Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

comparitech.com

Post reply on HN
Print view View original

161–170 of 240 posts

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#161

Post by Causality1 »

bitxbitxbitcoin wrote: post #83
Causality1 wrote: post #62

Earlier quoted context omitted.

The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.

Piggybacking off of this, Private Internet Access (PIA) has actually had their no logging policy "proven in court" via this method multiple times. [1][2] Full disclosure: I work at PIA. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/private-internet-access-no-logging-...

Has PIA solved that issue a lot of providers have where services like Google voice recognition just fail to work better than half the time? I presently use AirVPN to bypass my carrier's video streaming limits but barely being able to use Assistant is a pain.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#162

Post by Causality1 »

pbhjpbhj wrote: post #85
Causality1 wrote: post #62

Earlier quoted context omitted.

The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.

So a VPN provider needs to do something to get a police investigation, prove they're clean (not logging) and you're good to go. Unless ... could be First for Business Internet VPN services ... ;o)

If I actually intended to do something illegal over a VPN, then yeah. Not really my style though. I prefer a dedicated, clean laptop, a large antenna, and a public hotspot for my torrenting.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#163

Post by kevinkeller »

ashtonkem wrote: post #139
dharmab wrote: post #109

Earlier quoted context omitted.

Also, don't use 0.0.0.0/0 in a security group rule! P.S. Azure has load balancers and security groups too- in fact their security groups are better than AWS's in some ways such as supporting thousands of rules instead of only 50.

Azure can even configure mutual authentication between the LB & the underlying servers, which would cause any direct server access to result in a 401[0]. 0 - For API servers. I'm not sure if you could configure this with services like Elasticsearch.

>Azure can even configure mutual authentication between the LB & the underlying servers

You can achieve a similar effect in AWS, by declaring only the LB's security group as the source in servers' security group ingress rule.

Any requests sent directly to the servers simply wouldn't connect.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#164

Post by llarsson »

dcow wrote: post #158
outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

What's the difference between a VPC and iptables? I agree that you shouldn't expose insecure services. But why do I need to introduce an entire private address space and cloud-managed SDN services to achieve that goal? If it weren't industry status quo, I'd almost call you a shill for the union of ops teams working to secure jobs for years to come. Almost.. (;

I would think that the post you respond to either supposes a hosted service (you do not control the server and its iptables) or that it multiple layers of protection is good for something critical.

But yes, if it's your own server, everyone should remember that regular Linux features are darn powerful, too.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#165

Post by ffpip »

SAI_Peregrinus wrote: post #22

According to The Register, UFO VPN is just white-labeleing a parent service[1]. The full list of compromised providers is thus UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. [1] https://www.theregister.com/2020/07/17/ufo_vpn_database/

Never buy a VPN with these kinda names. You can tell they are shady from their names and websites.

UFO, Secure, Pure VPN, etc

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#166

Post by ffpip »

coronadisaster wrote: post #113
gentleman11 wrote: post #46

Earlier quoted context omitted.

I generally trust Mozilla/Firefox and they just released a VPN. It is nice to be able to outsource my VPN research to them as well, since there aren’t many orgs I trust like that. It works well so far.

Im starting to trust Mozilla less since they discovered the camera in Firefox keeps recording even when you lock your phone and that they wont fix it until October....

As it should?

You're on a call. You lock the phone. You expect the call to continue right?

This bug is in their new browser. Its in a very early stage. So these bugs are expected

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#167

Post by ffpip »

hoytschermerhrn wrote: post #50
orliesaurus wrote: post #14

What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

Piggybacking on this, can anyone comment on Mozilla’s new VPN service?

It's Mullvad with a different UI. That's it.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#169

Post by forgingahead »

outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

I think a big part of it is there are so many "here's how easy it is to set up!!!" guides out there, none of which actually tackle security first, or in a way that reflects the training (or lack thereof) many of these folks who are actually doing the work have.

It's nice to assume that everyone setting up backend services for the multitude of companies out there have gone through accredited training and have years of strong production experience with security chops.

The reality is that because the gap between technically inclined and technically clueless is so large, anyone who can stumble through an online tutorial can be seen as "experienced" to someone who isn't.

I'm not sure what the answer is, but this is going to keep happening - maybe a 3rd party service that evaluates "Getting Started" guides for backend services? If basic security protocols are not covered, they get a red mark, and business owners could use that as an indicator of whether their tech folks could potentially screw it up.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#170

Post by mrweasel »

dcow wrote: post #158
outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

What's the difference between a VPC and iptables? I agree that you shouldn't expose insecure services. But why do I need to introduce an entire private address space and cloud-managed SDN services to achieve that goal? If it weren't industry status quo, I'd almost call you a shill for the union of ops teams working to secure jobs for years to come. Almost.. (;

A VPC, with security groups, can be much easier, depending on how your instances are managed. You’re sure that all the indtances have the same rules and that the rules are always updated, even in if you use auto-scaling.

If you use some provisioning tool you can have the same thing with IPtables. But why are you on AWS if you don’t want to used the features Amazon provides?

Post reply on HN