Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

181–190 of 666 posts

Re: NordVPN confirms it was hacked

#181

Post by KirinDave »

rocqua wrote: post #161
KirinDave wrote: post #139

Earlier quoted context omitted.

You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my…

It works for when you need to use untrusted WiFi, because the alternative is worse. Beyond that, it forms a nice defense against unsophisticated attackers. (e.g. it breaks a single datapoint (ip address) used by Google and FaceBook).

Is the alternative actually worse than SSL? Why?

And no, it doesn't break analytical by Facebook or Google in any substantial way. I know some people use them to evade Netflix region exceptions, and that's about all they're good for.

Re: NordVPN confirms it was hacked

#182

Post by leevlad »

chickenpotpie wrote: post #146
KirinDave wrote: post #139

Earlier quoted context omitted.

You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my…

I thinking about spinning up a Digital Ocean droplet and rolling my own right now

I'd keep in mind that cloud providers have well-known IP blocks that can sometimes be rate-limited by various internet sites/services, primarily to combat botting. You might inadvertently get caught in the IP range that's being actively rate limited by e.g. Instagram. YMMV.

Re: NordVPN confirms it was hacked

#183

Post by clinta »

thenewnewguy wrote: post #132
godelmachine wrote: post #103

This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand ). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government),…

But this buys you nothing in anonymity to the sites you visit. The IP you use to access the internet is still a single IP tied to you via a billing account with your cloud provider. A commercial VPN service NATs your connection out with thousands of other customers.

So it all depends on what you want to use the VPN for.

Re: NordVPN confirms it was hacked

#184

Post by threecheese »

_-___________-_ wrote: post #63
sauwan wrote: post #59

Earlier quoted context omitted.

Because it's easy to change a VPN provider if you don't like their actions, but most of us are stuck with an ISP and have no control over what they do with our data?

What exactly can they be doing with your data other than selling a list of which DNS queries you make and which IP addresses you connect to? (Which the VPN provider can also do.)

The ISP knows who you are and where you live; the VPN provider only knows your source IP address and information gleaned from your payment method (which in many cases can be "not much", as VPN providers support pseudo-anonymous payments).

Re: NordVPN confirms it was hacked

#186

Post by jen_h »

lijogdfljk wrote: post #151
thenewnewguy wrote: post #132

Earlier quoted context omitted.

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand ). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government),…

But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?

Some thoughts:

1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer.

2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time.

3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in).

4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them?

5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.

Re: NordVPN confirms it was hacked

#188

Post by pm7 »

tmikaeld wrote: post #93
FDSGSG wrote: post #82

Earlier quoted context omitted.

>It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. Good reminder to set up FDE and not give your host logins for your servers. Unexpected reboots are rare enough that they're worth switching hosts over.

For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.

I doubt serious VPN provider are using LXC/OpenVZ containers. They don't even work with OpenVPN without special setup from provider, I don't know how about other protocols.

Re: NordVPN confirms it was hacked

#189

Post by calimac »

rf15 wrote: post #113
godelmachine wrote: post #103

This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be named and shamed, not NVPN.

Users trust The VPN services expertise in managing all aspects of the network to be secure. Nord failed by not managing the provider relationship to the level of security they promise to their users in their marketing.

I'm not saying it could or could not have been prevented. It is a fact that they did NOT live up to their promise made to their client users.

There must be some independent certification of these VPN providers by some sort of industry association to restore confidence in this non-transperant product that promises protection.

Re: NordVPN confirms it was hacked

#190

Post by _-___________-_ »

bitxbitxbitcoin wrote: post #172
lijogdfljk wrote: post #101

Earlier quoted context omitted.

Well, you're funneling your traffic through a single entity in almost all cases , right? So I view it more as, who do I distrust more? My ISP or a VPN? I don't use a VPN provider, but it's tempting as I don't trust my ISP at all.

One very explicit reason to not trust your ISP with your internet traffic is that since 2017 [1], they are allowed by Congress to sell your internet history. As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2]. [1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is.

I've always assumed VPN providers sell whatever data they can too.

Post reply on HN