NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#31

Post by swiley » Mon, Oct 21, 2019, 2:08 PM UTC

ganoushoreilly wrote: post #19

tmikaeld wrote: post #10

It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. - Did the hackers use an SSH or a VPN service vulnerability? - Or maybe even a previously unknown vulnerability? - Was SSH access firewalled? If not, why? - Do they still have root access?

A lot of them shared physical infrastructure definitely less odd that multiple were breached at same time.

I was just thinking yesterday that people might be overly paranoid about that, I’ve always agreed that if security were important you shouldn’t share space but lately I’ve begun to question it since a lot of these data centers are pretty carefully controlled.

I’m glad I didn’t speak my mind on that I guess since I was wrong.

Re: NordVPN confirms it was hacked

#32

Post by SEJeff » Mon, Oct 21, 2019, 2:08 PM UTC

mdorazio wrote: post #5

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-...

ProtonVPN comes from the same people who run ProtonMail, a very well known security focused email provider.

Re: NordVPN confirms it was hacked

#33

Post by tokai » Mon, Oct 21, 2019, 2:12 PM UTC

Mirioron wrote: post #13

Sir_Cmpwn wrote: post #4

NordVPN is being recommended a lot to people who don't know better by influencers on social media, especially on YouTube. This kind of endorsement is recklessly negligent and needs to stop. https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-cho... Edit: note that I don't blame these influencers for their ignorance on the risks of using a VPN; rather I blame the shady VPN providers for overselling the security v…

I'm pretty sure they're "recommending" it because they're getting paid for it - it's a sponsor segment. After demonetization became common YouTubers looked for other sources of revenue and there are rather few companies that try to contact them directly for ads, so you see them appear over and over again.

Yeah it's diffidently not being recommended, it is being advertised. I wonder how many money they have spend. Every freaking channel mention them at some point.

Re: NordVPN confirms it was hacked

#34

Post by _-___________-_ » Mon, Oct 21, 2019, 2:13 PM UTC

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

Re: NordVPN confirms it was hacked

#35

Post by elliekelly » Mon, Oct 21, 2019, 2:13 PM UTC

clSTophEjUdRanu wrote: post #7

I like Mullvad

I’ll second this. They also allow you to pay in cash which I think is an aspect of privacy that a lot of VPNs overlook.

Re: NordVPN confirms it was hacked

#36

Post by Bartweiss » Mon, Oct 21, 2019, 2:14 PM UTC

donkeyd wrote: post #6

ngcc_hk wrote: post #2

Wow. Just switch per advice of lihkg! How serious? Seems all tech talk but not impact talk

> How serious? From my understanding, that really depends what you're using it for. My friends mostly use Nord to get around region locks for Netflix etc. I think impact for them is minimal. If you were using NordVPN in Hong Kong, to cover your involvement in the protests, then it could be a lot more serious. I wouldn't use Nord (or any comparable provider) for that anyway, since their holdings tend to be pretty opaq…

I see the Twitter thread mentions:

> And someone just mentioned to me that past encrypted sessions may be able to be decrypted, which is a much bigger issue!...I haven't researched enough about OpenVPN to know if it's using forward secrecy, though you'd hope so

Any idea where that claim is coming from? Nord's site mentions having forward secrecy in place, so presumably most historical stuff is safe unless they botched that. Of course, somebody in e.g. Hong Kong could still have gotten a MitM attack if they were active while these keys were being used, which is reason enough to worry about exposure.

Re: NordVPN confirms it was hacked

#37

Post by harikb » Mon, Oct 21, 2019, 2:16 PM UTC

mdorazio wrote: post #5

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-...

I am surprised why isn’t anyone suggesting Cloudflare’s Warp VPN? Genuinely curious what is the difference. I guess Clodflare one is only for mobile?

Re: NordVPN confirms it was hacked

#38

Post by rasengan » Mon, Oct 21, 2019, 2:17 PM UTC

sudoaza wrote: post #26

More worrisome is that this may allow old cptures to be decrypted, anyone know of VPN providers that use PFS?

Private Internet Access is PFS (using DHE - Diffie Hellman Ephemeral).

Re: NordVPN confirms it was hacked

#39

Post by Santosh83 » Mon, Oct 21, 2019, 2:18 PM UTC

harikb wrote: post #37

mdorazio wrote: post #5

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-...

I am surprised why isn’t anyone suggesting Cloudflare’s Warp VPN? Genuinely curious what is the difference. I guess Clodflare one is only for mobile?

Cloudflare's Warp is not an anonymising VPN as far as I know. It is just a way to speed up Internet speeds, especially in poorly connected areas. They make no effort to hide the origin IP. So it is not in the same class as other VPN providers.

Re: NordVPN confirms it was hacked

#40

Post by roter » Mon, Oct 21, 2019, 2:18 PM UTC

justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

If you already have a DigitalOcean droplet up and running and you have ssh access, you can use sshuttle [0].

e.g. run this from the command line:

  sshuttle -r example.com 0/0 -x example.com --dns

[0] https://github.com/sshuttle/sshuttle