Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

251–260 of 666 posts

Re: NordVPN confirms it was hacked

#251

Post by derefr »

nvrspyx wrote: post #225
_-___________-_ wrote: post #190

Earlier quoted context omitted.

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is. I've always assumed VPN providers sell whatever data they can too.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing…

That’s what the parent said: they can still see “hostnames and IP addresses.”

But, for most people, that means that the ISP will just see:

• google.com

• facebook.com

• reddit.com

• somebignewspaper.example.com

Etc.

And there’s really nothing much too valuable about that. They won’t even be able to figure out if you’re shopping for something (unlike every other nosy channel provider), because most shopping traffic today just looks like Google + Amazon.

Re: NordVPN confirms it was hacked

#252

Post by [deleted] »

nvrspyx wrote: post #225
_-___________-_ wrote: post #190

Earlier quoted context omitted.

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is. I've always assumed VPN providers sell whatever data they can too.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing…

[deleted]

Re: NordVPN confirms it was hacked

#253

Post by seppin »

FillardMillmore wrote: post #201

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker…

> I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen

Which already means it's the least valuable.

Re: NordVPN confirms it was hacked

#254

Post by TallGuyShort »

nvrspyx wrote: post #225
_-___________-_ wrote: post #190

Earlier quoted context omitted.

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is. I've always assumed VPN providers sell whatever data they can too.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing…

You're correct - TLS / SSL operate above the IP layer, so they know which servers you're talking to, when and approximately how much, and if they can see your DNS requests it makes it that much easier to know which sites that maps to. TLS stops them from seeing the actual data you're sending them (like passwords), which pages you're viewing, and it also prevents them from manipulating the data (unless they've subverted the PKI, like if your company laptop has a certificate installed that trusts your company VPN, you company VPN can do a Man-in-the-middle attack to subvert TLS).

Re: NordVPN confirms it was hacked

#255

Post by octosphere »

_-___________-_ wrote: post #34

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

> Funneling all your Internet access through a single entity

You don't have to funnel it all, only data crossing hostile networks like free wifi hotspots (The only real use-case for VPNs in the first place). Alongside this is choice of geolocation so you can watch things like HBO even when in Europe.

Re: NordVPN confirms it was hacked

#256

Post by Spooky23 »

crazydoggers wrote: post #177
CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

The article is slightly more nuanced... know when and why to use VPN is more accurate. As mentioned near the end of that article, using known or suspected hostile networks, like public WiFi is a good reason to use VPN.

The problems addressed by avoiding a locally hostile network by connecting to another, globally hostile network is solving a very limited, nuanced set of problems.

Unless you're VPNing to your home or office, these public providers are just asking for trouble. They're too cheap to run well.

Re: NordVPN confirms it was hacked

#257

Post by jen_h »

thenewnewguy wrote: post #233
lijogdfljk wrote: post #151

Earlier quoted context omitted.

But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?

It's not like you're running a website on there - all you have to keep secure is SSH and your VPN. Keeping up to date with security updates and using a strong password (or better yet, private key) is essentially all you need to do. I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.

I've seen "infosec professionals" say they don't trust themselves to secure their own VPN server. It blows my mind...if you can't do that, why are you even in this business? How do you even use a personal computer?

Re: NordVPN confirms it was hacked

#258

Post by seaghost »

mdorazio wrote: post #5

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-...

Mullvad

Re: NordVPN confirms it was hacked

#259

Post by ultraism »

s_dev wrote: post #250
ultraism wrote: post #210

Earlier quoted context omitted.

> Because a VPN in this sense is just a glorified proxy. The VPN provider can see all your traffic, and do with it what they want - including logging. So can my ISP and they have been confirmed to sell customer data and work directly with NSA. https://en.wikipedia.org/wiki/Room_641A https://www.theguardian.com/business/2016/oct/25/att-secretl...

Pick a cloud provider you trust. I was thinking of moving from Digital Ocean (US) to Hetzner (German) and setting my own VPN up through a normal server.

Why are public cloud providers more trustworthy than VPN providers? Some VPN providers are sketchy but not all of them.

Re: NordVPN confirms it was hacked

#260

Post by FDSGSG »

tmikaeld wrote: post #93
FDSGSG wrote: post #82

Earlier quoted context omitted.

>It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. Good reminder to set up FDE and not give your host logins for your servers. Unexpected reboots are rare enough that they're worth switching hosts over.

For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.

>For dedicated servers this would work, especially for VPN where data-loss is "acceptable".

FWIW there's no need for data loss when you ditch the server, just download the encrypted data and decrypt using a clean environment elsewhere.

>But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.

You should never do this, unless you truly don't give a shit about whatever you have on the server.

Post reply on HN