Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TunnelBear Publishes Security Audit

tunnelbear.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: TunnelBear Publishes Security Audit

#21

Post by bg0 »

molestrangler wrote: post #14
summarity wrote: post #3

Some time ago, decompiled the Windows client and presented my findings here: https://hackernoon.com/poking-the-bear-is-tunnelbears-client...

I still have issues with a VPN provider who insists on using their VPN client.

Are there any nice free VPN Clients out there? I haven't been very lucky in finding any in the OS X realm

Re: TunnelBear Publishes Security Audit

#22

Post by codefined »

orf wrote: post #13

Report PDF: https://cure53.de/summary-report_tunnelbear.pdf The test looks good, down from 3 criticals and 3 high to just 1 high. I'd be interested if they could expand on the 4 medium findings found. It's not the full report.

It appears to be down from 3 criticals and 3 high, not 1 high?

Re: TunnelBear Publishes Security Audit

#23

Post by codefined »

bg0 wrote: post #21
molestrangler wrote: post #14

Earlier quoted context omitted.

I still have issues with a VPN provider who insists on using their VPN client.

Are there any nice free VPN Clients out there? I haven't been very lucky in finding any in the OS X realm

OpenVPN is free and I use it pretty often. Supports both CLI & GUI. Would highly recommend it as an excellent client.

Re: TunnelBear Publishes Security Audit

#24

Post by 0xffff2 »

huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Am I missing something? Nothing TunnelBear produces appears to be open source, so the obvious answer to your question is no. Members of the public can't build binaries at all.

Re: TunnelBear Publishes Security Audit

#25

Post by elithrar »

huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

> If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Given they provide a VPN service, trusting the binaries is only going to take you so far.

Re: TunnelBear Publishes Security Audit

#26

Post by orf »

codefined wrote: post #22
orf wrote: post #13

Report PDF: https://cure53.de/summary-report_tunnelbear.pdf The test looks good, down from 3 criticals and 3 high to just 1 high. I'd be interested if they could expand on the 4 medium findings found. It's not the full report.

It appears to be down from 3 criticals and 3 high , not 1 high?

Fixed, thanks :)

Re: TunnelBear Publishes Security Audit

#27

Post by atlgeek007 »

bg0 wrote: post #21
molestrangler wrote: post #14

Earlier quoted context omitted.

I still have issues with a VPN provider who insists on using their VPN client.

Are there any nice free VPN Clients out there? I haven't been very lucky in finding any in the OS X realm

Tunnelblick is the best option I've found for OpenVPN.

If you're using IPSec then there's a client built into the OS.

Re: TunnelBear Publishes Security Audit

#28

Post by fancy_pantser »

bg0 wrote: post #21
molestrangler wrote: post #14

Earlier quoted context omitted.

I still have issues with a VPN provider who insists on using their VPN client.

Are there any nice free VPN Clients out there? I haven't been very lucky in finding any in the OS X realm

You can use the MacOS Network settings to connect to most types of VPN (hit "+" and fill in the forms to add a new connection). For free, open-source clients, Tunnelblick is very common.

Re: TunnelBear Publishes Security Audit

#29

Post by cisanti »

molestrangler wrote: post #14
summarity wrote: post #3

Some time ago, decompiled the Windows client and presented my findings here: https://hackernoon.com/poking-the-bear-is-tunnelbears-client...

I still have issues with a VPN provider who insists on using their VPN client.

Viscosity is nice on Windows. I think it costs 10 bucks, though... on Linux I don't know, I use CL.

Re: TunnelBear Publishes Security Audit

#30

Post by Ethereum »

ericzawo wrote: post #20

Tunnelbear is a dead-simple VPN (like, "so easy Mom can do it" simple) and their branding is killer. Who doesn't love cuddly privacy bears?

Their marketing team is really on point. I was a happy customer of theirs until I started searching around for a cheaper alternative. Their price is probably their only downside.
Post reply on HN