discussion Free Android VPN all belong to 1 Chinese company

[moocow]

* Insert surprised Pikachu face *

Techspot reporting on a report by Free and Open Communications on the Internet initiative regarding security issue with free Android VPN. Turns out all of them ties back to one company in China. TL;DR, all the apps have the same code base and have hardcoded password that allow people to access traffic.

https://www.techspot.com/news/109132-massively-popular-android-vpn-apps-insecure-all-secretly.html

 

[gingerbee]

Wow, this is crazy, maybe don't use free VPN's eh. It always seemed like a bad idea to me.

 

[JD]

Yeah never really understood any "free" VPN, it negates any security gains as you are willingly handing over all your data to somebody to inspect and data mine to offer this "free" service to you. Hope people were just using them to watch content from different regions and not to do any secure transactions.

 

[Caldezar]

This only scratches the gong show that is the VPN market. In many cases, even paid VPN's are pretty scammy with data mining involved. Lots of people don't even really understand what a VPN actually does and how profile building/fingerprinting even works. Sure you get an IP that doesn't route directly to your location, and masks you from local networks, but that isn't a security/privacy silver bullet. They don't create a magical 'cloak of invisibility' or give true anonymity. And if you still use a single browser with no hardening, then you're still being fingerprinted.

But in general, the rule is that if you aren't paying for a service, then you ARE the product.

 

[sswilson]

But in general, the rule is that if you aren't paying for a service, then you ARE the product.

Very much this, although I'm also not completely sure what real security VPNs provide especially if they're not ones verified log free. I like to think that encrypted traffic going through mine is not traceable, but I'm not completely sure that's the reality.

 

[Caldezar]

Very much this, although I'm also not completely sure what real security VPNs provide especially if they're not ones verified log free. I like to think that encrypted traffic going through mine is not traceable, but I'm not completely sure that's the reality.

This is always the crux. And sadly, 'verified log free' can't even be trusted. In some cases, investigation has found that this is very much not the case, even when reported as such. If they don't have a full scope audit completed by a true 3rd party that THEY DON'T OWN, (this is its own rabbit hole) then I assume they're logging.

 

[Bond007]

crazy, but not surprising. Thanks for posting

 

[Izerous]

In the direction this is going is there any VPN services actually semi-recomended at this point. It feels like most of the ones marketed by various you-tubers have been exposed for something or another etc.

 

[moocow]

I used "That One Privacy Guy's VPN Comparison Chart" to compare what's out there and decided on PIA. There are at least one YT video on this topic but I haven't watch it yet. PIA is rated RED for Jurisdiction because it's in US and part of 5 Eyes. But it doesn't log anything (at least that's what they say).

 

[Bond007]

In the direction this is going is there any VPN services actually semi-recomended at this point. It feels like most of the ones marketed by various you-tubers have been exposed for something or another etc.

I used "That One Privacy Guy's VPN Comparison Chart" to compare what's out there and decided on PIA. There are at least one YT video on this topic but I haven't watch it yet. PIA is rated RED for Jurisdiction because it's in US and part of 5 Eyes. But it doesn't log anything (at least that's what they say).

is Nord not recommended anymore?