Post: #1

I need some opinions on this. I know that Roosh uses strongvpn but I would like consider some more options. My objective is to protect the internet business that I am working on.

I googled "best VPN service providers" and came across this article:

http://lifehacker.com/#!5759186/five-bes...-providers

I don't understand the concept of exit points mentioned in the article. What is it and how important is it while traveling?

Thanks.

Post: #2

In the past I used http://www.eukhost.com/ for various reasons, nothing to do with running a business but they were good. Might not be what you're after but worth a look.

Post: #3

$20 USD's a month, works for smartphones also:

https://www.goldenfrog.com/vyprvpn/vpn-service-provider

Its all you will ever need to know about VPN's, and fast as hell.

Post: #4

I have used strongvpn.com for close to 2 years now. I have had zero issues, customer service is excellent, and it works on my Iphone too!

Mixx

Post: #5

What threats are you guys trying to defend against with a secure VPN?

Post: #6

(04-11-2011 10:48 PM)Mystik Wrote:  I don't understand the concept of exit points mentioned in the article. What is it and how important is it while traveling?

The way the VPN works is that instead of the standard setup of

You <---> Host

Your connection becomes:

You <----> VPN <-----> Host

In other words, the VPN just acts as a middleman. You send requests to the VPN and the VPN carries them out on your behalf and gives you the results. The "exit point" is the location where the VPN actually carries out the request for you. For example, if you were in China and wanted to visit a site criticising the Chinese government, you'd need an "exit point" (i.e. a VPN server to carry out the request) located somewhere outside China. If the exit point was in China, then the Chinese government (having access to traffic going over Chinese networks) could block the traffic or identify you through your IP and come for you.

Exit points probably won't be an issue for you while you're traveling. They are a significant concern if you want to do XYZ, where XYZ is illegal in the country you're visiting, but legal/unenforced in the country you choose as your exit point. It might be useful if you want to view copyrighted material that can't be loaded for viewers outside the US (e.g. some YouTube videos).

Post: #7

I use strongvpn.com too.

I connect when I'm on an unsecured wifi network, mostly in public hotspots.

Post: #8

(04-12-2011 10:41 AM)Arobin Wrote:  What threats are you guys trying to defend against with a secure VPN?

I needed multiple IPs for accessing certain websites but I won't go into why.

Post: #9

Do NOT use Witopia. Waste of bloody money. Doesn't work half the time, is slow when it does.

Post: #10

Also some U.S. based sites need a ip address. I know that in Iceland I ordered Kindle books using an American ip address because it was cheaper. My domain provider also requires a u.s. ip.

Post: #11

(04-12-2011 10:41 AM)Arobin Wrote:  What threats are you guys trying to defend against with a secure VPN?

Thanks for the explanation Arobin. Now I understand what an exit point is.

Like Roosh, I want to use VPN while connecting to public wi-fi networks.

Looks like strongvpn is the winner. Two satisfied customers.

Post: #12

(04-12-2011 02:28 PM)Mystik Wrote:  Like Roosh, I want to use VPN while connecting to public wi-fi networks.

Yeah, but that's not actually a threat. I mean, specifically, what are you concerned about? For example, if you were to say, "I don't want other people to be able to see what web sites I'm visiting," that's a threat that VPN mitigates. Another threat would be that you're afraid of network level attacks on your OS from other people on the network, which VPN does not mitigate.

I suspect a lot of people are using secure VPN without an actual need; just that the phrase "unsecured wireless network" scares them. If you're worried about stuff like online banking and credit card transactions, that traffic is already encrypted because it's over HTTPS (unless the company has really terrible security). You can change settings in Facebook and gmail (probably most mail providers as well) to always use HTTPS, so VPN wouldn't offer you additional protection in these cases except to hide which site you're visiting.

There are legitimate reasons to use a secured VPN, but before you go through the hassle and cost, you should understand what it does and doesn't protect you from.

Post: #13

Arobin there's a popular Firefox plugin called Firesheep which makes stealing cookies a one-click process on unsecured network. A VPN protects against that.

Post: #14

(04-12-2011 03:22 PM)Roosh Wrote:  Arobin there's a popular Firefox plugin called Firesheep which makes stealing cookies a one-click process on unsecured network. A VPN protects against that.

Right, but Firesheep only works on sites that don't use HTTPS. I haven't used the plug-in, but from what I understand, it's not a general purpose tool to hijack sessions on any site. It only works for specific sites it was designed to steal cookies from. The big targets are Facebook and twitter, but both of these sites can be configured to always use HTTPS. If people are still antsy and want to make sure nobody can say, access their flickr account, go for it.

I'm currently traveling and am usually on public wi-fi. I have gmail and facebook configured to always use HTTPS and all my financial stuff is over HTTPS to begin with. The rest (e.g. this forum account) is vulnerable to session hijacking / traffic snooping but I don't imagine any of that is very interesting to an attacker. The risk of someone bothering to snoop on me or hijack my sessions for non-financial sites seems very low, especially since there's lots more low-hanging fruit on public wi-fi networks.

Post: #15

(04-12-2011 04:20 PM)Arobin Wrote:  

(04-12-2011 03:22 PM)Roosh Wrote:  Arobin there's a popular Firefox plugin called Firesheep which makes stealing cookies a one-click process on unsecured network. A VPN protects against that.

Right, but Firesheep only works on sites that don't use HTTPS. I haven't used the plug-in, but from what I understand, it's not a general purpose tool to hijack sessions on any site. It only works for specific sites it was designed to steal cookies from. The big targets are Facebook and twitter, but both of these sites can be configured to always use HTTPS. If people are still antsy and want to make sure nobody can say, access their flickr account, go for it.

I'm currently traveling and am usually on public wi-fi. I have gmail and facebook configured to always use HTTPS and all my financial stuff is over HTTPS to begin with. The rest (e.g. this forum account) is vulnerable to session hijacking / traffic snooping but I don't imagine any of that is very interesting to an attacker. The risk of someone bothering to snoop on me or hijack my sessions for non-financial sites seems very low, especially since there's lots more low-hanging fruit on public wi-fi networks.

I am concerned about my HostGator account and the files on my HDD. But I think hostgator will be over HTTPS and you are saying that a VPN won't stop a hacker from accessing my HDD?

Post: #16

My blog doesn't use https.

Post: #17

(04-12-2011 04:24 PM)Mystik Wrote:  I am concerned about my HostGator account and the files on my HDD. But I think hostgator will be over HTTPS and you are saying that a VPN won't stop a hacker from accessing my HDD?

Correct. Not that it'll necessarily be trivial for an attacker to get access to your hard drive just because you're on the same network, but VPN does nothing to protect you against those kinds of attacks.

(04-12-2011 04:34 PM)Roosh Wrote:  My blog doesn't use https.

Yep, and so in your case, I agree that VPN protects against significant threats.

Post: #18

As to "why use VPN":

- A lot of sites do not use HTTPS.
- A lot of people share the same password (and even login) across the significant number of sites. A lot of banks assign mandatory logins (like the first letter of the first name + last name)
- Even with HTTPS it is possible to see (without VPN) which banking sites you visit.
- Having a list of your login/password pairs makes it possible to try them on a lot of banking sites, Paypal, gmail, your company email server...

And I'm pretty sure some governments have the ability to intercept (and decipher) HTTPS traffic, and this attempt will not be noticed by you unless you're really paranoid and checking the HTTPS certificate fingerprint manually (this is extremely hard to fake).

Some VPNs are not cryptographically strong (PPTP, for example) and technically can be intercepted even by eavesdropping. I recommend OpenVPN setup which uses client certificates. This is pretty much unbreakable (except by bruteforcing the key) unless you lose the client cert.

Post: #19

(04-12-2011 06:43 PM)oldnemesis Wrote:  As to "why use VPN":

- A lot of sites do not use HTTPS.
- A lot of people share the same password (and even login) across the significant number of sites. A lot of banks assign mandatory logins (like the first letter of the first name + last name)
- Even with HTTPS it is possible to see (without VPN) which banking sites you visit.
- Having a list of your login/password pairs makes it possible to try them on a lot of banking sites, Paypal, gmail, your company email server...

That's a good point. Another way to mitigate this kind of attack is to have a separate password for the sites you don't care about. A better way is to a password manager like KeePass so all your passwords are unique and have high entropy, although this is probably a pain if you use a lot of different machines / smartphones.

(04-12-2011 06:43 PM)oldnemesis Wrote:  And I'm pretty sure some governments have the ability to intercept (and decipher) HTTPS traffic, and this attempt will not be noticed by you unless you're really paranoid and checking the HTTPS certificate fingerprint manually (this is extremely hard to fake).

I don't understand the attack you're describing. You mean the government is doing a MITM attack with a certificate for the site they generated themselves? How would they get a CA to sign it?

Post: #20

Quote:How can a VPN prevent a direct attack on your computer? Attacks are often directed directly at your known IP address. With a VPN account your home computer IP will not be seen, our VPN server IP will be. Luckily our VPN server is behind some of the best known hardware and engineers in the industry who monitor activity diligently and make sure the VPN server is protected.

http://strongvpn.com/firewall.shtml

Arobin,

This contradicts what you said about VPNs being useless if you want to protect the data on your HDD.

Just a sales trick or is there any truth to this?

Post: #21

(04-13-2011 12:44 AM)Mystik Wrote:  

Quote:How can a VPN prevent a direct attack on your computer? Attacks are often directed directly at your known IP address. With a VPN account your home computer IP will not be seen, our VPN server IP will be. Luckily our VPN server is behind some of the best known hardware and engineers in the industry who monitor activity diligently and make sure the VPN server is protected.

http://strongvpn.com/firewall.shtml

Arobin,

This contradicts what you said about VPNs being useless if you want to protect the data on your HDD.

Just a sales trick or is there any truth to this?

I was actually saying VPN won't protect your from network level attacks (i.e. attacks from other people sharing the WiFi network with you). The quote above is pretty much sales bs, though. Attacks are not "often directed directly at your known IP address." That's a "directed attack." In other words, someone is trying to attack you specifically, which is not common.

It'll offer you marginal protection from malware infecting your PC itself, but I don't see it as anything relevant to real world use. Here are some common ways to get infected:

-You visit a web site that an attacker controls (could be a legit site he hacked or you clicked a bad link and got to an evil site) and the web site exploits a vulnerability in your browser and uses it to take over your machine. VPN doesn't help you here because they're hiding your IP from the web site, but they're still forwarding you the traffic that takes over your machine.

-You download a file that's either malware entirely (e.g. Britney_Spears_Threesome_Video.avi.exe) or is a legitimate program that contains a trojan (e.g. you download a pirated version of MS Office that installs correctly, but also installs malware surreptitiously). VPN won't help you here for the same reason as visiting a malicious web site.

-Attackers use tools called "port scanners" to scan computers at random by guessing their IP addresses and checking if the machine behind the IP has any vulnerabilities. Even with a VPN, you still have an IP address and you're just as vulnerable to having an attacker guess it. The VPN will protect you if someone is collecting IPs from a web site or something that you visit and then scanning those machines for vulnerabilities, but that's not very common (it's much faster and easier to just search at random). VPN will offer you protection if someone is trying to attack you specifically (e.g. trying to find your IP from your web footprints) but if someone's targeting you specifically, you're in big trouble.

You'll notice that none of these have anything to do with travel. In all of these examples, the attacker is at a random location on the Internet. The threat you were originally talking about was public WiFi, meaning the attacker is on the same network as you. VPN isn't hiding your IP in this case because the attacker can see your communication with the access point / router. So an attacker can still port scan your machine and look for vulnerabilities, plus he has an advantage because he's on your network and behind your firewall, which gives him more to work with. The only way here I can see VPN helping you is if the attacker wanted to infect you by tampering with your web traffic to inject malware, but this seems pretty impractical for the attacker and therefore unlikely. If an attacker is trying to take over your machine or access your files over public WiFi, it'll likely be through attack vectors that VPN can't protect.

Post: #22

(04-13-2011 10:15 AM)Arobin Wrote:  VPN isn't hiding your IP in this case because the attacker can see your communication with the access point / router. So an attacker can still port scan your machine and look for vulnerabilities, plus he has an advantage because he's on your network and behind your firewall, which gives him more to work with.

But when the hacker sees my communication with the access point and hence, my VPN's IP address wouldn't the VPN provider's firewall act as extra protection?

Post: #23

(04-13-2011 11:44 PM)Mystik Wrote:  But when the hacker sees my communication with the access point and hence, my VPN's IP address wouldn't the VPN provider's firewall act as extra protection?

No, the attacker sees your real IP address (not the VPN's IP address) because he's within the network with you and can see your computer talking to the access point. The VPN's firewall doesn't offer any protection.

Post: #24

(04-12-2011 07:21 PM)Arobin Wrote:  That's a good point. Another way to mitigate this kind of attack is to have a separate password for the sites you don't care about.

Yes, this is the common security practice. Unfortunately it is violated quite often.

Quote:A better way is to a password manager like KeePass so all your passwords are unique and have high entropy, although this is probably a pain if you use a lot of different machines / smartphones.

Using the password manager is a good way to lose all your passwords together with login and web sites if you ever get infected. I don't even use the browser built-in one for anything worth stealing.

(04-12-2011 06:43 PM)oldnemesis Wrote:  I don't understand the attack you're describing. You mean the government is doing a MITM attack with a certificate for the site they generated themselves? How would they get a CA to sign it?

Yes, MITM attack. They do not need CA to sign it, they would have a CA private key. There are two ways to get it.

1. The government can setup a semi-legitimate CA company. Just look at the default list of authorities in Firefox. I have never heard about 70% of the companies there being in CA business. Look, there are two root certs from Wells Fargo, one from VMWare, one from Ford Motors. WTF? Well, there is even one from "Japanese government", they aren't even hiding.

2. The relevant government authorities can "ask" the appropriate companies for a copy of the CA private key - to fight international terrorism only, of course. I'm 100% sure the companies will provide it.

A lot of things changed once we only had Verisign and Twatwe. Now almost everyone could be a fucking root CA. That's why SSL now is only good against script kiddies or lazy sysadmins - unless you are using your own CA.

Post: #25

Wow I really wouldn't post here, but this is one of the things I see almost everyone do wrong.

Why do you need a VPN when using a public wifi?

Everything Arobin said, except instead of happening on a compromised site, anyone on the same network as you can send that zero-day exploit, which no AV will pick up, to you via packet insertion, say when you go to google.com. A few free tools off the internet and anyone with near zero tech knowledge can do this. Once that exploit is on your machine they can do whatever the fuck they want. From a little more advanced standpoint, the compromised machines infect other machines on their own. You don't even need a hacker sitting in the starbucks with you, just someone else who has a compromised machine.

Even without any of that all unencrypted internet traffic is free for the taking. Its common at tradeshows for some dude to sit around and dump all of the free wifi traffic to their hard drive and later go through the treasure trove of passwords that were broadcasted publicly. All these companies have no idea their competitor has been reading all of their email for the past year and has all of their trade secrets.

I don't care where I am, if I'm on a wifi I don't own I'm only running through an encrypted connection.

Of course if you hit a compromised site within the VPN your still going to be screwed. Just use firefox with noscript + adware along with not downloading stupid pirated stuff or clicking on every link in every email you get. This will do more for you than any anti virus software can.

If you have no idea about pc security chances are you are one of the millions of compromised internet users. The difference now is that they want to secretly control your machine to blast out spam message and steal your financial info, not to fuck with your computer and break it (like was popular 10+ years ago.)

Hope this helps someone.