'Zero logs' vpn exposes millions of logs including username and passwords in plain texts

[TehDwonz]

6 minutes ago, Kisai said:

the VPN that advertises it doesn't track you, does need to keep a customer database, thus it can be queried by law enforcement.

There are a few cases where this has proven impossible. https://restoreprivacy.com/no-logs-vpn/

Basically, as with all things, you get what you pay for.

 

[dilpickle]

More services in this hack:

 

https://www.theregister.com/2020/07/17/ufo_vpn_database/

 

Also relevant video:

 

 

 

 

VPNs are good for getting around geoblocks and govt censorship and logging into work systems. Other than that I don't see why most home users need them. Advertisers can still track you even with VPN.

[Kisai]

1 hour ago, TehDwonz said:

There are a few cases where this has proven impossible. https://restoreprivacy.com/no-logs-vpn/

Basically, as with all things, you get what you pay for.

 

Do you really think that's going to protect someone from doing major crimes. I doubt it. The point of not logging access is to not allow LEO to compel the VPN to track their users, but nothing prevents the LEO from compelling the data center from doing so. Routers and managed switches can track data.

 

 

[dilpickle]

1 minute ago, Kisai said:

Do you really think that's going to protect someone from doing major crimes. I doubt it. The point of not logging access is to not allow LEO to compel the VPN to track their users, but nothing prevents the LEO from compelling the data center from doing so. Routers and managed switches can track data.

 

 

Exactly. There could easily be a government tap directly at the VPN provider so it doesn't matter what logs they have. We know for certain this was done with some ISPs.

 

And whenever you hear about law enforcement not being able to access something that is usually local jurisdictions. You don't hear anything about what the NSA can or can't do. Nor do you hear about anyone that they help arrest.

 

In the pre-Snowden era this would sound like the rantings of a tin-foil hat crazy person. But now it is simply reality.

 

Nothing you do online can ever be considered private or secure.

[TehDwonz]

21 minutes ago, Kisai said:

Do you really think that's going to protect someone from doing major crimes. I doubt it. The point of not logging access is to not allow LEO to compel the VPN to track their users, but nothing prevents the LEO from compelling the data center from doing so. Routers and managed switches can track data.

 

 

It has been proven, here's one: https://en.wikipedia.org/wiki/ExpressVPN#Assassination_of_Andrei_Karlov

Literally seized the baremetal server. 

[Kisai]

19 minutes ago, TehDwonz said:

It has been proven, here's one: https://en.wikipedia.org/wiki/ExpressVPN#Assassination_of_Andrei_Karlov

Literally seized the baremetal server. 

This isn't proving anything. If the government forces wanted to, they could have dumped the RAM from it and compromised ExpressVPN if they wanted to. https://en.wikipedia.org/wiki/Cold_boot_attack

 

All I'm saying is that people are being overpromised what these services do. Account management is a weak point, payment processors are a weak point, routing and switching equipment is a weak point. Heck they could have compromised the ME/IPMI on the server and just straight up tapped the machine if they knew what they were doing. 

 

Clearly law enforcement is behind the times on exactly how they should go about dealing with VPN services, but if VPN's are used for crimes, then the government of the country can then just compel ISP's to block access to the VPN's, and that's the endgame.