Hacker News Reader

Comment by nerdsniper | Hacker News Reader

Note that all of these companies are also under the umbrella of Tesonet, a Lithuanian VC firm also headed by Tomas Okmanas (Tom Okman in TFA). Their flagship investments are Nord Security, Hostinger, Oxylabs, Surfshark, Decodo, Mediatech, and nexos.ai - all closely related business models around proxying.

They don't seem to have Russian ties: "In 2022, CyberCare opened an office in Lviv, Ukraine. Although planning for the move started before the war, according to Dainius Vanagas, CEO of CyberCare, one of the reasons why it was followed through was a desire to help Ukraine rebuild."[0]

They also donated money to help arm Ukraine.

0: https://en.wikipedia.org/wiki/Tesonet

View on HN

Don't forget ProtonVPN links to Tesonet, which they're trying hard to "debunk" (though no clue why, I have nothing against Tesonet). They only shared employees and accidentally signed apps with the same certificates, but are "totally unrelated". Their PR people are already on this thread.

If they didn't try so hard to fight it, people might care less.

"Links to" is doing a lot of work in that sentence. ProtonVPN is owned by Proton, which has no legal ownership ties with Tesonet. During Proton's expansion into Eastern Europe, Tesonet initially assisted Proton with HR, payroll, and local regulation, so for a period of time, people working for Proton were employed by Tesonet, since Proton had no local subsidiary that could hire them. These were not "shared employees", they worked exclusively for Proton.

In 2016, Proton created its own subsidiary, and these people are now employed by Proton. But for this historical reason, the ProtonVPN keystore on Android still lists Tesonet as the organization name, even though it is fully controlled by Proton.

None of this is "debunking"; these are just the facts. You can make of them what you will, but you should be honest about what actually happened when you talk about it.

> Tesonet initially assisted Proton with HR, payroll, and local regulation

Entirely normal behaviour for a competitor to provide “HR assistance”.

I've been part of a European startup that added offices in Asia and the US, and we initially always partnered with local companies to do this. It's mutually beneficial. It allowed us to grow more quickly, and it allowed them to make relatively easy money (and, in our case, to dump some of their shittier employees on us without us knowing).

In Proton's case, they already knew each other because Tesonet had previously offered to provide infrastructure during a DDoS attack against Proton.

So maybe it's a conspiracy, or maybe it's just how things go. You can make up your own mind, but you should provide the facts when you make sinister insinuations.

You know an awful lot of detail about the inner workings of two separate private companies though.

Is it really that shocking that someone on HN would have worked at as many as 2 private companies?

Nor is it shocking that a company with a PR issue would be astroturfing our forum.

The point is: we don't know.

I would assume that if they were astroturfing, they would be smart enough to use more than one account. Given that, I'm inclined to believe that you are part of an astroturfing campaign.

The summary is: if you use someone’s VPN, Tor, etc. you’re just setting yourself up. There is no privacy, and if you act like you want privacy, they’re going to pay more attention to you.

That's what they want you to think.

LOL, now I'm part of the conspiracy. This is all public knowledge.

Then you could provide sources, please?

Here you go: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

Here's the Handelsregisterauszug for Proton, which shows ownership: https://www.zefix.admin.ch/en/search/entity/list/firm/118926...

Proton's peering relationships: https://bgp.tools/as/62371#asinfo

I'm not sure what exactly you're looking for.

> Here's the Handelsregisterauszug for Proton, which shows ownership

It doesn‘t. It’s a joint-stock corporation and while the shareholders are registered, the register is not public.

Proton discloses shareholder information here: https://proton.me/support/who-owns-protonmail

But I guess they could be lying.

Them providing information isn't the same as publicly verifiable information.

> "Links to" is doing a lot of work in that sentence.

How? it is obvious.

> During Proton's expansion into Eastern Europe, Tesonet initially assisted Proton with HR, payroll, and local regulation, so for a period of time, people working for Proton were employed by Tesonet, since Proton had no local subsidiary that could hire them. These were not "shared employees", they worked exclusively for Proton.

So basically same people managed teams, same people paid the employes, but my "Links to" is doing heavy lifting and in the previous sentence you say "ProtonVPN is owned by Proton, which has no legal ownership ties with Tesonet."? Who is doing the heavy lifting here?

How much is Tesonet or Proton paying you to post in here?

> How much is Tesonet or Proton paying you to post in here?

Sadly, they're not paying me anything, but I would suggest that any belief system in which information contradictory to your belief reinforces your belief is inherently problematic.

So how much is Nord paying you to post here?

> so for a period of time, people working for Proton were employed by Tesonet, since Proton had no local subsidiary that could hire them. These were not "shared employees", they worked exclusively for Proton. In 2016, Proton created its own subsidiary, and these people are now employed by Proton. But for this historical reason, the ProtonVPN keystore on Android still lists Tesonet as the organization name, even though it is fully controlled by Proton.

So either:

1. Tesonet/Nord are loose with their private keys.

2. Proton isn’t being truthful.

Anyone who understands crypto and key management knows “not your keys, not your _____.”

If those staffers worked for Proton and not Nord, why did they have Nord’s key?

This level of negligence with private key management really can’t be explained away.

Proton explains this here:

https://redlib.catsarch.com/r/ProtonVPN/comments/8ww4h2/prot...

I suppose you're free not to believe them, but I'm unsure what exactly you believe is happening here and what exactly Proton is lying about. Tesonet secretly owns them and has been running a decades-long misinformation campaign to trick you into thinking they don't? To what end? It's not like Tesonet is some nefarious company we should all be afraid of. What would they gain from lying about this if it were true?

And how can they make such an obvious mistake with their certs and then not make another one for the next decade? It's just not plausible.

At some point, you've gotta use some common sense.

My comment still applies regardless of any level of “explaining” [1]:

1. Either Nord/Teso are loose with keys (horrible)

2. Proton isn’t being truthful.

I don’t think it’s a conspiracy or anything that it is Tesonet/Nord. Rather, the problem is you cannot trust someone with your privacy if they can’t even manage their own keys.

[1] The explanation is poor at best and doesn’t explain why they worked so hard to try to delete all of the evidence (all of which was archived already). Additionally, nothing can explain away the lack of security with key management across these two orgs.

The people who couldn't handle their keys were at Nord. The people you trust are at Proton.

> worked so hard to try to delete all of the evidence

The cert is still there. Apparently, they didn't work nearly hard enough.

They worked pretty hard as detailed in an archived article changing names and any records they could [1], but you're right - not good enough [2].

As pointed out on this reddit post [3], Proton's appears to contradict itself a number of times.

It's a good thing trust based VPN's are obsolete. After all, trust isn't constant [4] as seen in this article showing how Proton supplied IP addresses to "authorities."

[1] https://archive.ph/wG8t8

[2] https://archive.ph/4bzBm

[3] https://www.reddit.com/r/technology/comments/8x9aik/protonvp...

[4] https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

> Created by supposed MIT and CERN scientists

This is a hilarious way to start an ostensibly serious investigation. It's not as if you could easily figure out the answer to that.

At some point, you have to acknowledge that you're a clown.

Did they sign things with the wrong keys?

Back when I was running PIA, they threatened me a significant amount just for pointing these facts out.

Now that I launched a verifiable VPN, they are once again sending legal threats [1].

[1] https://vp.net/l/en-US/blog/Verified-Privacy-vs-Trust

The same PIA which is now part of Kape Technologies which under its former name of Crossrider was known for malware?

https://cyberinsider.com/private-internet-access-kape-crossr...

If you cant trust VPNs sold to dodgy Israeli spyware firms who can you trust?

Freenode, never forget.

what makes your vpn verifiable? can i verify you run specific oss on your servers? secure enclave is just management's idea of implementing crypto. everyone out here knows that it is highly flawed and intel with their management engine bullshit can't be trusted at all.

You might find this helpful: https://youtu.be/sz7NAe0G1_Y?si=focPEWli8xv7NCDi

Re verifiability: the point isn’t trust us, it’s that you don’t have to.

We built it so anyone can independently confirm what’s running.

1. All server and client code is published.

2. Builds are reproducible.

3. Each node provides cryptographic attestations of its runtime and routing identity.

4. Enclaves are used for verifiable isolation.

You can peruse the code yourself to see exactly why the transparency we bring makes legacy “trust based” VPNs obsolete: https://github.com/vpdotnet/vpnetd-sgx

It looks like this boils down to 'check the magic number in the code against the magic number our server gives you. It matches!!!'

Is there some indication the user has that your server isn't simply hard coded to return the right magic number? I don't understand how this provides any assurance of anything.

The SGX certificate is signed by intel and includes a certification of the hash of the code loaded in the secure enclave ("MRENCLAVE").

When the client connects to the server, the server presents a tls certificate that includes an attestation (with OID 1.3.6.1.4.1.311.105.1) which certifies a number of things:

- the TLS certificate's own public key (to make sure the connection is secure) - The enclave hash

It is signed by Intel with a chain of custody going to intel's CA root. It's not "just a magic number" but "a magic number certified by Intel", of course it's up to you to choose to trust Intel or not, but it goes a much longer way than any other VPN.

So did you sell pia? Why won’t you sell your next venture ?

I did not sell PIA. I entered into a merger agreement to create a publicly owned privacy company. Without getting into detail, I left the company on principle receiving only 1/3rd of the value for the shares.

Btw I used to love pia, I think I’ll check your new one out!

Used to love? What changed? PIA hasn't always had the best performance but they are on the list of VPNs who were subpoenaed and had no data to give the court.

my $.02 : I tried them, but found their "we support Wireguard" a bit misleading. They only did so via their app. No way to get a stable configuration for a router (other than run a python script to get one from the app, without any guarantee how long is that config valid for).

But that has not happened since PIA was acquired by Kape. All that proves is that the previous owner was trustworthy.

But, that happened since they were acquired by Kape. All that proves is the previous owner was trustworthy.

Why?

"Without getting into detail"

There is no mention of proton whatsoever, even more sending legal threats to your vpn, in the link though?

Ah yes, the King of Joseon Cybernation is a trustworthy source.

Proton are pretty shady. The Radware ties, the blocking of two journalists, etc. etc.

For anyone else who wondered what the radware thing was.

https://proton.me/support/protonmail-israel-radware

How much did proton pay you to post that link again?

The streisend effect. Although, personally I am interested in this topic, as everyone using these VPNs is one ToU change away from being data mined at all time.

I used to work at Tesonet (as software engineer) and I'm not familiar with corporate politics / ownerships but they're lovely people that would 100% walk out if there were some real Russian ties involved.

Lithuania is a really small country and IT has been a huge economic strategy since early 00s as a way to become economically independent specifically because of Russia and it worked out really well.

I have a good friend from Lithuania, who has told me so many amazing/wonderful/superlative things about the country he grew up in and loves very dearly, as well as its people. I can't wait to visit someday. Unfortunately, he only has Russian and American citizenship, so he can't purchase real estate there currently, but luckily most of Lithuania's restrictions have been very common-sense (applying only to people who frequently travel between Russia and Lithuania).

From what I can tell, Tesonet seems like a very patriotic group (as much as a corporation can be personified at all), and genuinely puts resources, both human and financial, towards raising up the local communities.

It's interesting to me that Tesonet has concentrated the most popular VPNs under one roof and is involved in so many companies that could be described as "dual-use" (white hat/black hat) such as residential/mobile proxies, ai-powered scraping, etc. It tells me that Tesonet has a very sharp understanding of gray-hat landscapes. It does seem like their portfolio could be leveraged as a valuable asset to any powerful interest, regardless if they are benevolent or malicious or misguided.

I mentioned Tesonet's stance towards Ukraine because Lithuania has a number of wealthy ex-soviet/Russian citizens and business-owners with differing politics, and wanted to clarify that for any readers who might wonder.

Additionally, I've always been very impressed with Estonia's digital infrastructure and Ukrainian software engineering - not just JetBrains but also other vendors that I've worked with personally. Seems like there are a lot of highly skilled people concentrated in your region.

I couldn't really get that segue from Lithuania to Estonia. Did you mean to type "Lithuania" in the last paragraph as well?

Here..

> Additionally, I've always been very impressed with Estonia's …

Before that you were talking about Lithuania exclusively.

And then:

> … Estonia's digital infrastructure and Ukrainian software engineering - not just JetBrains …

I think it was founded in CZ and is now HQed in NL. Right?

A typo? Or there's some relation between the two countries and whether JetBrains has some history with these two that is missing here?

(I am not trying to nitpick, really interested in knowing whether there's some angle/twist here, since the post itself is about hidden connections and what not).

> (I am not trying to nitpick, really interested in knowing whether there's some angle/twist here, since the post itself is about hidden connections and what not).

Honestly that shone through even from the first sentence.

I mentioned Estonia because Lithuania/Latvia/Estonia have a bit of shared identity, kind of similar to Sweden/Norway/Finland or USA/Canada.

> I think it was founded in CZ and is now HQed in NL. Right?

Yes I was just wrong. I was convinced it was Ukrainian for some reason.

I agree that the combination of those two points made my post particularly confusing.

JetBrains was russian (as in were most people initially actually worked). They were smart enough (like any business in russia not wanting to be trapped) to have registration outside of the country.

Some part of management were in CZ. Most of the technical team were in three buildings in St.Petersburg.

Wow. Didn’t know. As an Android developer I find it specially interesting. Not for any nefarious reasons, for I so far believe that JetBrains is one of those companies that has been a net positive on tech ecosystem in general (touchwood!) — be their dev tools or the Kotlin itself. I also follow these people and tools, partly out of professional needs/curiosities.

FYI Kotlin language is named after https://en.wikipedia.org/wiki/Kotlin_Island

Aha. I see that it was also called "Kotling". I guess they missed this opportunity, or maybe KotLang, in which case people would have started calling it just Kot.

Also the place seems to have quite a few rebellions under its belt.

They're neighboring small countries with similar (centuries' long) histories of tension with Russia, in its various guises. They're often considered en bloc:

https://en.wikipedia.org/wiki/Baltic_states

> most of Lithuania's restrictions have been very common-sense (applying only to people who frequently travel between Russia and Lithuania).

Common-sense like a complete ban for entering the country for red passport holders.

Lithuania is a wonderful, beautiful country and I understand the need to push the hardliner stance in the EU, but their decisions during the conflict have been strictly political, not in the slightest "common-sense".

Isn't Lithuanian passport red ? or the context here is communism ?

Turns out it's indeed red, but it's been green for a long time.

Context here is Russian Federation.

Calling Tesonet a VC firm isn't really an accurate description of their history. They started as an IT services company (which they still do), then split out internal services into effectively separate companies (e.g. CyberCare was originally built to manage customer support for NordVPN).

Now they have got more money than they know what to do with so are making VC investments.

"all of these companies" are you sure? Did you check the VPN relationships diagram that is within the article? Tesonet is listed and linked.

After seeing the front end and the tiniest bit of backend on CrowdStrike and why they’re in Ukraine… I wouldn’t say any company with offices there makes me feel at ease. It’s not better.

Reply on news.ycombinator.com