Hacker News Reader

Comment by cybralx | Hacker News Reader

Linked to US intelligence services. Makes you wonder how many VPN services are run by governments?

> Linked to US intelligence services. Makes you wonder how many VPN services are run by governments?

I don't recall details, but IIRC, there are (or were) a few popular VPNs in China that were used to circumvent the firewall that functioned fast and reliability despite the anti-VPN crackdowns. I've read speculation that they were likely collaborating with Chinese police/security forces to help them keep tabs on the VPN-using community in order to better anticipate threats to their power.

Facebook ran similar free VPNs for a similar reason: to gather intelligence on users to anticipate competitive threats: https://en.wikipedia.org/wiki/Onavo.

Well.... Tor started off as a government tech right?

That a government funded mixnet research in the 80s doesn't mean that VPNs are government-run, if that's what you are trying to say (honestly I'm not sure what exactly you're saying, the two have very little to do with each other).

By the way, you're off by a decade on when NRL did the onion routing research -- it was in the 90s rather than the 80s.

https://en.wikipedia.org/wiki/Onion_routing#Development_and_...

Thanks, I didn't know that. It was meant more illustratively than as an accurate time indication, but nevertheless it's good to be correct and now I know.

the US state dept funds the tor project to this day

My point was that one of the most secure ways of browsing the internet was essentially a government spin off from the 90s. So it's not hard to presume that the government has its fingers in a lot of other things built to hide/obscure user activity.

Well please prove me wrong but having talked to people like Roger Dingledine and Jacob Appelbaum in person and knowing a thing or two about how the Tor Project works, I have zero reason to think that this funding influences the security of Tor in any way, which is what "having its fingers in it" sounds like. The USA not funding the Tor project would, as far as I have been able to discover, not have changed anything about how likely it is that the USA or any other government has access to Tor users' data. If there are intentional bugs (bugdoors) inserted by any contributor, then those would be kept separate from any public funding it receives. Perhaps I'm not cynical, skeptical, or well-read enough though, so again, please point me towards anything that would suggest otherwise.

Then as for VPNs, they're again a very different thing. Funding research or a non-profit is very different from operating a commercial entity under a guise while abusing the trust anyone places in it. The comparison seems to me like comparing funding for general car safety or emission research with suggestions that the government operates one or multiple taxi services in order to learn who goes where. It's not that governments don't setup fronts or operate commercial entities under a guise ever, but rather that I have yet to hear of doing it for the purpose of surveilling random people (you have to get lucky in that anyone of interest signs up for yours, targeted marketing or no) that are not suspected of anything. Aren't fronts usually to enable targeted investigations or do specific actions unnoticed? Like, they might operate a VPN so it doesn't look weird if their secret operators use those IP ranges as well, but the main goal wouldn't be to spy on users (not saying they wouldn't do that on the side, of course, but it's getting more far-fetched).

This link should explain it:

https://surveillancevalley.com/blog/fact-checking-the-tor-pr...

The author of this book did FOIA requests to various entities but most of them got predictably shot down for national security concerns. This one obscure government agency, Broadcasting Board of Governors, wasn't covered by these exemptions.

So the author read the emails between BBG and the Tor Project maintainers and found that when they received a bug report, rather than fixing it they reported it to their sponsors. The government would then exploit the bug for years before the Tor guys got around to fixing it.

That link reads very much like a conspiracy theory blog, "shocking revelation", "Anyone who questioned this [was] attacked, ridiculed, smeared and hounded into silence", "But the facts wouldn't go away."

The content is worth following up on, though. Those emails are as if written in an alternate reality, where Roger Dingledine is a government agent. They seem hard to believe, but scrolling down there is a PGP signature with the right key ID. I can't verify the sig, the email that I'd have to type over is many pages long and I'd be fighting line endings and it might never match and I'd not know if it's due to a mistake on my part or because the message doesn't match the sig so it wouldn't prove anything anyway. The signing key ID is also a short one (64 bits) so it could also be forged with some effort. I've reached out on IRC some hours ago to see if they deny it, as there is nothing on the Tor Project's blog, but have yet to get a response.

arma.exe is not responding. The plot thickens...

So is the real solution such that you purchase internet service from another country and build your own VPN?

It's trivial to set up a FreeBSD instance with IPSec using StrongSwan on something like a Digital Ocean or Vultr instance in a country that suits (both D.O. and Vultr have regions in US, Europe and Asia/Pac Rim).

But it depends on what you're trying to do. If it's something like get access to shows on Netflix or the BBC iPlayer, then this is a good technique. I think for privacy, it might be OK; while the German or Australian govts. might share data with the US, probably Singapore, Korea, Japan or India doesn't. if you're up to something more nefarious then maybe you need something stronger like Tor.

Not trivial at all for vast majority of the VPN users. You know the people that buy VPN services because they saw it in a Youtube video as a sponsor.

Fair point.

Both Korea and Japan are client states in the U.S. empire, with large US military presences and drastic interventions in their domestic politics. They absolutely collaborate with the US on everything.

So I guess the best thing is to route through say US, Russia, EU and China?

You don't need the EU, they are probably more infiltrated then Japan, just listen to the german/french discussion (Germany believe that Europe can't have it's own army without US support...because of "nuclear"...France is pissed)

Part of the point of a VPN service is your IP represents thousands of users and no or very temporary logs are kept. Spinning up a one or dozen user VPN on a data-center IP where they definitely keep logs gives you none of that. Any complaint will immediately be forwarded or linked to your credit card. To see this in action go make one and then bittorrent some hollywood movies. You will get the scare letter emails forwarded to you within a month.

Want to get a data center account that takes crypto only? They are often shady, bad, unreliable and expensive, probably run by another gang that have their own issues.

>and no or very temporary logs are kept

If, and only if, the provider isn't lying

Thanks. I have always been wondering how the "hackers" (not in the sense of the way described in "How to be a hacker") managed to protect their traces while hacking other people's computers/networks. For sure many of them are gov entities so natually it's a lot easier to cover their tracks, but many of them are not.

I'm not sure what is currently beeing used, and I guess that really depends on what exactly you are doing. But I know that often infected Computers are used as a VPN or Shadowsocket to cover ones tracks. Combine that with several layers of protection and it gets harder and harder to track one down

Thank you, this makes sense!

>If it's something like get access to shows on Netflix or the BBC iPlayer, then this is a good technique.

Not very true anymore, at least Netflix outright blocks streaming to most ip blocks owned by VPS providers/datacenters.

side note: BBC now checks that IPs using iPlayer are coming from a residential IP address in the UK. It won't work from a UK-based VPN endpoint.

Why only VPN services? If you were in the Intelligence business would you stop there?

pretty much all of them, no?

How do you know?

Reply on news.ycombinator.com