Hacker News Reader

Comment by foobar33333 | Hacker News Reader

This is a pretty nasty situation that could happen to anyone. It might not have even been the wifi password. Any malware could have set up a vpn and done the same thing. Of course it's important to stop real crime but there has to be some improvements here.

At the very least they could have collected the passwords for the devices and dumped the storage to be investigated later rather than leaving these people without their essential devices for 3 months.

View on HN

It's worth noting that if they didn't hand over the passwords they're automatically liable for an offence whose punishment is two years in gaol, and all the police need to prove is that it is likely that they did know them. One of the quotes of the article describes the husband getting what is presumably an admin key from work for a Windows laptop -- if the crown wanted to, that alone would be enough to utterly throw him under the bus.

I honestly have an irrational fear of this happening to me. It's a great way for a malicious actor to utterly wreck someone's life. I tunnel all outbound traffic over a supposedly privacy-preserving (or at least non-UK) VPN, but honestly, this is the dystopian stuff of my nightmares. And I don't know why!

How do you tunnel your traffic though? Unless you can be sure it's forcing everything on your wifi network through it, then that wouldn't offer any protection to someone else using it without the tunnel, as is assumed to happen in this case.

A lot of WiFi routers actually support plugging in VPN details in the router software itself, it's not complex at all[0] even for your average consumer.

[0] https://www.expressvpn.com/vpn-software/vpn-router#recommend...

I believe you're over estimating the skills of the average consumer. The average consumer usually don't even know how to access their router' web interface.

As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.

My first thought was that it's more likely something like this than a bad actor on their wifi: https://en.wikipedia.org/wiki/Hola_%28VPN%29

Anyone with that browser extension installed on any device on their network is making themselves an open VPN exit for millions of random people.

Collecting passwords and dumping the storage is likely all they did. 3 months is fairly prompt for any kind of "cyber" in the UK to even get a brief look at, due to huge processing backlogs in the overworked departments whose job it is to deal with it.

I'd suspect that what happened here is they thought they had an easy win, went through the motions, determined fairly rapidly from interviews etc it wasn't actually a viable lead, and didn't pursue further. But the machinery is set in motion by the initial conversation, for fear of prompt deletion if the storage is left with the would-be perp.

Reply on news.ycombinator.com