Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

comparitech.com

Post reply on HN
Print view View original

181–190 of 240 posts

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#181

Post by mattmein »

ayende wrote: post #180
mienski wrote: post #160

Earlier quoted context omitted.

Even doing the official Elastic training - Elasticsearch Engineer 1 gives you everything you need to hurt yourself to set up, use and admin a cluster, but no security is covered unless you sign up for the next course and pay another couple of thousand dollars. Security really should be covered as a default in EE1. I'm a huge fan of beginner tutorials that include security as a default, rather than having it as the th…

With RavenDB, you cannot setup a unsecured server unless you are _really_ trying. And we worked on getting secured setup to be a click through process with under 10 minutes to setup a whole cluster. You can see it here: https://www.youtube.com/watch?v=K-2iZ_lJVag That was done explicitly because of issues like that. Security isn't a feature, and the fact that your product keep leaking details is not the fault of the…

This is completely unrelated, but I remember your blog about dotnet development. I followed it about 10 years ago and remember when you started with RavenDb. I haven't done any dotnet development in about 7 years, but you taught me a lot about programming properly. Thanks.

I'm glad RavenDb is still going well.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#182

Post by hkt »

SAI_Peregrinus wrote: post #22

According to The Register, UFO VPN is just white-labeleing a parent service[1]. The full list of compromised providers is thus UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. [1] https://www.theregister.com/2020/07/17/ufo_vpn_database/

If you can't see the code..

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#183

Post by hkt »

jakear wrote: post #147
_jal wrote: post #108

Earlier quoted context omitted.

> Do we know for a fact This always has been and always will be the security rabbit hole. (Well, one of them.) How do you define "know for a fact"? Even if you personally know a person managing an egress node, how do you know they aren't operating on behalf of someone else?

Saw an article a while back (years) saying NSA/FBI is able to track TOR connections and won’t say how even if it means they’d forfeit some cases.. anyone remember this? Edit to add: Also, it’s public knowledge that TOR is funded by the DoD, it seems extremely feasible that they privately control a sizable chunk of nodes. Based on what I know of American 3 letter agencies, I don’t think one could resist designing a “s…

Most Tor nodes are actually in Germany. You can see a map of them https://tormap.void.gr/

The design of the system is resilient to some nodes being under hostile control, too.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#184

Post by hkt »

anonfunction wrote: post #149
Reelin wrote: post #143

Earlier quoted context omitted.

Approximately: IP addresses are allocated to a network operator by the IANA via an ASN. Most large streaming services block non-residential ASNs at this point. Sometimes they miss one here and there. Your best bet is with smaller providers that operate using a less recognizable ASN. At this point even many non-streaming services block traffic from EC2, Azure, and other cloud providers just to cut down on bots.

Yeah I tried AWS and Digital Ocean and they were blocked by Netflix which is really what I care about. A commercial VPN I use actually works for Netflix but only in 2 specific regions.

https://lowendbox.com/ has always been a good place to find geofence hopping friendly VPS which can serve as a VPN. Not affiliated, I just use it and recommend.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#185

Post by alberts00 »

outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

AWS Elasticsearch was one of the last services which didn't support VPC until late 2017 [1], moreover if you had created a cluster without VPC support the migration is very cumbersome and application changes (to enable double writes) are required to execute it without any downtime [2].

[1] https://aws.amazon.com/blogs/aws/amazon-elasticsearch-servic...

[2] https://medium.com/@vishnunarang/how-to-migrate-elasticsearc...

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#186

Post by fancythat »

outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

Putting unsecured ES on side, but logging passwords in plain text? That's a whole another level of stupidity.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#187

Post by xorcist »

ramraj07 wrote: post #84
fivre wrote: post #74

Earlier quoted context omitted.

I trust VPN services for the one thing they're good and useful for: hopping over geo-fences for content. You should not have any expectation of privacy or security from consumer VPN services (if you want that, obtain Tor Browser or Tails as your needs require). They provide a means to choose roughly where your client traffic comes from, and that's it. The rest is marketing bullshit. They're probably sufficient for lo…

Why would I assure myself that Tor is safe either? Do we know for a fact that government agencies don't control the majority of the egress points?

Safe from what? Always assume that an exit node is compromised. Never run unencrypted and unauthenticated traffic over it. There used to be these password sniffing experiments run over exit nodes, which always caught surprisingly many logins. Don't do it.

That doesn't mean traffic can be deanonymized. Tor as a whole isn't compromised in any meaningful sense even if the exit nodes are. Large parts of the original white paper concerns this.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#188

Post by akerro »

solarkraft wrote: post #41

VPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that). If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).

Similarly to social networks, their profitability and existence is linked to them being unregulated. If VPNs are regulated, and we know what that means for their users, they will be close to useless for majority.

Re: UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

#189

Post by allarm »

ffpip wrote: post #165
SAI_Peregrinus wrote: post #22

According to The Register, UFO VPN is just white-labeleing a parent service[1]. The full list of compromised providers is thus UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. [1] https://www.theregister.com/2020/07/17/ufo_vpn_database/

Never buy a VPN with these kinda names. You can tell they are shady from their names and websites. UFO, Secure, Pure VPN, etc

Which name is better in your opinion? PIA? Nord? Express? All their web sites look alike as well.
Post reply on HN