Live data from Hacker News

UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

comparitech.com

111–120 of 240 posts

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#111

I wouldn't trust any VPN under China's sphere of influence.

That's actually not an entirely crazy idea if you're trying to hide from Western governments. Are you more worried about the Chinese government coming after you? Likewise, if someone in China is trying to hide from the Chinese government, it might not be a bad idea to use an USA based VPN. Maybe string up a bunch of VPNs in regions that are at least somewhat hostile to each other and it might be too hard to track an…

In some cases, a country will support criminal activity in an enemy country, in order to undermine the later. For example, al Qaeda has made a lot of money from trafficking heroin to Western markets – even though al Qaeda thinks drug use is sinful, it justified that as another way of waging war against the West (get enough Westerners addicted to heroin and maybe the West will collapse). And the North Korean government has been heavily involved in drug smuggling and currency counterfeiting – partly that is just to make money, but I'm sure they justify it to themselves by the harm it causes to what they view as enemy states. Indeed, during World War II, Nazi Germany used concentration camp slave labour to counterfeit massive quantities of British currency, in the hope that they could cause inflation and damage to the British economy. So a country might be happy to host a VPN to help criminals in its enemy country evade detection.

(I'm not suggesting China is doing anything like that right now. But, even if they are not, I wouldn't rule out the possibility that some day the China-West relationship might deteriorate to the point that it becomes something they might consider. )

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#112

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

FoxyProxy. Dedicated servers for each customer so speed is really good (at least for me). Video streaming sites are guaranteed not blocked. And here's US Secret Service subpoena for logs that was handled well:

https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#113

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

I generally trust Mozilla/Firefox and they just released a VPN. It is nice to be able to outsource my VPN research to them as well, since there aren’t many orgs I trust like that. It works well so far.

Im starting to trust Mozilla less since they discovered the camera in Firefox keeps recording even when you lock your phone and that they wont fix it until October....

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#114
post #51

VPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that). If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).

How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.

all of your traffic? Or just insecure DNS/HTTP requests?

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#115
post #60

Earlier quoted context omitted.

> I never understood why people working in tech would ever trust a VPN service? It’s not that I trust them but I’d rather some random company across the world has my jerk off logs rather than my ISP who hands my habits to my government and all its favoured cohorts.

For all you know, your government is running that VPN you’re using

> For all you know, your government is running that VPN you’re using

The NSA is simply not most people's threat model, and if they _are_ running it, it probably means that someone shadier is not. I'm using a VPN because I don't want my ISP to see what I'm browsing, don't want end sites to know who I am, want to watch American Netflix, and because the country I'm in tries to block all adult sites. The NSA is welcome to all of this traffic _shrug_

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#116

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

I'm not sure if that's better. You're just introducing more complexity in to your network..

If you don't have the budget for a nat/load balancer or want to just keep it simple, a simple iptables rule would do! Then test with nmap regularly to see if it's correct.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#117

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

I'm surprised nobody has mentioned airvpn yet. They're run by hacktivists and they're great. Mullvad is the other one with a good reputation, but everyone's mentioned that already.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#118

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

I use a registrar called Njalla[1] for many of my domain names and they are soon also launching a VPN option. They are privacy focused so they provide whois privacy, crypto payment and login via xmpp/e-mail only.

In their faq they state that they have previously worked on projects such as ThePirateBay... (this is a legit business and service though).

I hope I get to try their VPN soon. Other than that I usually just use a systemwide tor proxy. It's actually quite entertaining how my netflix feed randomly changes based on the current exit node.

[1]https://njal.la

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#119
post #74
post #51

Earlier quoted context omitted.

How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.

I trust VPN services for the one thing they're good and useful for: hopping over geo-fences for content. You should not have any expectation of privacy or security from consumer VPN services (if you want that, obtain Tor Browser or Tails as your needs require). They provide a means to choose roughly where your client traffic comes from, and that's it. The rest is marketing bullshit. They're probably sufficient for lo…

I also use my AWS free tier EC2 + wireguard for hopping over geo-fences. It is free, and my traffic is encrypted from my device to the remote EC2 server.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#120

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

People pay good money for your advice. Others ignore the free advice.
Post reply on HN