Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

comparitech.com

Post reply on HN
Print view View original

31–40 of 240 posts

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#31

Post by rmrfrmrf »

rthomas6 wrote: post #25
nullc wrote: post #16

Earlier quoted context omitted.

No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it. Public VPN services have to be the one of the greatest lemon markets to have ever existed: You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get. People realize this, so you end up getting a disproportionate n…

How does that help? If you're the only one with traffic from that IP, how does that give any privacy? Especially if you pay with something tied to your identity. And why does a VPS have any less likelihood of logging your traffic?

it's good for things like public wifi and other untrusted networks since your data is encrypted from your machine to the vpn server

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#32

Post by novok »

I've come to the sad realization if you want anything approaching no logs, you're going to have to use something slow like tor, or you're going to have to do the illegal thing and make a botnet.

VPNs are only useful for avoiding ISP / local network surveillance like comcast, your workplace, your school, airports, etc and to avoid DCMA scare letters. Making your own with a VPS is worse, since VPSs log on some level and directly forward the DCMA scare letters to you.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#33

Post by nullc »

rthomas6 wrote: post #25
nullc wrote: post #16

Earlier quoted context omitted.

No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it. Public VPN services have to be the one of the greatest lemon markets to have ever existed: You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get. People realize this, so you end up getting a disproportionate n…

How does that help? If you're the only one with traffic from that IP, how does that give any privacy? Especially if you pay with something tied to your identity. And why does a VPS have any less likelihood of logging your traffic?

> Especially if you pay with something tied to your identity.

Then don't do that.

Though VPN are not really a strong solution for hiding your identity period. Tor is a more effective tool, but hiding your identity is extremely difficult to do effectively.

> And why does a VPS have any less likelihood of logging your traffic?

They may be too but at least you should expect their business to be viable without doing that, which is better than you can say for VPN services.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#34

Post by gruez »

nullc wrote: post #16
orliesaurus wrote: post #14

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it. Public VPN services have to be the one of the greatest lemon markets to have ever existed: You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get. People realize this, so you end up getting a disproportionate n…

>You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

The amount of "private data" as a VPN operator isn't a lot. Most sites nowadays are https, so at best you're getting browsing habits on a per-site basis. On the other hand, using a commercial VPN does confer advantages in some cases:

* geo restrictions: commercial vpn have servers in multiple countries, so you can easily switch to one that works. you can achieve the same with cloud servers, but you'll have manually spin them up/down, which isn't convenient

* anonymity: commercial vpns usually have dozens/hundreds of users on one server. You can also switch servers/regions to increase your anonymity set further. This is a much bigger anonymity set than your own private server, which is linked solely to you.

* bandwidth: if you're a heavy traffic user, you'll probably end up paying more. most cloud providers only give you around 0.5TB for a cheap server (within the price of a vpn subscription)

* DMCA/abuse: they handle the DMCA/abuse letters for you. With a self hosted server you'll have to at the very least respond to the ticket they sent otherwise they'll take down your server.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#35

Post by messe »

hangonhn wrote: post #17
grensley wrote: post #11

I wouldn't trust any VPN under China's sphere of influence.

That's actually not an entirely crazy idea if you're trying to hide from Western governments. Are you more worried about the Chinese government coming after you? Likewise, if someone in China is trying to hide from the Chinese government, it might not be a bad idea to use an USA based VPN. Maybe string up a bunch of VPNs in regions that are at least somewhat hostile to each other and it might be too hard to track an…

Exactly. One really needs to consider their threat model when deciding on a VPN provider. A perfect system isn't always possible.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#36

Post by StanislavPetrov »

novok wrote: post #32

I've come to the sad realization if you want anything approaching no logs, you're going to have to use something slow like tor, or you're going to have to do the illegal thing and make a botnet. VPNs are only useful for avoiding ISP / local network surveillance like comcast, your workplace, your school, airports, etc and to avoid DCMA scare letters. Making your own with a VPS is worse, since VPSs log on some level an…

They are also very useful for circumnavigating geolocation restrictions.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#37

Post by netsec_burn »

orliesaurus wrote: post #14

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

SwissVPN. Without going into detail, I'm aware how they respond to all kinds of information requests due to my previous type of work. That earned my business.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#38

Post by grensley »

hangonhn wrote: post #17
grensley wrote: post #11

I wouldn't trust any VPN under China's sphere of influence.

That's actually not an entirely crazy idea if you're trying to hide from Western governments. Are you more worried about the Chinese government coming after you? Likewise, if someone in China is trying to hide from the Chinese government, it might not be a bad idea to use an USA based VPN. Maybe string up a bunch of VPNs in regions that are at least somewhat hostile to each other and it might be too hard to track an…

Yeah, it's like banking. You want it to be in a neutral country whose government has come to a clear understanding with the industry.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#39

Post by tintor »

tremon wrote: post #6
notyourwork wrote: post #2

The old saying trust but verify always seems to come up. Companies claim x and we find it to be untrue. They apologize, share statement they will do better and the cycle continues. Is anyone else tired of the tomfoolery?

Do you have a suggestion on how to verify the claims of a company you only interact with over the Internet? (edit: not that I disagree with you, I honestly don't see a practical way to do that. It's not like security seals have proven their worth in pixels either)

Solution is "credit score"-like system evaluating companies, and keeping track of incidents like these.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#40

Post by mindslight »

nullc wrote: post #30
mindslight wrote: post #20

Earlier quoted context omitted.

Your proposed alternative does not address the threat model that most people have when looking for a "VPN".

The threat model you're referring to is, I assume, mostly DMCA warnings. (As in: You want your service to not get disconnected in response to them) It does address it, when you factor in an appropriate choice of non-US VPS provider.

Not just DMCA warnings, but full extortionary lawsuits. From what I can tell, these exist in most countries. Jurisdiction hopping won't protect you from a determined attacker.

Most VPS providers generally insist on recording your identity, probably with government ID, to limit abuse that would otherwise fall onto them. Whereas VPN providers have already made the choice to weather mild abuse complaints.

I have looked into bulletproof VPS providers. They're drastic overkill, expensive, and getting in bed with the wrong sorts of people.

Post reply on HN