Show HN: Responding to NSA spying with a simple consumer VPN service

[rdl]

The NSA metadata gathering and passive monitoring is quite upsetting, and we don't have much confidence in legal changes happening quickly, so we put together a really simple consumer VPN service. We're still cleaning up the UI and making the install process easier, but it should work for people now.

Yes, it's based in the US, but there's a big difference between "will turn over data proactively" and "will push back on requests to the fullest extent of the law". Since we don't fall under CALEA, there's no requirement for us to have any monitoring infrastructure.

We're focusing on the mobile experience for iOS and Android -- the best combination of platform security but also difficult to "roll your own" service.

Would greatly appreciate HN's feedback on concept and implementation; still under active development. Posting some free signup codes in the comments to try it out.

https://privacy.cryptoseal.com/

[47]

The Biggest problem I have found with VPN providers is bandwidth. I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed drops to a level that makes the setup totally useless.

It might be because of consumer grade router[1] have low computing power, but the speed is so low that I highly doubt it. Yes I have tried multiple VPN providers.

I have yet to find a VPN provider that can provide all of the following:

- Guarantee Bandwidth

- Take Privacy Seriously[2]

- Support consumer grade router (with DD-WRT or alternative)

- Do not cost more than my actual internet connection

[1] ASUS RT-N16

[2] http://torrentfreak.com/vpn-services-that-take-your-anonymit...

[Spittie]

I'm sure there are many legit VPN provider out of there, which really care about the user and provide some hardware/bandwidth, but most are oversold services (barely scam) with very high price for what they offer. I think the solution is a self-made VPN out of a VPS. VPS nowadays are really cheap, and you can get awesome deals with some very serious providers. Also, you can easily get one outside the USA, for (in my opinion at least) increased security.

For anyone interessed, https://github.com/Nyr/openvpn-install makes installing OpenVPN a breeze. For VPS deals, http://www.lowendbox.com/ and http://vpsboard.com/.

[thaumaturgy]

You might look at https://torrentfreak.com/which-vpn-providers-really-take-ano...

I've been using one of these, bought with Bitcoin, via Coinbase, set up with a Hushmail account, for a while now. It works great. Bandwidth is diminished somewhat, but not enough to be a problem for normal browsing or other totally legal activities.

edit: I'm tired, just noticed you linked to essentially the same TF article I did. Anyway, the service I've been using works with Tomato and DD-WRT (on some routers), is affordable, and is on of the recommended services for taking privacy seriously. They don't guarantee bandwidth, but in practice, there hasn't been a problem so far.

[bifrost]

> I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed drops to a level that makes the setup totally useless.

A fair amount of that has to do with how little CPU is available on your router device, I suspect no manufacturer will support a device that can do a lot of crypto and still be in the consumer price range.

That said, I could ship you a device right now that'll do 100Mbps of encrypted traffic all day long, but it doesn't have wifi and its about $500...

[rdl]

What kind of performance are you looking for, and what traffic mix?

Testing various consumer routers with VPN for performance is on my todo list. I know the WRT54GL is probably fairly antiquated at this point, but I have some newer DD-WRT supported routers like the WNDR3700 to try.

[buro9]

Did you try IVPN? http://www.ivpn.net/

I've just purchased an Asus RT-N66U to run an OpenVPN client so that I can encrypt the traffic from all computers, and as I don't do file-sharing I've focused on choosing a provider obsessed by privacy rather than piracy. IVPN looks like it, but I haven't yet tried it so don't yet know how it will perform.

[a3n]

Has anyone set up a Raspberry Pi as a router?

[rdl]

For the tech details: it's OpenVPN, PPTP, or L2TP, your choice. Yes, PPTP and L2TP have "issues", but they're currently the easiest way to get a VPN on iOS without a custom client.

[btgeekboy]

There's an official OpenVPN client on iOS now in the App Store that will accept a standard .ovpn profile.

[lifeguard]

These "issues" are critical in thwarting PRISM. More security snake oil.

[richardwhiuk]

I'm not sure how this is at all relevant to the NSA spying - the NSA are gathering details from content providers (like Facebook, Google, Skype), so if you use the VPN to access any of them you are still at risk, or if you communicate using with anyone using one of those services.

[rdl]

It's not the whole solution, but the vast majority of NSA spying is passive "over the wire" stuff. We know they do that, pervasively, and even more, we know foreign countries do that (and filtering, and in some cases lots of fun tampering) on connections (e.g. Great Firewall of China). NSA has been doing passive intercept since inception in the 1940s.

PRISM is somewhat ambiguous -- maybe it's a huge secret program where they get blanket access to big sites directly, maybe it's just a UI layer for managing subpoena or warrant results.

Protecting your metadata is one thing where a VPN works pretty well. There are still some more advanced attacks (looking at the encrypted traffic flows on lightly loaded links, you can infer what site/activity one is doing, even without decrypting, unless you pad all communications).

[prayag]

It's not clear that this is what's happening. Especially since the companies have vehemently denied such allegations.

[prayag]

One thing the NSA fiasco has done is made people aware of the security and privacy issues on the internet and it's a great time to launch a service like this. Hopefully we will have most of the internet users using VPN (and hopefully Tor).

I also love the fact that they have servers outside of the US, makes it a little bit harder for the US government to spy on you.

[rdl]

Yes, we love Tor, and are looking at ways to help Tor and make Tor more robust and easier to use as well.

It would be ironic if the NSA fiasco ended up accomplishing half of the NSA's mission (protecting domestic networks) by getting everyone to improve security and encrypt-by-default, at the cost of making the NSA's SIGINT mission vastly more difficult.

[rdl]

Coupon codes: hn50hnaeS6SaeR is 50% off for HN.

[jvandenbroeck]

What's the difference between you and eg. http://unblockvpn.com/ who offer easy VPN access for less than $5 a month?

Or how is your product easier to use?

[thaumaturgy]

I intend absolutely no offense here. I love seeing HN projects posted here. But...

One of the major issues that has been raised recently is, essentially, trust. Especially in the market that you'd be targeting -- individuals that no longer trust various online services.

You can say that you will fight requests as much as possible under law, but how is that different from what Google, Facebook, and others claim to do?

The NYTimes just published an article claiming that Skype was backdoored by the NSA in cooperation with a small team of Skype developers, in secret, back in 2011. For the sort of people that are concerned by that sort of news, how are you going to convince them that you're different?

[B0Z]

This exchange may provide some insight... https://news.ycombinator.com/item?id=5914546

[rdl]

Yeah, we're actually working on a couple of things which will largely solve the trust problem (which is a bigger thing than just VPN service); stay tuned.

For now I'd like to think we're more trustworthy than a large/general purpose company because we have a lot less to lose in fighting (and much more to gain).

[B0Z]

One of the items I'm going to be most interested in from your service (when the time comes for you guys to start working on it) will be the TOS and/or practices you put in place.

I've been a ViprVPN customer before. I had a question or perhaps it was an issue I called them about and the person I was communicating with told me what VPN server I last connected to and when I connected. Sure, to do any kind of troubleshooting, this would have been necessary and important information. But I was concerned enough about the unsolicited disclosure that I cancelled the service immediately.

DuckDuckGo can claim a reasonably high interest in protecting my privacy because they simply do not collect data that the big search engine does. Collecting and storing this data would make them a target for undisclosed, unchallengeable, and unwarranted surveillance. This has enormous appeal to me.

Having said that, have you guys discussed (loosely) what data you will be collecting?

[rdl]

Our goal for the privacy service is to collect as little as possible. (the corp service is totally separate tech and infrastructure and has user-configurable logging). We're trying to figure out what the absolute minimum is. We're also looking at Bitcoin and other forms of payment.

For a $5-10/mo VPN, we're probably going to handle most problems by "open a new account, here's a service credit", so we don't actually need to debug much. We have a vested interest in collecting the minimum information possible so there's no point in subpoenaing it from us.

[kumarski]

Thanks for making this viable for noobs like me.

[Estragon]

There are already plenty of equally viable options for cheaper. I hear good things about https://www.privateinternetaccess.com/pages/client-support/ , and it is about 1/3rd the price.

[davepeck]

Howdy, CryptoSeal guys. It was great grabbing a beer with you in SFO earlier this year and talking about the VPN space. GetCloak.com continues to go well. I didn't realize you were heading in the consumer direction. We should probably catch up again someday soon! ;-)

[epoxyhockey]

I like the idea of more VPN providers coming online. One thing that may be helpful is to differentiate yourselves from the other VPN providers. For example, I have a VPN provider. Should I switch to cryptoseal.com?

[rdl]

Honestly if you're happy with your VPN provider right now, it's probably not worth switching yet. We try to do the baseline VPN service as well as possible (performance, support, etc.), but it's not that different from other providers, so please consider us if you're not happy with the current provider, but otherwise you're probably just as well served with whatever you're using now, for now.

We're working on some things which will make it compelling to switch. We put it up now because a lot of people don't have VPNs today -- so hopefully adding another provider convinces some additional people they could use a VPN.

[B0Z]

Without having visited your URL, or read your TOS, or evaluated your service for ease of use / viability, I will tell you right now that I would gladly pay a cost equivalent to what I pay monthly for broadband for a VPN service that's reliable and can protect 100% of my Internet traffic in transit. (Exit point, destination points are a whole 'nother animal.)

[rdl]

So, since you sound like a somewhat higher end user:

1) What platforms do you care about? Do you mainly need service from one fixed location, or from home/office network plus mobile?

2) How close does it need to get to the endpoints? We have 4 exit nodes right now; we'd probably need ~50+ to be very close to most services. There's still a portion which is "in the clear" (although, use https...), but it becomes very impractical for NSA or especially others to passively tap all those locations (since they wouldn't be IXes necessarily, and intra-colo links don't get routed through buildings like ATT 611 Folsom St.

[smegel]

Do you do ANY kind of logging?

[rdl]

We do logging on our web server, obviously the support ticket system, our mail server, coupon code redemption, etc. Billing with Stripe -- presumably they keep records for a long time. We don't see your CC, but are notified of payment, etc. (which is why Bitcoin is very attractive to add, and maybe other systems.)

The privacy VPN itself currently does zero logging. The best practices seem to be either zero logging or very short retention logging. We'll commit to one of those (but most likely zero logging) soon (working on a very clear and plain language ToS). All the stuff we'd handle with logging is instead done by going out to top-500 sites (or anything reported to us as not working), rather than monitoring use.

We don't currently do "anonymization" so web browsing can be an issue. We're looking at that with some kind of opt-in proxy.

[buro9]

Payment is by Stripe, how long are records of the transaction kept by yourselves? Are you associating a card transaction to an IP address in any way that could result in you ever having to release that data?

[rdl]

We're adding other, more anonymous payment options, which is probably the best solution.

[prg318]

Where are the VPN servers located geographically? It might be wise to include where your servers are located - and perhaps even a test IP address that users can use for latency / packet loss testing.

[rdl]

US-West, US-Central, US-East, UK right now. Adding some more in Europe and Asia ASAP.

A (current and historical) performance monitor, uptime monitor is a great idea.

[bifrost]

Good news, I actually put latency/loss monitoring into our internal support system last night, so I'll probably be exposing some data from it next week.

We currently monitor 60+ sites from the Alexa Top 500 for load time and loss so we can use the data for capacity planning and fault isolation.

[bliker]

you broke #1 rule of the internet: "Logo in header must point to the homepage."

[rdl]

At least the text next to it does, but will fix -- the traditional error is "blog header links back to blog vs. corp site" which we've solved for now (by not having a blog).

[alex_doom]

For the noobs, what's the difference in OpenVPN between UDP and TCP?

[rdl]

UDP will give you better performance. TCP will work better in pathologically bad network conditions (either some kind of firewall, or some specific kinds of network loss).

The issue is that "TCP in TCP" can lead to weird interactions where you delay one packet, wait for retransmit, etc., and essentially a single packet lost can eat up a second or two.

In general I'd always try UDP, and if it doesn't work, fall back to TCP.

They're equivalent security -- it's just network performance.

[jogzden]

I assume you know what a handshake is, right? A TCP connection requires a handshake and is evidently a much more reliable and safe connection. A UDP connection doesn't require a handshake. This means that you never know if your data has reached its destination or not and due to this is much less reliable. Skype uses a UDP connection, and at times it is evident that it does when video resolution drops, etc.

[davenull]

How about one of those tryout codes?