Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A privacy VPN you can verify

vp.net

Post reply on HN
Print view View original

71–80 of 160 posts

Re: A privacy VPN you can verify

#71

Post by akimbostrawman »

OsrsNeedsf2P wrote: post #46
MagicalTux wrote: post #32

Earlier quoted context omitted.

You're welcome to use cryptocurrencies (we have a page for that), and our system only links your identity at connection time to ensure you have a valid subscription. Your traffic isn't tied to your identity, and you can look at the code to verify that.

Cryptocurrencies? Aka the least private form of transactions, where not only the sender and receiver know, but the whole block chain immutably stores for everyone else to view?

cryptocurrency != bitcoin. monero has solved this issue for almost a decade.

Re: A privacy VPN you can verify

#72

Post by doublerebel »

junon wrote: post #53
MagicalTux wrote: post #30

Earlier quoted context omitted.

Intel audits configuration on system launch and verifies it runs something they know safe. That involves CPU, CPU microcode, BIOS version and a few other things (SGX may not work if you don't have the right RAM for example). The final signature comes in the form of a x509 cerificate signed with ECDSA. What's more important to me is that SGX still has a lot of security researchers attempting (and currently failing) to…

Depends on your threat model. You cannot, under any circumstance, prove (mathematically) that a peer is the only controller of a private key. Again, I would love to know if I'm wrong. The fact that no publicly disclosed threat actor has been identified says nothing.

Proving a negative that information has not been shared has been a challenge from the beginning of information.

Are you suggesting a solution for this situation?

Re: A privacy VPN you can verify

#75

Post by nugzbunny »

dguido wrote: post #70

This is cool, and I'm glad to see someone doing this, but I also feel obligated to mention that you can also just quickly deploy your own VPN server that only you have access to with AlgoVPN: https://github.com/trailofbits/algo

I’ve recently become interested in hosting my own VPN, due to the amount of websites that require me to disable my VPN when visiting their site.

I imagine those websites block IP ranges of popular VPN providers.

Am I right in thinking that hosting my own VPN would resolve this issue?

Re: A privacy VPN you can verify

#76

Post by deknos »

MagicalTux wrote: post #22
jchw wrote: post #14

Intel SGX/remote attestation for verifying that servers are running the code they say they are running is very interesting, I believe Signal talked about doing something similar for contact discovery, but at a base level it requires a lot of trust. How do I verify that the attestation I receive back is the one of the machine I am contacting? Can I know for sure that this isn't a compromised SGX configuration, since t…

Intel will not attest insecure configurations. Our client will automatically verify the attestation it receives to make sure the certificate isn't expired and has a proper signature under Intel's CA trust. A lot of people have been attempting to attack SGX, and while there have been some successful attacks these have been addressed by Intel and resolved. Intel will not attest any insecure configuration as do other TE…

> has a proper signature under Intel's CA trust.

That's a pretty big trust already. Intel has much to loose and would have no problem covering up bugs for government in SGX or certifying government-malware.

And intel had a LOT of successfull attacks and even with their cpu they are known to prefer speed than security.

Re: A privacy VPN you can verify

#77

Post by vaylian »

exfil wrote: post #29

These VPN's for privacy are so bad. You give your credit card (verified identity), default gateway and payload to foreign soil and feel safe. On top of that your packets clear text metadata verifies you with cryptographic accuracy. In today's internet you just cannot have exit IP which is not tied either into your identity, payment information or physical location. And don't even mention TOR, pls.

> And don't even mention TOR, pls.

What's your issue with tor?

Re: A privacy VPN you can verify

#78

Post by tamimio »

One year later: VP.NET SGX code collision attack using lultzmann xyz math theory that allows the attacker to run different code with same sgx verifier!

In all seriousness, I don’t even trust intel to start with.

Re: A privacy VPN you can verify

#79

Post by mzajc »

aidenn0 wrote: post #59
rkagerer wrote: post #10

Someone had a comment here that just disappeared, mentioning it's by Mark Karpelès (yes, the same guy from MtGox) and Andrew Lee. Why did that remark get deleted?

And that's the PIA Andrew Lee, not the Firebase Andrew Lee.

Also known as the freenode Andrew Lee/rasengan.

Re: A privacy VPN you can verify

#80

Post by nneonneo »

mjg59 wrote: post #68

I'm a huge fan of the technical basis for this. I want services to attest themselves to me so I can verify that they're running the source code I can inspect. And, well, the combination of founders here? Good fucking lord. I'm really fascinated to see whether we can generate enough trust in the code to be able to overcome the complete lack of trust that these people deserve. I can't imagine a better way to troll me o…

The SGX TCB isn’t large enough to protect the really critical part of a private VPN: the source and destination of packets. Nothing stops them from sticking a user on their own enclave and monitoring all the traffic in-and-out.

Also, the README is full of AI slop buzzwords, which isn’t confidence-inspiring.

Post reply on HN