Hacker News Reader

Hacker News

Comment by hklwarp | Hacker News Reader

Parent Full thread

hklwarp

ExpressVPN now belongs to Kape Technologies, which has a colorful history:

https://www.cnet.com/tech/services-and-software/what-is-kape...

https://www.reuters.com/technology/kape-technologies-buys-ex...

View on HN

I assume all VPN providers as honeypots by default, until they are proven otherwise.

Realistically, these things are mainly used to pirate and break the ToS of various websites ("Netflix from other countries", "buy games at cheaper rates"). With ISPs in some countries selling their customers' browsing data to advertisers, I don't think these shady VPN companies are much worse than not using them for a shockingly large amount of people.

Mullvad seems to come out pretty clean whenever these shady VPN providers show up on the news again. Being able to use them by just transferring some crypto to the right address without even needing to enter a username or email address seems pretty good. If you ever forget your account number, you're out of a month's worth of service at most and can just generate a new account when needed. It's the only commercial VPN I put a moderate amount of trust in, even though I've never used their service.

I see these posts, and my gut feeling is that Mullvad is probably fairly trustworthy at this moment in time, but the more word of their service spreads the more likely I would assume it is that they get approached by the type of government representatives you don’t say no to.

(I.e. I assume success to be a death knell for a service like this.)

I’m not a customer, but I’ve considered it from a privacy perspective (in that I could just route general browsing through it to block a layer of data harvesting). The problem is that I don’t know what authority they have to push back if pushed by the right actor (who inevitably will knock on the door at some point).

> at this moment in time

yup. So was The Great Suspender.

This is why privacy is a one-way circuit breaker kind of system. Once you give your privacy away, you can never assume anything about how your data is used. No matter the entity, you simply cannot trust that they will hold your data secure and use it in your best interests. Even Apple, hell even Signal, has leaky bits and "side channels" that can, and you must assume will, be subverted.

VPN services are well off the mark in terms of privacy protection. That the ~~marketing~~ propaganda is so focused on the opposite is an abomination.

I assume you are talking about the chrome plugin "the great suspender"; I am not sure what controversy you refer to? What happened to it?

See https://github.com/greatsuspender/thegreatsuspender/issues/1...

Better link https://github.com/greatsuspender/thegreatsuspender/issues/1...

> TLDR: The old maintainer appears to have sold the extension to parties unknown, who have malicious intent to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension (published to the web store but NOT to GitHub), arbitrary code was executed from a remote server, which appeared to be used to commit a variety of tracking and fraud actions. After Microsoft removed it from Edge for malware, v7.1.9 was created without this code: that has been the code distributed by the web store since November, and it does not appear to load the compromised script. However, the malicious maintainer remains in control, however, and can introduce an update at any time. It further appears that, while v7.1.9 was what was listed on the store, those who had the hostile v7.1.8 installed did NOT automatically receive the malware-removing update, and continued running the hostile code until Google force-disabled the extension.

Sidechannels in Signal is news to me. Can you provide some keywords to search for, or any links?

The contact discovery services leaks the fact that you are using Signal. It is not optional. It's clear why that is, so I won't spell it out.

They can get download records from Google or Apple to check for Signal downloads.

So there’s really no reason for Signal to try and hide one is merely using Signal. Best to focus on securing content.

You are missing the attack vector here.

It is optional isn’t it? I never gave Signal permission to read my contacts and yet I still use it.

>I see these posts, and my gut feeling is that Mullvad is probably fairly trustworthy at this moment in time, but the more word of their service spreads the more likely I would assume it is that they get approached by the type of government representatives you don’t say no to.

AFAIK (IANAL etc.) for that to happen several changes to Swedish laws would be required. And the follow up question would be what those demands possibly would be? And of course Mullvad's technical ability to comply?

For some comparison, you could look at the Swedish ISP Bahnhof, which quite publicly fights against the Swedish implementation of the data retention and requests by Swedish authorities. Repeatedly getting Sweden slapped by the EG court. (Which could also be compared with how Signal responds to requests for information about their users which they don't collect.)

There are (again AFAIK, IANAL) no NSL like laws in Sweden.

I use VPN services because my ISPs routing has a strange habit of going the wrong way around the globe and making mystery detours through the US. Picking a good point in-between helps to get on less congested paths.

I had this problem trying to do online gaming on Frontier. Their routing was both atrocious and mysterious. Using a VPN to get off their network ASAP made games playable.

I just pay for the most expensive ISP.

Edit: Not sure why the downvotes but I don't live in the US, if that matters.

What makes you think a more expensive ISP will go against their interests and refuse to maximize their profits by selling access to information that they are legally allowed to share? Are there expensive "privacy"-branded ISPs I'm not aware of?

I don't live in the US, but here's a link from eff:

https://www.eff.org/deeplinks/2017/03/small-isps-oppose-cong...

That doesn’t mean anything. It’s the same with Apple pretending to care about privacy right now while it is a competitive advantage.

Yes, you are right and I'm wrong.

You're lucky if you live in an area with more than one ISP. lol

How could one prove otherwise? (Assuming you can't send in a 5 Eyes team to audit them, haven't hacked their management network, etc.)

I think sending in a 5 Eyes team to audit them would result in the VPN provider becoming a honeypot even if they weren't before!

One can't really, which is why these absurd claims of "we wont monitor your traffic" should be assumed to be blatant falsehoods.

But what does proof even mean? They can pass any audit you throw at them, and then immediately switch to being bad actors.

If you want a decent sized paid VPN service, you are basically choosing between Nord and Kape now.

Pepsi and Coca cola.

Proton VPN - 70M+ signups across our products. Fairly decent size at this point.(disclaimer I work for Proton)

Mullvad?

"decent sized"

Lots of small coke companies exist too, to use my analogy again.

Why does size matter? Mullvad is fast, has quite a few locations/endpoints, and good service.

Mullvad is not small.

True that. IIRC Mullvad was literally the world’s largest Wireguard deployment until Cloudflare did Warp. Just because people haven’t heard of it doesn’t mean it’s small. They just don’t advertise on shitty podcasts, so it doesn’t have the same brand recognition.

Mullvad isn't small, and I'm not sure how Nord specifically compares, but its probaubly worth noting they mostly use 100TB, Tzulo, Quadranet, M247, and 31173. They use a bunch of others but not much.

Mullvad for obvious reasons is used for less... wonderful usecases. It's not uncommon for websites to block you due to abuse from that exit. ASN blocking is rather common with mullvad too though that's less avoidable.

I have less info on Nord, although I can see it has about 4x the ip's. No idea if they are more diverse network wise. Their accepted payment methods suck though.

I saw NordVPN ads in German TV. At this point I would say they invest all of their money into marketing - my reason for never ever buying their product. I haven't had any issues in terms of blocking on mullvad but my sample size is small since I don't change the servers that often.

Yeah my impression is they're all marketing and care relatively little about privacy. How you can claim to care about privacy but still require an email is beyond me.

Would you accept RC Cola?

- A loyal Mullvad customer

If mullvad is RC Cola then I'll switch immediately. Love that stuff.

What are the thoughts on PIA? I've used them for years without issue, but I'm sure they're harvesting my data. lol

PIA has proven in court multiple times that they don't log. Everyone in this post worrying about Kape is probably not using their vpns for anything illegal in their jurisdiction, and are just obsessed with "privacy"

Has PIA proven in court not to log subsequent to being purchased?

They're owned by Kape. I switched to Proton once my 3-year plan ended.

Reply on news.ycombinator.com