Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A privacy VPN you can verify

vp.net

Post reply on HN
Print view View original

91–100 of 160 posts

Re: A privacy VPN you can verify

#91

Post by immibis »

junon wrote: post #52
rasengan wrote: post #34

Earlier quoted context omitted.

> Any network protocol can be spoofed, with varying degrees of difficulty. Because of the cryptographic verifications, the communication cannot be spoofed.

Pray tell how a black box peer can validate its not had its private keys cloned?

Because the code doesn't have any code to clone private keys.

The trust chain ends with you trusting Intel to only make CPUs that do what they say they do, so that if the code doesn't say to clone a private key, it won't.

(You also have to trust the owners to not correlate your traffic from outside the enclave, which is the same as every VPN, so this adds nothing)

Re: A privacy VPN you can verify

#92

Post by immibis »

rasengan wrote: post #36
b8 wrote: post #23

They claim to allow anonymous sign up and payments, but requires an email,an account, zip code and name for Crypto payments, but fake info could be used I guess. I tried ordering via Crypto, but it constantly gives me this error: "Unable to load order information. Try again". Honestly, I feel more comfortable using Mullvad. This team has some folks with questionable backgrounds and I wouldn't trust Intel. Also VPN pr…

> Honestly, I feel more comfortable using Mullvad. This team has some folks with questionable backgrounds and I wouldn't trust Intel. Relying on "trust" in a security/privacy architecture isn't the right way to do things - which is what this solves. It removes the need to trust in a person or person(s) in most VPN company cases since they have many employees, and moves it to trusting in code. > Also VPN providers are…

This VPN requires you to trust in Intel - a failing US megacorp desperate for money - as well as the guy who destroyed Mt Gox and the guy who destroyed Freenode. Personally, I'd rather trust in Mullvad.

Re: A privacy VPN you can verify

#93

Post by exfil »

victorbjorklund wrote: post #65
exfil wrote: post #29

These VPN's for privacy are so bad. You give your credit card (verified identity), default gateway and payload to foreign soil and feel safe. On top of that your packets clear text metadata verifies you with cryptographic accuracy. In today's internet you just cannot have exit IP which is not tied either into your identity, payment information or physical location. And don't even mention TOR, pls.

Mullvad VPN allows you to pay with cash in an envelop with no name etc

Yes. But your cash gets attributed by your origin IP address. Which you pay with your identity available.

Re: A privacy VPN you can verify

#94

Post by ranger_danger »

MagicalTux wrote: post #33
ranger_danger wrote: post #25

Earlier quoted context omitted.

> the connection is guaranteed to be with a host running the software in question a host... not necessarily the one actually serving your request at the moment, and doesn't prove that it's the only machine touching that data. And afaik this only proves the data in the enclave matches a key, and has nothing to do with "connections".

Let me clarify, it guarantees your connection is being served by the enclave itself. The TLS encryption keys are kept inside the enclave, so whatever data is exchanged with the host, it can only be read from within the secure encrypted enclave.

> it guarantees your connection is being served by the enclave itself

Served by an enclave, but there's no guarantee it's the one actually handling your VPN requests at that moment, right?

And even if it was, my understanding is this still wouldn't prevent other network-level devices from monitoring/logging traffic before/after it hits the VPN server.

Saying "we don't log" doesn't mean someone else isn't logging at the network level.

I think SGX also wouldn't protect against kernel-level request logging such as via eBPF or nftables.

Re: A privacy VPN you can verify

#95

Post by exfil »

MagicalTux wrote: post #32
exfil wrote: post #29

These VPN's for privacy are so bad. You give your credit card (verified identity), default gateway and payload to foreign soil and feel safe. On top of that your packets clear text metadata verifies you with cryptographic accuracy. In today's internet you just cannot have exit IP which is not tied either into your identity, payment information or physical location. And don't even mention TOR, pls.

You're welcome to use cryptocurrencies (we have a page for that), and our system only links your identity at connection time to ensure you have a valid subscription. Your traffic isn't tied to your identity, and you can look at the code to verify that.

You cannot offer service for money with user anonymity. Your legal knows that.

Re: A privacy VPN you can verify

#97

Post by pydry »

mjg59 wrote: post #68

I'm a huge fan of the technical basis for this. I want services to attest themselves to me so I can verify that they're running the source code I can inspect. And, well, the combination of founders here? Good fucking lord. I'm really fascinated to see whether we can generate enough trust in the code to be able to overcome the complete lack of trust that these people deserve. I can't imagine a better way to troll me o…

>the complete lack of trust that these people deserve

Yeah, I took one look at that and laughed. CEO of mt gox teaming up with the guy who sold his last VPN to an Israeli spyware company sounds like the start of a joke.

Re: A privacy VPN you can verify

#98

Post by Retr0id »

> No trust required.

You also have to trust that SGX isn't compromised.

But even without that, you can log what goes into SGX and what comes out of SGX. That seems pretty important, given that the packets flowing in and out need to be internet-routable and necessarily have IP headers. Their ISP could log the traffic, even if they don't.

> Packet Buffering and Timing Protection: A 10ms flush interval batches packets together for temporal obfuscation

That's something, I guess. I don't think 10ms worth of timing obfuscation gets you very much though.

> This temporal obfuscation prevents timing correlation attacks

This is a false statement. It makes correlation harder but correlation is a statistical relationship. The correlations are still there.

(latter quotes are from their github readme https://github.com/vpdotnet/vpnetd-sgx )

All that said, it is better to use SGX than to not use SGX, and it is better to use timing obfuscation than to not. Just don't let the marketing hype get ahead of the security properties!

Post reply on HN