With WireGuard, it is easy these days to setup a VPN on our own server(https://www.freecodecamp.org/news/how-to-set-up-a-vpn-server...). Obviously it won't give us anonymity, but it is a good choice for security when browsing from public wifi.
UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
151–160 of 240 posts
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#152Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#153Earlier quoted context omitted.
You can chain several unrelated VPN providers.
To elaborate on this a bit: * You only need two VPNs assuming you just want to protect against either of them linking your browsing history back to your identity and selling that information. * The second one must be paid for in a reasonably anonymous manner (ex Bitcoin) and only ever accessed via the first VPN in the chain. * You're fine to pay the first one in a more traditional manner. * The two providers must be…
This reminds me of chaining indials and outdials back in the POTS modem days. Operation Sundevil was certainly a motivated investigation.
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#154Earlier quoted context omitted.
The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.
FoxyProxy posted one of their Secret Service subpoenas along with their reply. TLDR; they said they have nothing to give: https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp... As for PrivateInternetAccesss / PIA, I would not trust them at all. No one knows who the founders and executives are. After speaking at length with an ex-employee of PIA who now maintains this open-source iOS VPN client, https://passe…
So the company is run by people who enjoy privacy? It seems weird to frame that alone as an argument against a company which deals in Virtual PRIVATE Networks.
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#155Earlier quoted context omitted.
Piggybacking off of this, Private Internet Access (PIA) has actually had their no logging policy "proven in court" via this method multiple times. [1][2] Full disclosure: I work at PIA. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/private-internet-access-no-logging-...
I wouldn't trust PIA for anything. The whole company is shrouded in secrecy. After speaking at length with an ex-employee of PIA who now maintains this open-source iOS VPN client: https://passepartoutvpn.app/ many (most?) employees and contractors at PIA have no idea of the identify of their direct managers. Imagine working for a company and not knowing your manager's real name. Now imagine trusting that company with…
Disgruntled employees aren't necessarily the least biased sources one can find
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#156Earlier quoted context omitted.
> That's actually not an entirely crazy idea if... Except that it gives them a direct avenue into your network for their own surveillance and other network attacks ... If you think comcast injecting their own JS into http pages is bad, wait you see what the d̶a̶r̶k̶ ̶a̶r̶m̶y̶ CPC could do with such power...
What's stopping any domestic TLAs from doing the same though?
Its more about trust. I trust them to try their best to be benevolent
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#157Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…
It's usually not intentional. It's common to either assume by default it will listen on 127.0.0.1 and connect to it. With cloud VMs, people spin up a VM for non-public use but check the box that adds a public IP and forget it's there. It's a design problem in my opinion. By default, listening on 0.0.0.0/0 should exclude loopback interfaces by the OS. That way, anything makig incorrect assumptions would fail and would…
Along this line, every Google Compute Engine VM instance comes with 2 “implied” rules: allow all egress and deny all ingress.
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#158Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…
What's the difference between a VPC and iptables? I agree that you shouldn't expose insecure services. But why do I need to introduce an entire private address space and cloud-managed SDN services to achieve that goal? If it weren't industry status quo, I'd almost call you a shill for the union of ops teams working to secure jobs for years to come. Almost.. (;
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#159Earlier quoted context omitted.
I second Mullvad also. They don't even have usernames, emails or passwords. All you use to log in is a random number for your account. Can't get much more anonymous than that. And they financially sponsor wireguard, have a bunch of wireguard servers. Can't recommend them enough.
I found Mullvad pitifully slow, even with Wireguard.
I get close to my native bandwidth (80-90 Mbps for a 100 Mbps connection) when using a local wireguard server.
Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]
#160Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…
Even doing the official Elastic training - Elasticsearch Engineer 1 gives you everything you need to hurt yourself to set up, use and admin a cluster, but no security is covered unless you sign up for the next course and pay another couple of thousand dollars. Security really should be covered as a default in EE1.
I'm a huge fan of beginner tutorials that include security as a default, rather than having it as the thing you do last - and then commonly in actual project work all the development gets done against an insecure cluster in dev, then someone turns security on at the end, it all breaks and you now have a group of stressed-out people only incentivized to remove the thing that is now delaying the project at the very last moment. Makes for some easy mental gymnastics.