Hacker News Reader

Comment by cronix | Hacker News Reader

Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.

View on HN

After that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America.

Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.

This is why I don't trust VPN companies that advertise.

Which ones are good then?

PIA has been tested in court as not keeping your data. Other than that you're placing trust in others, depends on what you wanna keep secret.

That's from before it got sold to Kape who has had a horrible track record with VPNs.

They're also ran by Andrew Lee/Rasengan, who killed Freenode about a month ago. So, uh, that's great.

Depends on what you want it for. To pretend you are in the US for netflix or to evade the fbi. The ones that advertise are good for the first.

Rolling your own fixes one issue and raises another.

If you pay using the right method, Mullvad doesn't know your identity.

Came here to promote Mullvad as well. Not that they can’t point back to your up address or some such but since you can login to the VPN using a unique identifier instead of an email address and password it’s a pretty decent way to decouple it from your PII.

And you can pay with cash. I always feel a bit funny dropping $10 cash in the mail with no return address but so far it’s always made it into my account.

They have your fingerprints now (and possibly your DNA from the stamp)!

No, I use SnailOnionCoin. It sends my cash through a number of intermediaries, each just getting a .onion adress explaining where to send it next. Every hop is also switched between cash in snailmail, western union and bitcoin to make it harder to trace the links and make sure that physical traces (like fingerprints) or legal traces (like the postal system or traditional financial transfers) don't make it to the final recipient.

Is this satire or a real thing? Because nothing comes up when I google it.

The website is only available on IPFS-over-TOR-over-IPoAC (https://en.wikipedia.org/wiki/IP_over_Avian_Carriers). We take secrecy very seriously.

Not only your fingerprints, but the fingerprints of the dozens of people who handled the envelope and cash. Who knows what they could do with so much information?

But anyway they know my home IP unless I connect via multiple proxy or tor. I wonder is hiding PII for payment meaningful.

Your own, purchased using untraceable means (fake ID is the easiest... and likely most illegal).

I think you can't really prove an entity to be trustworthy; you can only really prove that an entity is not. I trust Mullvad about as much as it's possible to trust a VPN company... but, that's probably as good of a recommendation as you can really get.

plot twist: letsencrypt.org

I seem to not get the twist. What am I missing?

I think its an insinuation that letsencrypt is a honeypot.

It's been long rumored that privacy-as-a-product companies are actually three letter agency honey pots. ProtonMail actually has some connections to NSA investment firms and some former NSA staff on their board. There could be good explanations here, and there could be bad explanations, however, we don't know the role each of these components play in the larger sum; we can only guess and speculate.

In that way, an ambitious project that gives away certificates that were formerly worth a lot of money would be a pretty slick honeypot because now you could stow away private keys and have a copy of most of the encrypted webs certificates to decrypt in-flight communications.

That's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed certificate. You never give them your private key.

Never heard of a back door? There can be master private keys.

Functionally irrelevant to your browser though without HSTS: being able to MITM specific targets with correctly signed certificates would be extremely useful.

If they issued a malicious certificate they would not be able to hide it. Certificate Transparency logs are now mandatory for all TLS certificates:

https://en.m.wikipedia.org/wiki/Certificate_Transparency

The log is like a git hash-chain: you can never erase the past without affecting the whole chain after the erasure.

If you want hidden backdoors, put them in hardware, not software. Chips are the best place.

A CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a customer, atleast untill they get caught and have their root certs revoked by tech companies.

I believe perfect forward secrecy (now default) blocks such attacks.

Didn't Facebook already do this?

I already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.

This is why I mostly recommend a Russian VPN or one in a foreign country. Sure, your data might end up in the hands of Putins mobsters. Do you think they will share the data with your government? Unlikely...

And even if a VPN company isn't compromised, there are so many legal loopholes that would allow government to access your data. Kitten on a tree can quickly become a matter of national security.

Reply on news.ycombinator.com