Comment by NeedMoreTea | Hacker News Reader

Comment by NeedMoreTea | Hacker News Reader

Parent Full thread

Trust and ethics are important. A company that is identified as using questionable ethics in business, for an extended period, is not automatically "reset to neutral" by airdropping in a new management team and a rebrand. Honestly? That sounds more like a move to bury the bad news, which has a long and effective history, just as the day a story goes public does - The Friday News Dump, Thanksgiving News Dump, etc. So, for this PIA user, Kape are in significant negative territory that needs making up to even hit neutral again.

Transparency is verification, but it is critical you like what you see. With the newly formed Kape link, owned by Teddy Sagi with extensive links to other online advertising companies, mobile advertising and online gambling. Nothing good for humanity is done by his investments. No, don't like what I see at all. With the reputation PIA had I'm actually really surprised you chose to be associated with such a stable as Sagi's.

My sub is due for renewal shortly into the New Year. It won't be.

This is exactly my rationale. The fact that you have to explain that the company that bought you is not shady is writing on the wall, even if you have a good explanation. For the record, I think the explanation is pretty decent. But PIA is a commodity product from a technical perspective. It's the trust and reputation that's not the commodity, and being bought by a shady company (even if it's "formerly shady") you discard this right away.

I bought PIA because it had stellar reputation back in 2015 or so. Now it went from stellar reputation to "just another VPN provider". Mullvad appears to be prime candidate now, they're not based in the US if that means something to you, and they even have Wireguard to play with. Let's go.

Trust is a fleeting concept. If you used PIA only for the trust and not for the verifiable transparency, then we have failed you.

You can't trust some random VPN on internet. Anyone could have set it up.

You can only verify. Don't trust. PIA will continue on its mission to increase transparency and set a new standard and expectation in the industry.

With PIA, we will make sure you know what you're getting. Some may choose not to go with PIA, and that is beautiful freedom. For the rest, I'm confident people will choose verifiable transparency over blind trust.

How do you propose we verify the transparency? I legitimately have no idea how I can verify what specifically is running on your servers.

It seems to me that the entire VPN industry has a huge inherent information asymmetry since it is incredibly difficult for an end consumer to confirm any claims a provider makes about the quality of their product. Economic theory tells us that results in a market for lemons [1]. We just end up with a bunch of low price and low quality products provided by shady companies because it simply isn't cost effective to compete against those options with a quality product whose quality can't be verified. For a technically savvy end user, you are probably better off rolling your own VPN with open source software you compile yourself rather than trusting any of these black box VPN providers.

[1] - https://en.wikipedia.org/wiki/The_Market_for_Lemons

Transparency is not verifiable, just as it's impossible to prove the non-existence of something.

PIA could appear to be 100% transparent while secretly creating and backing up logs, or passing them through a third-party. An auditor is less likely to be fooled, of course.

The bottom line is that it's reasonable for us to choose our VPN based on both transparency and trust, and we have no reason to trust the new owners.

Much like a conflict of interest, appearance of mistrust is akin to mistrust. You are associating with groups that have demonstrated minimal trust and ethics and allowed abuse of their platform. Worse than that, you are passing you business, product, and any existing or future data to a mistrusted group. I won't be part of that transition.

You intentionally placed your product in the hands of this group knocking your own reputation down several pegs below competitors if not out of the picture entirely. Lip service won't win me back.

And what, practically, does this verifiable transparency look like? What stops it from being just another _unverifiable_ promise on the internet?

if you are really all about transparency then would you like to explain why someone from your company was caught red handed trying to smear other VPN providers?

https://i.imgur.com/xg52ous.jpg

https://www.reddit.com/r/sevengali/comments/9dgexs/why_to_av...

Speaking for myself, you have indeed failed me. Before I read your comment, I had now idea that PIA offered "verifiable transparency". I still do not know what you mean by that phrase and how I as a mere user can even begin to verify your transparency.

I did use PIA for the trust, I lost that trust and I will therefore stop using PIA.

The PIA clients are closed source, and can't be verified. (They also run as root....)

You can manually set up the VPN connection with the OpenVPN client, NetworkManager, etc etc

> You can only verify.

What are you talking about? Verify what?

I honestly want to agree with HN on this, but then Im reminded of the constant support for Apple on here, despite the fact that they have violated user trust on numerous occasions, while PIA has not.

So I did some checking:

* Teddy Sagi is a entrepreneur. To say that he is an ex spy is a gross misstatement. Yes, he worked as a developer in Israeli SIGINT program - so do a lot of developers who work for any number of government contractors in US with security clearances working in SIGINT. Does that make them all spies? If you wanna believe in the conspiracy that all the Unit 8200 graduates who have gone on to found Silicon Valley Companies are still state sponsored, then man, you gotta start boycotting all your popular software (and some hardware), cause Apple, Microsoft, Oracle, and Facebook all have a hand in buying these startups.

* Crossmark, the company that Kape originaly was, had malware which is the equivalent of ad supported app on your mobile device - it was bundled with some software (much like Oracle used to bundle Adware with the Java installer), and injected browser traffic, while sending user information back, perhaps for better targeting This is a far cry from actual nefarious malware. Bad? Yes.

* Kape technologies is under the lead of a new CEO that was responsible for transforming the company away from Crossrider towards cybersecurity. Again, if you want to believe in a conspiracy theory, that is your choice.

* All other Teddys ventures since Kape are in the advertising space. There is a concern that can be made that perhaps advertising is going to sneak in to PIA, but lets cross that bridge if it actually happens.

TLDR, pretty much the expected overblown response, which is sadly becoming the standard for HN. By all means, vote with your wallet, but try to keep your voting consistent. Personally, given the web of investors and ownership that surrounds modern tech companies, I do not see any glaring red flags here.

I make no mention of Sagi's background, just his investment choices. Those alone are enough to question the wisdom of supporting any of the businesses with my actual money. Yes, let's have some honesty.

He's invested in : Founding Playtech an online gambling outfit, a credit card clearing company for online gambling, Kape, Stucco Media - Search engine marketing, and several mobile advertising companies. Not a list many would associate with either ethics or privacy. Not a list I want to give money to or see succeed. All businesses built on erosion of privacy. Colour me unconvinced seeing a privacy oriented company joining that particular stable.

CrossRider was nothing like you imply. It was a BHO platform that injected a dll into the browser to allow easier peddling of malware and adware. Why not mention adware? Let's ignore the malware smokescreen you're trying to launch, with them as innocent victim. A platform putting injected adware on my fucking computer is more than enough. Every anti virus and anti malware platform I'm aware of identified CrossRider as a problem, or flagged its shite as "unwanted program".

Not liking that they now have a plan b that is not in an injected adware platform is not "a conspiracy theory". It's simple track record. Given what their first plan did, and how, it'll take considerable effort over considerable time for me to even consider them neutral. They may never reach neutral or "trustworthy" again.

No all his other ventures aren't in advertising. They are in advertising and gambling - funny you don't mention gambling - that, for me, is more than enough for choosing a business to rely on for trust and privacy. I don't want to support those sectors. I don't actually want them to exist. I don't actually trust anyone in the SEO, advertising or gambling industries at all, from Google and Ladbrokes down. As they keep doing the opposite of the ethical thing, consistently and repeatedly.

If PIA, who have built a decent and (as far as I can see) well deserved reputation, want to hitch their future to that. Well it's their disappointing free choice. My money goes elsewhere.

Online gambling is not in any way built on eroding privacy. You are free to not like how the industry knowingly makes money of off addicts (no, no matter how much they say they care about responsible gambling they will not stop problem gamblers more than necessary to comply with the law), but in my opinion that is the only ethics problem online gambling has that most other industries do not also share.

Start here (from Simon Davies, the founder of Privacy International): http://www.privacysurgeon.org/blog/incision/how-the-online-g...

They are as bad as, and often indistinguishable from, the least salubrious corners of online advertising in their tracking and data gathering. Unfortunately their determination to keep feeding off addicts and keep tracking the whales is what has driven their data abuses. Responsible gambling is 99.9% greenwashing. :)

As someone who has worked in the online gambling industry I can say that this article is very outdated and on some points misinformed. Things have changed a lot since 2010, and he is wrong even about how things worked back then.

> It is routine for sites to demand the transmission of passport and credit card scans, drivers licenses, utility bills and other personal documents. All the available evidence indicates that this information is stored permanently.

Only due to the regulating authorities demanding this to prevent money laundering. Collecting and storing this information is just a huge headache to the gambling companies. I know some small companies do it improperly, but if they could chose themselves they would not have stored it at all. I have never heard of any company using this KYC documents for anything other than storing them for possible police investigations.

> As a rule, they don’t. It is extremely difficult to close an online gambling account, and in my experience impossible to have your data deleted.

This kind of BS with making it hard to close accounts was an issue and has been cracked down on. These days it is very easy to permanently close a gambling account if it is Malta or UK regulated at least. If it is not then you can report them and they can get large fines. It is impossible to get your data deleted though since the casino must keep it for anti-money laundering for a long time. Here I do not know how many actually delete anything once their legal time is up.

> [and] fail to notify customers that personal data will be retained permanently even after an arduous process of account closure.”

Yeah, I think the sites should be more clear about this. But I do not know of any industry which does this well.

Edit: About tracking the whales. No, that is not related to any data abuses as far as I can think of. It would actually be better (from a greedy and selfish point of view) for us if we could delete the gambler's data when they delete their account because then they can register a new account and lose all their money again and we could say we have fulfilled our responsible gambling obligations because there was no way we could correlate the new account with the deleted. Tracking whales is usually mostly done with quite simple BI queries and VIP teams doing work manually.

I am not saying data abuses do not happen in the industry, but it is certainly not built around them or close to as bad as e.g. adtech. Actually ordinary online stores seem often to be worse than casinos when it comes to privacy which probably says more about our current society than about casinos.

What you're forgetting to mention is that none of the "improvements" is due to the industry itself. ALL of it has come from government regulation and threats from legislators to ban online gambling unless the casinos clean up their act.

While this fact surely deserves to be mentioned, I think plenty of companies make good PR off complying with legally mandated measures. Doing something good is doing something good, even if you don't want to do it.

Kinda yes, kinda no. While the user account locking and several other things only happened due to regulators there are other similar issues which the industry fixed itself (e.g. intentionally delaying withdrawals which regulators did not give a fuck about but after one company offered it everyone had to) and reducing the number of sensitive documents necessary to collect (the regulators do not give a fuck about user privacy).

>Only due to the regulating authorities demanding this to prevent money laundering

Authorities demand tracking/ID info for users because the industry declines to make laundering impossible on their platforms.

How would you make money laundering impossible? If we could we would. Money launders are shitty customers who mostly just rack up tons of transaction fees for us which their losses just barely pay for.

I don't know, I'm not in the profession. Maybe start from first principles?

> To say that he is an ex spy is a gross misstatement. Yes, he worked as a developer in Israeli SIGINT program

This makes him an ex-spy. There's no prejudice or judgement in saying so, it's simply true.

There's a podcast called Darknet Diaries with an episode about this program[1], where the host interviews an ex-member. It's all very interesting, but there's one part in particular where he talks about the reunions that some ex-members regularly attend. It raises questions since many of these people are working in important positions at major corporations that compete with each other and compete with Israeli companies and companies founded by other members of their unit.

It wouldn't be fair to assume any collusion is going on of course, but considering their past in espionage and the military, it's at least worth mentioning.

[1]: https://darknetdiaries.com/episode/28/

Are people exaggerating? Sure.

But is there more reason to think that their data isn't safe with PIA now than before the merger? Definitely.

> you gotta start boycotting all your popular software (and some hardware), cause Apple, Microsoft, Oracle, and Facebook all have a hand in buying these startups.

You make this sort of action sound out of reach/unreasonable.

Nice comments.

When Trump became president, was it still Obama’s administration?

Given my knowledge on corporate governance and publicly held companies, I disagree with your first statement. The CEO and management team are absolutely the ones who define the ethics of a company and are legally responsible as well.

As for Teddy, I’m not sure how knowing his background and being able to public verify his moves would cause less trust then, for example, the other VPNS which you have no idea who owns them or even where they are located. Transparency builds trust in real life and there is nothing but transparency here. This isn’t a blind faith.

PIA has never logged nor has KAPE. Checkout the other providers and see what they have done. It’s gross.

Regardless of your decision and your comments, I appreciate your contribution to the discussion.

While I disagree with some of the statements in the thread overall, I recognize that PIA can do more to provide more comfort to people. Unfortunately, I don’t believe in blind trust and theater so all we can do is continue to increase our transparency until there is no need for you to trust us.

And to Zero Trust we are headed.

Happy New Year and thank you for the opportunity to protect you until now. I trust we did a good job, and one day, I hope we will have created an ecosystem that doesn’t rely so much on trust in the future so that you might return and we can serve you again.

Best, Andrew

It seems that you are redefining the word "trust" here. I would agree that transparency in a VPN is very important, but surely you have to realize that any time a consumer such as myself is utilizing the services of any third party company, whether it's a traditional software provider, a commercial VPN, a SaaS vendor, etc., etc., there is a trust dynamic taking place. No matter how transparent PIA is about their no logging policy, for example, I have to trust that the PIA team is holding firm to that policy. Yes, that policy has been tested in the courtroom; but all that does is tell me that as of 2018 or whenever you were served you didn't log; it doesn't tell me anything about whether you logged my traffic last month. For that, I need to trust you, based on a multiplicity of factors, that you didn't. Prior court cases form part of that trust, and your outspoken no-logging policy, but your corporate structure is also factors in to whether I trust PIA.

It is also worth meditating on the fact that, unlike this very boring (from a legal and political perspective) user, undoubtedly there is a segment of your user base who are dissidents and journalists, for whom the privacy of their online activities truly is a matter of life and death.

Trust is like respect; it should be earned, not given freely. PIA had my trust. You have since eroded it. Not completely, but enough that I am shopping for another VPN. If you want me to sign up again, you must re-earn that trust.

> I recognize that PIA can do more to provide more comfort to people.

You could start by looking for a new CTO maybe? I mean, Mark Karpeles was such an obvious bad choice.

> Transparency builds trust in real life and there is nothing but transparency here.

What transparency? I all see are unverifiable claims. Such claims actually make you more suspect imo.

> PIA has never logged nor has KAPE.

So you say.

> And to Zero Trust we are headed.

How is 'Zero Trust' in any way related to the issue of transparency you bring up?

The irony. You were spreading FUD concerning ProtonVPN and their connections here on HN and Reddit. Now it is you who gets grilled. Karma is a bitch, isn't it?

> When Trump became president, was it still Obama’s administration?

The current president picks up where the previous one left off -- they don't start with a clean slate and no historical baggage.

Reply on news.ycombinator.com