Hacker News Reader

Hacker News

Comment by rasengan | Hacker News Reader

Parent Full thread

rasengan

Back when I was running PIA, they threatened me a significant amount just for pointing these facts out.

Now that I launched a verifiable VPN, they are once again sending legal threats [1].

[1] https://vp.net/l/en-US/blog/Verified-Privacy-vs-Trust

View on HN

The same PIA which is now part of Kape Technologies which under its former name of Crossrider was known for malware?

https://cyberinsider.com/private-internet-access-kape-crossr...

If you cant trust VPNs sold to dodgy Israeli spyware firms who can you trust?

Freenode, never forget.

what makes your vpn verifiable? can i verify you run specific oss on your servers? secure enclave is just management's idea of implementing crypto. everyone out here knows that it is highly flawed and intel with their management engine bullshit can't be trusted at all.

You might find this helpful: https://youtu.be/sz7NAe0G1_Y?si=focPEWli8xv7NCDi

Re verifiability: the point isn’t trust us, it’s that you don’t have to.

We built it so anyone can independently confirm what’s running.

1. All server and client code is published.

2. Builds are reproducible.

3. Each node provides cryptographic attestations of its runtime and routing identity.

4. Enclaves are used for verifiable isolation.

You can peruse the code yourself to see exactly why the transparency we bring makes legacy “trust based” VPNs obsolete: https://github.com/vpdotnet/vpnetd-sgx

It looks like this boils down to 'check the magic number in the code against the magic number our server gives you. It matches!!!'

Is there some indication the user has that your server isn't simply hard coded to return the right magic number? I don't understand how this provides any assurance of anything.

The SGX certificate is signed by intel and includes a certification of the hash of the code loaded in the secure enclave ("MRENCLAVE").

When the client connects to the server, the server presents a tls certificate that includes an attestation (with OID 1.3.6.1.4.1.311.105.1) which certifies a number of things:

- the TLS certificate's own public key (to make sure the connection is secure) - The enclave hash

It is signed by Intel with a chain of custody going to intel's CA root. It's not "just a magic number" but "a magic number certified by Intel", of course it's up to you to choose to trust Intel or not, but it goes a much longer way than any other VPN.

So did you sell pia? Why won’t you sell your next venture ?

I did not sell PIA. I entered into a merger agreement to create a publicly owned privacy company. Without getting into detail, I left the company on principle receiving only 1/3rd of the value for the shares.

Btw I used to love pia, I think I’ll check your new one out!

Used to love? What changed? PIA hasn't always had the best performance but they are on the list of VPNs who were subpoenaed and had no data to give the court.

my $.02 : I tried them, but found their "we support Wireguard" a bit misleading. They only did so via their app. No way to get a stable configuration for a router (other than run a python script to get one from the app, without any guarantee how long is that config valid for).

But, that happened since they were acquired by Kape. All that proves is the previous owner was trustworthy.

But that has not happened since PIA was acquired by Kape. All that proves is that the previous owner was trustworthy.

Why?

"Without getting into detail"

There is no mention of proton whatsoever, even more sending legal threats to your vpn, in the link though?

Ah yes, the King of Joseon Cybernation is a trustworthy source.

Reply on news.ycombinator.com