It looks like this will help protect your privacy when configured properly, however, it may be more difficult to accomplish one of the key values VPN users seek: navigating around censorship walls. Does anyone know if it's possible to specify the location of your exit node in the network?
FreePN: Open-source peer-to-peer VPN service
11–20 of 136 posts
Re: FreePN: Open-source peer-to-peer VPN service
#12Re: FreePN: Open-source peer-to-peer VPN service
#13This appears to be the main repository for their "VPN" daemon: https://github.com/freepn/fpnd
Some observations:
* It's not actually a virtual private network, at least by the traditional definition. They route HTTP(S) and DNS traffic only; other protocols (presumably) get routed in the clear.
* IPv6 isn't supported at all.
* I might be missing it, but I can't find any cryptographic design documents or a threat model anywhere. A quick repo search doesn't even bring up any cryptographic primitives, which makes me wonder about malicious peers.
It's good to have more competition in this space, so I'd like to be wrong (or eventually wrong, feature-wise) about all of the above. But if I'm right, this is roughly the same as using a SOCKS proxy (and maybe a bit worse, if any other peer can futz with your traffic).
Re: FreePN: Open-source peer-to-peer VPN service
#14If its P2P it means it uses other peoples' nodes as your exit node, sort of like Tor but without the onions. That's risky. What happens to me if someone does something illegal via my connection? How could I prove it wasn't me? Maybe I could win in court by citing my use of something like this, but I really don't want to be dragged into court in the first place even if I end up walking out.
Lantern [0] and Pisphon.ca do so, too, since it is an effective anti-censorship deterrent. Also, industry leaders like NordVPN and ExpressVPN may engage in P2P routing especially to unblock services like Netflix and Disney+ [1]. HolaVPN unapologetically does this too [2]. All of this is discounting the new-age dVPNs like Orchid (not quite the Tor replacement that was promised [3]) and Mysterium [4]. [0] https://archi…
Routing traffic for specific domains with known legal content is questionable practice, but at least it’s safe from the specific concern here (until someone finds an exploit, maybe a bad domain parser or something).
Routing arbitrary traffic is plain risky, it is entirely conceivable to be arrested for it, or at least be searched, whether you can explain it away later or not. “Other providers are doing it too” hardly makes it any less risky.
Re: FreePN: Open-source peer-to-peer VPN service
#15I have a project I want to do that would involve a lot of YouTube scraping. But they'll throttle you if they detect it. This led me down the rabbit hole into the world of residential proxy services. Some of them[0] advertise up to 40 million IPs. I can't imagine many of the owners of those IPs know what they're being used for.
It would be cool if there was a reputable open source project that would let people share/buy residential proxy usage, but at the end of the day there's no way to guarantee people aren't doing horrible things with your IP.
Re: FreePN: Open-source peer-to-peer VPN service
#16I have a project I want to do that would involve a lot of YouTube scraping. But they'll throttle you if they detect it. This led me down the rabbit hole into the world of residential proxy services. Some of them[0] advertise up to 40 million IPs. I can't imagine many of the owners of those IPs know what they're being used for. It would be cool if there was a reputable open source project that would let people share/b…
> I can't imagine many of the owners of those IPs know what they're being used for.
They don’t. For instance, Luminati, possibly the best known player in this market, uses HolaVPN users as exit nodes.[1]
[1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
Re: FreePN: Open-source peer-to-peer VPN service
#17This appears to be the main repository for their "VPN" daemon: https://github.com/freepn/fpnd Some observations: * It's not actually a virtual private network , at least by the traditional definition. They route HTTP(S) and DNS traffic only; other protocols (presumably) get routed in the clear. * IPv6 isn't supported at all. * I might be missing it, but I can't find any cryptographic design documents or a threat mode…
Some other sketchy bits, from a very quick perusal:
* Shelling out[1] to some tool that may be responsible for all of the heavy networking bits[2]
* Falling back on a non-monotonic clock but calling it monotonic[3]
* Another sketchy shellout[4] that calls a bunch of scripts with trivial interpolation/injection bugs[5]. It's not clear if the arguments passed to those scripts are remotely controllable, but it's sketchy.
[1]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9...
[2]: https://github.com/zerotier/ZeroTierOne
[3]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9...
[5]: https://github.com/freepn/fpnd/blob/eda6536754d35224ca773ba9...
Re: FreePN: Open-source peer-to-peer VPN service
#18They tried to promote the launch of this service on a bunch of linux-related subreddits 6 months ago, and I wasn't much of a fan of the concept or the way they advertised it, in skipping over the p2p nature of the system. Their answer to the question of 'what happens when a bad actor has their illegal activity routed through my connection' seemed illogical. They claimed that as more people signed up, the proportion o…
The main page copy seems misleading bordering on malicious:
> No bandwidth caps. No throttling. Stream all day, and download away.
Yes, no caps on the tunneled connection. But it will happily use up your home connection data caps with both your own and other people's traffic.
Then once you run an exit for long enough, your home network will get tor-like treatment from many CAPTCHAs and you'll be blocked from anything on cloudflare.
> FreePN never logs your IP or tracks your activity. (...) FreePN shields your data from prying eyes, giving you peace of mind.
FreePN doesn't log. But anyone running FreePN is welcome to do just that.
It's a perfect tool for that monitoring too. Tor browser at least has lots of extra protections. This one does not, so settig up a tunnel-to-tunnel routing node means you can listen to a lot of interesting things. (Without the liability of being a true exit node)
Re: FreePN: Open-source peer-to-peer VPN service
#19I have a project I want to do that would involve a lot of YouTube scraping. But they'll throttle you if they detect it. This led me down the rabbit hole into the world of residential proxy services. Some of them[0] advertise up to 40 million IPs. I can't imagine many of the owners of those IPs know what they're being used for. It would be cool if there was a reputable open source project that would let people share/b…
> I can't imagine many of the owners of those IPs know what they're being used for. They don’t. For instance, Luminati, possibly the best known player in this market, uses HolaVPN users as exit nodes.[1] [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
Thanks for the link. I figured something like that had to be the case. I can't really think of a legitimate way to get access to that many IPs.
Re: FreePN: Open-source peer-to-peer VPN service
#20Earlier quoted context omitted.
"Should", yes. (Details obviously depend on jurisdiction) For that, they get a warrant to search your home and for your computers to be confiscated to do the forensic analysis on them. You might get them back after a few years if nothing can be proven. They also might tie you into it for knowingly supporting it by installing such a VPN, some places make you responsible for everything happening through your connection…
True, but there is a big difference in operating an exit node and using a VPN. Millions have VPNs installed. These is only a small amount of exit notes, and millions use VPN. I'd argue that the chance of being accused because someone used your connection in p2p VPN is less than when someone will use your wifi to do something illegal.
The more relevant question is, what does this software offer that would make it worth taking on this risk?
For whatever values of 'this risk' you evaluate running this code to carry.
Arguing semantics with a prosecutor might be your idea of a good time, but that seems to me like the sort of thing I could do without. In any case, they may call this a VPN, but it isn't a VPN in the sense that term is normally used, and it certainly isn't even vaguely similar to that VPN connection you make to the office.