Earlier quoted context omitted.
And that's the PIA Andrew Lee, not the Firebase Andrew Lee.
Also known as the freenode Andrew Lee/rasengan.
aka "The Korean Prince."
A privacy VPN you can verify
111–120 of 160 posts
Re: A privacy VPN you can verify
#112Earlier quoted context omitted.
I’ve recently become interested in hosting my own VPN, due to the amount of websites that require me to disable my VPN when visiting their site. I imagine those websites block IP ranges of popular VPN providers. Am I right in thinking that hosting my own VPN would resolve this issue?
Yep! It’s very easy: rent any cloud server, stick a WireGuard/OpenVPN/ShadowSocks container on it, download the config, and you’re done. Since you’re not interested in compute, you can probably use the tiniest cloud server available to save costs. I pay approximately 50¢/month for such a setup, and you can probably do it for free forever if you decide to be slightly abusive about it. However, be aware that you don’t…
I'm interested in doing this, and also running ZNC because I still use IRC and need to run a bouncer, &c.
Re: A privacy VPN you can verify
#113Earlier quoted context omitted.
> Honestly, I feel more comfortable using Mullvad. This team has some folks with questionable backgrounds and I wouldn't trust Intel. Relying on "trust" in a security/privacy architecture isn't the right way to do things - which is what this solves. It removes the need to trust in a person or person(s) in most VPN company cases since they have many employees, and moves it to trusting in code. > Also VPN providers are…
This VPN requires you to trust in Intel - a failing US megacorp desperate for money - as well as the guy who destroyed Mt Gox and the guy who destroyed Freenode. Personally, I'd rather trust in Mullvad.
> guy who destroyed Mt Gox
Let me correct that for you - the guy who brought you the first Bitcoin exchange and arguably helped pave the way for cryptocurrencies today.
> guy who destroyed Freenode
This was already debunked [1]. I tried to save freenode - I was the only one funding it up until the point where freenode's ownership "gave" it to me essentially which resulted in the non-developer staff to attempt to hostile takeover the network [2].
The end result was that they gave control of the domain back to me (and as a result, freenode).
> Personally, I'd rather trust in Mullvad.
Trusting random teams of people on the internet isn't exactly a form of security or privacy.
Developers and cypherpunks trust code, not words.
If you're a developer, I'd highly suggest you read the code.
> This VPN requires you to trust in Intel
You really can't use the internet or any internet-distributed software without trusting Intel. Maybe you're better off logging out if that is your policy. ¯\_(ツ)_/¯
[1] http://techrights.org/wp-content/uploads/2021/05/lee-side.pd...
[2] Funny how non-developers keep ruining Open Source (Mozilla, and many others - see Lunduke Journal for more).
Re: A privacy VPN you can verify
#114Earlier quoted context omitted.
Also, it requires me to trust Intel—an American company, to not have a backdoor in the SGX. That amounts to exactly no trust at all, so it’s a pass from me, and probably any non-US citizen.
The backdoor is as simple as “Intel has all the signing keys for the hardware root of trust so they can sign anything they want” :)
Defense in depth dictates that this is more secure than standard VPNs out there (Mullvad, Proton, Nord, Express, etc.).
Any real security researcher recognizes this.
If you think 'trusting random strangers' is a better security architecture, then you should not work in security.
Re: A privacy VPN you can verify
#115Earlier quoted context omitted.
Depends on your threat model. You cannot, under any circumstance, prove (mathematically) that a peer is the only controller of a private key. Again, I would love to know if I'm wrong. The fact that no publicly disclosed threat actor has been identified says nothing.
Proving a negative that information has not been shared has been a challenge from the beginning of information. Are you suggesting a solution for this situation?
In this case it's rather like trusting that a government issued private key has not been stored by the government for further use.
Re: A privacy VPN you can verify
#116One of the many reasons I love Mullvad (been using it for 4 years now) is their simple pricing—$5/month whether you subscribe monthly, yearly, or even 10 years out. I wanted to give your product a try, but the gap between the 1-month and 2-year plans is so big that a single month feels like a rip-off, while I’m not ready to commit to 2 years either. On payments: for a privacy-focused product, Monero isn’t just a luxu…
But then aren't you messing with the IRS? If you pay in crypto, you have to report every conversion from fiat to monero, and every payment out of the monero wallet: https://www.irs.gov/newsroom/taxpayers-need-to-report-crypto...
Until crypto is legally treated like cash (e.g. I don't have to report that I bought a beer with a $20 bill from an ATM), I don't think it's a very satisfying solution to have to either 1. Report to the IRS that I bought a VPN with monero or 2. Commit a tax crime and be paranoid about the IRS using automated tools to find you out for years after each transaction.
Even ignoring that elephant inthe room, how do you regularly (to pay subscription) get the crypto without leaving a paper trail or dealing with sketchy people?
I like virtual cards like privacy.com. If a state actor is after you, they will find you. So the typical threat model to me is companies trying to track you, like your ISP/Google/Facebook.
It would be nice if there was some way to be tax compliant and get the privacy benefits of monero though. Am I missing some crypto tax compliance tooling here or are all of these crypto payment users just poking the IRS bear?
Re: A privacy VPN you can verify
#117Cute idea. Bit worried about the owners here; rasengan doesn't have a stellar reputation after what happened with Freenode. The idea itself is sound: if there are no SGX bypasses (hardware keys dumped, enclaves violated, CPU bugs exploited, etc.), and the SGX code is sound (doesn't leak the private keys by writing them to any non-confidential storage, isn't vulnerable to timing-based attacks, etc.), and you get a val…
The whole point here is you don’t have to trust us - we don’t want you to. We want you to trust code, period. That said, the freenode issue was debunked and you can see receipts here: http://techrights.org/wp-content/uploads/2021/05/lee-side.pd... I funded freenode since 2011 so any narrative that makes it seem I just appeared out of nowhere is factually untrue. Also, I was handed it because Christel felt I was a goo…
I’ll note that you didn’t reply to any of the technical points made in my post, nor have you substantively engaged with those points made elsewhere by other posters.
Notably: the only part of your system which can be verified is the SGX box, which can only handle encryption. How can we be certain that you are not able to correlate traffic? It is not enough to simply say that you implemented traffic mixing, as that can be defeated by placing each user on their own SGX instance.
Re: A privacy VPN you can verify
#118Earlier quoted context omitted.
This VPN requires you to trust in Intel - a failing US megacorp desperate for money - as well as the guy who destroyed Mt Gox and the guy who destroyed Freenode. Personally, I'd rather trust in Mullvad.
> guy who destroyed Mt Gox Let me correct that for you - the guy who brought you the first Bitcoin exchange and arguably helped pave the way for cryptocurrencies today. > guy who destroyed Freenode This was already debunked [1]. I tried to save freenode - I was the only one funding it up until the point where freenode's ownership "gave" it to me essentially which resulted in the non-developer staff to attempt to host…
At worst I have a neutral opinion of the Mullvad team because I don't know them at all and don't use their product. I have a negative opinion of the guys who stole everyone's money at Mt Gox and who destroyed Freenode, because they stole everyone's money at Mt Gox and destroyed Freenode. In any case, why would I ever have a positive opinion of them, which is what's required to exceed my neutral opinion of Mullvad? What have they done to deserve a better-than-neutral opinion?
Not sure how you can "debunk" that Freenode was destroyed - it clearly was - and the fact that an identical network minus that person is now running just fine, proves that person was the problem. All evidence points to the fact that Freenode (under a different name) seems to have been saved by kicking out the guy who was trying to blackmail it by having ownership of the name Freenode.
You're right, Intel CPUs aren't trustworthy either since they tend to stop working after just a year or so. I have a greater confidence that my CPU doesn't contain an intentional remotely exploitable backdoor, because that takes serious effort (also because it's AMD), than that Intel hasn't sent a couple of short bitstrings to the US government.
Re: A privacy VPN you can verify
#119Intel SGX/remote attestation for verifying that servers are running the code they say they are running is very interesting, I believe Signal talked about doing something similar for contact discovery, but at a base level it requires a lot of trust. How do I verify that the attestation I receive back is the one of the machine I am contacting? Can I know for sure that this isn't a compromised SGX configuration, since t…
Intel will not attest insecure configurations. Our client will automatically verify the attestation it receives to make sure the certificate isn't expired and has a proper signature under Intel's CA trust. A lot of people have been attempting to attack SGX, and while there have been some successful attacks these have been addressed by Intel and resolved. Intel will not attest any insecure configuration as do other TE…
What happens to the system if Intel goes under ? Seems like a single point of failure.
Re: A privacy VPN you can verify
#120Earlier quoted context omitted.
>the complete lack of trust that these people deserve Yeah, I took one look at that and laughed. CEO of mt gox teaming up with the guy who sold his last VPN to an Israeli spyware company sounds like the start of a joke.
I didn’t sell PIA. It was a merger to create a publicly owned privacy company and, unfortunately, the terms of the merger did not come to fruition. I left the company on principle by relinquishing my shares at a mere fraction (about 1/3) the value. I walked away from millions of dollars, and I am happy with my decision. Given what happened, we built VP so that trust is no longer required.
Nobody trusts you, mission accomplished.