit: Perhaps the unimpeded sale of these "hacked" accounts leads indirectly/directly back to someone inside NordVPN? A dirty "trade secret" they wouldn't want revealed..? Seems farfetched but they have not proven themselves trustworthy in the past.

It's not a YouTube comment. It's my entire channel. They want me to remove NordVPN videos like this one: https://youtu.be/xxwvAjmNec8

The plot thickens..

I mean... How are you involved? Why would NordVPN allegedly blackmail TorGuard to get you to stop posting negative things? What leverage does TorGuard have over you?

> What kind of information could you gleam as the owner of a 'service provider' for such a use?

They could find internal targets for DDOS to disrupt the competing VPN service so users get kicked off or can't login. If you can't use what you paid for most would ask to cancel.

Ddos attacks like this occur in any competitive space, but what bothers me here is the hosting company Collective seven appears to have betrayed a client's trust for competitive gain.

With such dishonest practices by hosting providers these days it makes me wonder what is really going on.

How come everyone seems to ignore a fact where torguards server config file was floating around on the internet? I just can't wrap my head about that. Is this lawsuit really an attempt to intimidate nord, so they don't disclose this vulnerability publicly? Wouldn't surprise me if so.

It’s not uncommon for ISPs to voluntarily tap and sell traffic data to government agencies - perhaps this is another case of that.

Reply on news.ycombinator.com