SoylentNews is people
SoylentNews
*** Note that Proton has a commercial interest in VPNs. This may be biased reporting ***
https://www.cnet.com/tech/services-and-software/proton-vpn-report-location-tracking-privacy/
With a fast VPN, your speed loss will be virtually unnoticeable.
Using a virtual private network is a surefire way to keep your information private when browsing the internet. But a new report from Proton, released on Wednesday, exposes some major holes in that concept.
A VPN is a tool that encrypts your internet behavior and hides your IP address and physical location, with the goal of keeping your identity and identifying information secure. But 64 of the VPN apps downloaded in the US, Proton found, are owned by Chinese companies and contain trackers that collect all sorts of user information, including device IDs, network information, device models and mobile carrier data.
And 25% of the apps in question were found to actively track your location.
In June alone, these apps were downloaded over 13 million times.
Narrowing down the numbers further, Proton found that 31 of those Chinese-owned VPNs use shell companies registered in jurisdictions such as Singapore, Hong Kong and the UK to further hide their identities.
An authoritarian government like China’s could use this information to track a person’s location. So if a public official, someone in law enforcement, a journalist or even someone attending a protest was using one of these VPNs for safety, this flaw would expose them to potential threats.
It should be clear that China isn’t the only country where companies harvest the data these apps collect, but it’s near the top of the list. Israel, Russia and the Five Eyes countries — Australia, Canada, New Zealand, the UK and the US — all have companies collecting tracking data from millions of people.
Transparency is a big issue here, with a load of bad VPN apps being readily available for download through Apple and Google. Proton’s report points out that both companies require developers to submit their own paperwork to verify their apps, with little verification (and no independent audits) being done on Apple’s or Google’s part. Apple and Google didn’t immediately respond to requests for comment.
This lack of guardrails in the verification process makes it hard to decipher which virtual private network apps protect your privacy and do what their policies promise and which are virtually doing the opposite.
“Proton's report is yet another example of why it's so important to know who's behind your VPN and what data they're collecting,” CNET Senior Writer Attila Tomaschek said. “It's also another reminder that just because a VPN app is popular in Apple's or Google's app marketplaces, it doesn't necessarily mean that the VPN app is safe to use.”
If you’re looking for a VPN, Tomaschek points to VPNs like Proton and ExpressVPN, which regularly rank near the top of CNET’s VPN recommendations. Each virtual private network is put through a rigorous testing process that includes a thorough examination of the app’s privacy policy, transparency reports, audits, corporate structure and legal jurisdiction.
When all else fails, avoid any VPN that is murky about any of those key principles. “Instead, opt for a trustworthy VPN that is crystal clear about where it’s based, who’s behind it and how it protects user privacy,” Tomaschek said.
(Score: 2, Interesting) by day of the dalek on Saturday September 05, @02:32AM (4 children)
I have discussed this issue many times over with the staff. The fact is, there is a script, daily_forget.pl [github.com] that is part of Rehash and hasn't been modified in 12 years. It runs every day and purges the IP and subnet hashes from comments that are older than a certain date. I do not know the exact configuration and how old comments have to be in order to have the hashes purged, but multiple staff members have told me at various times that this script does run.
I know for a fact that the first five hex digits of IP and subject hashes are shown to people with editor privileges (SecLev >= 100) for every comment that has the hashes recorded. After awhile, I'm sure staff notice patters that tend to recur, and they learn where a few of the hashes originate from. I never wanted to look at the hashes, so I almost exclusively browsed without logging in for the couple of weeks I had admin access. Then I just walked away from the editor training, and my access was properly revoked. I never looked to see if hashes were still recorded for old comments because I just didn't want to see hashes and was logged out as much as possible. But like I said, multiple staff members have told me that daily_forget.pl does run, and it's been active on this site for a long time.
So I'm not seeing evidence of the "pervert database" that you claim exists. And there's also a valid reason to track IP and subnet hashes for a window of time, so people can't easily mod up their own AC or sock puppet comments.
I've had many discussions with kolie about this over email. He's assured me that the hashes do get purged periodically, and that SN has functioned this way for a long time. I have no reason to believe kolie has been anything other than truthful with me in our interactions, so I believe him.
I've criticized the site many times and argued about this frequently in the journals. I know I've pissed off janrinok quite a few times, and he's not been very happy with me on many occasions. So I have asked the tough questions, and I have zero reason to implicitly defend the staff. In fact, they'd probably tell you that I've frequently been an asshole over email about issues just like this. But I do care about the facts, and all the evidence I've seen says that Rehash contains the functionality to remove old hashes, and that this functionality is used on SN.
Where's your evidence for the "pervert database"?
Stay thirsty, my friends.
Leviticus 19:33-34
(Score: 2) by Bentonite on Saturday September 05, @03:41AM
I was writing generally about databases that store things, not any specific one.
I am pleased that IP's do get purged eventually and aren't kept around forever.
(Score: 2) by janrinok on Saturday September 05, @06:58AM (2 children)
You might be conflating 2 entirely different issues.
Firstly there is the link from comments to their originating IPs which is only displayed to authorised staff.
Secondly, there are the lists of IP addresses themselves which have several functions, including protecting the site from various attacks (DDoS etc), some of which are automated. (As an analogy, many people use Fail2Ban to protect themselves from some attacks) They go back to the very start of the site. Removing them is likely to cause all sorts of problems. It would probably not be a trivial task. Reproducing older page content would not be possible.
I have checked journals of mine and those of "day of the dalek" and can confirm that the software is functioning as stated.
The links from a comment to its IPs are removed after a period of time. This duration is important when investigating moderation abuse, sock puppet activity etc. The link from IPs to comments, moderations, or whatever remains in perpetuity. The requirement was to remove the link from comments to IP addresses after a period of time so that they are not displayed unnecessarily. That has been done.
The links can only ever be seen by someone with the appropriate privileges. If the database existed within the EU it would have to be declared (but its contents would not be viewed) and the duration that data was kept would have to be justified. The US has no equivalent restrictions.
(Score: 1) by day of the dalek on Saturday September 05, @08:58AM (1 child)
What SN does is above my pay grade of $0. So I don't know the specifics of this.
But I am trying to get better privacy protections in my state advocating for this in the legislature. One of the benefits of volunteering to help with campaigns is getting to share my concerns with people who may well be elected in November. While I don't much like Flock cameras, I've been telling elected officials and people running for office that there are even much bigger risks from other businesses like data brokers.
Last year, my identity got stolen, a fraudulent financial account was opened in my name, and I didn't find out until many months later when debt collectors started calling. Despite federal laws to know your customer, the financial institution never requested an ID, and there wasn't any sort of live selfie or other verification. The phone number and email address used weren't mine. There appears to have been no employment verification. They never checked any of the major credit bureaus. Despite the many red flags, they made virtually zero effort to verify the person's identity before letting someone enter in my name, address, DOB, and SSN online, and open a fraudulent account in my name.
When I found out and contested it, the financial institution decided I wasn't liable for the charges, and that manual approval would be needed if the account was used to apply for any other products from the institution. Their response implies that they never even bothered to disable and close the fraudulent account. Since this financial institution is known to sell customer information to data brokers, they may well have shared my name and address along with the attacker's phone number and email address. And that means a criminal's contact information gets mixed in with my real data, and that gets sold to other data brokers. That potentially puts me at risk if I need to have something like a background check done later.
If the account is still open, which I believe it is, and a second attacker managed to access it, they could presumably get personal information like my SSN and steal my identity again. This financial institution already had a massive data breach a few years ago. I never gave them my personal information, so they have no right to it, But because a criminal provided it to them, I believe my personal data is sitting on their servers where it can be misused or stolen again. Let's just say I'm already taking action to hold the financial institution accountable, and I expect to find out if they're going to be cooperative within the next few weeks.
You'd better believe I'm pissed off about the lack of regulations to protect my data. I have zero confidence in the Congress to do a damn thing. So the next time the state legislature is in session, you can count on me sharing my story to anyone who will listen, and I'll be pushing for bills to be introduced that include some very strict privacy regulations. The financial institution is an out-of-state business, so you'd better believe I'll be pushing for any new laws to apply to anyone handing the personal data of any resident of my state.
Perhaps I'll cross-post this in the poll and hope it doesn't get modded as spam.
Stay thirsty, my friends.
Leviticus 19:33-34
(Score: 3, Funny) by janrinok on Saturday September 05, @11:13AM
That is exactly the same pay grade that all SN staff are on too! All pay rises are based on a percentage of our current pay :)