Surfshark, TurboVPN and more are secretly undermining security
From the article: Six major Virtual Private Network firms have been shown to be installing root certificates that could open up users’ computers to surveillance.
In a similar way to Apple’s iCloud Private Relay, VPNs are intended to protect users by routing all data through a trusted service that encrypts personal information. Six of the best-known VPN firms, however, have now been shown to be doing this in a way that could be compromised.
According to TechRadar, the six were uncovered by security research firm AppEsteem. Each installs a trusted root certificate authority (CA) on users devices, and it’s this that can be risky.
“Installing trusted root certificates isn’t good practice,” said Mike Williams, security expert at TechRadar. “If it’s compromised, it could allow an attacker to forge more certificates, impersonate other domains and intercept your communications.”
It means that even if a user is using a service that is itself encrypted, the VPN provider and potentially bad actors, could overwrite that encryption and intercept all data.
The six VPN vendors reported to be doing this are: Surfshark, Atlas VPN, VyprVPN, VPN Proxy Master, Sumrando VPN, Turbo VPN
You almost certainly do not need a VPN.
VPNs do not protect your privacy in the way you assume they do, because most tracking is not done based on IP address.
If you need a VPN, use Mullvad.
E: I’ve never understood why this statement of literal, objective fact makes redditors so mad. VPNs do not prevent you from being tracked. Tracking users via IP is pointless and virtually impossible. If you’re a journalist afraid of government harassment, then yes, a VPN would be useful, but you need to ensure it’s one whose logs can’t be subpeonaed. If you’re a random person worried about Facebook spying on you, your VPN isn’t doing a god damn thing.
Are any VPNs really safe these days? Most of these companies probably save your data and sell it off to other anyway.
People should also stay away from any VPN and software owned by Kape Technologies (Private Internet Access, Express VPN, CyberGhost VPN and ZenMate VPN).
Teddy Sagi (the CEO) has been convicted in the past for bribery and fraud and he has worked with Israeli intelligence agents. The company has a history of pushing out malware, adware and spying on their users.
Some sources:
- Strange Ties: Private Internet Access, Kape, and Crossrider
- Kape Technologies (Formerly Crossrider) Now Owns ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and a Collection of VPN “Review” Websites
- What is Kape Technologies? What you need to know about the parent company of CyberGhost VPN - CNET
- ExpressVPN exec among three facing $1.6 million fine for helping UAE spy - CNET
- https://www.reuters.com/world/us/american-hacker-mercenaries-face-us-charges-work-uae-2021-09-14/
- ExpressVPN employees complain about ex-spy's top role at company | Reuters
- https://cybernews.com/news/expressvpn-cio-daniel-gericke-fined-335-000-for-cyber-espionage/
Then you have this statement from Edward Snowden:
And:
Are they installing root certificates secretly somehow, or are users duped into giving them permission to do so?
NEVER allow anyone to install a root certificate on your devices.
“I don’t know you or your use case, but here’s what I think anyway”
You’re making inaccurate assumptions on the reasons why most people use VPNs. It’s not to “prevent tracking” but to shield their online activity from their ISP and copyright lawyers.
In this respect, VPNs are generally effective, but they introduce a new problem which is that you’re now sharing all your online activity with a sketchy company that likely has ties to intelligence agencies.
I’m not. And if your desire is to hide your traffic from your ISP, I question why you’d feel better routing it all through random third parties.
If you read the entirety of my comment, you’d realize I already addressed the downside. Also that flaw doesn’t negate the intended purpose. It just introduces a new risk/problem.