Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

21–30 of 666 posts

Re: NordVPN confirms it was hacked

#21

Post by Diederich »

justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

I was getting ready to paste the same thing; the command-line instructions make Algo, effectively, a somewhat technical solution, but it really does just work.

And for those who have used various VPN solutions over the years but not Wireguard: it really is pretty magic. It Just Works, with fantastic performance.

Re: NordVPN confirms it was hacked

#22

Post by rasengan »

ganoushoreilly wrote: post #18
mdorazio wrote: post #5

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-...

The thing is, almost all of these providers share infrastructure and IP blocks. Lookup MicFo and the associated lawsuits (not even including their lawsuit with arin). They provided the exact same IP blocked systems to dozens of the top VPN providers. The reality is, if someone else owns the infrastructure you're just pushing the risk to a different location.

This is only an issue if the keys of the VPN are compromised (like it appears to be for NordVPN).

Re: NordVPN confirms it was hacked

#23

Post by s3r3nity »

Sir_Cmpwn wrote: post #4

NordVPN is being recommended a lot to people who don't know better by influencers on social media, especially on YouTube. This kind of endorsement is recklessly negligent and needs to stop. https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-cho... Edit: note that I don't blame these influencers for their ignorance on the risks of using a VPN; rather I blame the shady VPN providers for overselling the security v…

I also don't blame them, and in fact I'm a bit bullish on the fact that these influencers are bringing greater awareness to using VPNs to an audience that might otherwise not use them / understand them.

Re: NordVPN confirms it was hacked

#24

Post by tmikaeld »

justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

There's also Streisand[0], that gives a lot more options.

[0] https://github.com/StreisandEffect/streisand

Re: NordVPN confirms it was hacked

#25

Post by lkbm »

Sir_Cmpwn wrote: post #17
throwaway66920 wrote: post #14

Earlier quoted context omitted.

I have a non technical friend who did this citing CNET. It felt like kind of a shit thing based on how it was being advertised, but I couldn’t actually see anything that warranted saying nord was bad. How would have expressed this in laymen terms (before this compromised thing was revealed obviously)?

My layman explanation is: You have to take your choice of VPN seriously. When you use a VPN, they can read all of your internet traffic, so choose a company you can trust with that information. If they screw up, like NordVPN did, then anyone can read all of your internet traffic even when you think you're safe. You're often better off without a VPN than with one.

This seems like an overstatement. Five years ago, mostly true, but can they mitm my ssl connections? (I'm getting mixed answers on StackExchange, but it seems like generally no.)

They can see what sites I visit, but for most of those sites, they still shouldn't be able to see the content.

(This might be more nuanced than the layman explanation needs to be. Just curious for my own sake.)

Re: NordVPN confirms it was hacked

#27

Post by Sir_Cmpwn »

lkbm wrote: post #25
Sir_Cmpwn wrote: post #17

Earlier quoted context omitted.

My layman explanation is: You have to take your choice of VPN seriously. When you use a VPN, they can read all of your internet traffic, so choose a company you can trust with that information. If they screw up, like NordVPN did, then anyone can read all of your internet traffic even when you think you're safe. You're often better off without a VPN than with one.

This seems like an overstatement. Five years ago, mostly true, but can they mitm my ssl connections? (I'm getting mixed answers on StackExchange, but it seems like generally no.) They can see what sites I visit, but for most of those sites, they still shouldn't be able to see the content. (This might be more nuanced than the layman explanation needs to be. Just curious for my own sake.)

The article I linked in my original comment goes into a bit more detail and is aimed at the layman, but it's a bit more in depth than a comment you can make in a conversation.

Re: NordVPN confirms it was hacked

#28

Post by jen_h »

justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

This. I can set up and connect to a new OpenVPN instance under my own control in less than seven minutes (5:59 last I clocked) from my phone.

Anyone can do this, it’s not nearly as complicated to launch and secure as some would have us believe. (https://github.com/jenh/sevenminutevpn)

You do lose anonymity with personal VPN, but it all depends on your use case.

Re: NordVPN confirms it was hacked

#30

Post by FactolSarin »

rasengan wrote: post #20
FactolSarin wrote: post #15

Earlier quoted context omitted.

EDIT : I said I used IPVanish mostly because the EFF endorsed them, but someone pointed out below they got caught logging. I suppose that would explain why they're not endorsed on the EFF VPN page anymore. So, I guess time to find a new VPN. :(

IPVanish was caught logging while claiming they didn’t log [1]. [1] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...

Ugh. Good to know, thanks.
Post reply on HN