Live data from Hacker News

Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

windscribe.com

341–350 of 456 posts

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#341
post #236

Earlier quoted context omitted.

I work from home and use a VPN service to get a bunch of IP:s I can easily switch between. Recently a SaaS supplier blocked my IP because I was logging in programmatically every thirty seconds to collect data on batch processing in a customer project, basically two HTTP requests to get an access key and then the data, and I was lazy so I just put those in a script and dumped the second response to a log file and put…

> another customer of the SaaS supplier somehow could see the traffic on my customer's SaaS instance Is this common?

I'm not sure, but it definitely shouldn't be.

It was surprising in a way I don't hesitate to call bad, but this supplier is an enterprise style organisation so of course they've only ranted at me and don't plan to alter their infrastructure.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#342

At this point, the VPN industry is so rife with shady dealings, suspicious ownership structures, weird exits, questionable marketing/PR practices/pushes, and rumours that waters have been muddied sufficiently for every provider out there. It might have been by design as well. Who knows. I now believe that you know your use case and use VPN only for that, and decide whether you really need to pay with parts of your ki…

> If your needs are anonymity, a VPN is not going to solve it— in fact, relying on one might endanger you.

Why?

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#343

Earlier quoted context omitted.

Idk what's the official status, but it's Tesonet. Some fake debunking in the comments of this thread that is factually almost correct: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... EDIT: ProtonVPN app was "accidentally" signet by Tesonet. How do you think this could happen?

Proton's response in the thread: Hi everybody, this is Andy here. I'm one of the original researchers from CERN behind ProtonMail and ProtonVPN. There's some false info out there about ProtonVPN, and these stories were first fabricated by Private Internet Access, a competitor who has been feeling pressure from ProtonVPN lately. The stories are false, but we have always been very open with the community, so I would li…

> it would not have been possible to source local candidates, handle HR and payroll, understand local regulations, etc, without outside assistance

I have no dog in this fight, but I agree with the "smear campaign" that this is 100% bullshit. I work for a fully remote company with employees from all over the world, including Eastern Europe, and we didn't need to partner with any local company, let alone a competitor. Plus even if we need local HR assistance there are plenty of global/local HR services to choose from that focus on HR, no "employee sharing" needed.

I don't know if any other claims are false, but this kind of bullshit obvious to anyone who has been in a similar position undermines everything else they claim. Plus it was never mentioned what these "local partners" get in return, which seems to be the most interesting thing if there's no secret ownership, which is the thing they set out to debunk.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#344

So anyone else besides Airvpn and Mullvad is even worth considering?

You can setup a private VPN with Digital Ocean and a PiHole droplet. I guess it's a little bit less likely to be a honeypot. It also seems cheaper than any public VPN offering.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#345
post #150

Earlier quoted context omitted.

Wait, I think an ISP cannot inspect the content of packets that are encrypted, say, with HTTPs. In order to inspect TLS encrypted packets you need access to the end-device, controlling the end-router is not sufficient since you would not have access to the device certificates. If you can prove that an ISP can inspect packets, it would be major news.

You don't need fully broken encryption to gain useful information. Knowing how much data is transferred, to which servers, and when (especially with details like how various endpoints will inadvertently chunk up HTTPS requests based on the details about the content or how interactive sessions will have certain back-and-forth transmit patterns) is sufficent to generate a traffic "fingerprint" which you can correlate t…

ip addresses are not encrypted, they are part of the header, not the body. The mailman needs to know the address.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#346

Earlier quoted context omitted.

Don't forget ProtonVPN links to Tesonet, which they're trying hard to "debunk" (though no clue why, I have nothing against Tesonet). They only shared employees and accidentally signed apps with the same certificates, but are "totally unrelated". Their PR people are already on this thread. If they didn't try so hard to fight it, people might care less.

Back when I was running PIA, they threatened me a significant amount just for pointing these facts out. Now that I launched a verifiable VPN, they are once again sending legal threats [1]. [1] https://vp.net/l/en-US/blog/Verified-Privacy-vs-Trust

Ah yes, the King of Joseon Cybernation is a trustworthy source.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#347
post #235
post #167

Can anyone give info on who owns Trust.Zone VPN? The company saves all credentials and doesn't allow the user to generate anything, such as Wireguard private keys. The service is very likely logging everything, and already admits to logging bandwidth, which is severe enough. Wouldn't be surprised if this was a honeypot for logging Russian internet users, as it appears to cater to Eastern users.

They hide who they are. If you look at their privacy policy: https://trust.zone/privacy Then you'll notice that it does not tell you what entity they are or where it is incorporated. Elsewhere they claim to be incorporated as Trusted Solutions Ltd in Mahé in the Seychelles. https://trust.zone/tr/post/trust.zone-vpn-reviewed-by-the-to... And this review claims they are an LLC. https://thebestvpn.com/reviews/trust-zone…

The analysis is spot on.

What in particular concerns me is the lack of any type of registration seemingly anywhere. I don't mind if a privacy focused VPN said they don't register at all in any country and stated the reasons as to why, but this company seems to have lied.

"The Seychelles kind of belong to the 'non-aligned' group of countries, and maintains decent relations with Russia, India, China and so on. They also advocate for a diminished US presence in the Indian Ocean. On the other hand, they're a member of the british Commonwealth and only got independence in 1976."

Seychelles is a great place to register for a privacy focused service but I agree with you that being a member state of the British commonwealth is concerning. Could you possibly recommend any place that would be better to register such as service?

"Trust.Zone sure looks fishy but I can't tell from this whether they are surveillance for the UK, traffic to hide in for russian authorities and cyber crime groups or something else entirely. I'd avoid them unless I was already into grey or directly criminal activities and already had layers of protection and indirection in place."

It gives the worst vibes possible for a supposed security service.

Trust.Zone offers a free trial which I signed up for to test with a disposable VM. This is where I learned how they keep user credentials and other major privacy issues, such as the logging I mentioned in my last comment. The support also sent a very questionable reply to a ticket where they wanted to do screen sharing and run an arbitrary script on my server to "diagnose" the issue.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#348
post #6

Been saying it for YEARS: 95% of VPNs sell your data. It's where they make their money. It's absolutely insane the push-back I get when I say this online. I get downvoted to hell and back. Source: I bought this data from VPN companies... Hell, you can inject ads and surveys if you want!

Yes, I've heard of bad VPN companies that sell your data. I would like to learn more about how it is done exactly.

In your later comment you said "DNS is very useful, and unencrypted. OpenDNS makes its money on this same info." Is the VPN company only openly selling DNS info or are they selling more, such as connection logs?

How did you approach the VPN provider to ask to buy this info?

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#349

Earlier quoted context omitted.

I used to work at Tesonet (as software engineer) and I'm not familiar with corporate politics / ownerships but they're lovely people that would 100% walk out if there were some real Russian ties involved. Lithuania is a really small country and IT has been a huge economic strategy since early 00s as a way to become economically independent specifically because of Russia and it worked out really well.

I have a good friend from Lithuania, who has told me so many amazing/wonderful/superlative things about the country he grew up in and loves very dearly, as well as its people. I can't wait to visit someday. Unfortunately, he only has Russian and American citizenship, so he can't purchase real estate there currently, but luckily most of Lithuania's restrictions have been very common-sense (applying only to people who…

> most of Lithuania's restrictions have been very common-sense (applying only to people who frequently travel between Russia and Lithuania).

Common-sense like a complete ban for entering the country for red passport holders.

Lithuania is a wonderful, beautiful country and I understand the need to push the hardliner stance in the EU, but their decisions during the conflict have been strictly political, not in the slightest "common-sense".

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#350

If you’re worried about your VPN provider but you can trust your VPS provider, try an SSH Tunnel. https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-priv...

Thanks for the link. How does this work on the server side? It gets packets on 8080 and then what? The article needs to explain the server config, even if it is just how to install ssh-server. I have tried setting up OpenVPN on my own VPS and I didn't get very far with it. I have also had to use OpenVPN in the day job and I much prefer just using ssh without some extravagant OpenVPN layer. My experience of failing to…

it's very easy to setup your own VPN on your own server. I'm using AWS Lightsail because of virtually unlimited bandwidth and the locations I like, but any VPS would work well. I used to have my own scripts but I found this lately which is doing this much better than what I was doing https://github.com/angristan/wireguard-install

The only advantage of professional VPN is the ability to use obfuscation, so to bypass VPN restrictions in countries like Egypt or others.

Post reply on HN