Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy and Security Risks of Android VPN Permission-enabled Apps

blog.csiro.au

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#41

Post by laumars »

leni536 wrote: post #35
laumars wrote: post #32

Earlier quoted context omitted.

The problem with personal VPN services is that it can be pretty trivial to reverse who the traffic is coming from (eg by requesting the billing address from the VM hosting provider). This may not be an issue for some people and for those who it is an issue, there are ways around it (I'll leave that part of the post for someone more experienced than I as I don't want to risk giving out bad advice). But it's worth bari…

And your VM hosting provider can still MITM you.

I think that's pretty unlikely to be honest - or at least easily avoided. There's enough reputable hosting providers out there (Amazon, Google, Microsoft, OVH, Digital Ocean, etc etc) that there isn't really any excuse for signing up with a provider who does MITM your VMs traffic.

That all said, I'm not excluding the possibility of providers logging network connections passively. The way around that is to run more than one VPN; that way any particular provider only has visibility of either the destinations but not the source, or the source but not the destinations. I'm not recommending that people need or should run two VPNs though - just adding it as a workaround against passive snooping by hosting providers.

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#42

Post by mirimir »

gog wrote: post #26
mirimir wrote: post #10

Earlier quoted context omitted.

There's also " rel="nofollow">https://thatoneprivacysite.net/vpn-comparison-chart/> . And my testing of ~30 VPN services " rel="nofollow">https://vpntesting.info/> .

You links are not clickable.

Thanks. I forgot that HN doesn't like .

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#43

Post by akjainaj »

>Only less than 1% of the negative re- views relate to security and privacy concerns, including the use of abusive or dubious permission requests and fraudulent activity, for the 9 apps listed in Table 7.

Of course. People don't install these VPN apps because they want their traffic to be "secure" or "private". They install them because they want to bypass geographical restrictions for content.

Nobody cares about traffic being insecure, or ads being injected in pages--users just want to see that geolocked video and get on with it.

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#45

Post by Piskvorrr »

shakna wrote: post #6
DrScump wrote: post #5

Earlier quoted context omitted.

What about the new VPN feature built into Opera Browser?

It's not a VPN, it's a proxy. [0] [0] https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd...

Marketed as a "VPN".

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#46

Post by Piskvorrr »

wfunction wrote: post #15
exclusiv wrote: post #11

Why would you need a third party app on Android? I just use the native VPN support over ipsec. Or are people using them for older Android installs?

> Why would you need a third party app on Android? Because the consensus seems to be that if you use any VPN besides OpenVPN you're a moron, and therefore some build-in solutions for some OSes only support OpenVPN.

Now I'm all confused. Let me check the built-in support for OpenVPN: Windows - nope. Android - nope. Linux - nope. iOS - nope. OS X - nope. The consensus you are referring to seems to be quite imaginary - or I'm missing something. What is it?

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#47

Post by throwanem »

exclusiv wrote: post #11

Why would you need a third party app on Android? I just use the native VPN support over ipsec. Or are people using them for older Android installs?

In my case, it's because I've found IPSec considerably more of a pain to set up and maintain than OpenVPN, which iOS doesn't natively support. (I don't think Android does, either.)

In the general case, it's because most folks don't have the knowledge and skill required to set up either - nor should they have to.

With the increasing adoption of IoT devices and their generally crap (but not actively malicious) security, it would seem like a no-brainer for ISPs to offer VPN capability on the CPE as part of the basic service package, with UPnP configured to expose on the VPN interface rather than the public one, and with dynamic name resolution included to make configuration an easy one-time process. It'd help with customer retention, I think, and it'd surely improve network stability and throughput by reducing the quantity of attack traffic.

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#48

Post by chatmasta »

scandox wrote: post #31

Slightly off topic, but I'd be interested while I have the VPN people here to hear opinions about Softether. I've been using it for a while and like it. But I can't get much independent information about it from a security point of view.

I once looked extensively into Softether. It's the work of a Japanese professor and his lab. It's over a million lines of code because squeezes different VPN protocols into one server. IIRC it might even require some binaries as a prerequisite to installation. Nobody has ever audited its source code (how could they? it's million+ lines), and it has not popular long enough to have faced serious scrutiny.

I would assume it to be insecure against a motivated attacker.

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#49

Post by throwanem »

gog wrote: post #25
_23sd wrote: post #8

Earlier quoted context omitted.

TorrentFreak maintains a list of providers that responded to a questionnaire about anonymity, including one about encryption used: https://torrentfreak.com/vpn-anonymous-review-160220/ Personally, I prefer the "roll your own" approach mentioned above. A VPS from DigitalOcean or something beats most providers' pricing.

There is no anonymity if you roll your own. The whole idea of VPN providers is that a lot of users have a connection to the same server so it's hard to monitor who talks to who.

Perhaps you're confusing VPNs with Tor. The latter seeks to provide anonymity; the former protects traffic traveling over a potentially untrustworthy network. Sure, a lot of folks seem to use VPNs lately as just a proxy to bypass geoblocking or whatever, and that works if the upstream endpoint is in the right place - but that's no reason to get confused about what the tool under discussion actually is able to do.

Re: Privacy and Security Risks of Android VPN Permission-enabled Apps

#50

Post by kebolio »

Many I know who have recently started using these free VPNs only do so to skirt content filtering on free wireless networks. They do not have any expectation of security or privacy and are not conscious of the possibility of their traffic being collected or inspected by a rogue third party.
Post reply on HN