Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

windscribe.com

Post reply on HN
Print view View original

441–450 of 456 posts

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#441

Post by Dylan16807 »

TZubiri wrote: post #439
Dylan16807 wrote: post #417

Earlier quoted context omitted.

> No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination. As long as the VPN is up, the worst the wifi can do is cut you off. It can't alter your connections. It's far fewer trust points. > Also, you are just switching up the "unpr…

>For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet. WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that. I don't deny that a third layer adds security in that scenario, as 3 layers is more than 2 layers. But you necessarily weaken some other stretch in a zero-sum fashion, as…

> WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that.

If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Not that you need to do that, you could ARP spoof. Or the router could be hacked.

And you don't have to break HTTPS to have a good chance of attacking someone. There's enough HTTP around.

So it's easy to fall through both of those layers.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#442

Post by TZubiri »

Dylan16807 wrote: post #441
TZubiri wrote: post #439

Earlier quoted context omitted.

>For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet. WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that. I don't deny that a third layer adds security in that scenario, as 3 layers is more than 2 layers. But you necessarily weaken some other stretch in a zero-sum fashion, as…

> WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that. If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Not that you need to do that, you could ARP spoof. Or the router could be hacked. And you don't have to break HTTPS to have a good chance of attacking someone. There's enough HTTP around. So it's easy to fal…

If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy.

Is it that easy? I'm not sure if you are a genius hacker or just somewhat misinformed.

My understanding was that observing the initial connection is a requirement for the typical exploit. The attack itself is considerably more complex. Additionally WPA2 is a sort of envelope protocol, the actual encryption cipher can vary and so will the attacks.

I'm not an expert, but I looked into this stuff 7 years ago when I was broke, and I apt installed aircrack-ng from a starbucks so I could try siphoning off my neighbour's wifi, I wasn't able to. Skill Issue sure, but it wasn't as trivial as "just observing a device connecting".

I personally don't see much HTTP, I think a more reasonable attack would be hoping that the user clicks on "continue anyway" whenever a TLS error pops up.

On another note, this would relate to local attackers only right? If a router has been pwned remotely, it wouldn't matter whether the last mile is a twisted pair or air.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#443

Post by Dylan16807 »

TZubiri wrote: post #442
Dylan16807 wrote: post #441

Earlier quoted context omitted.

> WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that. If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Not that you need to do that, you could ARP spoof. Or the router could be hacked. And you don't have to break HTTPS to have a good chance of attacking someone. There's enough HTTP around. So it's easy to fal…

If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Is it that easy? I'm not sure if you are a genius hacker or just somewhat misinformed. My understanding was that observing the initial connection is a requirement for the typical exploit. The attack itself is considerably more complex. Additionally WPA2 is a sort of envelope protocol, the actu…

https://textbook.cs161.org/network/wpa.html

> In the WPA2 handshake, everything except the GTK is sent unencrypted. Recall that the PTK is derived with the two nonces, the PSK, and the MAC addresses of both the access point and the client. This means that an on-path attacker who eavesdrops on the entire handshake can learn the nonces and the MAC addresses. If the attacker is part of the WiFi network (i.e. they know the WiFi password and generated the PSK), then they know everything necessary to derive the PTK. This attacker can decrypt all messages and eavesdrop on communications, and encrypt and inject messages.

No genius hacker, no misinformation. WPA2 in the normal password mode does not protect clients from each other. It's not part of the design.

https://wiki.wireshark.org/HowToDecrypt802.11

Here's a page about how you can use wireshark to decrypt WPA2 if you capture the handshake, but you can't do it on WPA3. (Also it's not hard to force new handshakes.)

> I'm not an expert, but I looked into this stuff 7 years ago when I was broke, and I apt installed aircrack-ng from a starbucks so I could try siphoning off my neighbour's wifi, I wasn't able to. Skill Issue sure, but it wasn't as trivial as "just observing a device connecting".

Trying to get a password is a completely different thing from trying to attack someone else on the same network as you. You did not fulfill the "If you're on a WPA2 network" part of the sentence.

There was a password-finding attack called KRACK that came out in 2017 but it's fussy and there are ways to defend against it. And you can still brute force WPS sometimes but I guess their device didn't allow it.

> On another note, this would relate to local attackers only right? If a router has been pwned remotely, it wouldn't matter whether the last mile is a twisted pair or air.

Yes, "someone sharing the network" and "hacked router" are two different ways you could be attacked.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#444

Post by almostbasic »

causality0 wrote: post #184
getcrunk wrote: post #135

Earlier quoted context omitted.

Btw I used to love pia, I think I’ll check your new one out!

Used to love? What changed? PIA hasn't always had the best performance but they are on the list of VPNs who were subpoenaed and had no data to give the court.

But, that happened since they were acquired by Kape. All that proves is the previous owner was trustworthy.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#445

Post by almostbasic »

causality0 wrote: post #184
getcrunk wrote: post #135

Earlier quoted context omitted.

Btw I used to love pia, I think I’ll check your new one out!

Used to love? What changed? PIA hasn't always had the best performance but they are on the list of VPNs who were subpoenaed and had no data to give the court.

But that has not happened since PIA was acquired by Kape. All that proves is that the previous owner was trustworthy.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#446

Post by TZubiri »

Dylan16807 wrote: post #443
TZubiri wrote: post #442

Earlier quoted context omitted.

If you're on a WPA2 network you just have to observe a device connecting and you can crack their session key. It's very easy. Is it that easy? I'm not sure if you are a genius hacker or just somewhat misinformed. My understanding was that observing the initial connection is a requirement for the typical exploit. The attack itself is considerably more complex. Additionally WPA2 is a sort of envelope protocol, the actu…

https://textbook.cs161.org/network/wpa.html > In the WPA2 handshake, everything except the GTK is sent unencrypted. Recall that the PTK is derived with the two nonces, the PSK, and the MAC addresses of both the access point and the client. This means that an on-path attacker who eavesdrops on the entire handshake can learn the nonces and the MAC addresses. If the attacker is part of the WiFi network (i.e. they know t…

> If an attacker knows the WPA2 password, they can intercept traffic.

Oh yes, of course, this is not unlike the capacity of computers in my LAN being able to see my packets, for example if my roommate was a hacker, they would be able to intercept packets while on their way to the router.

Now an interesting thing I've seen in public networks like say Starbucks or McDonalds, they usually don't rely on WPA2 password default security mechanism. I'm not sure what mechanism they use, but they have me log through a browser first.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#447

Post by TZubiri »

lmm wrote: post #272
sciencejerk wrote: post #209

Earlier quoted context omitted.

Do some countries force the browser companies to add their root cert, despite abuse?

There are always rumours. And some countries simply openly require computers sold in their country to have their root cert.

Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses.

Now it only sounds weird when a country exherts their national sovereignity because the US doesn't need to perform any additional steps to install any of their Certs, they have hundreds of them by design.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#448

Post by zubiaur »

mr_mitm wrote: post #230
zubiaur wrote: post #35

Earlier quoted context omitted.

They sell metadata. DNS queries, locations, apps using data, device info. Usually anonymized, but both unscrupulous and "better" providers do have access to your account and payment info.

GP claimed they can inject ads. How does that work with HTTPS?

They can't inject to the http response, but ad servers that work with the VPN or their data brokers can better identify the requester and serve better targeted ads.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#449

Post by Dylan16807 »

TZubiri wrote: post #446
Dylan16807 wrote: post #443

Earlier quoted context omitted.

https://textbook.cs161.org/network/wpa.html > In the WPA2 handshake, everything except the GTK is sent unencrypted. Recall that the PTK is derived with the two nonces, the PSK, and the MAC addresses of both the access point and the client. This means that an on-path attacker who eavesdrops on the entire handshake can learn the nonces and the MAC addresses. If the attacker is part of the WiFi network (i.e. they know t…

> If an attacker knows the WPA2 password, they can intercept traffic. Oh yes, of course, this is not unlike the capacity of computers in my LAN being able to see my packets, for example if my roommate was a hacker, they would be able to intercept packets while on their way to the router. Now an interesting thing I've seen in public networks like say Starbucks or McDonalds, they usually don't rely on WPA2 password def…

It's like your roommate being able to splice into your cable without touching it, which seems to me silly to allow, but basically yeah.

WPA3 uses a better calculation where listening in doesn't tell you the key.

Re: Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)

#450

Post by lmm »

TZubiri wrote: post #447
lmm wrote: post #272

Earlier quoted context omitted.

There are always rumours. And some countries simply openly require computers sold in their country to have their root cert.

Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses. Now it only sounds weird when a country exherts their national sovereignity because the US doesn't need to perform any additional steps to instal…

> Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses.

Yeah. I don't think the US explicitly requires it but they don't have to, there are more than enough US-based entities with root certificates who they could send a National Security Letter to if they ever wanted one. (Also the US FKPI root certificate is at least shipped by some vendors, although it seems to be disabled by default)

Post reply on HN