Hacker News Reader

Comment by flashman | Hacker News Reader

As to how the FBI got access to the messages, Vice says[1] after Vincent Ramos of Phantom Secure was arrested in 2018, a confidential human source offered Anom, which the source was developing, to the FBI (probably in exchange for immunity or a reduced sentence, in my opinion). The source then seeded Anom phones to his existing distributors as a replacement for Phantom Secure phones, and from their they made their way into criminal organisations.

[1] https://www.vice.com/en/article/akgkwj/operation-trojan-shie...

View on HN

Makes you wonder how many commercial VPN services are just FBI honeypots?

One of the (publicly unspoken) conditions to offer VPN services in western countries is to keep logs and provide on their request, regardless of the marketing stories. There are several verifiable cases where Nord has cooperated with FBI and Interpol and provided logs, but this is a fairly small lie, compared to the time when they tried to keep quiet about a breach.

Not saying that having a VPN service from Russia or China is a better solution...

Generally speaking, they all have to have relatively short term logs to operate and protect their services. This tends to defeat things like piracy, where commercial actors need time to file paperwork and get subpoenas, by which time the logs are gone, but obviously the feds can move a lot faster and tend to get what they need to catch serious criminal activity.

This would, to me, suggest VPN services are a general societal good, as they prohibit annoying corporate IP enforcement behaviors, while not meaningfully helping pedophiles and terrorists.

Russia and China would in fact be a better solution as most Westerners are never going to be subject to Russian or Chinese authorities.

> most Westerners are never going to be subject to Russian or Chinese authorities

Coercible locals are a valuable asset. Not sure why countries with zero rule of law would be attractive to someone valuing a principle like privacy.

I'm not sure what you are trying to say, especially with the "coerciable locals", other than trying to say China and Russia have "zero rule of law".

His point is that foreign states could blackmail you or exert pressure in other ways, even if they aren't gonna extradite and throw you in jail following due process. Thus, Russia/China would have "coercible locals" in western countries.

In the US a "coercible local" is given a far less scary descriptor of confidential informant, or state's evidence. There are far more of those than there are "coerced locals" in the service of Russia or China.

Any locals in any country are coercible to their government, if it really wants to.

Sure until you visit a geopolitically aligned airport and get detained and propositioned by a foreign intelligence agency. Then you end up spying against your own country because your VPN provider was just a honeypot for a foreign intelligence agency. Blackmail, forced detention, "crimes against the Chinese state", jail without due process or civil rights, who knows. Maybe you didn't even break US law but Chinese or Russian law.

I would never willingly trust a country like Russia or China with my information.

That stuff already happens to people in the West, and people who visit non-Western but Western aligned countries. The fact of the matter is that if you are a Westerner, you are going to spend more time in the Western sphere of influence, of which Russia and China are not a part of.

I think the West generally respects and understands due process, rule of law and those general ideas. You will likely get a fair trial. Not so for some of the opposition.

This is exactly why I tend to use VPNs from country's with which the US is not in good terms with : Russia, Iran, Belarus, China

If I was a US intelligence agency I would specifically establish colocation presences with ISPs in Russia, Belarus, Uzbekistan, china, etc, on commercial ISP terms, and admin the servers remotely to set them up as a commercial vpn service. There's plenty of datacenter operators in Russia that will take your money.

> There's plenty of datacenter operators in Russia that will take your money.

Wouldn't they have some uncomfortable questions to answer when Putin finds out they've been cooperating with the Feds?

Presumably the feds wouldn't say who they were and would pose as common criminals, because they wouldn't have any reason to suppose that the datacenter operator would keep quiet if they were open about their identity.

But yours assumes that Russia doesn't do counter-intel and wouldn't be looking for exactly these kinds of infiltrations. If it is obvious to us that these things would be targets, I'm pretty sure it is obvious to Russian intelligence services.

Bellingcat appear to routinely buy data from Russian blackmarket data brokers.

Replace 'buy' with 'receive' and 'Russian blackmarket data brokers' with 'intelligence assets' and you're correct.

Shady fly by night data hosting doing counter-intel, or better, Putin spending his precious rubles on running counter-intel ops for shady fly by night hosting companies, are both hilarious.

Russian govt has always held counter intel to be a top priority and they devote an enormous amount of resources towards it, so why is that hilarious?

The feds would pose as a slightly shady hosting/Colo company or similar.

First-order strategy (do something that works as long as the other side hasn't also thought of it) only works until the other side thinks of it. My guess is that the intelligence complex (CIA +) thought of this around 1995, and the domestic law enforcement complex (FBI +) around 2005.

Very plausible. A lot of "western" VPNs are run by Chinese companies.

https://www.computerweekly.com/news/252466203/Top-VPNs-secre...

I'm confident the big ones like Nord are just that. And even if they're not, they can just be taken over or backdoored - nobody will ever be the wiser.

Especially VPN services that got acquired, like Private Internet Access, acquired by what many people describe to be a malware company.

Wait, what? What did I miss?

It was acquired by Kape Technologies, which used to go by the name of Crossrider and has a sketchy history

https://hiddenrouter.com/private-internet-access-vpn-to-be-a...

Thoughts on ProtonVPN?

There are few real use-cases for any commercial VPN which claims to sell privacy, they are generally snake oil. The one possible exception is to get around geo-blocking, and in that case you just want to go for one with the most numerous and reliable servers in the location you want to appear to be visiting from.

For privacy, the gold (and imperfect) standard is still Tor, and even then you are at the mercy of the owners of the exit node. Freenet and I2P are also interesting.

1, but this is exactly the point. Use them for netflix not to coordinate heroin sales.

Or even foreign state actors

The FBI, from the viewpoint of 95% of the world, is “a foreign state actor”.

Not country-wise. The US has many first world allies that cooporerate with the FBI on a second party basis.

So Vice says that an external source came to offer the app, while the Australian Police "said the plan to use an encrypted app was hatched overseas over a few beers with FBI agents in 2018, before police figured out how to decrypt all messages."

I wonder how this all ties together. As someone mentioned here, there surely be some movie about it.

It’s likely the FBI mentioned they had an app they could leverage, Australia noted that there was a gap in the local market after Phantom had been taken down, and the two agencies decided to seed the app into the Australian criminal underworld to see how far it would spread.

Yep, sounds plausible.

The AFP says that this Mr Ayik should turn himself in for his own safety, but surely the one with an enormous target on their back is this person. It can’t be too difficult for these criminal organizations to piece together who that is.

Reply on news.ycombinator.com