Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

github.com

Post reply on HN
Print view View original

21–30 of 88 posts

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#21

Post by tootahe45 »

ilarum wrote: post #15

What is the best way to have a VPN in each continent (apart from the obvious option to have an instance in each region)? I used to pay for a commercial service, but I lost this functionality when I switched to a self-hosted solution. I prefer this feature since I travel a lot and would like to have lower latency wherever I am.

What is wrong with purchasing a VPN that is made to provide this functionality on the cheap? i don't get why everybody has to try do it themselves. If you're worrying about tainted IPs, pay a little more for a VPN that logs. All good VPNs support connecting via openVPN at this point.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#23

Post by mirimir »

LeoPanthera wrote: post #16
givinguflac wrote: post #2

Serious question, do people consider a cloud provider to be more trustworthy than a professional VPN company?

It depends what you want. If you're trying to obtain some degree of anonymity, then a personal VPN server is obviously much worse, since you'll be a using a dedicated IP address just for you, instead of sharing a public one. But if you just want to secure your data from an untrustworthy local network, it's a reasonable choice. You're less likely to be flagged as connecting from a "bad" IP.

You can have both. Mirimir reaches the Internet using a nested chain of three VPN services. The last being IVPN, given that I work for them. But then I use private VPNs on VPS when I need to pretend that I'm not using a VPN.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#24

Post by vermilingua »

It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel.

You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local network or ISP.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#25

Post by mirimir »

filmgirlcw wrote: post #6
givinguflac wrote: post #2

Serious question, do people consider a cloud provider to be more trustworthy than a professional VPN company?

Perhaps? If you’re using a VPN to protect your internet traffic from being sold to ad companies, probably. The VPN industry has become a racket full of affiliate schemes that push people towards plans and services that don’t necessarily act in the user’s best interest. Figuring out the food from the bad can be difficult. And I’ve seen some services that when audited use outdated or insecure stacks. Of course, if you’…

I've been using VPN services for over a decade. In my opinion, the most privacy friendly are AirVPN, Insorg, IVPN, Mullvad, Private Internet Access and Riseup. To my knowledge, HideMyAss, EarthVPN, IPVanish, PureVPN and WANSecurity have violated their users' privacy. For the most part, by sharing logs with investigators. Prudent providers make damn sure not to have any logs that could be seized.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#26

Post by dguido »

verroq wrote: post #9

Not enough people have heard of Outline. https://getoutline.org/ It is a shadowsocks client and even non-technical users can provision VPNs on cloud hosting providers.

Outline is a security disaster, and I strongly recommend against using it.

- Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! https://github.com/shadowsocks/shadowsocks-rust/issues/78

- Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw avoid all of them when it built Outline? Their copy of shadowsocks appears to use an unauthenticated CFB mode by default (https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d...), but then this setting is overridden elsewhere. Good luck checking all the rest.

- They enabled an automated update system they called "Watchtower." Is this safe to use? Who controls the keys? When are updates pushed out? How would it react to a subpoena?

- Is shadowsocks safe? It's a giant pile of C that was purpose-built to evade censorship by the Chinese Great Firewall, nothing more. It wasn't written or designed by an expert in secure communications and it was not even intended for that purpose. It's had a bunch of bugs before (https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/) and none of the crypto makes sense (https://crypto.stackexchange.com/questions/39776/evaluatung-...)!

- The setup process is bonkers. Outline has an Electron app that builds a cloud server, authenticates to it over a random port, then somehow bootstraps encrypted communication with a self-signed certificate. I haven't had time to review the process in all its detail but what the hell? The certificate does not even appear pinned correctly: https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d...

- Jigsaw did not pay for a reputable security review of the code. This security review is one of the worst, possibly THE worst, that I have ever read. It looks like shadowsocks was in scope at first, but then eliminated from scope. There's some weird fascination with parsing bugs in local configuration files. I don't know what's going on here, but it's a waste of paper: https://s3.amazonaws.com/outline-vpn/static_downloads/ros-re...

Jigsaw is advertising this as a method to keep high-risk journalists safe and it's likely to get someone killed (https://medium.com/jigsaw/introducing-outline-making-it-safe...). They are conflating two different use cases: Outline may be acceptable for bypassing censorship (low-risk, where success is immediately visible), but it is wholly unacceptable for protecting the safety or anonymity of speech online (which carries the risk of an invisible and potentially fatal failure in a hundred different ways if traffic can be inspected or even just attributed to a person).

tl;dr Outline is a flaming pile of garbage. Stop recommending it.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#27

Post by dguido »

Operyl wrote: post #14
accrual wrote: post #4

> Does not install Tor, OpenVPN, or other risky servers Although I recognize IPsec is a widely supported protocol and suitable for this use case, did the readme intend to imply OpenVPN is risky?

https://github.com/trailofbits/algo/issues/36 I guess they consider TLS to be a considerable risk. Theoretical I guess.

There is an FAQ that addresses "Why not OpenVPN?" including the specific security concerns with it:

https://github.com/trailofbits/algo/blob/master/docs/faq.md#...

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#28

Post by dguido »

vermilingua wrote: post #24

It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local…

Hello, I am the original author of Algo. This is 100% correct and I am glad that people understand the goals of the project. Please use Algo to keep communications secure.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#29

Post by dguido »

Nadya wrote: post #18

I actually tried running Algo through Azure and Microsoft terminated my Azure account citing I was breaking Terms of Service. I had hosted Algo for all of two and a half days before the takedown. Not sure if anyone else has had luck - that was all I was using Azure for was to test Algo out so had nothing else running on Azure at the time. I also ran into a few snags trying to deplay Algo onto Azure so haven't bothere…

Hello! Developer for AlgoVPN here.

We have many successful reports of using Azure for AlgoVPN. I would appreciate it very much if you could file an issue and include the full details of what happened, including any communications you received from Microsoft (https://github.com/trailofbits/algo/issues/new). I have contacts at Azure that I can escalate this issue to directly.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#30

Post by dguido »

voltagex_ wrote: post #22
verroq wrote: post #9

Not enough people have heard of Outline. https://getoutline.org/ It is a shadowsocks client and even non-technical users can provision VPNs on cloud hosting providers.

It's a Google/Alphabet project. Hmm.

It's not a Google project, it's a Jigsaw project. There's a huge difference, since one is run with extremely low resources and employees between the entities are not shared. Don't trust code that comes from Jigsaw. In my experience, it's all been haphazardly thrown together for a proof of concept and media coverage, not production quality software that people should use.
Post reply on HN