191–200 of 240 posts
Earlier quoted context omitted.
Never buy a VPN with these kinda names. You can tell they are shady from their names and websites. UFO, Secure, Pure VPN, etc
Which name is better in your opinion? PIA? Nord? Express? All their web sites look alike as well.
Earlier quoted context omitted.
The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.
FoxyProxy posted one of their Secret Service subpoenas along with their reply. TLDR; they said they have nothing to give: https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp... As for PrivateInternetAccesss / PIA, I would not trust them at all. No one knows who the founders and executives are. After speaking at length with an ex-employee of PIA who now maintains this open-source iOS VPN client, https://passe…
Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…
AWS Elasticsearch was one of the last services which didn't support VPC until late 2017 [1], moreover if you had created a cluster without VPC support the migration is very cumbersome and application changes (to enable double writes) are required to execute it without any downtime [2]. [1] https://aws.amazon.com/blogs/aws/amazon-elasticsearch-servic... [2] https://medium.com/@vishnunarang/how-to-migrate-elasticsearc.…
I can see developers crunched for time (or businesses, money) not taking the additional steps to get there... And this is the same deal for Redis/memcache, which is another reason I think we see those exposed sometimes too.
(To be clear, the additional costs are minor compared to a big business budget, they would be more detrimental to a low (~<400/month) budget project .. or a team that can't dedicate 300-600 man hours to implement this)
Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…
Putting unsecured ES on side, but logging passwords in plain text? That's a whole another level of stupidity.
Oeck claims no-logs and details how they've achieved that (they don't even have hard drives). Support is responsive, you'll be responded to by those who actually built the platform. They're planning support for WireGuard. Unfortunately they have admins in Australia which has some pretty hefty laws similar to those in the US (look at gag-orders issued, and recent responses to media outlets for publishing vetted and le…
> I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack This is security theatre. Anyone wanting to surreptitiously access the server farm only has to stream an alternate video to defeat this.
No one is safe from a state actor.
If I was working at UFO and saw the risks to my fellow citizens created not just by the company's poor security but their willingness to descieve customers I'd worry the company would quietly hand over whatever the Chinese authorities asked for - no "warrant canaries" or truth in advertising - and if probably look to throw a figurative grenade into their operations. If that meant data exposure, better now before they perfect the application of the new security laws then later when everyone feels comfortable and the CCP is just sucking up all of UFO's traffic and logs.
Earlier quoted context omitted.
> I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack This is security theatre. Anyone wanting to surreptitiously access the server farm only has to stream an alternate video to defeat this.
But it still builds trust in the brand. No one is safe from a state actor.
Earlier quoted context omitted.
Im starting to trust Mozilla less since they discovered the camera in Firefox keeps recording even when you lock your phone and that they wont fix it until October....
As it should? You're on a call. You lock the phone. You expect the call to continue right? This bug is in their new browser. Its in a very early stage. So these bugs are expected