Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ExpressVPN employees complain about ex-spy's top role at company

reuters.com

Post reply on HN
Print view View original

121–130 of 175 posts

Re: ExpressVPN employees complain about ex-spy's top role at company

#121

Post by saurik »

qw3rty01 wrote: post #74
joconde wrote: post #61

Earlier quoted context omitted.

What traffic does it log exactly, and who logs it? As I understand Tor: - the exit node knows the second-to-last node, the cleartext data and the destination, - each intermediate node knows the previous and next nodes, - the entry node knows the sender and the second node. And using HTTPS prevents the exit node from knowing the cleartext data. This doesn't enable any individual node to know who sent what to whom, ass…

Everything you mentioned goes back to my point that it's an anonymity service, not a privacy service. Tor exit nodes don't know who sent traffic, but they do see all the traffic that passes through them. HTTPS can mitigate some of that, just like it can for VPNs, but the site you're going to is still very much visible. Don't get me wrong, Tor is a very useful service if anonymity is your goal, but it requires a solid…

With Tor the site you are going to is visible, but not who you are (there actually are some quibbles with this, but those don't seem to be your better argument); that someone--somewhere out there--is accessing a specific site doesn't seem to be particularly secret information. I think Tor might tend to use a single circuit for all of your traffic, which allows for correlations, but that is trivially fixable (you can hash the websites you are accessing to multiple circuits that egress with separate exit nodes, so you don't provide the attacker that information).

Re: ExpressVPN employees complain about ex-spy's top role at company

#122

Post by ralusek »

simiones wrote: post #97
ralusek wrote: post #92

Earlier quoted context omitted.

The first one would still know everything though.

The first one would know that you are talking to the second VPN. The second VPN would know that VPN1 User is talking to facebook.com. In principle, neither of them has the full picture. In practice, you may leak enough information that both of them could get the full picture.

My IP: 1234

VPN A IP: 4321

VPN B IP: 6543

---

Unless I'm missing something, the request would go like this:

VPN A sees that 1234 is going to facebook.com

VPN B sees that 4321 is going to facebook.com

facebook sees that request is coming from 6543

Am I misunderstanding the technology, or didn't VPN A see everything?

Re: ExpressVPN employees complain about ex-spy's top role at company

#123

Post by saurik »

lemoncookiechip wrote: post #5
elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

It's far from a waste of money. They help with things such as skipping geoblocking, able to deceive ISPs that send mail warning users about pirated content, can in some cases help with gaming ping, allow users to trick sites that rely on IP logging and many other applications besides cybersecurity and privacy. The main issue is that they all seem to advertise themselves as these privacy and cybersecurity services fir…

Meanwhile, a lot of users really can't trust their ISP: your "ISP" might be coffee shop, or someone renting on AirBNB, or your friend (as you are at their home or office). If you are in any of these circumstances, I would probably first recommend "tether off your phone or something", but if you are finding yourself needing or merely wanting to use someone else's internet connection (maybe for speed or because you don't have a good cell signal), it totally makes sense to use a VPN.

(Also: I don't think anyone has mentioned this yet, as maybe it is somehow "gauche" to do so, but one of the top reasons people use VPNs around the world is because they want to browse porn and they don't want people around them to know. At some point, the people in the apartment next door to me figured out my wi-fi password and seemingly felt the correct solution to this issue was to use me for their porn browsing, but it was then all the more awkward when I figured out why my network was slow and knew all of the porn sites they were browsing. Most people seem more OK with the idea of paying a company like ExpressVPN--even if they are legitimately run by "spies"--to be their dedicated porn access point than hoping that someone else more locally won't find out what sites they are browsing.)

Re: ExpressVPN employees complain about ex-spy's top role at company

#124

Post by jon-wood »

lemoncookiechip wrote: post #5
elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

It's far from a waste of money. They help with things such as skipping geoblocking, able to deceive ISPs that send mail warning users about pirated content, can in some cases help with gaming ping, allow users to trick sites that rely on IP logging and many other applications besides cybersecurity and privacy. The main issue is that they all seem to advertise themselves as these privacy and cybersecurity services fir…

It is in fairness not a winning business strategy to go out and advertise with “we make breaching copyright easier”.

Re: ExpressVPN employees complain about ex-spy's top role at company

#125

Post by mintplant »

elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

> At worst, it's a government agency honeypot

Kevin Poulsen's book Kingpin, about the takedown of CardersMarket, describes how the FBI ran a VPN service as a honeypot for quite a while as part of the operation, logging everything that passed through it. As you say, it could be anyone on the other end of that connection.

Re: ExpressVPN employees complain about ex-spy's top role at company

#126

Post by [deleted] »

elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

[deleted]

Re: ExpressVPN employees complain about ex-spy's top role at company

#127

Post by jjoonathan »

elagost wrote: post #18
lemoncookiechip wrote: post #5

Earlier quoted context omitted.

It's far from a waste of money. They help with things such as skipping geoblocking, able to deceive ISPs that send mail warning users about pirated content, can in some cases help with gaming ping, allow users to trick sites that rely on IP logging and many other applications besides cybersecurity and privacy. The main issue is that they all seem to advertise themselves as these privacy and cybersecurity services fir…

Browser fingerprinting works much better than checking IPs. With multiple devices being behind the same IP, it's necessary to distinguish between users. I'm not saying VPNs are worthless - I'm on one right now for work. Commercial VPNs, for most people who purchase them, are completely worthless. And I very much doubt that tunneling your connection through a VPN can improve ping.

It can improve bandwidth too! Network operators LOVE to mess with traffic based on service type: prioritize it, throttle it, cap it, the games don't end.

"Turn on VPN, network performance improves" is a regular occurrence these days.

Re: ExpressVPN employees complain about ex-spy's top role at company

#128

Post by fortuna86 »

garyrob wrote: post #35
elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

Honest question: it's still a consensus that they do have value in situations such as airport Wi-Fi, correct? Separately from that, I still do wonder whether, if you subscribe to a VPN that has well-examined security practices and whose reputation depends on such practices, whether it still may have value over relying on the security over a local ISP which may not have as much expertise or reputation investment with…

> Honest question: it's still a consensus that they do have value in situations such as airport Wi-Fi, correct?

No, with SSL and https now the default for 90%+ of the web, you can be sure no one is casually listening in.

Re: ExpressVPN employees complain about ex-spy's top role at company

#129

Post by guerrilla »

elagost wrote: post #2

It's been clear for a long time that every single commercial VPN service is a waste of money. At best, you replace trusting your ISP with trusting a different group of unknown people with similar motivations. At worst, it's a government agency honeypot or someone like Facebook. If you think you want a VPN for "privacy", use Tor Browser. If you want a VPN for any other reason that "normal people" think they want a VPN…

> It's been clear for a long time that every single commercial VPN service is a waste of money.

This is nonsense. It depends entirely on your goals. It's important to me that my ISP doesn't know what I'm doing while I couldn't care less if my VPN provider does. I also need to circumvent geoblocking from time to time.

Re: ExpressVPN employees complain about ex-spy's top role at company

#130

Post by monocasa »

ralusek wrote: post #122
simiones wrote: post #97

Earlier quoted context omitted.

The first one would know that you are talking to the second VPN. The second VPN would know that VPN1 User is talking to facebook.com. In principle, neither of them has the full picture. In practice, you may leak enough information that both of them could get the full picture.

My IP: 1234 VPN A IP: 4321 VPN B IP: 6543 --- Unless I'm missing something, the request would go like this: VPN A sees that 1234 is going to facebook.com VPN B sees that 4321 is going to facebook.com facebook sees that request is coming from 6543 Am I misunderstanding the technology, or didn't VPN A see everything?

VPN A only sees that the request is going to VPN B.
Post reply on HN