New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Seems I am vindicated. I can operate 3 ElCheapo vpn KVMs for $36/yr.
Viva LET dealz
Unfortunately, this is probably not a matter of "learning". If you look at the original leaked data, you can see that they're inflating their server count via containers, which suggests they never had legitimate intentions to begin with (although that probably won't come as a surprise to many people).
Also, people should really stop using VPN services in general. There's really no reason to believe that any of the other services is more secure or competent; all the providers consistently fall over the moment a security researcher looks at them a bit funny, and it's ultimately all the exact same (flawed) product with a different coat of marketing applied.
nordvpn lawsuit waiting...
blame it on the "calvin".
“They spent millions on ads, but apparently nothing on effective defensive security"
That's not IDEAL but I would most other VPN providers will run the same way.
So expect ANOTHER breach.
Hello,
You seem to be from the near future.
Welcome to 2019!
Containers does provide better isolation then none at all, but yes, they should go with dedicated servers.
If you are under a country that monitors your actions closely or blocks your access to certain websites, VPN may be your only way out (China for example). VPN does provide better anonymity then your ISP.
Best would be to setup your own private VPN on a server and use it.
Public VPNs are just that, public. Even if they promote "private access", they are still shared by users so are public in nature. Ofcourse if you want your traffic to be mixed with public traffic, this is the way to go
I might have believed that the containers were for isolation, if it weren't for the fact that they proudly claim that each container is a separate "server" with absolutely zero transparency on what's really going on.
One of the more interesting VPN providers I've found that tries really hard to do things right is AzireVPN.
They go as far as to detail exactly how they setup their physical servers, which includes removing all drives and sealing everything but the network ports, and then just PXE booting their config. https://www.azirevpn.com/docs/environment
Don't have many PoPs, but find it funny that a small provider with 0 budget at least owns their gear and makes an attempt to physically secure it.
Another one I have always found to be pretty transparent is IVPN.net. Not cheap though. If only they supported streaming services, they would be my only provider.
For VPN, I mostly use WindScribe. It is an excellent VPN.
Recently I am trying out TunnelBear.
@MechanicWeb and some others
Your "I use" ... "good experience" stories (or recommendations?) are cute but utterly worthless unless you have proof or at least tangible and credible evidence of a VPN providers honesty and quality. And NO, a providers assertions are not evidence but marketing.
Do yourself a favour and read @joepie91 's post again.
Appreciate the notion.
I still believe a VPN has its uses other than security.
lmao
iLO accessable from public network with default password of root:calvin
Holy duck, this gave me chills. I’ve been using them a lot, especially their Japan and Finland locations... for stuff.
quack quack motherfucker
My mind immediately went here--some fries, motha fucka!
RAM is also unsafe
AHAHAHAHA, they were using OpenVZ, not even KVM! What separate server? Thats just a container with limited isolation.
Which sane Datacentre would put out IPMI on a public IP by default? And from what I read the DC still see no problem with that? Wow.
Look a bit more and you find industrial control's without any password protection in the web.
There are loads of google dorks to identify these sorts of things, a quick browse on LinkedIn and you can see they value their brand ambassadors and brand evangelists much more than their operational support. Only one person tagged to them on LinkedIn had anything security related, and even then, he is doing brand management.
Is this really just a containerised mess? It was only a matter of time before one of these "big" "hyped" brands were owned, and this is minor compared to what it could have been. Imagine taking ownership of the locations host node, dropping into VZ containers, performing a significant scale MiTM attack and compromising many users traffic.
I'm glad I roll my own openvpn setup, although I did pick these up to see if their speeds were any better than I was able to fine tune myself. It isnt.
And I'm sticking to my personal PiVPN with Pi-Hole. Protected and ad-blocked, just the way I like it.
No, LXC.
Still, every container is identical so if one gets popped they'll all get popped anyway.
Francisco
There is no 100% safety guarantee. No matter which provider you choose, it can always come to hacker attacks.
The problem wasn't evil hackzors. The problem was utter, dramatic, mind-shattering ignorance and incompetence both of the DC and NordVPN.
At least TRY to think before dropping something here.
Let's use EA's logic.
They weren't hacked. It was just a surprise intrusion.
They weren't hacked, it was just an unannounced, no-cost penetration test.
The question whether were hacked might actually be interesting. Is it "being hacked" when a company that pretends to sell secure services uses an utterly incapable moronic DC and is incapable and moronic themselves?
Probably you are right and they were not hacked.
Without lube.