Privacy and Security Risks of Android VPN Permission-enabled Apps

Post by ajdlinux » Wed, Jan 25, 2017, 8:49 AM UTC

nl wrote: post #19

homulilly wrote: post #16

looked at the report to see if they'd reviewed torguard and apparently they... don't realize it's a VPN service and think it's related to the onion router. Kinda undermines they're credibility a bit if they can't even identify the tools they're auditing properly.

Actually, their report is much more credible because they note the difference between TorGuard (and a few similar apps) vs normal VPNs. To actually quote the report[1]: 67% of Android VPN apps claim to provide traditional VPN services (labeled here as “VPN clients”) including enhanced security and privacy, anti-surveillance or tunnels to access geo-filtered or censored content. Note that we consider Tor clients (e.g.…

Post by nl » Wed, Jan 25, 2017, 9:07 AM UTC

ajdlinux wrote: post #21

nl wrote: post #19

Earlier quoted context omitted.

Actually, their report is much more credible because they note the difference between TorGuard (and a few similar apps) vs normal VPNs. To actually quote the report[1]: 67% of Android VPN apps claim to provide traditional VPN services (labeled here as “VPN clients”) including enhanced security and privacy, anti-surveillance or tunnels to access geo-filtered or censored content. Note that we consider Tor clients (e.g.…

Tor == "The Onion Router". TorGuard == something completely unrelated to Tor. Per the TorGuard website ( https://torguard.net/faq.php ): "Is TorGuard related in any way to the “tor” project? No, The reference to "tor" in TorGuard relates to "torrents" and guarding one’s privacy when using bitorrent. We are not related in any way to the “tor” project however the company does support through donations." Orbot, OTOH, is…

Post by gog » Wed, Jan 25, 2017, 9:46 AM UTC

_23sd wrote: post #8

angry_octet wrote: post #3

It is no surprise that 'free' VPNs don't work or compromise security. Would be good to see the actual list of VPNs that comply with basic security requirements.

TorrentFreak maintains a list of providers that responded to a questionnaire about anonymity, including one about encryption used: https://torrentfreak.com/vpn-anonymous-review-160220/ Personally, I prefer the "roll your own" approach mentioned above. A VPS from DigitalOcean or something beats most providers' pricing.

Post by Vexs » Wed, Jan 25, 2017, 9:59 AM UTC

csydas wrote: post #20

ReverseCold wrote: post #7

Earlier quoted context omitted.

One side effect of schools blocking websites is students downloading and using free VPN software. They have no money, and it works well enough for "unblocking" websites as far as they're concerned. Rip privacy.

Can you elaborate where you are seeing this? Is this as the post-secondary level or lower? I worked in higher-ed in the US and almost uniformly our institution and those we talked to in mailing lists were adamantly anti-blocking. Remembering back to when I was in HS and our library was outfitted with a few donated computers that shared a 56k connection, I know they had a net-nanny installed, but that was quite some t…

Post by terrywang » Wed, Jan 25, 2017, 10:15 AM UTC

daurnimator wrote: post #9

terrywang wrote: post #4

People should NOT trust free VPN services at all, as you don't pay level of service is not guaranteed. What's worse, who knows what the service provide is doing with the data flowing through the tunnels (to)? cover the operational cost (and goal for profits) Install and configure your own VPN services (IPsec or OpenVPN), use strongSwan (Android native client which works great with RSA authentication with x509 certs,…

> People should NOT trust free VPN services at all, as you don't pay level of service is not guaranteed. The corollary is that ones you pay for should not be trusted either: a service can both take your money and insert ads. huh.... reminds me of pay/cable tv....