Hacker News Reader

Comment by jeffbee | Hacker News Reader

It seems very silly to analyze the Google VPN with Google as your privacy adversary. The point of the VPN is to hide your traffic from 9th-circle privacy adversaries like local telephone companies.

It also seems pretty silly to mix in interesting findings in a big PDF sprinkled among other items that are, speaking generously, debatable matters of opinion, like whether programs should be stripped or not.

View on HN

One such "interesting finding" is that the VPN software is run with admin privileges, including the parts that deal with concepts which would not need admin privileges, such as debug logging, because this increases the attack surface for a hacker who already has limited control of the machine, to potentially elevate their privileges, if they manage to find vulnerability.

This is one of their medium findings. This report smells like "Guys, we MUST find something, give me something, anything!"... :P

Yeah, I love the finding that an attacker in possession of your unlocked iOS device could discover your email address. Big news!

These reports usually start from a baseline template/checklist. I'm sure the "unobfuscated binary" and "admin" findings that everyone on this thread is making fun of are part of the SOP for NCC Group audits of native applications.

We laugh and argue that this makes pentests a joke (which plenty are!), but at the end of the day that "admin" note resulted in a material improvement, however tiny, in the system. Google reacted by removing the need for escalation from the application and now an attacker needs one more exploit to build a full chain.

They are SOP/standard findings.

You work through a checklist for arse covering, which generates a lot of meaningless/low value findings.

If you omit a lot of those issues, the client thinks you didn't do the work sufficiently.

If you put in too many of those findings, the report gets made fun of for containing "filler".

I agree with this - VPNs protect you from only the ends of the chain, while centralizing the middle, and it's rather foolish to think that any VPN construct will reliably blind traffic and identity from the VPN provider. Depending on your threat model this is a good thing or a bad thing overall.

However, this "privacy" goal is something that a huge number of VPN providers, including Google, claim as a goal and market heavily against, so it's fair to assess against it IHMO.

As for the second part, yeah, that's pentest reports in a nutshell. A few nuggets of information combined with checklist-satisfying irrelevant findings from automated tooling.

A VPN service that doesn't log should reliable be expected to protect you from dragnet style surveillance that is initiated after the fact. If the government asks google for everyone who searched for a term in a range of dates will return a list of IPs and times. Comcast may choose to happily connect your real identity when asked but a VPN provider that didn't log can honestly answer that they have no way to establish that.

At another level a vpn provider that doesn't operate in country can reliably refuse orders to surveil you in the future wherein orders don't rise to the level of obtaining international cooperation AND don't meet standards higher than the nonsensically low standards in say the US.

This wont be enough to protect your international criminal empire but might well provide reasonable assurance of privacy to concerned individuals. I'm sure the google one is good for something....

Perhaps keeping your ISP from chiding or blocking you for pirating music until that hole is plugged...or keeping people who access http websites over coffee shop wifi safe?

Yeah, I just use it so my employer can't see what websites I'm browsing

You should use a second cheap computer for that.

That would be impractical

I assumed people are mostly worried about Google being compelled to de-anonymize the traffic (for a government).

And they should be so worried, because of Google's apparent lack of respect for user privacy, which has them using, selling, or handing over data to whatever authorities and 3rd parties at anytime they were asked, feel like it, or could profit. From the history, trusting Google looks to be insanity.

https://www.datacenterdynamics.com/en/news/google-handed-ove...

https://www.forbes.com/sites/andygreenberg/2011/06/27/google...

https://www.theguardian.com/technology/2020/aug/17/google-gi...

https://www.dailystar.co.uk/tech/news/google-hand-over-video...

What does "9th-circle privacy adversary" mean?

Reference to Dante's Inferno and the 9th circle of hell. I believe it's away of saying "very very bad" advertisers here.

Reply on news.ycombinator.com