Most VPN Services are Terrible

vpn_psk_bingo.md

Most VPN Services are Terrible

Short version: I strongly do not recommend using any of these providers. You are, of course, free to use whatever you like. My TL;DR advice: Roll your own and use Algo or Streisand. For messaging & voice, use Signal. For increased anonymity, use Tor for desktop (though recognize that doing so may actually put you at greater risk), and Onion Browser for mobile.

This mini-rant came on the heels of an interesting twitter discussion: https://twitter.com/kennwhite/status/591074055018582016

Again I strongly do not recommend using any of these providers.

Provider / known "Secret" Key

Astril / way2stars  
EarthVPN / earthvpn
GFwVPN / gfwvpn  
GoldenFrog / thisisourkey  
IBVPN / ibVPNsharedPSK!  
IPVanish / ipvanish  
NordVPN  / nordvpn
PrivateInternetAccess (PIA) / mysafety  
PureVPN / 12345678  
SlickVPN / gogoVPN
TorGuard / torguard 
TigerVPN / tigerVPN
UnblockVPN / xunblock4me  
VPNReactor / VPNReactor  

Yes, I know. Many/most of these offer OpenVPN, or special clients for IPSec. But for all of the above, they are actively placing a significant portion of their user base (particularly those with older Androids and desktops) at risk by not using per-user PSKs. If your threat model is streaming BBC or helping your cousin geo-shift Hulu, go wild and plug into the Mad Max-esque Thunderdome commons and take your chances. If you're a dissident in Tehran or Riyadh, be extremely cautious of any of these providers.

Lastly, a VPN Hall of Shame honorary mention goes to DoubleHop.me* on general principle for blatant sexism and utter insincerity. Their privacy/legal policy section includes LGBT slurs and literally has your-mom jokes. But even ignoring that, as of this writing, there is virtually zero technical information provided, only YouTube videos apparently intended for 10 year-old boys.

Moral of the story: Don't believe everything you read on, say, TorrentFreak and PCMagazine. And (crucially) think about your threat model—are you guarding against amateur WiFi snoops at Starbucks or Marriott? Reducing identity monetization profiling by ISPs (ie ad tracking)? Minimizing exposure to government surveillance? Trying to be anonymous online? If the latter, a VPN won't help much.

Citations:

https://www.google.com/#q=goldenfrog+thisisourkey Archive: http://archive.is/qlrLK

http://www.gfwvpn.com/?q=node/224 Archive: http://archive.is/EdpFV

https://www.vpnreactor.com/android_l2tp_ipsec.html Archive: http://archive.is/uwJvk

http://unblockvpn.com/support/how-to-set-up-l2tp-on-the-android.html Archive: http://archive.is/4To5Y

http://www.ibvpn.com/billing/knowledgebase/34/Set-up-the-VPN-connection-on-Android-handsets.html Archive: http://archive.is/srptW

https://www.astrill.com/knowledge-base/50/L2TP-IPSec-PSK---How-to-configure-L2TP-IPSec-on-Android.html Archive:http://archive.is/PZpRU

http://billing.purevpn.com/knowledgebase.php?action=displayarticle&id=33 Archive: http://archive.is/R4JTi

https://www.privateinternetaccess.com/pages/client-support/ Archive: http://archive.is/U1bkL

http://torguard.net/knowledgebase.php?action=displayarticle&id=58 Archive: http://archive.is/iKJjl

https://www.ipvanish.com/visualguides/L2TP/Android/ Archive: http://imgur.com/IQU1mdg

http://www.earthvpn.com/android-l2tp-setup-guide/ Archive: http://archive.is/roKtf

https://nordvpn.com/tutorials/android/l2tpipsec/ (scroll down) Archive: http://archive.is/BQumt

https://help.tigervpn.com/support/search/solutions?term=shared+secret+tigerVPN Archive: http://archive.is/xZ136

https://www.slickvpn.com/tutorials/ipsec-for-iphone/ and http://archive.is/h4rI9

*DoubleHop.me: Archive:http://archive.is/G11WQ and http://archive.is/MZgWE and http://imgur.com/Zn5HSIj

@kenkeiter Interesting find on Tunnelbear; Is there any documentation online illustrating how a non-user-unique private key could be used by an attacker?

Perhaps would be nice to mention those providing a per-user PSK. No link with them, just try a lot of them to waste my time :o)

VPN Unlimited - 20 alpha-numeric characters.

Lastly, a VPN Hall of Shame honorary mention goes to DoubleHop.me* on general principle for blatant sexism and utter insincerity. Their privacy/legal policy section includes LGBT slurs and literally has your-mom jokes.

lol, is that a priority for you? Or is this some PC rant you had to thrown in there? Grow up.

As far as those commercial VPNs are concerned, I'm not trying to hide from the NSA or am that paranoid. Hiding from Comcast or any ISP will do just fine, thank-you-very-much.

Besides, using something like Tor will only attract attention from the NSA since they figure that just by you using it, you have something illegal to hide from anyway. They now have you in their sights.

Besides, using something like Tor will only attract attention from the NSA since they figure that just by you using it, you have something illegal to hide from anyway. They now have you in their sights.

The NSA, by that logic, is also scrutinizing the U.S. military since it's a major user of TOR. And yes, the NSA does do that, admittedly or not. It's the CIA's hacking team that now really needs to be considered, however, since it's budget is larger than that of the NSA's in its entirety. It's also completely unbound by even what little law still applies to to the NSA's activities. Or what little law supposedly still restricts it in any way, which is likely none. Still, likely none is possibly more than definitively none.

@gwt10 "Grow up" LOL how ironic

I have to agree with the critics of this piece, which is indeed too vague to use as a basis for any decision. That leaves it in the category of scare mongering.

PIA, for example, recommends OpenVPN for security and offers a 4096-bit certificate to validate the host. There is no PSK for this option and each user authenticates with a unique passcode.

Non-OpenVPN connections are described on a "we also offer" basis along with security warnings:

The PPTP/L2TP/SOCKS5 protocols are provided for devices lacking compatibility with the Private Internet Access application or OpenVPN protocol. PPTP/L2TP/SOCKS5 should be used for masking one's IP address, censorship circumvention, and geolocation.
If you need encryption, please use the Private Internet Application or OpenVPN protocol with our service.
https://www.privateinternetaccess.com/pages/client-support/ios-openvpn-connect

On that basis, I have to doubt the overall quality of your "mini-rant".

@PacketSmuggler:

The only Zero Customer Knowledge VPN provider in operation is Cryptostorm.

Mullvad also doesn't require any identifiable information or email, and accepts Bitcoin.

Hi Kenn,

The URL for Streisand has changed, is now https://github.com/StreisandEffect/streisand.

Cheers.

nothing is absolutely anonymous on the web, in china, using a good vpn probably is the most efficient way to access websites blocked by cn gov, these are the good VPNs which work effectively in china.

Just say: “Hi Kenn, are you aware of Sentinel VPN yet? -
https://Sentinel.co | Medium.com/Sentinel | @Sentinel_Co”

Mike Kuketz found that NordVPN app for Android sends your email address plus the Google Advertising ID to the third party Iterable Inc. during the registration process.
Exodus Privacy confirms that the app contains several wide-spread trackers.

https://www.kuketz-blog.de/android-nordvpn-uebermittelt-e-mail-adresse-an-tracking-anbieter/
https://reports.exodus-privacy.eu.org/en/reports/55961/

Lastly, a VPN Hall of Shame honorary mention goes to DoubleHop.me* on general principle for blatant sexism and utter insincerity. Their privacy/legal policy section includes LGBT slurs and literally has your-mom jokes.

Do you have a source for that? I don't find it on their website.

Yes. It's literally in the sources listed.

they are actively placing a significant portion of their user base (particularly those with older Androids and desktops) at risk by not using per-user PSKs.

Do you mind explaining how that puts users at risk, or link to a page that explains that?

@kennwhite Can you comment on Cyberghost VPN? I've been using it for few years now and it worked well for me and so far I haven't found anybody putting them in the spotlight for something. It was the case for the very famous NordVPN too.. up to now. So now I'm curious about your opinion on Cyberghost.
Thanks!

This strikes me as rather exaggerated. It's not great that some of these VPN services are providing instructions for using a known IPSec PSK in some cases but I'm going to hazard a guess that the majority of VPN customers are using the native app from their service provider, not following those instructions. In NordVPN's case at least, the Windows app is a wrapper around OpenVPN and the Linux client has Wireguard support, so the IPSec PSK isn't relevant. And even in the worst case where someone's using L2TP/IPSec with a known PSK, it's still better than nothing because IPSec provides forward secrecy if you're not being actively MITM'd. As for no-logs policies, I wouldn't necessarily trust them but "possibly logs" is still better than your ISP which "definitely logs."

It seems that PIA does specifically note that if you're in a particularly sensitive position you shouldn't use L2TP or older protocols. They say that you should default to OpenVPN if possible, On my desktop (PIA v2.2 on the latest Win10), the only available protocol options are OpenVPN and a beta version of Wireguard.

Hello,

Can you provide insight into perfect-privacy? I remember using them long, long before VPNs were thought of something for consumer use.

I also knew back then it was the preferred VPN by fraudsters. There are news articles about one there server locations being raided and them unable to find logs.

Thanks!

Doublehop SCAM stole my money and blocked me.

22 Nov: I bought a yearly subscription for $33. I made a payment of 0.00176325 BTC to 18ZcmBksf9GEVxfABYUXUp39oryF7CJkHG for Order ID: 17uGMc. The order did not process.

I sent an e-mail to them. I sent them a WhatsApp message. They said they'd process my order by the weekend.

25 Nov: I pinged them back. They blocked me on WhatsApp.

Scammers took my money and ran away. DO NOT BUY FROM THESE PEOPLE.

I know this list might be old stuff already (?), but what about these ones, anything?

AzireVPN
IVPN
Surfshark

I have been focusing on reviewing the VPN connection speed, it's surprising to read about the pre-shared key issues. I am wondering how to verify is it still a issue in 2022 as this gist was reported in 2016. Now most VPN provider advertise their Wireguard VPN mode. Will this implicitly resolve the disclosed pre-share key issue?

Many countries do not allow the use of VPNs, and it has to be said that the security of VPNs is an issue that many companies should consider.

some VPNs sell your data connection to other customers.

The best VPN recommendations

Thanks, kennwhite, for the heads-up on VPNs! It’s scary that some well-known ones aren’t safe. I’ll look into Algo, Streisand, and Signal. It’s important for us to pick the right one, especially considering using VPN in places like China. And, wow, DoubleHop.me really needs to check their behavior! We all need to pick services that are honest and respect all users.