or, you could just use https://airvpn.org/
I hear airvpn is awesome. They have many different options to encrypt your connections.
VPN Encryption
21–30 of 46 posts
Re: VPN Encryption
#22While I've heard good things about PIA, you're still trusting someone else with your data. Whether you trust them or not is entirely up to you, but it's not that hard to set up your own VPN tunnel. We posted about it a few weeks ago here: https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-publi... , and there was some good HN discussion on it here: https://news.ycombinator.com/item?id=6285458
" On your CA's environment (hopefully elsewhere):
openssl x509 -CA cacert.pem -CAkey cakey.pem -CAcreateserial \ -days 730 -req -in vpn.csr -out vpn-cert.pem "
What does the author mean by 'hopefully elsewhere?' It's no longer a simple one server solution, no?
Re: VPN Encryption
#23Earlier quoted context omitted.
Doesn't their business location in the US negate the need to be cracked?
Based on their sites, I believe they're UK-based company (and US endpoints are just endpoints, in case someone wants to have US-located exit to access US-only services), so it makes somehow reasonably harder (but not impossible) to correlate between the client and their traffic. Still, I don't see any significant difference between NSA and GHCQ, except that we have (thanks to Snowden) some details of former's operati…
We're still talking about PIA? Definitely US-based.
From https://www.privateinternetaccess.com/pages/contact-us
"Q: Where are you located? A: We are located in the US. Being in the US is optimal for VPN Privacy services since the US is one of the few countries that does not have a mandatory data retention policy. Countries in the EU are forced to log, even though some claim they do not."
Re: VPN Encryption
#24I've been a happy PIA subscriber since the Snowden controversy. However every time I see them becoming more popular (at least 4 of my friends have signed up with them in the past few weeks) and earnestly trying to make themselves more secure, I also realize that someone, somewhere within the NSA (and yes, other intelligence agencies around the world) is elevating them on a list of VPNs to break.
I've said this before, but PIA and other similar VPN providers are great security against most drive-by hackers. I am a happy customer for this reason.
But if your threat model includes "NSA/CIA/FBI/DEA", you are going to have to spend more than $4 a month to remain secure.
Re: VPN Encryption
#25Earlier quoted context omitted.
Doesn't their business location in the US negate the need to be cracked?
They don't store any user logs (I have no reason to suspect they'd lie about that). So there's not much stored data to break. Which means the focus will be on breaking their traffic encryption protocols.
Not necessarily. There's no need to break the encryption or have logs if the NSA can monitor all the traffic going in and out of the proxy server. They just have to correlate your incoming encrypted connection with the outgoing unencrypted data to remove the layer of anonymity. I'd frankly be a little surprised if they weren't doing this or something like it.
I would guess that using PIA makes you less secure against NSA snooping since it makes you more of a target and provides weak anonymity.
Re: VPN Encryption
#26Earlier quoted context omitted.
Doesn't their business location in the US negate the need to be cracked?
They don't store any user logs (I have no reason to suspect they'd lie about that). So there's not much stored data to break. Which means the focus will be on breaking their traffic encryption protocols.
If your adversary includes the NSA, you have to consider the possibility that the NSA has required that they store logs and not tell anyone about it.
Re: VPN Encryption
#27FYI, this is the info page for our new (beta) OpenVPN based client which supports multiple encryption options: https://www.privateinternetaccess.com/forum/index.php?p=/dis...
Interesting to note that you've hosted your beta clients on Kim Dotcom's Mega service. This is the first time I'm coming across a legit & popular service hosting its public client files on Mega.
Re: VPN Encryption
#28Note: ECC-521 is not a typo. It is really 521-bit curve.
Standard: http://www.secg.org/collateral/sec2_final.pdf
Explanation: http://crypto.stackexchange.com/questions/6219/why-do-the-el...
Re: VPN Encryption
#29FYI, this is the info page for our new (beta) OpenVPN based client which supports multiple encryption options: https://www.privateinternetaccess.com/forum/index.php?p=/dis...
Interesting to note that you've hosted your beta clients on Kim Dotcom's Mega service. This is the first time I'm coming across a legit & popular service hosting its public client files on Mega.
I've bought some digital art from a freelancer and received it via there.
Re: VPN Encryption
#30While I've heard good things about PIA, you're still trusting someone else with your data. Whether you trust them or not is entirely up to you, but it's not that hard to set up your own VPN tunnel. We posted about it a few weeks ago here: https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-publi... , and there was some good HN discussion on it here: https://news.ycombinator.com/item?id=6285458
" On your CA's environment (hopefully elsewhere): openssl x509 -CA cacert.pem -CAkey cakey.pem -CAcreateserial \ -days 730 -req -in vpn.csr -out vpn-cert.pem " What does the author mean by 'hopefully elsewhere?' It's no longer a simple one server solution, no?
Your CA doesn't have to be (read: shouldn't be) the same box. Also, it doesn't have to be (read: shouldn't be) connected to the internet. I recommend a USB key you keep around your neck or on your keychain, but it's really up to you.