Hacker News Reader

Comment by legrande | Hacker News Reader

> Are people so gullible that they see an ad for NordVPN, think “oh shit I need to protect my security”, and then buy NordVPN

Well not the people serious about VPNs. The ones I consistently see popup in online discussions about what VPNs to use are Mullvad, ProtonVPN (Because of their Switzerland location), & iVPN (because they're based in a non fourteen-eyes jurisdiction, namely Gibraltar).

Of course jurisdiction doesn't matter since the point-of-presence of the particular VPN country is usually housed in some cheap colocation datacenter that could have questionable ethics and could be feeding logs to adversaries, without the VPN provider even knowing.

Then there's the whole 'we never keep logs' claim which can't be proven. So, caveat emptor folks!

View on HN

> iVPN (because they're based in a non fourteen-eyes jurisdiction, namely Gibraltar).

Gibraltar is an British territory under the jurisdiction and sovereignty of the United Kingdom, it's part of the fourteen-eyes.

    Then there's the whole 'we never keep logs' claim which can't be proven. So, caveat emptor folks!

It can be trusted with a fair degree of certainty depending on the company. For instance, we know that PIA at the very least was willing to testify under oath that they had no records to provide the US government. Could they be keeping secret logs or have changed practices since? Sure, but at some point the claim seems credible.

Now those flavor-of-the-month budget VPNs that cannot possibly be profitable unless you're the product? Different story.

i thought pia got bought recently by a much less trust worthy vpn?

Huh, looks like it was. That would make me apprehensive about continuing to trust them.

They were bought by Kape Technologies, an Israeli surveillance firm whose founders have ties to Unit 8200. PIA literally couldn't up a bigger red flag if they tried.

They were bought by Kape Technologies which used to be called Crossrider and has a history of producing malware and the owners used to work at the Israeli version of the NSA.

https://restoreprivacy.com/private-internet-access-kape-cros...

The issue is that yesterday they may not have kept logs, and today they might, and there's no feasible way to know for sure. Even warrant canaries can't be relief on if the type of warrant requires no notification whatsoever.

FoxyProxy also testified under oath to the US Secret Service that they have no logs:

https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...

The company has been owned by the same individuals since 2006.

Parallel construction also isn't out of the question for these VPN providers that have testified under oath. If I were the NSA I'd buy some "no logs" VPN providers that don't provide logs in court, but do have them to make catching criminals much easier.

It doesn't hurt that the "no logs under oath" assertion will no doubt engender trust with the very people you want to log.

> VPN providers that don't provide logs in court, but do have them

That doesn’t make sense. If the provider has the logs, they’ll be presented in court if the company is given a subpoena and the owners are American. No one is going to risk contempt and jail time for their customers.

The apperence of not having logs is useful for both the law enforcement and the VPN owner, so why whould they subpoena the logs? The VPN could leak some details to the law and in exchange the law mostly leaves them alone. And the law would get cases where they know that spending their time will pay of: Saying "yeah, the computer repair shop found CP on the guys computer", thinking "because we told them where to look".

i'm mostly happy with ProtonVPN for average stuff. clearly tho, when it's serious time you gotta pwn your own box

Reply on news.ycombinator.com