Hacker News Reader

Comment by prophesi | Hacker News Reader

This isn't revolutionary, or did we forget that OpenVPN (and when it's easier to use: Wireguard) is a thing?

Well-audited, open-source, cross-platform, and most VPN providers offer an .ovpn config.

The point is with the app, you don’t need the config. The app can automatically assign you to the fastest server for you, you can pick any server on the fly without predownloading a config, you’re automatically abreast of the latest servers added, etc.

Advantages and disadvantages with both methods.

Not everyone has the resources or inclination to learn how to setup and maintain their own vpn servers. If they are only a single user on that machine, the anonymity of the service is also compromised.

----

That being said: Everyone who has the inclination should absolutely give it a try!

I think you're confused. OpenVPN is both the server and the client. I'm arguing that you can simply download an OpenVPN client, get the .ovpn config from your VPN provider, and you're good to go.

To clarify: VPN Providers are running their own OpenVPN servers, and this is likely what their apps are connecting to in the first place. This is why most of them offer .ovpn configs for you to use in your OpenVPN client.

Ahh OK... well yes, that makes way more sense. I think it's a matter of convenience, its far simpler to download an app and let it "do its stuff" than to find a suitable client and feed it the correct config.

What you describe is also a good setup. Good if you don't trust your VPN provider to deliver a secure app -- a level of trust that cannot always be assumed.

Yeah, that's definitely fair. Figuring out how to import a config file can be enough friction. And you certainly wouldn't be able to easily switch which server the app is connecting to, which a VPN provider's app will have a slick UI for.

From the features page:

> We use only VPN protocols which are known to be secure - IKEv2/IPSec and OpenVPN.

If you want to use Wireguard, consider Mullvad.

In Dec 2018, ProtonVPN said Wireguard support is forthcoming: https://protonvpn.com/blog/wireguard-donation/

As of Oct 2019, no updated status: https://protonvpn.com/blog/wireguard-donation/#comment-9236

Apparently it is expected by the end of this year, as noted in a recent reddit [1] thread:

>protonvpn 1 point 6 days ago

>Thanks for your suggestion, we will consider this. We will plan to implement Wireguard as a protocol by the end of this year.

[1]https://old.reddit.com/r/ProtonVPN/comments/eo2k9m/eta_on_wi...

OpenVPN and IPSec clients exist, why is ProtonVPN reinventing the wheel? This ProtonVPN advertisement wouldn't have been 'necessary' if they had used and supported an existing client for these protocols.. but then again, they wouldn't have had this ad on 'hacker' 'news' if they had..

Lower barrier to entry for non-technical users?

Marketing (by being in app-stores, and thus gaining visibility & being suggested for 'users like you')?

Those arguments don't hold any weight. They could have forked the OpenVPN for Android app (which is some GPL license, don't remember which), thrown in their own branding and default config, and not shipped a proprietary mess to customers. Instead they went the proprietary mess route.

I haven't looked at the app, but my guess is things like exit point selection, account management, troubleshooting and performance indicators.

Not sure what exit point selection is, but I don't see why any of those features can't be added upstream to a FOSS OpenVPN client/server.

It's simply selecting where packets exiting the VPN are routed.

> but I don't see why any of those features can't be added upstream to a FOSS OpenVPN client/server

Could be simply because none allows this in the first place. And then the selection may be very service-dependent.

In any case, their app is now open source, so why is this an issue anyway?

> In any case, their app is now open source, so why is this an issue anyway?

My issue is that countless VPN companies are re-inventing the wheel, when they could just be contributing to open-source in the first place. It's obviously in their best interests from a security & trust standpoint to start from an already open & well-audited platform. Everyone wins when bugs are squashed and new features are added; and the licensing lets them keep their branding/ui for the app they deploy.

Reply on news.ycombinator.com