One positive for PIA at least is that their "no logs"-policy actually has been proven multiple times by subpoenas. https://torrentfreak.com/vpn-providers-no-logging-claims-tes...

I'm not aware of any subpoenas directed at Cloudflare that was equally as useless.

So far that only applied to the DNS, I don't think many would subpoena a DNS provider.

We thought about the trust aspect of it (we have gone through numerous VPN related threads here on news.yc and r/privacy and this has been one of the top concerns). Here's how we plan to convince folks (in our own naive way) we mean business (do serveral or all among):

1. OpenSource vpn server and client, with ability to Cloud-SSH to the server and view what's running.

2. Hands-off, one-click, spin up VPN servers on a VPS of your choice under your control, Streistand/Algo style [0][1], but find a way to provide support (think AWS marketplace).

3. Make privacy-centric commitment legally binding as part of EULA/ToS (is this sufficient?).

4. Run client-side only VPN (like intra, blockada, netguard). The idea is you're still able to analyse traffic and add blacklists client-side, without having to pay for or run a VPN server.

Thoughts?

[0] https://github.com/StreisandEffect/streisand

[1] https://github.com/trailofbits/algo

Sounds a bit like what Google / Alphabet / Jigsaw are already doing with Outline, but I still think there’s major opportunity there for a transparent and decentralized one-click service. Especially when you add in #4.

For some reason, Outline is still mega-targeted at journalists and activists when it could be so much more — it’s been an absolute joy to use so far, and being powered by Shadowsocks certainly doesn’t hurt.

https://getoutline.org/en/home

Thanks. Yes, you're right. Not just Jigsaw (who are excellent, and I've been recommending their DNS app, intra, on news.yc for as long as I can remember), there are multiple other companies in this space (SecureMix, TheGuardianApp, KeepSafe, CopperheadOS, Proton mail/VPN, AdGuard), but not everyone is quite doing what I have in mind related to fighting trackers and censorship with a focus on 'one click and you're done' kind of simplicity (?)

I hope to get something ready to show you guys here on news.yc in may be 3 to 6 months from now.

Sounds like something HN readers will like, but which also would be completely commercially unviable.

True. That's the part where we might need to think hard: A business plan. We haven't thought that far yet, tbh.

Our intention is to: Put the control of the mobile device back in the hands of the consumer and empower them with simple but powerful tools. Think keybase, Stripe, or pre-2014 WhatsApp in terms of UX.

Mobile VPN is key part of that vision, including building other apps around it.

A lot of things triggered this:

1. The prism/carrier-iq snafu from 7yrs back.

2. The uptick in government censorship prevelant in multiple nations (India, Turkey, Pakistan, Russia, etc).

3. Rise of app-economy and the relentless tracking behaviour that entails, esp from Facebook.

4. pi-hole and it's elegant solution to shut out trackers. Though I first saw this solution impl by Sam Hocevar (one of the VLC devs) in 2002 (?): http://sam.zoy.org/writings/internet/doubleclick.html

5. Not very many firms developing products like DuoSecurity did but for the end-consumer. There's a few I could find, like SecureMix (glasswire developer), Objective-See (LuLu Firewall), Jigsaw (primarily for journalists?), Purism, and KeepSafe.

Filtering, Adblocking, VPNs are commercially viable. More of a B2B play than B2C though

Another way would be using some trusted computing technology [1] to do that. This would be a good use case for some kind of remote attestation. (Shameless pug: I did my Ph.D. thesis on this, so if you want to discuss this point, cloudflareatvernizzisdotit ;-) )

[1] https://en.wikipedia.org/wiki/Trusted_Computing

The IPv6,IPSec and PKI together may be interesting to authenticate and encrypt traffic without any entity managing the traffic.

It could eliminate the client/server by activating the authentication and encryption with exchange of certificates by using a PKI.

It may provides a full p2p encryption in the network layer without logging your traffic somewhere or third parties. open-sourced would be awesome.

> established company with a good reputation

are you insane?

CF's reputation is terrible[1]. They are trying to MiTM the entire internet, and frustrate attempts to access some of the most important information online( including but ont limited to evidence of the holocaust, sexual health information and climate change ). They are practically a threat to humanity itself at this point - you shouldn't trust them worth anything.

[1] https://notabug.org/themusicgod1/cloudflare-tor/

The cynicism is fair and I can see where it comes from, but cloudflare CTO, jgrahamc, has replied elsewhere in this thread [0] why tor is a difficult scenario for cloudflare to handle. They did promise to make life easier for tor users but the abuse over tor is apparently relentless, according to them.

[0] https://news.ycombinator.com/item?id=19543188