Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

comparitech.com

Post reply on HN
Print view View original

171–180 of 240 posts

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#171

Post by harikb »

outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

I have seen people taking the easy way out setting up dev environments where these security holes are ignored. Hopefully in some near future, everyone would use something like tailscale[1] or nebula[2] instead of taking the easy way out and leaving it all open.

[1] https://tailscale.com/

[2] https://github.com/slackhq/nebula

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#172

Post by ashtonkem »

kevinkeller wrote: post #163
ashtonkem wrote: post #139

Earlier quoted context omitted.

Azure can even configure mutual authentication between the LB & the underlying servers, which would cause any direct server access to result in a 401[0]. 0 - For API servers. I'm not sure if you could configure this with services like Elasticsearch.

>Azure can even configure mutual authentication between the LB & the underlying servers You can achieve a similar effect in AWS, by declaring only the LB's security group as the source in servers' security group ingress rule. Any requests sent directly to the servers simply wouldn't connect.

That’s also a thing on Azure, but you can actually deploy certificates for mutual authentication as well. That way if somehow the network layer is pierced, you have another layer of protection.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#173

Post by pixxel »

alfiedotwtf wrote: post #104
pixxel wrote: post #60

Earlier quoted context omitted.

> I never understood why people working in tech would ever trust a VPN service? It’s not that I trust them but I’d rather some random company across the world has my jerk off logs rather than my ISP who hands my habits to my government and all its favoured cohorts.

For all you know, your government is running that VPN you’re using

Yes maybe. I got to go with the maybe.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#174

Post by Rebelgecko »

sqldba wrote: post #152
ta17711771 wrote: post #145

Earlier quoted context omitted.

Cryptocurrency

Most crypto places force you to provide ID now and governments force you to declare how much you have. Both for tax reasons.

You could mine the crypto yourself, or buy it from someone in person. Bitcoin ATMs verify phone numbers, but if you have a burner phone you could also get BTC from them— they're surprisingly common at gas stations near me

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#175

Post by mirimir »

llsf wrote: post #51
solarkraft wrote: post #41

VPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that). If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).

How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.

Sure. But those statements are also true if you replace "VPN services" with "ISPs".

The point of VPN services is obfuscating your ISP-assigned IP address. And hiding your traffic from your ISP, which both knows who you are, and is generally vulnerable to your government. With VPN services, conversely, you can pick ones that are less vulnerable to your government. And if you use nested VPN chains, you can fully obfuscate the relationship between your meatspace identity and your site traffic.

So as long as you don't reveal your meatspace identity through your online activity, you can be at least somewhat anonymous online. And if you add Tor to the mix, you can be even more anonymous. And by hitting Tor through nested VPN chains, you're less vulnerable to deanonymization through Tor compromise. Such as the relay early vulnerability that CMU researchers exploited to deanonymize Tor users and onion sites.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#176

Post by elcomet »

llsf wrote: post #51
solarkraft wrote: post #41

VPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that). If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).

How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.

Do you have big bills for traffic?

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#177

Post by ajzinsbwbs »

alfiedotwtf wrote: post #104
pixxel wrote: post #60

Earlier quoted context omitted.

> I never understood why people working in tech would ever trust a VPN service? It’s not that I trust them but I’d rather some random company across the world has my jerk off logs rather than my ISP who hands my habits to my government and all its favoured cohorts.

For all you know, your government is running that VPN you’re using

My government, along with any other entity with lawyers, can obtain my browsing history from my ISP as evidence that is admissible in civil or criminal court by submitting some paperwork. They can’t do that with my VPN traffic, even if some government spooks are secretly running the VPN. The NSA is not going to burn their operation to help the MPAA fine me.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#178

Post by throwwwaway »

Mandatum wrote: post #131

Oeck claims no-logs and details how they've achieved that (they don't even have hard drives). Support is responsive, you'll be responded to by those who actually built the platform. They're planning support for WireGuard. Unfortunately they have admins in Australia which has some pretty hefty laws similar to those in the US (look at gag-orders issued, and recent responses to media outlets for publishing vetted and le…

> I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack

This is security theatre. Anyone wanting to surreptitiously access the server farm only has to stream an alternate video to defeat this.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#180

Post by ayende »

mienski wrote: post #160
outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

Even doing the official Elastic training - Elasticsearch Engineer 1 gives you everything you need to hurt yourself to set up, use and admin a cluster, but no security is covered unless you sign up for the next course and pay another couple of thousand dollars. Security really should be covered as a default in EE1. I'm a huge fan of beginner tutorials that include security as a default, rather than having it as the th…

With RavenDB, you cannot setup a unsecured server unless you are _really_ trying. And we worked on getting secured setup to be a click through process with under 10 minutes to setup a whole cluster.

You can see it here: https://www.youtube.com/watch?v=K-2iZ_lJVag

That was done explicitly because of issues like that. Security isn't a feature, and the fact that your product keep leaking details is not the fault of the user the 100th time this happens.

Post reply on HN