What do you think of our signup process? - <AUTHOR> http://siasto.com <comment><USER2> Maybe this is a common marketing technique, but I had (and still have) no idea what the site does. "reinventing teamwork" sounds interesting, yet it still doesn't tell me much. Don't get me wrong; I do appreciate the minimalism. However, you're asked to enter quite a bit of information before you know why.

One alternative is to start the user out with sample projects and tasks (like Trello does).

One other thing: the "invalid password" message when creating an account is not very helpful.

<comment><USER3> I second this viewpoint. Maybe you should try the no-login tryout of the product like Stripe?

<comment><AUTHOR> Thanks Chris, good point. We'll look into that in future.

</comment></comment></comment><comment><USER4> Nitpicky, but I do have some small suggestions:

1) +1 for needing a button to continue after typing my email

2) should add a distinct focus state for the buttons, so when I Tab to them I can tell it is selected.

3) the password I entered ('test') wasn't accepted, which is fine, but the error message didn't say why. (It said "invalid password", could have said "password must be 8 chars")

4) You asked in the signup flow who I worked with, and then asked again when I first see the dashboard (on the "Create A Team" tab)

5) "Who are you working with?" requires a 3 char name. If I put in a 2 char name, e.g. 'IK', the box flashes with no explanation.

6) I'd probably remove the adding tasks step of the wizard, and instead put a big label / arrow pointing to the New Task button

Also, the layout feels unbalanced to me. I would greatly prefer the orange bar to extend across the screen, instead of only showing on the left side.

Overall, I dig it though. Nice work!

<comment><AUTHOR> Thanks for the detailed feedback!

</comment></comment><comment><USER5> First impressions - this is really good

There were only two places were I got a little stuck for a second:

\- Front page after typing in my email address: there wasn't a button for me to click so I poked around for a bit, then just hit 'enter'

\- Creating my first project, I tried to just type in one task and hit 'all done' but it forced me to type in three which I didn't expect to have to do

<comment><AUTHOR> Thanks Amir -- very helpful!

</comment></comment><comment><USER6> I'm really not sure what to think here. The cynic in me thinks that HN is being trolled. It's not as if this is a link to a blog post about your sing up process -- it's a link to a page with eleven words, two of which are dedicated to explaining what this actually is. If I were someone who wasn't really interested in any feedback, but rather wanted to game HN in to signing up for my product, this is one way I could accomplish my goal.

I'll give you the benefit of the doubt in saying that I do not intend this to be an accusation. I had a look at your HN profile and it definitely looks like you've been participating in a positive way.

My only feedback would be this: I can't be the only one who is completely unwilling to provide even my email address on a web page with such little detail. So at step one, the process is broken. Put something up. Anything. Some small amount of detail with a screenshot, diagram, or graphic relevant to the product. Otherwise many users won't make it past the first step.

<comment><AUTHOR> Thanks for your honest feedback. We will have to include a proper marketing site very soon, so it's clearer what siasto is; in future I'll have to be clearer in my notes and mention that this is a work and collaboration tool. My intention was not to simply generate signups. Signups for us will not be useful if they don't stick around!

<comment><USER6> Thanks for the reply. I know it's a small thing, but the ability to reply to a comment like mine with a perfectly level head says a lot about the character of your company.

I want to make clear to anyone who comes behind to read this that I believe you. Anyone with questions should take a moment to look at your profile.

Kudos to you guys and good luck with your product!

<comment><AUTHOR> Thank you!

</comment></comment></comment></comment><comment><USER7> \- The front page needs to offer me at least a one paragraph overview of what the service is.

\- Center-aligned text inputs don't work for me

\- the first few steps felt fine, being 'forced' to give details of team members etc started to annoy me: I started thinking "just either tell me what it is now, if it doesn't exist, or let me get on to playing with it". I gave up at that point so don't know if there was a working service at the end :-)

</comment><comment><USER8> \- If you don't enter an actual email address it doesn't provide you with feedback about the mistake you made.

\- Also, buttons should tell me what's going to occur when I click them.... not what will appear on the next form page.

So instead of "Create password" for your first form which has no password screen, you ought to put "Next" or "Enter Company Info".

\- I think you should signify somewhere how many steps are in the process.

\- Instead of a generic 'Sign up', you might want to think about identifying what information each page is supposed to get out of the user such as "Company Info".

<comment><AUTHOR> Do you think if it said: 'now create your projects' or 'invite your colleagues' it would be clearer?

Thanks for your feedback.

<comment><USER8> Do you mean as the button or as the title for each page?

<comment><AUTHOR> as the button.

</comment></comment></comment></comment><comment><USER9> Quick and fluid and mostly self-explanatory. Only two things that threw me off to a small degree:

\- Angry Birds avatars. Maybe it's just me, but I'm not a fan.

\- The prompts to enter the initial to-dos; reading them made sense, but reading a multi-line description then typing over the same multiple lines (in multiple input boxes) was a little disorienting.

Also, more content on the front page would be great. Turns out - I've been exploring my team's options in terms of services similar to this one, but I had no idea that this is something I might be interested in until I already signed up.

<comment><USER10> I didn't care for the Angry Birds avatars either, luckily I did find just how easy it is to change because it motivated me to click around :)

</comment></comment><comment><USER11> You need a tiny bit more colour on the homepage to me. It's an off-white-pink on my screen (looking at it on a mac in chrome). Or maybe some kind better shading. That's just my one gripe. Otherwise pretty easy to set up and get started. Do you need other people to sign up too in order to use it, or can they use the site as a guest? Don't have an issue with the angry birds avatar, actually makes me want to change it, and is probably in keeping with the whole thing being more lively than dreary old "work". Good luck with it.

</comment><comment><USER12> A couple of things

\- No clear 'what to do' on the first page

\- Not enough validation errors. I typed in something weird and it didn't present an error. Just a refresh of the page. Maybe a blinking of a field in some cases.

\- Where there were validation errors, it doesn't provide feedback on the type of input is acceptable (password)

\- Last page of the project creation, 3. Create tasks, there was no clear indication that those were text input fields.

<comment><AUTHOR> Noted, thanks a lot for taking a look!

</comment></comment><comment><USER13> Looks clean but I'm not sure what I am signing up for. There is no validation on forgot password. You can just hit enter and it says a email was sent.

<comment><AUTHOR> Thanks for taking a look.

</comment></comment><comment><USER14> The guided nature of the signup process is oddly effective. I say "oddly" because I just signed up, but I had no idea what your app does. I had some guesses, but no solid idea.

So I would say that the interface is nice, but the experience needs work because I'd have like to get some context before being asked to enter tasks.

<comment><AUTHOR> Thanks for the feedback.

</comment></comment><comment><USER15> I think its needlessly complex. Why do you need three screens to get email address, password and some data ? Also, since each screen simply asks for more fields, users will be frustrated. Of course, all this assuming users are going to signup by looking at two words : teamwork, reinvented.

</comment><comment><USER16> Password length seems to be limited to < 20, which is way too short [1].

[1] <http://www.codinghorror.com/blog/archives/000360.html>

</comment><comment><USER17> At first glance, I thought it was just another email collection page.

If the call to action was instead "Try it now," I would get the impression I could satisfy my curiosity immediately.

<comment><AUTHOR> That makes sense. Thanks for the feedback!

</comment></comment><comment><USER18> Smooth and effortless -but I had no idea where it was going. So I bluffed. Finally I was asked for tasks to be performed - entered one and couldn't continue. That was the end for me.

</comment><comment><USER19> It's very clear what I'm supposed to do: +1

I will never ever enter my email address without knowing what it is for and what you are going to do with it.</comment>


Fake Steve Jobs on Chrome OS - <AUTHOR> http://fakesteve.blogspot.com/2009/07/lets-all-take-deep-breath-and-get-some.html <comment><USER3> "Because Chrome is shit. Just utter, utter shit. I mean they've got all these big brains at Google and you'd think they could make a decent fucking browser. Jesus, the freetards at Mozilla can do it. But not Google. Nope. They gave it their big best effort and what did they come up with? Chrome. It's a joke."

Seriously? Maybe I'm missing the satire or hyperbole here, but I really don't see it that way. Chrome on Windows is one of the fastest, most stable browsers I've ever used. And minus plug-in support, it's getting better on the Mac every week (I haven't tried the Linux version). When add-on support is added, I see no argument at all for calling it shit or a joke.

<comment><USER4> I'll just assume the whole SF thing applies to you too on that one. Just like most people don't give a shit about what OS they use, most people don't really care about browsers either.

I have never had issues with Firefox, I don't care one bit about Javascript speed and honestly Chrome is underfeatured to the point where I think I'm using NCSA Mosaic. I gave it a shot. I was back to Firefox before lunch.

I see there is a hype there, but I just don't get it. The post is clearly hyperbole and overly sarcastic, but to _me_ and stuff which matters to me, Chrome actually is shit. I'm not buying it, even though it's free. I might even go for MSIE before Chrome.

For the same reason, a OS where Chrome is the only browser* would be 100% DOA on my hardware.

* Rumour has it that Google wants to ditch X. If that is the case, no other GUIed *nix software will run without a rewrite.

<comment><USER5> All of those criticisms apply to Safari 4, tho.

<comment><USER6> ...which is why Safari is also not very popular in the mainstream.*

* [http://www.techcrunch.com/2009/07/05/since-march-internet-ex...](http://www.techcrunch.com/2009/07/05/since-march-internet-explorer-lost-114-percent-share-to-firefox-safari-and-chrome/)

</comment></comment></comment></comment><comment><USER7> It always amazes me how the best social commentary comes from those who have the least to lose. Without the artificial constraint of professionalism (or, I guess, the need to be factually accurate), Lyons somehow manages to be more honest and credible, not less.

Take his Fake Steve piece on the Microsoft-Yahoo merger: [http://fakesteve.blogspot.com/2008/02/ballmer-im- completely-...](http://fakesteve.blogspot.com/2008/02/ballmer-im-completely- out-of-ideas.html) which I felt was the most succinct and insightful piece on the subject from any journalist.

<comment><USER8> Exactly. If you don't let the style distract you, Fake Steve is actually the most sensible and sharp tech journalism around. This is the first non- hyperbole analysis of Google's announcement I've seen today.

My bet is that Chrome OS will have similar impact to the Chrome browser - encourage everyone to step up their game, but not dominate the market. Google has a lot of money and a lot of bright people, and it acts just like a bright person with little financial concerns: It toys with a lot of ideas, many of them brilliant, but rarely bothers to execute them fully. An OS takes years of frustrating, boring work to mature, I doubt Google has the focus for that.

<comment><USER9> They put years of frustrating, boring work into Google search, Maps, Mail, Chat, Calendar, Reader, etc.

Why should we doubt their ability to stick with a Linux Windowing and Usability project? This 'Google is unfocused. Google doesn't follow through. Google leaves projects to rot' meme is particularly annoying, because there is so little evidence that it happens to anything on a significant scale.

Several of their large acquisitions have appeared to be neglected, but each and every time that I can recall, it's been a seeming public neglect followed by the introduction of the 2.0 successor.

Case in point: if you think their social networking acquisitions are being left to rot, vs their energy being focused on new services that integrate with WAVE, I've got a bridge to sell you.

<comment><USER8> There's also Froogle, Google Notebook, Blog search, Google Video and there's still no way to delete a GAE app... My view is that, unlike what much of the media seems to assume, Google and other huge companies aren't executing some secret Harry Seldon-like plans to conquer the universe - they just do a lot of stuff, sometimes it works and sometimes not. (Eg: Sun paying $1b for MySQL. Conde Nast paying actual money for Reddit's "Crowd wisdom". Bebo acquisition and most everything else AOL does.)

As for their social networking acquisitions vs WAVE, I'm completely ignorant on both (and expect to remain so, along with most of humanity).

But my main point isn't Google, but FSJ's tech coverage. Between Techcrunch & co hysteria and The Register's empty cynicism, I think FSJ's piece remains the best analysis of the Chrome OS announcement yet.

<comment><USER9> Froogle's been continually updated, even if it's not very good it appears to be as good as comparable products. And blog search is largely integrated now. (One wonders if it's worthwhile to maintain the distinction at all, now that Google's algorithm has a better 'understanding' of blog-style posts and links.)

Google Video and Notebook are good examples of projects that seem to linger and rot, but are in fact just having their energy devoted to their successors. Google Video development is being channeled into Youtube updates and Notebook into WAVE-based document creation.

And the only reason I didn't respond to your comment about FSJ's analysis is I agree with you 100% on that. Lyons' is without a doubt the most insightful and interesting commentary thus far.

I just think the 'Google is unfocused/fickle/etc' meme needs to be approached critically and put out to pasture if it's found wanting. (which i believe it is)

</comment></comment></comment></comment></comment><comment><USER10> "nobody uses Chrome" [http://gs.statcounter.com/#browser-ww- daily-20090708-2009070...](http://gs.statcounter.com/#browser-ww- daily-20090708-20090708-bar) losing to safari by .05? I understand its a joke... I just didn't laugh. They also say they are planing on starting with netbooks, not only targeting netbooks. I do think its a good niche market to target first though since there isn't as much of a dominance and since netbooks target low prices, removing the windows cost might make it a better seller.

All and all I think google and apple use different marketing strategies, so perhaps Jobs wouldn't understand googles strategies. Is interesting that although google makes 60% the total revenue (2008) their gross profit is very close.

<comment><USER11> The joke is to portray Steve Jobs as someone who doesn't respect Adsense as a product.

</comment></comment><comment><USER12> Microsoft is shipping Windows 7 without a web browser in the EU, after several years of legal fuss largely because they bundled a browser with their OS.

I wonder if Google will consider shipping Chrome OS without a web browser in the EU?

<comment><USER13> I seriously doubt Google will be charging any money for Chrome.

<comment><USER14> So? Microsoft has never charged for any version of IE.

<comment><USER13> I meant Chrome OS.

If MS Windows is given away for free on new laptops, by filling the OS with banner ads and then bribing manufacturers to bundle it, would the EU still require IE to be removed?

</comment></comment></comment></comment><comment><USER15> For people who hate this article, can you please share why you hate it instead of just saying it sucks?

It was meant to stir things up obviously, but I thought that the various points brought up were really valid.

<comment><USER16> The biggest point in my mind:

"You also may not have noticed, but nobody uses Chrome. I mean think about it. Do you know anyone who uses Chrome? Really?"

Aside from the stat-based argument (<http://news.ycombinator.com/item?id=694756>): I've been repeatedly surprised by the non-technical people around me who are on Chrome. My girlfriend downloaded it literally the day it came out, when I had read just a blog post or two about it. My parents, various friends' parents, the list just goes on and on, and none of them are nerds. It's startling how effortlessly Chrome has permeated public consciousness.

I don't hate the article, but I think fake steve jobs has jumped the shark.

<comment><USER17> It still has a pretty mediocre takeup rate, regardless of the people around you that are using it. The latest stats I've seen (posted on HN) have been that Chrome is less used than Safari. FF seems to be the bigger winner at the cost of IE.

<comment><USER16> Dude, how long has each been around to grab marketshare? Chrome is absolutely meteoric when you divide by time.

</comment></comment></comment></comment><comment><USER18> This is very well written (which is defined as not quitting after the first 3 paragraphs) and the first FSJ post I've read.

</comment><comment><USER19> I'm firm in my belief that at least one of the main reasons for Chrome was to kick things up in the browser market, rather than a serious attempt to grab browser market share. "Look, you're doing it all wrong, just give it here a moment... ok, you can have it back now." And it worked - Apple, Microsoft and Mozilla all scrambled to include some, if not all of the features that identified Chrome, which were the features that made it use Google's services more effectively.

I'm fairly sure that a part of this (and, to a lesser extent, Android) is a similar deal.

<comment><USER20> I would have agreed with you once, but I changed my mind since Google started advertising Chrome like crazy. You can hardly use a Google service these days without having Chrome suggested to you somewhere prominently. It seems like Google is really pushing Chrome to the mainstream. Whatever their reasons, they _really_ do want to capture a significant portion of the market for it.

<comment><USER21> It's a long way to "capturing a significant portion of the market".

What they _can_ do is reach some of the Internet users in dire need of an upgrade, like IE 6 users who trust the Google name, and get them to use a reasonable browser.

Not that that explains why Google had to invent their own browser. But their target market was average Internet users, so they might as well try to get them to run it.

</comment></comment></comment><comment><USER22> I wasn't sure if this is article should be taken seriously.

He pointed out that Google is targeting netbooks. He himself stated 11 million netbooks were sold last year and will be 39 million this year. The netbook category is a growing market that it would probably account to a substantial share in a few years.

Another is that "Chrome is shit." He probably has never used Chrome. I used the browser exclusively now unless I have a need to use Firebug in which I use Firefox instead.

I guess he's trying to be funny but he fell way short.

<comment><USER23> It was written so that the reader can take any given point and either embrace it as brilliant insight or disregard it as satirical Fake Steve humor.

I mean, the end of the piece entirely contradicts the earlier points... If Chrome OS is pointless and ineffectual -- occupying market niches that Apple isn't even interested in -- why should Fake Steve feel so threatened by it?

(BTW, he claims the 39 million netbook figure in the article is for the next _four_ years, not next year, implying that the netbook market is minuscule compared to desktops, laptops, and phones.)

</comment></comment><comment><USER24> some of it actually makes sense. how is google going to make money from this?

<comment><USER25> I know that I'm probably wrong.

Sergey Brin and Larry Page are _neeeerdddssss_ , not business school kids that decided to make a web app.

There is a good chance that they're doing this just because it's really really cool, and because they can. I imagine that if I ever had the sort of cash that they have, I would be doing the same thing that I do on the weekends NOW, but on a larger scale: geekery.

Building a linux distro is geekery of the highest order. Good for them. Google makes billions and billions of dollars from their other projects. This is one that they can figure out later. :). (or I can figure it out for them now: adsense, lots of it.)

I understand that google is a publicly traded company; they have shareholders to answer to, but I imagine that all they have to do is point at their earnings and go "trust us, guys...trust us".

If anything, this will drive more traffic to their moneymakers.

<comment><USER26> There is probably some truth in what you say, albeit i wouldn't go so far to say that they're just nerds. They're business nerds, or they wouldn't be where they are today.

Also, i'd really appreciate if people would stop calling it a "linux distro". It makes as much sense than to call OS X a "BSD Distro"

</comment></comment></comment><comment><USER27> Guess I'm the only one that finds this not very funny.

<comment><USER28> Maybe one is not enlightened enough to fully understand its brilliance?

"Ours started out 20 years ago, at NeXT. You could say it goes back to 1977, with the BSD guys. Heck, you could even say it goes back to 1969 with Dennis Thompson and Lionel Ritchie."

<comment><USER27> I "get" it, but the delivery falls flat like a stand-up comedian that makes the audience uncomfortable because no one is laughing. At least that's how it is in my head.

</comment></comment></comment><comment><USER29> I know that Google says that GCOS is "aimed at Netbooks", but I'm sure that that's supposed to be just the _initial_ target platform. So I think that the criticism that the netbook market is so small as to be meaningless will turn out to be moot.

Also, the precedent for this is probably the SplashTop and the (upcoming) Crunchpad.

</comment><comment><USER30> > Linus Tordalv started working on Linux back in 1991 when he was a high > school student in his native Denmark. That's nearly twenty years ago, and > the shit still doesn't run right

That's kind of ironic when you that his own blog on blogspot runs on linux.

<comment><USER15> he probably means as a desktop OS. UI for a complex system like the OS is incredibly hard to nail

</comment></comment><comment><USER31> Google's approach vs. MS or Apple's approach to product development offer an interesting contrast - feature rich apps vs. feature-poor but faster/stabler/simpler apps. Betting on a faster/stables/simpler OS is a worthy and possibly successful endeavor. Atleast it offers another alternative.

</comment><comment><USER32> The thing that is bothering me about the Fake Steve Jobs piece is that Google aren't creating a new operating system. It's Linux, tuned for the tablet environment. If anyone knows about tuning Linux, it's the Google engineers, they tune Linux for millions of machines.

</comment><comment><USER32> Why is everyone assuming that this is supposed to be a full computer? It isn't. It's an internet portal tablet. It is optimised for a purpose - <USER2> the browser on the screen with the smallest amount of intermediate steps as possible.

</comment><comment><USER33> If chrome OS takes away another 1 or 2% of IE usage, that's a big enough of a win for google and everyone else

</comment><comment><USER34> I love Fake Steve. I'm so glad he's back. If only the real Steve were so forthcoming.

</comment><comment><USER35> Fake Steve: "First of all, nobody seems to appreciate how goddamn hard it is to make an operating system."

From the Google blog: "[GOS is Chrome running] within a new windowing system on top of a Linux kernel"

So they're not building an OS from scratch. Did Fake Steve even read the post?

</comment><comment><USER36> That is, quite literally, one of the better things on the Internet.

</comment><comment><USER37> I made a rebuttal to the Fake Steve Jobs on my Chrome OS blog here...

[http://www.chrome-os-blog.com/fake-steve-jobs-on-googles- chr...](http://www.chrome-os-blog.com/fake-steve-jobs-on-googles-chrome- os-73/)</comment>


Don't Use VPN Services - <AUTHOR> https://gist.github.com/joepie91/5a9909939e6ce7d09e29 <comment><USER3> While it's true that your VPN provider _may_ be lying about their "no logging" policy, at a minimum, you get additional layers of protection. Your source IP is masked. A subpoena would be required to reveal your source IP, and perhaps your VPN provider is telling the truth about not keeping logs. If your VPN endpoint is in a different country than your network endpoint, then the legal obstacles get even higher.

Surely you shouldn't depend on that alone. Tor would be a wise additional layer of protection, if applicable. But to suggest that you get no privacy benefit at all from a VPN is like saying your host may be compromised, so you might as well use regular telnet rather than SSH.

<comment><USER4> Yeah, I hate extreme opinions that say not to do something just because it's not 100% effective. It's like saying don't bother using a lock because all locks can be picked and cut anyway.

<comment><USER5> I consulted to an organisation that spent multiple years refusing to allow any form of MFA.

Everyone agreed it was extremely important and some password protected data was very sensitive. But the conversation about authenticator apps always got bogged down with risks about malware on phones. I would get asked "will you stake your career on it never happening?" Of course not. Therefore "for security reasons" we never supported authenticator apps. Of course it was pointed out that people might lose hardware tokens, so they didn't happen either. Because mobile MFA isn't perfect, I had directives to stick with easily phished passwords for years.

<comment><USER6> > I would get asked "will you stake your career on it never happening?" Of > course not.

"Let's make a bet over whether a customer reports an authenticator app gets hacked before a customer's account without an authenticator is broken into. If the authenticator app is hacked first, I'll resign. If an account with no 2FA is compromised, you resign."

<comment><USER7> This is probably just meant to be a joke, but I have been in that situation before and I don't think offering to gamble away your job would be an effective way to convince others to accept your advice on risk management. I still don't know how to effectively convince others to take on new risks in order to avoid bigger risks presented by the status quo. Given the additional risk that my risk assessment is deficient, doing nothing is usually the easier decision.

<comment><USER8> _I still don 't know how to effectively convince others to take on new risks in order to avoid bigger risks presented by the status quo._

I think you just need to be talking to someone who can understand the risks you convey, has the responsibility for both risks and the authority to effect the necessary change.

IME that's straightforward in most small companies and in large government departments it's rarely one person but multiple committees of people who you'd never be able to explain the risks to and who won't make a decision.

Feel my pain?!

</comment></comment></comment></comment></comment></comment><comment><USER9> "... because the provider can see all your traffic!"

However, if you don't use a VPN: Your ISPs (Broadband, coffee shop, whatever) can see all your traffic!

20 years ago I passed _ALL_ my traffic on my laptop through a VPN, I just happened to run my own. But back then much less of the standard traffic was encrypted. Now, pretty much all web traffic is encrypted. So that makes the VPN less of a concern, IMHO. Depends on what you're doing though...

There was this one time I went to Defcon. Installed a scratch laptop for it. The firewall on it would only allow DHCP and OpenVPN on the physical interfaces.

<comment><USER10> Exactly - I trust my VPN provider not to use or abuse my traffic data (websites visited, DNS queries, etc) more than I trust my ISP (Comcast)

<comment><USER11> VPN companies are explicitly built on reputation for not doing that. ISPs don't give a damn about reputation and are usually a monopoly, or the other options are just as bad.

<comment><USER12> What reputation? Where is the dispensing of knowledge? And how do you know violations are evening coming back to the surface? With the ease of starting a new service, and the typical anonymity of who is running it, I don't believe one bit in being able to let the decentralized world determine is trustworthy here. The space is full of shady operators.

<comment><USER7> We don't know that all violations are coming to the surface, but we can be pretty sure that if there are VPN honeypots then they are either obviously sketchy services or part of an expensive, sophisticated, secret and therefore targeted attack. Based on their website and other public information (like their WireGuard advocacy), I think Mullvad is more trustworthy than the average ISP, which in turn is probably more trustworthy than the average fly- by-night VPN operation.

</comment></comment></comment></comment></comment><comment><USER13> I mention this every time this comes up but it's info worth spreading... "sshuttle", make any server into a VPN without VPN server-side software, this takes the pain out of doing your own VPN, gives you far more obscurity, lots of flexibility and in my experience it also performs much better - which I believe is due to the TCP deconstruct-reconstruct vs traditional VPN which does TCP over TCP. The only disadvantage is it's only for TCP (no UDP or multicast).

For routing all your internet it's as simple as this (on the client only, no server setup):

        sshuttle -r email@example.com 0/0

That's it... server requirements are met by almost anything, you don't need root access, but it does need python, which most distros have by default. Now you can use your own little obscure server, yes it's not invulnerable a VPS provider can still look at you if they wish, but it's far less of a target than a purpose built consumer VPN provider.

It's also far more powerful for slicing up and mixing subnets or only routing specific targets ... for example unblock a specific site, but don't re-route other traffic:

        sshuttle -r firstname.lastname@example.com sci-hub.tw

[edit]

Minor issue worth mentioning, not to disappoint people trying this out - it's currently necessary to use the -x option to exclude the server itself from being routed on Linux, I think this is due to a kernel bug? which is a little annoying, hoping this will go away eventually. This is not relevant to BSD or Mac, although on Mac you have other kernel bugs to worry about in XNUs network stack.

        sshuttle -r firstname.lastname@example.com -x 22.214.171.124 0/0

[edit]

As "icelancer" has pointed out bellow, please note that using your own server ties your activity to your identity more definitively if you are the only one using the server and you pay for the server in your name. Not being a purpose built consumer VPN makes it a less likely target through significant obscurity, however in the event it IS targeted, it's uniqueness will make it easier to associate activity with you via the VPS provider.

> This also ties your identity to a provider definitively. That's fine, as > long as you tell people that's what is happening. A good consumer VPN that > isn't a garbage one offers plausible deniability.

<comment><USER14> These days WireGuard is just as easy to set up, and has lots of benefits over sshuttle (it's UDP based, supports roaming a-la Mosh, has a much more solid cryptographic design, and so on).

<comment><USER15> From the WireGuard installation instructions:

"Generate a private and public key pair for the WireGuard server:"

"umask 077 wg genkey | tee privatekey | wg pubkey > publickey"

"This will save both the private and public keys to your home directory; they can be viewed with cat privatekey and cat publickey respectively."

"Create the file /etc/wireguard/wg0.conf and add the contents indicated below. You'll need to enter your server's private key in the PrivateKey field, and its IP addresses in the Address field."

That's not within reach of your average computer user.

<comment><USER16> > That's not within reach of your average computer user.

Same for sshutle.

<comment><USER13> I don't think anyone is under the delusion that non-technical users are going to use sshuttle, but not everyone has the will to invest the time and effort doing server side configuration of a VPN client for their personal use. sshuttle makes it simple for anyone who is the least bit familiar with ssh and has some kind of server access or is happy to spin up a VPS quickly, nothing more is necessary.

<comment><USER14> There are plenty of scripts online that make it incredibly trivial to set up WireGuard (here's mine[1]). This isn't like configuring OpenVPN -- it actually only takes a minute or two to set up.

Given that WireGuard is headed for inclusion into Linux mainline soon, it probably would be a good idea for folks to take a few minutes to learn how to use a technology that is going to be part of core Linux.

[1]: [https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...](https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg- enroll)

<comment><USER16> There are scripts To install OpenVPN in 5 minutes as well so Wireguard has absolutely no advantage there.

<comment><USER14> Well yes, but OpenVPN has many dozens of different options and my experience with it is that it's a pain in the ass to get the right set of options (on both the client and server) which result in minimal latency and maximum throughput.

But you're quite right that if you already have a config that you know works, WireGuard has no _significant_ advantage in this area (in terms of ease-of- configuration -- though the keys being quite short is nice for SSH-like key distribution). But if you're starting from scratch then you need to first figure out what is the right configuration to use (or you need to pick from the many dozens of "set up OpenVPN quickly" scripts) and then you need to hope that your configuration is not insecure.

WireGuard can be set up and work just as well as any other configuration without a script in a couple of minutes (or less than a minute with a script). The script that was linked in a sister comment to "set up OpenVPN quickly" also sets up Apache for god's sake...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> This post makes good arguments, but there's a very real reason to use a VPN provider over your own server - plausible deniability. With a VPN your traffic is mixed in with many, many other users', whereas with your own server, any traffic coming from that IP can safely be presumed to be yours.

<comment><USER18> When the vpn company is subpoenaed because someone saw suspicious traffic coming out of their servers, regardless of the number of people, the logs and connections would point directly to you.

<comment><USER19> This only applies if their claim to keep no logs is false; some have demonstrated in court that their claim is true.

<comment><USER20> Why not use Tor? Isn't its whole purpose to solve this problem in a trustworthy way?

<comment><USER21> I'm no expert on Tor but when I researched it years ago, it seemed like your privacy on tor was only as safe as the exit node you happen to go through. If you're in North Korea trying to get out and happen to go through an exit node run by the NK government, they could theoretically decrypt your traffic in some cases. If all the nodes you're going through are theirs, then they know exactly who you are even if they can't inspect the traffic.

Edit: I must stress I'm not an expert, and would love to hear if the above is wrong.

<comment><USER14> No, that's not entirely true. No single node in a Tor circuit knows both who the user is and what site they are going to. In order to compromise a user's anonymity, you need to do a traffic correlation attack (where you look at packets going through both the guard node and the exit node and match up the timing of packets). There are some protections against this attack in Tor (guard nodes are not changed often by clients, relays need to be running for a long time in order to be permitted to be guards, and there is some randomised traffic sent to the guard by the client) but it is definitely not a solved problem.

But of course, if you aren't using TLS then your traffic is not encrypted as it leaves the pipe. So obviously you should use TLS over Tor.

</comment></comment></comment></comment></comment></comment><comment><USER22> Other reasons you might want to use a VPN:

* Geoblockers - Much media content is blocked based on geolocation, specifically geolocation based on your IP. (Netflix, Youtube, etc.)

* IP blacklist - I know a few people that have inherited a blacklisted IP simply through unlucky ISP IP allocation.

* ISP logging - So not a hostile ISP, but one that actively tries to log your data. (If you live in Europe, this is almost definitely happening. Apparently in the US ISPs even sell this data.)

* Speed - A few people report being able to get a faster network connection. (I'm not entirely sure why this is the case, but I can imagine there being edge cases where this is possible.)

Setting up your own VPN is NOT solution to every problem mentioned here, especially if you want to switch server location on a whim or are not technically minded.

<comment><USER7> I often get really slow download speeds from the GitHub CDN, which my ISP must not peer with or something. My ISP has faster routes to most of the rest of the internet, including some VPN endpoints, so a VPN can be used to cut out the bottleneck and allow me to download large binaries off GitHub at 2 MB/s instead of 80 KB/s.

<comment><USER23> GithHub uses S3 for artifacts. If your typical S3 download speed is ~80KB/s, I suspect it would be a similar story for Cloudfront, in which case a huge part of the Internet would be painful to use...

<comment><USER22> < 80kB/s is what a large majority of the internet experiences with page viewing times is excess of 30 or 60 seconds...

<comment><USER23> Been there.

</comment></comment></comment></comment></comment><comment><USER19> The primary reason people use VPN services, which articles like this always fail to address, is best illustrated at this URL: [https://iknowwhatyoudownload.com/](https://iknowwhatyoudownload.com/)

<comment><USER24> Okay, so I just checked this out, and there is a non-zero amount of child porn on the list. Is my roommate downloading CP? Is there any other explantion?

<comment><USER25> keep an eye on that list, the last seen column should tell you if this is current of ancient activity, if he/she is seeding, correlating this with times your roommate is home (or his/hers pc on) should give you a good idea of whether this is him/her or someone else sharing your IP. Another such file coming up on that list is a strong indicator as well, and could help you even if he/she is no longer seeding. Keep in mind that remote control of a torrent client is possible. If you control the router you could try getting a new IP. All this without downloading the actual file

<comment><USER24> Thanks for the advice I'll keep an eye on it. As far as I'm aware he's home basically 100% of the time so that unfortunately doesn't help narrow anything down lol

</comment></comment></comment></comment><comment><USER26> [https://thatoneprivacysite.net/#detailed-vpn- comparison](https://thatoneprivacysite.net/#detailed-vpn-comparison)

Sure, you're always trusting a VPN at their word that they don't log, the above gives a detailed analysis of which ones you probably shouldn't trust. You can always host your own: [https://github.com/n1trux/awesome- sysadmin#vpn](https://github.com/n1trux/awesome-sysadmin#vpn)

You can also VPN chain (l2iptables), tunnel over TLS, etc. That gist post is pretty dumb imo

<comment><USER27> The post is targeted to those who are not sufficiently technically adept to know of these techniques.

<comment><USER28> How many non-technical people read things on github? I'm seriously wondering, because whenever I see a link to something posted on github I always assume that it's intended for an audience with some technical understanding. I know that some laws and what not have put up onto github to provide easier access, but it never seemed like that non-technical people started using it.

<comment><USER29> I think if someone shared it to their facebook, a non-technical user wouldn't be much less likely to read it than say a medium article. Non-technical users don't really care about the domain.

Certainly most readers of github are technical, but that doesn't necessarily make it less suitable for non-technical people.

</comment></comment></comment></comment><comment><USER30> This actually reminds me of an episode that happened to me many years ago. Back then, it was "web anonymizers" (not VPN providers) that were all the rage. These programs would maintain a database of open proxies, and route peoples' web activity through those proxies.

Well, I had Apache misconfigured just long enough to get picked up by one of these apps. For years afterward, my server logs were chock full of attempts at logging into various accounts via HTTP. I seriously had thousands of Yahoo! username/password pairs just sitting in plaintext inside my server logs.

</comment><comment> S-E-P > And remember that it is in a VPN provider's best interest to log their users > - it lets them deflect blame to the customer, if they ever were to get into > legal trouble.

Hmmm? If you don't have record of it, the courts don't do much, at least in the US. If they subpoena you, and you don't have logs, nothing ever comes out of it. Outside of fines and things of that nature.

> The $10/month that you're paying for your VPN service doesn't even pay for > the lawyer's coffee, so expect them to hand you over.

How do you think insurance works, or why airlines habitually overbook? A trivial word problem if you will: If you had 10,000 users, you were subpoena'd and only 100 users did anything worth prosecution, that's what. For one lawyer, drinking a $10 coffee (or two $5 dollar) every week day for a month. that's 20 days, $200 a month. $2,400 annually. Assuming in this example only 1% of your users need defending, that's 99% of your coffee budget you don't have to worry about! For 10,000 users, a yearly subscription pulls in about $1,200,000 (we aren't doing any adjustment for taxes and all that garbage). If 99% of your users are behaving themselves.. or at least not doing something bad enough for the courts to take notice (which in the digital age, things like piracy are white noise) that means you still have $1,188,000 to help you in those, typically blanket cases (i.e. a court case in which 20 of your users were downloading illegal movies, and MGM got really upset). Since if you aren't logging, these infractions are dealt with in aggregate usually, since it can't be quantified. So number of lawsuits < bad users.

That's not bad, if all your lawyers needed was coffee monthly, then you could support, with 99% of your users cash, 495 lawyers coffee for a year! more than enough coffee to defend your business. Don't forget you can still use the "blood money" you got to buy them coffee!

The basic principle behind my oversimplified, and somewhat tongue-in-cheek example was to remind you that insurance is a lucrative business. I wonder how they survive if your monthly cost for liability (up to $500,000) isn't $500,000 per month!?!

</comment><comment><USER31> Reposting the last response I gave when this article came up.

\----

> Your IP address is a largely irrelevant metric in modern tracking systems.

I don't believe this for one second.

Your IP address on its own is not sufficient to identify you. That doesn't mean your IP address is not helpful in identifying you.

If you have Javascript disabled, it is a heck of a lot easier to identify you with a combination of an IP address, user agent, and OS than it is to identify you without the IP address cutting down the pool of potential visitors.

On top of that, if you're targeting me and do a geo-location of my IP address, it will get you within 5 miles of my house. That's close enough that you'll know which county I'm in, which with a few other easily-obtained pieces of information will let you pull up my voter registration, which will give you my exact street address.

Of course, you could mitigate this by setting up your own VPN on something like Linode, but unless you're regularly rotating IP addresses, you've just traded a pseudo-identifier that multiple people/devices share for a persistent identifier.

This argument comes up all the time, and I have never heard anyone explain it in a way that passes my sniff test. If you want me to stop using a VPN, you need to do a lot better than just claiming that IP addresses don't matter -- you need to show some kind of evidence to back that up.

\----

Broadcasting your IP address to every website you've ever visited is a completely valid concern that gets hand-waved out the wazoo whenever this subject comes up.

I've sent bug reports to sites that publicly tied IP addresses to comments/accounts so anyone could track your movement patterns over time. Yes, that info can be useful to an attacker trying to deanonomyze you. Yes, that info can be used to link users together. Yes, that info can be used to narrow the pool of potential visitors so other fingerprinting techniques are more powerful.

It is blanketly ridiculous to claim that an approximate county-level geolocation isn't a useful data-point to attackers. If IP addresses weren't useful, the Tor project wouldn't be going to such lengths to hide them.

<comment><USER32> > Of course, you could mitigate this by setting up your own VPN on something > like Linode, but unless you're regularly rotating IP addresses, you've just > traded a pseudo-identifier that multiple people/devices share for a > persistent identifier.

This actually happened to me. I'm using a persistent VPN (50% to access my private infrastructure and 50% because I have a hostile ISP).

I mostly don't use any Google services (maybe one google search a month and the occasional google map search but I avoid when I can) and I was very surprised when once I did a google search and saw my postal code at the end of the page. The IP address was for a VPS (in the same city but with a different post code). I found it unusual but didn't pay too much attention. A few months later I moved places (different post code) and after a while google had my new post code at the end of their search page. That's when I found it troubling and assumed that a family member's iPhone was using Google Maps and based on the 'directions' usage they figured out that that IP address has a home address for those GPS coordinates. (The iPhone in question is reasonably 'hardened' with background updates off and location services only 'when app opened' and disabled for most system services). That was the only plausible correlation between IP address and location google could have done automatically - neither I nor the said family member no longer login to old google accounts we had many years back.

That's when I started rotating IP daily (which is trivial in my case as I use lightsail, I issue a shutdown from a different server and then a power on, AWS rotates the IP automatically out of a very large pool - so far I haven't gotten the same IP twice).

The only problem I have with lightsail is that I often get a 'dirty' IP so I rotate 4-5 times before getting a good one (I test this by going a curl on a website that sends google captcha on dirty IPs but lets the 'good' ones straight in).

</comment></comment><comment><USER33> I use a VPN because I want a proxy, and for e.g iOS it seems a VPN is the easiest way to set up a proxy.

The article lists several reasons to use VPNs but isn't the biggest one these days simply to circumvent geographical content limitations for online services such as video streaming? Nearly everyone I know has used a VPN service at some point, and if you asked any of the non-technical ones what it _is_ they might say "a think that lets me watch the game broadcast when I'm in another country".

People want proxies and the VPN providers provide VPNs that work like proxies. I can't really see the downside to using the VPN as a proxy?

</comment><comment><USER34> A terrible summary of why VPNs are useful. Goes on and on about privacy with no mention of bypassing censorship. It must be nice living in a place where you don't have to worry about access.

There's no point in privacy without access.

</comment><comment><USER35> The title should be renamed to "Don't Use 3rd Party VPN Services".[1]

On-prem VPN deployments with solutions like AlgoVPN[2] from TrailOfBits is still very useful. Let alone mass majority of the the corporate IT's internal VPNs that is required for some workforces to perform their jobs remotely on public Internet.

[1]: [https://gist.github.com/joepie91/5a9909939e6ce7d09e29#gistco...](https://gist.github.com/joepie91/5a9909939e6ce7d09e29#gistcomment-2197521)

[2]: [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

<comment><USER36> I've seen a complete lack of arguments for why anybody should use Algo or Streisand. I don't see the point. If you don't trust VPN's, why trust literally anybody you choose to host a VPN, especially if there is arguably even less anonymity to be had.

<comment><USER35> > If you don't trust VPN's

That's the exactly the misnomer that the title didn't do justice. Of course you MUST trust VPN in order to make sense of using it. The differentiation is whether that VPN is some 3rd party manage it or you manage it on your own. With 3rd Party VPNs you have no idea how they setup it and no transparency how they secure the VPN node. If you manage your VPN node on your own, you have full control what algorithms and configuration you are using and you pick the right node in an "secure" environment, all are risks factored into the big picture.

<comment><USER36> > If you manage your VPN node on your own, you have full control what > algorithms and configuration you are using and you pick the right node in an > "secure" environment, all are risks factored into the big picture.

No, it's the exact same situation. Or do you happen to know exactly how whatever hosting provider manages the server you're using? They can be trusted exactly as much as VPN providers. There is no real security once you're using systems that you don't own, but there are benefits to using a VPN that can't be realized if your name is on the box.

<comment><USER35> > No, it's the exact same situation. Or do you happen to know exactly how > whatever hosting provider manages the server you're using?

It's not exactly the same. In the case of cloud providers, you know what you are getting into and mostly having the freedom to setup your own VPC, your VM image, your firewall, even secure boot/TPM stuff, etc.

As far as the data security goes, many Cloud vendor provide data encryption at rest with your own keys (Of course data security in transit for a VPN, that goes without saying). This is even MORE true for Corporate ITs since they own and operate their own data centers and hardwares too (even with popular trend cloud computing migration).

Just think about it, if public cloud vendors can get government contracts (DoD/CIA/NSA), then they can ensure security at a high bar. But keep in mind that security is NEVER an absolute term, so your argument to me are moot.

</comment></comment></comment></comment></comment><comment><USER15> "There is no way for you to verify that, and of course this is what a malicious VPN provider would claim as well. In short: the only safe assumption is that every VPN provider logs."

This is demonstrably false; look at any VPN provider that was subpoenaed and unable to produce documentation.

</comment><comment><USER37> >Because a VPN in this sense is just a glorified proxy. The VPN provider can see all your traffic, and do with it what they want - including logging.

This is a tautology. If you use it as a proxy, then its a proxy. VPNs arent for this, and so are bad at it.

VPN use case is either to securely leave a network (hotel Wi-Fi, airport wifi) or to securely get to a network (home resources, corporate resources). If you want a proxy, find a proxy.

<comment><USER38> Proxy is securely leaving the network. There is no real difference in the principle of operation besides the protocol(SOCKS vs OpenVPN, etc.)

</comment></comment><comment><USER39> What about just setting up your own VPN on a cloud provider or a raspberry pi? You'd still be responsible for the traffic flowing through but at least you wouldn't have ISP logging, get around geoblockers, keep a secure connection in public WiFi's, fantastic for devops people who want to have local connections for debugging networking things on aws/gcp/cloud providers, etc...

I think you mean that you shouldn't think of a VPN as an anonymous traffic tool like they advertise.

<comment><USER40> Where do you connect that raspberry pi? At home, you're using your own IP and ISP still.

</comment></comment><comment><USER41> What a myopic viewpoint. ISP's can and do sell customer data:

www.cnbc.com/amp/2017/03/28/congress-clears-way-for-isps-to-sell-browsing- history.html

It's doesn't take a logical leap to infer that a company whose entire purpose and business model is to provide anonymization as a service is less likely to sell out its own customers than the ISP's.

Yes VPN's can log despite claiming they don't. But the well known ones are highly incentivized to do as they claim because lying would destroy trust and would ultimately destroy their business. Governments are also more likely to target giant national ISP's than some VPN provider whose servers are in some very liberal and consumer leaning countries outside the US. Also securing your own VPS on the internet and managing it without getting pwned is well outside the expertise of most people and is probably not recommended.

</comment><comment><USER42> Although I agree with the general notion, social proof and a good track record are not bad indicators. I will always recommend Mullvad if you are looking for a VPN service that is trustworthy. I think VPN services that advertise a lot are a little sketchier, though surely some of them _must_ be decent... maybe PIA?

<comment><USER43> I use pia, they are inexpensive with plenty of traffic to blend with.

</comment></comment><comment><USER44> Before anyone buys a vps from Lowend talk like he recommends, most of the providers on there are trash-tier and massively over-sell their services which is why they seem cheap but performance ends up very poor. And why would i trust a vps vendor with 10 customers over a VPN provider?

</comment><comment><USER45> Use to have this view,now conceded that a vpn provider with good reputation and accountability is best. Your local ISP sell whatever data or inject whatever content thet desire,and your rights mean little if your contract stipulates they can sell this access to a 3rd party and this 3rd party can then resell analyzed or raw data to anyone including your own government. If you perform methodical risk analysis,you will find having the ability to damage reputation of your first-hop provider is an ideal leverage. Never negotiate from a position of weakness (e.g.: ISP or Tor exit nodes)

</comment><comment> bloody-crow Even if you assume that VPN provider is listening and analyzing all your traffic, it's still preferential to your internet service provider doing the same thing. Fost starters, the internet provider just knows more about you. You probably have a contract with them, they know your exact physical location and they have your SSN. A malicious actor from within internet provider having access to all this information could potentially blackmail you by revealing your porn logs to your spouse, or your unsavory private reddit history to your employer etc.

Second, your VPN provider could be in a different country, and that would make data mining your traffic slightly less interesting to them. It'd also make data acquisition via subpoena of some sort from your country slightly more bureaucratic.

Third, if you have reservations about your VPN provider, you can just cancel your account and go to a different one. Changing VPN providers takes 5 minutes, while changing internet service provider can take months, or in some cases might not even be possible.

</comment><comment><USER46> This is silly.

Most people use VPNs to get out region restrictions.

These are getting more and more common due to local governments making laws that affect the whole internet - think GDPR - that individual site owners do not want to abide by so they block IPs. VPNs solve this very real problem for those still wanting access to the content.

They're also used for subverting content region licensing. For example, with Netflix.

<comment><USER47> Or using it to tunnel to a more torrenting-friendly region.

<comment><USER48> I can't believe VPN can give you acceptable speeds for torrents tho...

<comment><USER36> I've downloaded games over Steam at full speed over my VPN...

<comment><USER48> Steam downloads have nothing to do with torrents.

<comment><USER36> Come on. My point being - VPN isn't the limiting factor here. It's the people you're downloading from. If you can't see the connection I can't help you.

</comment></comment></comment></comment></comment></comment><comment><USER49> Off topic but — anybody know a good/recommendable vpn service that supports MacOS without requiring third party software and which allows inbound access to the external ip associated with the service ...?

I need to ssh back to my laptop frequently because of some annoying restrictions with a service provider I use (heroku). I _can_ do shenanigans with ssh tunneling on a publicly accessible server I control - but it's actually pretty annoying to work that way in my scenarios.

I've tried a few vpn services that offer "static ips" but the services I've tried filter inbound connections to that ip ... does anyone know a good vpn service that can effectively gives me a public IP address so I can make inbound connections to my developer machine while I'm random shitty coffee shop WiFi ...?

</comment><comment><USER50> "remember that it is in a VPN provider's best interest to log their users - <USER2> lets them deflect blame to the customer, if they ever were to get into legal trouble"

Disagree. It is always easier for the legal team to say, "sorry we don't store the logs" as a way to absolve themselves.

</comment><comment><USER51> The title is misleading because the article focuses on using VPN providers to obfuscate traffic when this is one use case of VPN technologies. The gestalt types of VPN usage are:

* Remote Access VPN: Connect to resources on your corporate network. An example of this is you're in a coffee shop on holiday and need to access a corporate resource.

* Site-to-Site VPN: Connect networks on two sites together. An example of this is you're in a branch office and need to connect to a resource in HQ.

Note that VPN providers give you a limited Remote Access VPN to _their network_ , which they control. They can do whatever they want to your now- decrypted traffic before they send it out to the internet. If you want to obfuscate your traffic, Tor is a better candidate.

<comment><USER38> Quote: > Note: The content in this post does not apply to using VPN for their intended purpose; that is, as a virtual private (internal) network. It only applies to using it as a glorified proxy, which is what every third-party "VPN provider" does.

<comment><USER51> I agree with you - the gist does have a caveat. The title is still misleading as _VPN Services_ is too broad for the gist's content.

<comment><USER52> "Service" here refers to a service in the "company" sense, not in the "system daemon" sense. Legitimate VPNs are typically run on one's own network, not outsourced to a third-party service.

</comment></comment></comment></comment><comment><USER53> Being able to use airport wifi (or other public wifi) is actually a pretty big deal IMHO.

I really value not having to constantly leave my phone on, blasting my location to anyone who cares to ask.

[https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hu...](https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hunter-300-dollars-located-phone-MicroBilt-zumigo-tmobile)

(I self host my VPN, so I'm fairly confident the provider isn't going to jeopardize their entire business model to add extra analytics. Sites I visit get the IP of the VPN, and conversely my ISP sees my traffic going to a random server in Denver. It's win-win.)

<comment><USER54> How often do you rotate the IP on the box you're proxying through?

<comment><USER53> It's for security, not anonymity.

I use Tor if I want anonymity.

</comment></comment></comment><comment><USER55> >There is no way for you to verify that, and of course this is what a malicious VPN provider would claim as well. In short: the only safe assumption is that every VPN provider logs.

If the VPN provider has been ordered by a US court to produce log information, and they have appeared in court responding that it is not possible for them to do so as such logs do not exist, and the court has accepted this as true, that is adequate 'proof' in my eyes. It is something which puts them in the position of being extremely legally liable for in a way that advertising 'no logs' does not, since prosecution for false advertising is a joke.

<comment><USER56> I know I'm going fully into the realm of conspiracy theories here, but history has shown secret court orders are a thing. VPN's are the perfect honeypot for law enforcement agencies, they wouldn't want to lose this every time they bust someone. So put on a nice show that they can't get the logs, then secretly order them to log.

</comment></comment><comment><USER57> I agree with the content, but I would recommend dsvpn instead of the suggested solutions.

[https://github.com/jedisct1/dsvpn](https://github.com/jedisct1/dsvpn)

<comment><USER58> It's great, but has no Android support atm. Gotta stick with Wireguard for now.

</comment></comment><comment><USER9> Aside: 15 years ago all of our employee laptops passed all of their traffic over our own VPN. One of my employees wanted to quantify how much having all our traffic go to our server space was slowing it down.

He ran a series of tests comparing latency and throughput of directly visiting sites on his home Comcast connection, vs. the VPN. Generally, the VPN was significantly faster.

I wasn't entirely surprised by this. Our facility had multiple high quality connections (Level-3, InterNAP), and one of those traffic optimizers that would add intelligence beyond just BGP.

<comment><USER59> That is my experience today. My Linode is a lot closer to things on the Internet than my Spectrum connection. For example, if I ping the US/Central Overwatch server, it's 50ms from my home connection and 20ms from my Linode (which is 11ms away from home).

It is sometimes as much as 26ms to the first hop after my router, though, which is pretty amazing. That's enough time for light to travel 5000 miles.

</comment></comment><comment><USER60> The biggest value I've seen from VPNs is when certain networks block SSH. This happens to me all the time when staying in hotels. For my work I need SSH.

I've also had edge-cases where I need to obscure my country of origin. For instance, I couldn't stream Game of Thrones via Hulu/HBO Go this Summer while in Mexico. For some reason, Mexico is blocked. My VPN solved that.

For security? It's unlikely to help unless I am on an unsecured wireless network or something like that. Good read nonetheless.

</comment><comment><USER61> Now, with DoH, VPNs will be nore relevant if you don't trust our IPS.

Today, if you change you DNS to another resolver, your IPS won't bother because majority will not change and you can pass under their radar.

With DoH, IPSs will be forced to log filtered/mapped IP requests so they can keep doing whatever they're doing today with DNS queries.

So, when DoH matures, IPS won't see your DNS queries but it won't matter for them any more as they will be seeing all other requests

</comment><comment><USER62> > ... with increased adoption of CGNAT and an ever-increasing amount of > devices per household, it just isn't a reliable data point anymore.

I know this is not a popular stance on HN, but ipv4 has built in casual anonymization, whereas ipv6 had built in casual identification. Both systems are defeatable, but what bothers me about ipv6 is that the invasion of privacy is the default.

Coincidentally, Google, Facebook, et all are pushing ipv6 very hard.

</comment><comment><USER63> This reminds me of the "don't use sms for 2fa" arguments.

</comment><comment><USER64> This is focused purely on people who think VPN is for privacy/security. I use a VPN to get around geo-fencing - in Australia there is a lot of media agreements that mean you can't watch stuff here that is free elsewhere without paying for cable or a local streaming company. A small VPN with multiple exits so I can watch content that is free in the US and EU markets.

</comment><comment><USER65> This is BS, VPN is an legitimate service and many people rely on such services to do their things, it may pose some potential security issues, but in most cases, it won't cause big harm to you even when your credentials leaked.

Just try to use a very random username and password, payment can set to pay as a VCC or one time method.

</comment><comment><USER66> Do random routing features like SecureCore of ProtonVPN add some value? I think they do in terms of anonymity.

</comment><comment><USER67> These arguments all assume that ISPs are more trustworthy than VPN providers.

One of these markets involves competing on security and privacy. One of them involves colluding on influencing FCC policy.

So even if a particular VPN provider is inept or corrupt, my expected return on the investment is higher than trusting TWC.

<comment><USER52> > One of them involves colluding on influencing FCC policy.

That is an extremely US-centric view.

Aside from that, physical ISPs have something to lose, as they have a very real infrastructural investment; whereas becoming a "VPN provider" literally does not entail more than "rent a few servers, run OpenVPN, buy a billing system license, hire a marketing guy".

It's entirely viable for a VPN provider to just disappear overnight and set up shop under a different unrelated name at virtually no cost to them, if their old brand gets burned. That significantly changes the trust equation, and not in favour of VPN providers.

<comment><USER68> > physical ISPs have something to lose

Unless they're a (natural or artificial) monopoly, like... pretty much every ISP in North America is. Comcast has the reputation of, well, Comcast, and they're doing just fine.

> Becoming a "VPN provider" literally does not entail more than "rent a few > servers, run OpenVPN, buy a billing system license, hire a marketing guy".

Yes, that's a _good_ thing: it means that VPN providers, unlike telcos, are under _selection pressure_. Which means that for VPN providers, unlike telcos, reputation actually means something; the top VPN provider is striving much harder for your dollar than the top telco is.

Certainly, don't pick a VPN provider at random, but you wouldn't anyway.

<comment><USER52> > Unless they're a (natural or artificial) monopoly, like... pretty much every > ISP in North America is. Comcast has the reputation of, well, Comcast, and > they're doing just fine.

Once again, that is an extremely US-centric view.

> Yes, that's a good thing: it means that VPN providers, unlike telcos, are > under selection pressure. Which means that for VPN providers, unlike telcos, > reputation actually means something; the top VPN provider is striving much > harder for your dollar than the top telco is.

Except that isn't how the industry works, _at all_. Virtually all "reputation" that VPN providers have originates from paid product placements (see: the myriad "VPN reviews" that are chock full of affiliate links, YouTube ads, etc.), and providers are _assumed legitimate unless shown otherwise_ by default.

This means that said "reputation" is 100% reproducible under a new brand without ever having a single long-term customer vouching for you. There's no competition on quality; the competition is on marketing only.

Exactly why the industry has turned out that way and doesn't follow the "competition breeds quality" narrative that people on here love to put forward, is left as an exercise to the reader.

<comment><USER68> > Once again, that is an extremely US-centric view.

It's a Canada-centric view, for me. :)

But seriously, does anyone _care_ about VPNs outside of North America? Why would you, if your ISPs aren't awful? Do most VPN services even bother to advertise outside of the North American market?

> This means that said "reputation" is 100% reproducible under a new brand > without ever having a single long-term customer vouching for you.

Why pay attention to word-of-mouth reputation, when _survival_ under competitive pressure is a much more objective signal of reputation of its own?

If the bad actors need to restart with a new brand every few years, then why not just look for the oldest brands around (who must therefore have done this the least), and then sort those by the number of negative news articles you can find about them (which _should_ exist, given that they haven't laundered their brand-identity much)?

It's the same thing you do to figure out who to order from on AliExpress: look at who's put themselves out there the longest while doing active business, without accruing negative ratings in the process.

Or, as well, it's the same thing you do when deciding whether it's worth it to try out a new restaurant in your neighbourhood: you give it a few months, and if it's still around, then it's probably good.

</comment></comment></comment></comment></comment><comment><USER7> Can (2015) be added to the submission title? This hasn't been substantially updated since then.

<comment><USER69> Why would it need to be?

<comment><USER7> The opinions expressed in the article aren't new to me, but I thought the fact that I saw them on the front page of HN implied that they were becoming increasingly popular or there was some new development (eg. confirmation of certain VPN providers being honeypots). If I had realised this was just a link to a discussion that happened a few years ago and had no real impact on the general consensus among IT experts, I wouldn't have clicked on it.

</comment></comment></comment><comment><USER70> A slightly less breathless analysis from Krebs (2017):

[https://krebsonsecurity.com/2017/03/post-fcc-privacy- rules-s...](https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should- you-vpn/)

</comment><comment><USER71> How about when you get a VPN from a country that has strong privacy laws due to bad experience with local snitches and which doesn't have intelligence- sharing treaty with any other country (including US) - like Romania. Wouldn't that be safer?

</comment><comment><USER72> I don't get how using a VPS is any better than just going without anything? It's got the exact problem as the VPNs...just shifts the end point.

Would there be any benefit in using a number of VPS round robin style? I've got access to a handful...

<comment><USER18> Simply layers obscurity, it would be harder to subpoena multiple companies than a single vpn service. (Plus you "own" the vps and can quickly delete or create new services whenever) Before you browse, create a new vpn box, browse..., then delete the box after use. What logs, what box?

<comment><USER72> Doesn't really get me any anonymity - first VPS box in the chain still has my name on it (credit card history etc).

Not that it matters - fortunately my traffic isn't all that exciting

<comment><USER18> Well if you are really after anonymity, you have to also keep in mind your isp and browser fingerprinting and the million other things that can expose you online. :)

<comment><USER73> Any way to spoof and inject random browser parameters to poison your fingerprints?

</comment></comment></comment></comment></comment><comment><USER74> I use a third party VPN service to get around the fact that my residence comes with broadband that hijacks all DNS and routes all HTTP (port 80) connections through a Squid...

I also feel sharing an IP with many other users adds to the level of anonymity.

<comment><USER75> > I use a third party VPN service to get around the fact that my residence > comes with broadband that hijacks all DNS and routes all HTTP (port 80) > connections through a Squid...

You could set up a local resolver to NXDOMAIN specific IP address replies. Dnsmasq has an option for this. Regarding Squid, what makes you sure your VPN services doesn't do the same?

> I also feel sharing an IP with many other users adds to the level of > anonymity.

Can you explain how you feel this adds anonymity? There is still potentially a record of you using that shared IP at a certain time to do a certain thing, so what is your threat model in which the VPN helps anonymity?

</comment></comment><comment><USER76> If you want privacy use TOR+VPN. TOR for anonymity, a VPN for a "clean" breakout IP. Oh, and make sure to pay for the VPN using a form of anonymous payment. And, make sure that your devices won't give up your identity.

Anonymity is actually pretty hard...

<comment><USER77> VPN is just fine if you want to avoid dragnet surveillance, though choose a less popular one. If you are actually the target of a nation-state level adversary then yeah install Tails and use Tor but know that you're probably fucked.

</comment></comment><comment><USER78> I need an IPSec VPN a couple times a year to get around network issues. Trouble is, when I need it, I can't connect to it to buy it, and I don't want to pay for it year round. Pay-as-you-go IPSec would be great.

</comment><comment><USER79> that's an astonishingly idiotic argument, most of what he talks about also counts for your ISP too. They might log everything too and not tell you about it, but at least my ISP never made their whole business case around protecting my privacy.

And also what exactly would be their incentive in building up their infrastructure to facilitate this logging, do you have any idea how much storage space each VPN node in their network would need just to log everything?

And even if they were to log everything you are still sharing a IP with hundreds of other people making you less identifiable to at least the websites you are visiting.

100% FUD

</comment><comment> to-too-two I'm way out of my element here, but would it be plausible in the future for say, Firefox, to offer a simple and free VPN like service? Something in the vein of incognito mode (it's UX simplicity).

<comment><USER80> Firefox is testing a VPN, and you can try it right now [https://www.theverge.com/2019/9/11/20861381/firefox- testing-...](https://www.theverge.com/2019/9/11/20861381/firefox-testing-vpn- mozilla-private-network-test-pilot-program)

Mozilla tests Firefox VPN service to help protect your privacy [https://www.cnet.com/news/mozilla-tests-firefox-vpn- service-...](https://www.cnet.com/news/mozilla-tests-firefox-vpn-service-to- help-protect-your-privacy/)

</comment></comment><comment><USER9> I've always been amazed at the prices I see for the VPN services, they seem improbably low. Which makes me wonder where they make their money.

<comment><USER43> Bandwidth is cheap.

</comment></comment><comment><USER81> The author admits in comments that this is clickbait. Not much to see here except "the providers you trust might not be trustworthy."

</comment><comment><USER82> It would be nice if there were an independent auditing organization that could confirm an ISP's claims.

</comment><comment><USER83> one thing that was not mentioned- your ISP logging your data. Too much of my data in my ISP's hands is not a good thing. I'd rather tunnel out through a "trusted" 3rd party server then give all my data traffic to Comcast or whatever.

</comment><comment><USER84> I wholeheartedly agree and I am surprised to not see Tor mentioned as an alternative.

</comment><comment><USER85> Hehe, at least someone is talking about it. Online privacy is a dream in the 2010s

</comment><comment><USER86> Seems to be from 2015

</comment><comment><USER87> Says a person living in a free democratic society...

<comment><USER88> That's a fair point of cause, but if you need a VPN to hide from your government, then you need to be extremely careful about which VPN provider you pick. Potentially your VPN provider could be forced to, or voluntarily, hand over data to your government, without your knowledge, leading to a dangerous false sense of security.

You certainly shouldn't be running your own VPN either, because that would be much easier to track, seeing as your traffic isn't mixed in with that of others.

Those of us in free democracies have little need for VPN providers. For those who do not, I'm not sure that I'd trust a VPN provider how targets gamers via YouTube ads.

</comment></comment><comment><USER89> Fantastic post. I've long given up trying to explain this to morons paying for NordVPN and similar products.

</comment><comment><USER90> Is 188.8.131.52 a dependable VPN?

</comment><comment><USER91> If it is necessary

Run....your....own....vpn

</comment><comment><USER92> Use a VPN and a proxy.

</comment><comment><USER93> "unless you are on a hostile network"

Which I consider my ISP.. no, I can't just change ISP, I live under five eyes. I don't get a choice.

This article is rediculous. It's just a clickbait title and a whole bunch of ranting saying the exact opposite.

</comment><comment><USER94> Wasn't this already recently posted?

Also, it's a _terribly_ constructed article, genuinely terrible. Completely wrongly assumes a specific threat model that isn't accurate for the target audience.</comment>


LG TV logging filenames from network folders - <AUTHOR> http://rambles.renney.me/2013/11/lg-tv-logging-filenames-from-network-folders/ <comment><USER2> The implications are troubling. Your TV collects and broadcasts for the permanent record of anyone who can snoop the cleartext (your neighbors, your ISP, whatever the NSA looks like in your country, etc) all the media it can find on your network.

We used to need firewalls at the edges of our home networks to keep bad actors out. Now we need firewalls that point the other direction to keep the bad actors on our networks _in_.

<comment><USER3> Good firewalls should always block unwanted traffic whether it's inbound or outbound. This is not anything new, but you're right that most people trust the devices they own. Not anymore.

<comment><USER4> Good luck making that easy for the end-user to configure.

<comment><USER5> Yep you've basically refuted the idea of personal security due to a vague insinuation of how "most people" trust their electronics. Or did you have anything constructive to add?

<comment><USER4> Sorry, I should have said:

"Historically it's been very difficult to make detailed firewall configuration user-friendly. As a result, we've lived with the simplistic compromise of 'allow outgoing connections, don't allow incoming connections'. It seems like it's going to require some incredible new firewall configuration interface if we hope to make it possible for the ordinary clueless computer user to properly configure outgoing firewall rules."

</comment></comment></comment></comment></comment><comment><AUTHOR> Can anyone recommend a consumer grade router that has a good GUI for tracking outgoing connections in real-time and setting up rules to control them?

I am imagining some kind of add-on to DD-WRT or derivatives that will put up a real-time graph of devices on my home network and draw lines representing outgoing TCP and UDP connections while also logging them in a tabular format. Both forms would be clickable to drill down for more details (including session packet captures if enabled) as well as set policies like a per device white-list of acceptable IP addresses to connect with.

I know all of this is possible with individual tools like tcpdump or wireshark and ip-tables configs, but that is too painful. I'm looking for a robust GUI on top of all that.

<comment><USER6> I'm a fan of pfsense:

[http://pfsense.org/](http://pfsense.org/)

It might be a little more complicated than a standard consumer-grade router, but it's powerful enough to do almost anything. It's based on FreeBSD and has a reasonably pretty GUI on top of pf.

I've used it on alix embedded hardware before, and have it currently running on an atom supermicro board - both work great.

<comment><USER7> pfSense is awesome. It won't help a lot with this specific problem (without a lot of manual work). But it's still a great solution. I've been using its multi-WAN capabilities on a Soekris box for a few years now.

<comment><USER8> You can use Squid on PFsense (available as package):

[https://doc.pfsense.org/index.php/Setup_Squid_as_a_Transpare...](https://doc.pfsense.org/index.php/Setup_Squid_as_a_Transparent_Proxy)

but I don't think it would be trivial to configure for an end-user

</comment></comment></comment></comment><comment><USER9> Seems it's time to put your closed-source consumer devices into a DMZ, with carefully limited access to both the internet and your home network.

<comment><USER10> Using "DMZ" in this context is very confusing, in common usage it means the exact opposite of what you intended.

A lot of home routers have a "DMZ" feature that gives the device you put in the DMZ full access to the outside internet, but restricts their access to other hosts on the local network.

It's typically used for gaming machines when you can't be bothered to forward a lot of ports individually, I have a gaming console in a "DMZ" on my network so I can play games online without fuss.

<comment><USER11> This is what _sdfjkl_ is intending I think. Have the TVs/Whatever on the other side so they can't scan your network shares to get the information to send back the HQ.

I would be much more effective, straightforward and ultimately more useful though, to firewall the TVs from the internet outbound so they can collect data all they like and never send it home.

<comment><USER9> Both actually. They might need access to your internal network to access your file shares and whatnot, but you'll want to make sure they can access only the parts you want them to, and nothing else, so they can't for example log onto your unsecured printer and collect a list of most recent print jobs, including filenames.

And they might need to access the internet to download firmware updates and stream video, but you don't want them to "LG phone home" and report your midget porn viewing habits, so you'll block that.

Of course all that requires quite a bit of knowledge, time and equipment to set up and is therefore quite unrealistic, so you're better off just hooking up your laptop via HDMI and putting the damn TV into monitor mode, "smart" be damned.

</comment></comment></comment></comment><comment><USER12> The dutch website tweakers.net contacted LG and confronted them with this behaviour. They replied that it was a left over from some functionality that was never fully implemented and it will be removed in an update.

Most of the commenters there don't buy that story, just like here. Full story (dutch): [http://tweakers.net/nieuws/92747/lg-erkent-versturen- privacy...](http://tweakers.net/nieuws/92747/lg-erkent-versturen- privacygevoelige-data-smart-tv-en-belooft-firmware-fix.html)

</comment><comment><USER13> The only possible way to fix this in some way, is having Open alternatives.

Will love that when you buy a tv, you buy just the monitor. Without the tunning hardware or the crappy ooss. Like when you do with projectors.

Then you buy any chromecast, raspberrypi, or something that you can hack.

I can see for 2014/15 having a lot of startups creating small devices to connect to monitors only that tune internet in the same way they tune digital- tv.

Once you have competition in that market, you can start thinking in security.

<comment><USER14> You can already do all of that if you want. It's not a 2014/15 thing, it's a 2011 thing.

There are a variety of USB-powered android-on-a-stick-with-hdmi solutions out there. You can also buy separate tv tuner boxes pretty cheap. And many tvs run some form of FOSS and are hackable/flashable already.

</comment></comment><comment><USER15> Here is the list of domains from the original doctor beets post linked in the this story to block on your router to stop this:

ad.lgappstv.com

yumenetworks.com

smartclip.net

smartclip.com

smartshare.lgtvsdp.com

ibis.lgappstv.com

<comment><USER16> Thanks, was looking for a list like this. I've blocked them all via DNS, hopefully doesn't break anything too important.

<comment><USER17> What sort of communication between your TV and these domains would you feel is important?

<comment><USER18> I don't specifically know the services the TV expects from those domains but:

You may want to receive software updates for the TV.

You may also want to access services that the are launched by the LG apps. Those services may only run correctly when the appropriate pre-roll advertising (quite possibly from Smartclip) are allowed to play.

</comment></comment></comment></comment><comment><USER19> Previous discussion from the original DoctorBleet finding:

[https://news.ycombinator.com/item?id=6759426](https://news.ycombinator.com/item?id=6759426)

</comment><comment><USER20> Also, my LG TV's WiFi password text box doesn't accept anything other than letters and numbers and not more than 8 chars long. What is this? A 10th grade programming assignment?!

Having to change my router's password to something insecure just to accommodate LG's retarded software sealed the deal : I will never buy anything LG again.

</comment><comment><USER21> The dangerous precedent set here is inclusion of Terms & Conditions on multipurpose electronic _hardware_.

</comment><comment><USER22> Genuine, question. How does one actually go about sniffing traffic from a device like this? This is really interesting stuff.

<comment><USER18> 1) Install Wireshark

2) Connect laptop to Wifi network

3) Connect TV to laptop's Ethernet port (and set TV to use wired Ethernet)

4) "Share" your wifi connection with devices on the Ethernet port.

5) Run Wireshark and start a capture session on your [edit: Ethernet] port.

Edit: recommend capturing from Ethernet port as there will be less other traffic.

<comment><USER23> … or use [http://fritz.box/html/capture.html](http://fritz.box/html/capture.html) if you have a Fritz!Box router – it's a great device anyway but especially useful for capturing your own LAN and WAN traffic.

<comment><USER24> WOW! I have a fritz box and never knew it could do that.......... mind blown!

</comment></comment></comment></comment><comment><USER25> This was only found because LG was stupid enough to use plain HTTP instead of HTTPS. I wonder how many devices use SSL/TLS for this same thing that just haven't been caught yet.

<comment><USER26> Unless they offer a way to accept certificates and use a proxy server. Neither are particularly uncommon, and something like Charles[1] makes this laughably easy.

[1] [http://www.charlesproxy.com](http://www.charlesproxy.com)

<comment><USER27> Can you self sign other people packages with Charles? That's crazy!

<comment><USER14> Not really, you can do that with any decent SSL tool. Getting the client to accept your trusted certificate is all that is needed. Once you have that you have the keys to the kingdom. I've written similar software myself.

Now on a closed device it can be very difficult to add root certificates to the store, but it's often possible.

For instance when the PS3 firmware was first cracked I took the opportunity to flash mine with a firmware I made that contained my root authority certificate. Then I wrote a python program to intercept and MITM all the traffic.

Result? I found out that on boot your PS3 tells Sony every game (or other thing) you run on the ps3, what times you run them and how long for.

</comment></comment></comment></comment><comment><USER28> reminds me of the old sony rootkit cd stuff.

But i think a lot of these companies know that it would be legally hairy to get into vigilante DRM justice, so instead they just surreptitiously collect data that will let them plot their next move. maybe that's paranoid, but comeon in this day & age everything is logged. Even if they are serving 404s, it's trivial to log that data anyway (as was pointed out) or maybe it goes straight to server logs and someone in LG analytics says in the future "well, that data is there somewhere... we may as well use it"

it's hard for me to imagine someone at a corporation standing up and going "NO! that's violating our users' privacy". they pretty much consider any info they can get to hit their servers to be their property no questions asked

</comment><comment><USER29> Isn't Windows 8.1 logging local filenames, too, thanks to the integrated Bing search and advertising platform, so then it can serve you ads based on your local files?

</comment><comment><USER30> "Dear LG,

I've really enjoyed using my LG TV/network informant. I'm wondering whether LG has any other exciting products I could use.

Do you happen to sell a camera that monitors my location? What about a vacuum that phones home with my fingerprints? Or perhaps a washing machine that steals my dreams?

Thanks for developing the products of The Future!"

<comment><USER31> I cut my finger on this edge.

</comment></comment><comment><USER30> What is this even supposed to be doing? Monitoring the user's watching habits is evil but unsurprising. But why do they even want your filenames?

</comment><comment><USER32> So who's going to be the first to start sending bogus data to LG's endpoints?

Could do some very fun things to their statistics.

</comment><comment><USER33> Coming soon to an episode of CSI

</comment><comment><USER34> Great work by Samsung!

</comment><comment><USER35> Did anyone think DRMed systems can ever be trusted? If you are using one, expect stuff like this by default.</comment>