Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hola VPN turns 10M users into exit nodes

8ch.net

Post reply on HN
Print view View original

41–50 of 144 posts

Re: Hola VPN turns 10M users into exit nodes

#41

Post by sudioStudio64 »

8chan wrote: post #37
sudioStudio64 wrote: post #33

Earlier quoted context omitted.

It looks like they clarified their story, not changed it? It did say that it uses idle resources collaboratively...I'm not really trying to argue, just wondering if it was really that deceptive. I had never heard of them until this post.

> It did say that it uses idle resources collaboratively So does Folding@Home. So does tor onion routing (relay node). Nowhere did it say outside of the EULA that they are using all their users as exit nodes. They failed to specify which "resources". It's indefensible, and people would have fallen for this cover up had Google not archived it.

I see what you mean. That's pretty crazy.

Re: Hola VPN turns 10M users into exit nodes

#42

Post by tombozi »

8chan wrote: post #38
tombozi wrote: post #30

What if a node messes with the response and returns fake data? Do they route the request over multiple nodes and compare the results? Then what if someone owns a lot of nodes?

Hola's browser extension is proprietary. A friend of mine has been considering reverse engineering it but is not sure of the laws.

I assume they forward the requests to their own servers? In that case there isn't much to reverse engineer without access to their servers. Unless they use some kind of P2P system, which I doubt.

Re: Hola VPN turns 10M users into exit nodes

#43

Post by voltagex_ »

bifrost wrote: post #2

This is basically why you never want to use a proprietary client with any VPN service, you don't know what you're getting into at all. At least with PPtP/L2TP/OpenVPN based services you can use well known clients or OS vendor provided clients that are unlikely to have little goodies like this.

I'm not sure this will get seen but - is there an OpenVPN client for Windows that doesn't suck?

Re: Hola VPN turns 10M users into exit nodes

#44

Post by yohui »

8chan wrote: post #29
dchuk wrote: post #3

They explicitly state in their FAQ how this works and why their service is able to be free: http://hola.org/faq#in_how_is_free They even have a non-free option that eliminates the VPN as a proxy feature. "Hola built a peer to peer overlay network for HTTP, which securely routes the sites you choose through other Hola users' devices and not through expensive servers. Hola never takes up valuable resources from these u…

Hello, Fredrick Brennan here (8chan owner). They changed their FAQ IN RESPONSE to my breaking the story on this. Proof: Google cache of Hola FAQ as of 26 May: https://archive.is/tgujS As you can see, there is no mention of Luminati, or the underlying mechanics at all. I published hola.html and updated my global announcement just hours before the FAQ change: https://twitter.com/infinitechan/status/603178141650026498 T…

The Luminati angle is new, but the fact that free Hola users are used as peers or exit nodes is common knowledge among better informed users. I've warned others of that fact in the past myself.

Of course, I imagine most users are not so well informed.

Re: Hola VPN turns 10M users into exit nodes

#45

Post by pwnna »

TylerE wrote: post #27
dchuk wrote: post #25

Earlier quoted context omitted.

I'm not sure I understand your logic here. They've come up with a clever way to create a sustainable, free vpn service, with the ability to easily opt-out for a still reasonable price. All the while clearly stating how it all works in their FAQ. What more do you want them to do?

What happens when the Feds are knocking on your door because someone routed kiddie pr0n or drug deals through your connection?

To play devil's advocate: isn't this kind of a good thing for privacy though? If everyone routed everyone else's stuff, it will decouple the notion that IP = person.

Although the service seems shady, if everyone did this wouldn't it be for the better? (albeit at cost of slower connections)

Re: Hola VPN turns 10M users into exit nodes

#46

Post by zxcvcxz »

zodiakzz wrote: post #36

You seem rather high on the moral horse for someone hosting child/underage porn.

Source that proves he's hosting such things?

Are you arguing against anonymity on the internet altogether? IMO Mr. Brennan is a hero for taking on the risks associated with hosting an anonymous image board and not backing down in the face of people who time and time again continue to slander his name.

I don't want to live in a world where people live in fear of hosting an anonymous image board.

Re: Hola VPN turns 10M users into exit nodes

#47

Post by imsofuture »

voltagex_ wrote: post #43
bifrost wrote: post #2

This is basically why you never want to use a proprietary client with any VPN service, you don't know what you're getting into at all. At least with PPtP/L2TP/OpenVPN based services you can use well known clients or OS vendor provided clients that are unlikely to have little goodies like this.

I'm not sure this will get seen but - is there an OpenVPN client for Windows that doesn't suck?

Viscosity is pretty good for Macs+Windows.

Re: Hola VPN turns 10M users into exit nodes

#48

Post by 8chan »

yohui wrote: post #44
8chan wrote: post #29

Earlier quoted context omitted.

Hello, Fredrick Brennan here (8chan owner). They changed their FAQ IN RESPONSE to my breaking the story on this. Proof: Google cache of Hola FAQ as of 26 May: https://archive.is/tgujS As you can see, there is no mention of Luminati, or the underlying mechanics at all. I published hola.html and updated my global announcement just hours before the FAQ change: https://twitter.com/infinitechan/status/603178141650026498 T…

The Luminati angle is new, but the fact that free Hola users are used as peers or exit nodes is common knowledge among better informed users. I've warned others of that fact in the past myself. Of course, I imagine most users are not so well informed.

Indeed, I knew for a while too, but I let it go so long as all posts were made by humans.

But selling an API at $20/GB (bandwidth you pay $0 for) to flood message boards and scrape search engines from random people's IPs without their consent is horribly unethical in my opinion.

Edited to add: I also see it as a breach of trust in the original agreement, even if you were fully informed that by installing Hola you become an exit node. Originally you were an exit node for other humans, and this was reasonably "secure" due to the fact that Hola hadn't been reverse engineered yet. But when Hola released the first party flood/scrape API Luminati they changed the agreement after the fact, even if they didn't have to change the EULA to permit this.

Re: Hola VPN turns 10M users into exit nodes

#49

Post by zodiakzz »

zxcvcxz wrote: post #46
zodiakzz wrote: post #36

You seem rather high on the moral horse for someone hosting child/underage porn.

Source that proves he's hosting such things? Are you arguing against anonymity on the internet altogether? IMO Mr. Brennan is a hero for taking on the risks associated with hosting an anonymous image board and not backing down in the face of people who time and time again continue to slander his name. I don't want to live in a world where people live in fear of hosting an anonymous image board.

http://arstechnica.com/security/2015/01/8chan-domain-seized-...

-------NSFW!-----

https://8ch.net/ephe/ "Teenagers ONLY! That means only 13+ But of course, 16 is the perfect age."

https://8ch.net/nnmodels/ "Young Models and Jailbait"

https://8ch.net/phile/ "Show some https://8ch.net/hebe/

https://8ch.net/cuteboys/

Re: Hola VPN turns 10M users into exit nodes

#50

Post by milankragujevic »

8chan wrote: post #38
tombozi wrote: post #30

What if a node messes with the response and returns fake data? Do they route the request over multiple nodes and compare the results? Then what if someone owns a lot of nodes?

Hola's browser extension is proprietary. A friend of mine has been considering reverse engineering it but is not sure of the laws.

I've reverse engineered it a long time ago and are using their proxy clients (ZAgents as they refer to them internally) as proxies for clicking on my own ads. I have their username and password and a list of dyndns domains. Email me if you want the data.
Post reply on HN