NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#301

Post by orbital-decay » Mon, Oct 21, 2019, 4:49 PM UTC

danShumway wrote: post #288

orbital-decay wrote: post #265

Earlier quoted context omitted.

If you have Javascript disabled, it is a heck of a lot easier to identify you because you're one of the very few who disabled Javascript.

Eh. If you're enabling JS because you think it's going to help you blend into the crowd, I am skeptical that you understand how powerful JS fingerprinting actually is, particularly around cache abuse and super-cookies. You don't need to go all the way, but the very least I would advise turning on the resist-fingerprinting config in Firefox. At a minimum, block things like canvas/webGL. You're making yourself more ide…

Sure, I do understand that, and yes IP hiding does matter. I'm merely pointing out that disabling Javascript (and eventually enabling some set unique to you, to un-break a broken site) is just another way to leak some bits one might want to be aware of. Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way... until the new ones are found. I don't know. The leaking bits need to be carefully accounted for, and you don't know the site userbase for sure to blend into the largest cluster possible. I don't think that fingerprinting is something that can be fought by the end user efficiently, besides the very obvious things like blocking the major vectors.

Re: NordVPN confirms it was hacked

#302

Post by Faark » Mon, Oct 21, 2019, 4:50 PM UTC

alex_duf wrote: post #90

jen_h wrote: post #28

Earlier quoted context omitted.

This. I can set up and connect to a new OpenVPN instance under my own control in less than seven minutes (5:59 last I clocked) from my phone. Anyone can do this, it’s not nearly as complicated to launch and secure as some would have us believe. ( https://github.com/jenh/sevenminutevpn ) You do lose anonymity with personal VPN, but it all depends on your use case.

But the problem remain the same. Whoever manages the network that hosts your instance will see your traffic...

You choose the business model to trust. VPN serve customers who to pay to be private. That seems like a high value target. ISPs serve connectivity, but apparently in the US, spying on their users is part of their core business and have strong local monopolies. Due to fierce competition and trust being pretty much one of the business requirements (I'd expect a lot more due diligence in b2b), hosting providers seem like the least big evil to me.

Re: NordVPN confirms it was hacked

#303

Post by herbst » Mon, Oct 21, 2019, 4:51 PM UTC

gambler wrote: post #284

dehrmann wrote: post #248

Earlier quoted context omitted.

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks…

HTTPs will not stop Google from logging your IP + activity on their services. I'm not convinced that ad-blockers are 100% effective in disabling trackers either. One of the appeals of VPNs is that you have multiple points of exit and they rotate.

Hint: They ain't. You can still create unflagged CNAMEs for many trackers and Ad Networks.

Re: NordVPN confirms it was hacked

#304

Post by nprateem » Mon, Oct 21, 2019, 4:52 PM UTC

kevindong wrote: post #291

apecat wrote: post #230

Earlier quoted context omitted.

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

[dead]

Re: NordVPN confirms it was hacked

#305

Post by 1000units » Mon, Oct 21, 2019, 4:52 PM UTC

This is a feature in my eyes. Just stack a bunch of these hacked by different people who don't cooperate with each other. Now any user has plausible deniability over anything that happens on these networks. No?

Re: NordVPN confirms it was hacked

#306

Post by protonmail » Mon, Oct 21, 2019, 4:53 PM UTC

jorvi wrote: post #271

protonmail wrote: post #168

Earlier quoted context omitted.

There's a couple ways to look at this. On one hand, there's anonymous websites, competing VPN companies, and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records). Then, on the other hand, you have Mozilla and the EU (which has access to all European corporate records) vouching for Proton, which also operates in a highly transparent way, examples here: https://protonvpn.co…

> On one hand, there's anonymous websites, competing VPN companies, and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records). I agree, the VPN industry is rife with shady business practices. But the story being pushed isn't 'demonstratively false'. * TesoNet offers data mining services * You did contract TesoNet employees * Due to an error and unyielding policies by Googl…

Definitely appreciate your concern here, but there's still a lot which is being confused.

Proton does not today, and has never, used contracted (outsourced) employees. As is common with startups, in the past we did not always do all our HR in house (it's all in house today), but employees were always working on Proton and for Proton.

There are no board members, directors, shareholders, or employees, related to Tesonet beyond the fact that a couple employees might have been employed there previously. This in itself is not strange, we also have some employees who previously worked at Google, the ultimate data mining company, but clearly decided they preferred to work for the other side. People can and do change jobs.

Proton has also always run our own infrastructure, and for ProtonVPN, this is publicly verifiable.

So, we don't have to "gut our company" to remove any "intermingling" because there was little to none to begin with, and certainly nothing today.

Indeed trust is super important, but it seems odd to trust anonymous internet accusers or those with a clearly vested interest in harming Proton, as opposed to reputable third parties like the EU or Mozilla who don't have a vested interest here and are independent.

Proton is still to this day, the only VPN company that has an address clearly published on our website, where you can show up, and find company management and board members, and that means something.

Re: NordVPN confirms it was hacked

#307

Post by danShumway » Mon, Oct 21, 2019, 4:53 PM UTC

orbital-decay wrote: post #301

danShumway wrote: post #288

Earlier quoted context omitted.

Eh. If you're enabling JS because you think it's going to help you blend into the crowd, I am skeptical that you understand how powerful JS fingerprinting actually is, particularly around cache abuse and super-cookies. You don't need to go all the way, but the very least I would advise turning on the resist-fingerprinting config in Firefox. At a minimum, block things like canvas/webGL. You're making yourself more ide…

Sure, I do understand that, and yes IP hiding does matter. I'm merely pointing out that disabling Javascript (and eventually enabling some set unique to you, to un-break a broken site) is just another way to leak some bits one might want to be aware of. Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way... until the new ones are found. I don't know. The leaking bits need to…

That's a good point.

> Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way...

I wish there was more research being done around this. I appreciate what Firefox is doing, and I assume there are good reasons for their fingerprinting strategies. They know more than me about this stuff. But... it still sets off some alarm bells in my head. It seems like it would be strictly better to spoof location/canvas/microphone data instead of only blocking it.

Re: NordVPN confirms it was hacked

#308

Post by ganoushoreilly » Mon, Oct 21, 2019, 4:54 PM UTC

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

The tinfoil hat would argue maybe this was a leak that happened, but it was shared by design. It’s an HK company with questionable relationships and owners.

Re: NordVPN confirms it was hacked

#309

Post by Faark » Mon, Oct 21, 2019, 4:54 PM UTC

tyfon wrote: post #209

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal da…

> to the supervisory authority

Does this always/necessarily lead to customers/the public being informed? But yeah, better than nothing.

Re: NordVPN confirms it was hacked

#310

Post by ultraism » Mon, Oct 21, 2019, 4:54 PM UTC

_-___________-_ wrote: post #190

bitxbitxbitcoin wrote: post #172

Earlier quoted context omitted.

One very explicit reason to not trust your ISP with your internet traffic is that since 2017 [1], they are allowed by Congress to sell your internet history. As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2]. [1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is. I've always assumed VPN providers sell whatever data they can too.

If the NSA revelations have shown anything, it is that meta data is very valuable.