Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonVPN

protonvpn.com

Post reply on HN
Print view View original

71–80 of 205 posts

Re: ProtonVPN

#71

Post by boomboomsubban »

sr2 wrote: post #42
boomboomsubban wrote: post #34

Earlier quoted context omitted.

What so you mean "found malware?" You checked the installer and found that some aspect was malicious or some software you are running said it found malware? As the installer seems likely to cause false positives. You're still better using independent VPN clients, but I would not trust them at all if the installer actually has malware.

I spotted loads of malicious network traffic, and using the Sysinternals Autoruns[0] utility I was able to spot attempts at persistence. I also checked the outbound connections and they were C&C servers. I can't remember if the installer was digitally signed or not, but there was definitely malware in it. I always make sure to opt-out of any AD ware that might be bundled with an installer, but this seems to have been…

So an installer was trying to set up autoruns, and the outbound connection IP's were on some list? The first part seems like expected behavior, the second sounds like your list of bad IP's included several that one of the most popular VPN providers use.

Re: ProtonVPN

#72

Post by aktau »

tptacek wrote: post #56

Using public commercial VPN providers for serious security/privacy is a very bad idea. Get someone to set up Trail of Bits "Algo" for you (or do it yourself, if you're comfortable with Ansible).

Looking at Algo (https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...), it seems like it provides an easy way to setup a (secure) VPN on a piece of hardware you own or one of the supported public clouds. In that respect, I'm not sure if it gives a lot of privacy. As you're the only one using that VPN, the traffic may not be too hard to trace back to you.

Re: ProtonVPN

#73

Post by cmurf »

tyoma wrote: post #25
saintfiends wrote: post #6

How does this compare to TunnelBear [1]? - TunnelBear is a bit more expensive (4.99$/mo, paid annually vs 4$/mo). - TunnelBear supports up to 5 connections per account vs 2. I use TunnelBear regularly for my browser and phone. Both works great. My subscription is going to expire soon and I'll be open to try other VPN providers, not that there is anything wrong with TunnelBear. Any recommendations? This site [2] has f…

HN gets regular "what VPN should I use?" questions and my answer is always the same: Algo [1]. It is designed to be simple to set up, simple to tear down, and usable with numerous cloud providers or your own Linux server. [1] https://github.com/trailofbits/algo

Does not install OpenVPN or other risky servers: so what's risky about OpenVPN? And Algo is properly describe as IKEv2/IPSEC? I've read L2TP is recommended over PPTP, but the Algo read me says it does not use L2TP, considering it legacy, along with IKEv1.

Re: ProtonVPN

#74

Post by kakarot »

saintfiends wrote: post #6

How does this compare to TunnelBear [1]? - TunnelBear is a bit more expensive (4.99$/mo, paid annually vs 4$/mo). - TunnelBear supports up to 5 connections per account vs 2. I use TunnelBear regularly for my browser and phone. Both works great. My subscription is going to expire soon and I'll be open to try other VPN providers, not that there is anything wrong with TunnelBear. Any recommendations? This site [2] has f…

Check out Mullvad. I haven't yet found a service that I think is slicker, more convenient, and more serious about privacy.

You can generate unlimited free trials until you're confident you want to spend the paltry $5 a month on them.

https://mullvad.net

Re: ProtonVPN

#75

Post by 9erdelta »

hedora wrote: post #9

I have mixed feelings about protonmail. On the one hand, they tend to be on the right side of political / legal issues, and this transparency report is nice: https://protonmail.com/blog/transparency-report/ On the other hand, they recently reduced the level of detail in the transparency report. There is also the fact that they are Swiss, and their privacy laws were severely weakened by a recent referendum. In particu…

Oh interesting. Kind of annoying to have to keep moving services.

Re: ProtonVPN

#76

Post by sr2 »

boomboomsubban wrote: post #71
sr2 wrote: post #42

Earlier quoted context omitted.

I spotted loads of malicious network traffic, and using the Sysinternals Autoruns[0] utility I was able to spot attempts at persistence. I also checked the outbound connections and they were C&C servers. I can't remember if the installer was digitally signed or not, but there was definitely malware in it. I always make sure to opt-out of any AD ware that might be bundled with an installer, but this seems to have been…

So an installer was trying to set up autoruns, and the outbound connection IP's were on some list? The first part seems like expected behavior, the second sounds like your list of bad IP's included several that one of the most popular VPN providers use.

This was before the client even connected for the first time. And the IPs were well known C&C servers used for collecting keystrokes and screenshots of your O.S

Re: ProtonVPN

#77

Post by sr2 »

elmigranto wrote: post #49
sr2 wrote: post #42

Earlier quoted context omitted.

I spotted loads of malicious network traffic, and using the Sysinternals Autoruns[0] utility I was able to spot attempts at persistence. I also checked the outbound connections and they were C&C servers. I can't remember if the installer was digitally signed or not, but there was definitely malware in it. I always make sure to opt-out of any AD ware that might be bundled with an installer, but this seems to have been…

> I spotted loads of malicious network traffic Care to provide anything substantial (e.g. net dumps or screenshots at least)? > and they were C&C servers How do you know that, have you MITMD your connection? Do you have anything besides generic spooky words?

> Have you MITMD your connection

Yes, with another Sysinternals tool called TCPView https://technet.microsoft.com/en-us/sysinternals/tcpview.asp...

You don't even need an AV product, you can spot malicious activity by eye alone.

Re: ProtonVPN

#78

Post by atmosx »

Looks the time has come for a small country to create a data haven like the fictional Sultanate of Kinakuta. I believe that the idea will attract foreign investment quickly.

Re: ProtonVPN

#79

Post by akerro »

ProtonMail is doing what I expected Mozilla would do. I expected Mozilla to promote online privacy with their browser and Tor nodes and more...

Re: ProtonVPN

#80

Post by sr2 »

msh wrote: post #66
elmigranto wrote: post #55

Earlier quoted context omitted.

Those prices are… pricey! At least the ones at PRQ.

Yes but then they give you a tunnel with a static IP you can host things on, so it's not really comparable to proton VPN.

There's also iPredator[0] run by Peter Sunde. PRQ is the work of Gottfrid Svartholm. Your traffic goes through Sweden, so you're safe!

[0] https://www.ipredator.se

Post reply on HN