News for hackers. Stuff that matters.
Re:Ask HN: What is it like to run a VPN as a business? by wild_preference on Sunday October 07, 2018 @01:37PM (#18161706)
One of my "favorite" evil business models is Hola VPN (https://hola.org), a free browser VPN extension. Hola VPN users unknowingly become exit nodes for residential IP address proxies for sale at https://luminati.io.
Re:Ask HN: What is it like to run a VPN as a business? by foob on Sunday October 07, 2018 @03:26PM (#18162205)
As part of a company in the residential proxy space [1], I just wanted to point out that this type of proxy is used in a very different way than low-end VPNs. Residential proxies tend to much more expensive, and this results in them being used almost exclusively for legitimate business purposes. It's even a standard practice to go through a KYC process before obtaining access to residential proxies in order to ensure that they'll be used responsibly.

VPNs are often used for piracy, SPAM, and other nefarious purposes while residential proxies are primarily used to obtain access to data through web scraping. Large companies like Google are able to scrape the same sites without getting blocked already, and proxies help to level the playing field between innovative startups and established players. I can certainly understand the critique, but I strongly believe that the existence of residential proxies results in a lot more good than evil.

[1] - https://intoli.com

Re:Ask HN: What is it like to run a VPN as a business? by wild_preference on Sunday October 07, 2018 @04:37PM (#18162489)
My critique is that Hola VPN users don't realize that they are peers, nor what that entails even if you were to use more direct language than the vague "share your idle resources with the community!" rhetoric on Hola VPN's homepage.

But since you brought it up, we both know residential proxies are especially attractive to bad actors and circumventors.

It's like how we're both capable of pitching Tor as the emancipator of the sanctioned journalist trying to publish the truth in the face of mortal danger. Yet 99% of Tor traffic to my websites is malicious despite our feel-good hypotheticals.

Of course, residential proxies are even better than Tor because a network can't just block the residential IP address space. ;)

Re:Ask HN: What is it like to run a VPN as a business? by exolymph on Sunday October 07, 2018 @10:27PM (#18163757)
Upvoted for realism, but I want to respond to this:

> It's like how we're both capable of pitching Tor as the emancipator of the sanctioned journalist trying to publish the truth in the face of mortal danger. Yet 99% of Tor traffic to my websites is malicious despite our feel-good hypotheticals.

Of course. That's the reality of freedom on the radical edges — bad actors need it more than pro-social actors. Many of us choose to support radical freedom(s) anyway because the capacity for anyone to act* freely is judged to outweigh the negative effects from bad actors.

*browse, post, etc.

Re:Ask HN: What is it like to run a VPN as a business? by dragonwriter on Sunday October 07, 2018 @10:36PM (#18163778)
Phrased a different way, the argument is that the benefit of the freedom for those incorrectly assessed to be bad actors outweighs the cost of the freedom for those correctly judged to be bad actors.
Re:Ask HN: What is it like to run a VPN as a business? by exolymph on Sunday October 07, 2018 @11:00PM (#18163862)
Yes, well-put.
Re:Ask HN: What is it like to run a VPN as a business? by extremum134 on Wednesday October 10, 2018 @11:11AM (#18185608)
Most users from third world countries can't distinguish between ads and content.
Re:Ask HN: What is it like to run a VPN as a business? by wittedhaddock on Sunday October 07, 2018 @08:36PM (#18163391)
still loving that f5bot article, thank you sir
Re:Ask HN: What is it like to run a VPN as a business? by throwawaymath on Sunday October 07, 2018 @02:13PM (#18161872)
While this is correct and worthy of discussion, technically it doesn't really have anything to do with what the OP is asking. The way Hola/Luminati works is not a good template for understanding the VPN cottage industry more generally.
Re:Ask HN: What is it like to run a VPN as a business? by 0xb100db1ade on Sunday October 07, 2018 @11:49PM (#18164008)
Relevant section of EULA: http://archive.is/n7wCB#selection-645.1-651.45

> In return for free usage of Hola Free VPN Proxy, Hola Fake GPS location and Hola Video Accelerator, you may be a peer on the Luminati network. By doing so you agree to have read and accepted the terms of service of the Luminati SDK SLA. You may opt out by becoming a premium user.

Re:Ask HN: What is it like to run a VPN as a business? by amingilani on Sunday October 07, 2018 @07:13PM (#18163133)
Whoa, as a luminati customer, I always wondered how they got these residential IPs. Now I know.
Re:Ask HN: What is it like to run a VPN as a business? by tormeh on Sunday October 07, 2018 @03:17PM (#18162170)
So, it's kinda like Tor, just that there's a free tier where you are an exit node, and a paid tier where you are not?

I dunno, I don't really see what's so very wrong about this, as long as it's communicated clearly.

Re:Ask HN: What is it like to run a VPN as a business? by jazoom on Sunday October 07, 2018 @05:43PM (#18162779)
as long as it's communicated clearly.

Exactly. It's not.

Re:Ask HN: What is it like to run a VPN as a business? by farresito on Sunday October 07, 2018 @02:24PM (#18161915)
Thank you for mentioning it. Just removed it. Do you know of any good, non-expensive (VPN?) alternatives? I was using it to access Netflix in other languages for language learning purposes.
Re:Ask HN: What is it like to run a VPN as a business? by Kaveren on Sunday October 07, 2018 @03:57PM (#18162333)
ProtonVPN has a free plan, I recommend it quite strongly. Netflix works on the server I use, though I'm not sure if it works for all servers. P2P traffic is not allowed on free servers.

Support is okay, not the fastest. Downtime is rare but not unheard of, they've been targeted with big DDoS attacks. Server options expanding but not in tons of countries. Most trustworthy and reputable service because it has a CEO you can actually put a name and a face to, and the history of Protonmail.

Re:Ask HN: What is it like to run a VPN as a business? by computerfriend on Sunday October 07, 2018 @11:41PM (#18163978)
This is ironic given the connection between ProtonVPN and Hola/Luminati.
Re:Ask HN: What is it like to run a VPN as a business? by Kaveren on Monday October 08, 2018 @02:05AM (#18164504)
What are you referring to? The situation I found bits and pieces about didn't seem to amount to much of anthing. ProtonVPN was able to explain what happened to what I thought was a satisfactory degree [1].

I definitely don't trust NordVPN in particular, they advertise their "military grade encryption", and I have no clue who runs it.

[1] https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

What other VPN would you trust? Mullvad, absolutely no clue who runs it. Private Internet Access had claims about logs proven in federal court at some point in the past, but I really still don't trust it.

Running your own VPN is one of the best options but you almost completely lose the relatively reasonable degree of anonymity that VPN providers serve to you. Depends on your objectives.

Re:Ask HN: What is it like to run a VPN as a business? by krn on Monday October 08, 2018 @04:36AM (#18165382)
> ProtonVPN was able to explain what happened to what I thought was a satisfactory degree

ProtonVPN's explanation was extremely hardly believable[1].

> Mullvad, absolutely no clue who runs it.

It's clearly stated on Mullvad's homepage[2]:

> The legal entity operating Mullvad is Amagicom AB. [...] Amagicom is 100% owned by founders Fredrik Strömberg and Daniel Berntsson who are actively involved in the company. The rest of the team includes Robin Lövgren, Simon Andersson, Linus, Richard Mitra, Sanny Mitra, David Marby, Odd, Andrej Mihajlov, Janito Ferreira Filho, Elad Yarom and Jan Jonsson.

[1] https://news.ycombinator.com/item?id=17775554

[2] https://mullvad.net/en/

Re:Ask HN: What is it like to run a VPN as a business? by Kaveren on Monday October 08, 2018 @04:24PM (#18170964)
I thought the Reddit reply was thorough, though I can't speak to the claim by krn.

At the end of the day, I can't name many (if any) VPN providers that operate their own data center, which is extremely important since they all (including ProtonVPN) lease from the same companies. ProtonVPN does provide Secure Core though (routing traffic through certain countries to attempt to mitigate exit node threats), too.

I wasn't aware about Mullvad, thank you for pointing that out. I still have little clue who those people are, while Andy Yen has given a TED talk, so he has some public presence. I'm personally more inclined to trust them.

Re:Ask HN: What is it like to run a VPN as a business? by protonmail on Monday October 08, 2018 @04:50PM (#18171207)
Actually, ProtonVPN does own the physical hardware and network for our secure core servers, which we fully operate and run ourselves. This is rather expensive to do, but it's the only way to be sure things are behaving as they should.
Re:Ask HN: What is it like to run a VPN as a business? by tasticanal on Monday October 08, 2018 @08:29AM (#18166790)
Why so? ProtonVPN explained the situation quite clearly though I don't understand why you wouldn't trust NordVPN. Just because they are advertising? Or 'military-grade encryption'? They aren't misleading really, even if it is a marketing gimmick. And who runs it... Well, it is a caveat with most of the VPNs. Because of the delicate nature of them (cybersecurity service, various jurisdictions and such), you don't really know. It is a matter of trust, more than anything. I know that I trust them more than my ISP, that's for sure.

Running your own VPN doesn't really anonymize you though. And like you said, depends what you want from the VPN really.

Re:Ask HN: What is it like to run a VPN as a business? by Kaveren on Monday October 08, 2018 @04:29PM (#18171013)
You should know who runs a VPN in my opinion if you're going to trust them. Private Internet Access you at least have a name at London Trust Media, but Andy Yen has a public presence.

I don't trust anyone who uses "military grade encryption", period, even though it is just a marketing ploy.

ProtonVPN has their own data center of some sort in Switzerland. All VPNs are leasing the same servers from Leaseweb and friends (even ProtonVPN). They say it's in an underground retired army bunker, which sounds good for physical security assuming that's really the case. You never know for sure, but it's better than the alternatives.

VPN companies are notoriously shady, and I only trust ProtonVPN. I believe their service in _some_ respects is a cut above the rest, and I am willing to deal with multi-day customer service responses, DDoS attacks, and the like because of that.

Re:Ask HN: What is it like to run a VPN as a business? by F_r_k on Sunday October 07, 2018 @02:43PM (#18162005)
If it's (nearly) free, them you're the product
Re:Ask HN: What is it like to run a VPN as a business? by majewsky on Sunday October 07, 2018 @02:40PM (#18161991)
The only ones that I know with a good reputation are ipredator.se and Mullvad, though those aren't free.
Re:Ask HN: What is it like to run a VPN as a business? by terrycody on Sunday October 07, 2018 @09:41PM (#18163585)
I got a free VPN plan can share with you, in a very very low cost, and you can use it for 1-2 years, at least, reply me with your email, I will contact u.
Re:Ask HN: What is it like to run a VPN as a business? by celticninja on Sunday October 07, 2018 @02:52PM (#18162056)
Re:Ask HN: What is it like to run a VPN as a business? by morpheuskafka on Sunday October 07, 2018 @07:29PM (#18163181)
> Hola works because it is a peer-to-peer network - you use the network and contribute to the network. To provide this service without charge to our community, Hola charges validated corporations for use of the network. For Hola users that do not want to be a peer in this network, we offer the Hola Premium service, which lets you only use the network, but not be a part of it

Seems quite knowing to me. That same FAQ page, which is very detailed, even provides an explanation of what permissions are used.