Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Kape Technologies was originally found under the name of Crossrider in 2011 developing advertising apps until they changed their name in 2018.

However, their software was treated as malware by companies such as Malwarebytes and Symantec begging one to ask, how can such a company despite rebranding itself change the shoddy culture that it had?

But the connections don’t end there. The very first CEO of Crossrider, Koby Menachemi, happened to be once a part of Unit 8200 which is an Israeli Intelligence Unit in their military and has also been dubbed as “Israel’s NSA.” Teddy Sagi, one of the company’s investors was mentioned in the Panama Papers which were leaked in 2016."

https://www.hackread.com/israeli-firm-kape-technologies-expr...



I don't think tagging people as ex 8200 is very helpful. Israel has mandatory military service and at this point if you have aptitude or are in a high school computer club in Tel Aviv or a few other places, you probably end up in 8200 for your service. For that matter, half the people who say there were in 8200 were either 1) listening to telephone calls 2) relegated to writing memos about the data people did hack and get. Of course, there are things one could have done that would raise serious questions. See, e.g., the issues raised for the people we know who worked on DualEC_DRBG.

On the other hand, there are other sketchy things about express VPN.


it’s definitely relevant background.


FWIW, I once worked at NSA, and likely care more about privacy than anyone you know. These places employ 10s of thousands of people, and the people that come out are as varied as the industry at large.


agreed. also, it’s definitely relevant background.


This reminds me of a Chinese company 360 (www.360.cn). It used to be a malware company and then turned into a antivirus company.


Indeed, and if you've ever used a machine in China with that crap installed you know how well that went.

Speaking of China, it has always been strange how well ExpressVPN worked there even during high pressure moments where all other vpn operators bit the dust, with some already wondering a few years ago if there wasn't something more shady going on. Eventually I ended up using some self managed shadowsocks servers and it's been a while, so no idea what the current state of affairs is, but I'm even less convinced to use them now.


I interviewed with ExpressVPN (NetworkGuard) not too long ago. While the founders are American and they're incorporated in the Virgin Islands, their actual base of operations is Hong Kong and they have no intention of moving out despite the recent upheaval there. So either they have serious guanxi, which seems improbable for pasty white dudes (sorry, but in China race matters), or they're very naive.


They have backdoor for the CCP, but why would they tell you?


Can you expand on the point about race mattering in China in regards to their business approach?


As of 18 months ago to my knowledge most expats still used name brand ExpressVPN, Astrill, etc. while techie types used stuff like v2ray+shadowsocks or shadowsocks alone. Shadowsocks is really underrated, once you’ve found your location, plugins and obfuscation “stack” that just work on the gfw it’s also super handy in other countries that have lighter and less sophisticated censorship.

https://www.v2ray.com/en/.


That was my experience as well. Didn't know about v2ray, thanks!


I've never been to China, but I'm curious - is it possible to connect to EC2 instances in us/eu? Anything stopping an SSH tunnel or wireguard to such a machine?


ML-backed DPI on the great firewall that cuts you off after some time. Plethora of methods to wrap traffic in non-suspicious protos have been made.


I think any VPN service not blocked in China must have backdoors.


I mean, those are transferrable skills.


Here's hoping the change is genuine and not just a surveillance front.


The founder/ceo of 360 is a totally opportunist. He enjoys several political titles. He would love to be a surveillance front.


I switched to ExpressVPN when PIA was transfered to an owner I was skeptical of. Whom can one recommend now?


Mullvad


This or Mozilla which backs onto Mullvad.


Yes, you're right. Four main reasons that drove me towards Mullvad:

1. Mozilla VPN is built on top of it.

2. Cheap and stable price. 5€/month.

3. Ability to pay by cash.

4. Founded and based in Europe (Sweden).


TIL PIA was acquired by Kape as well. I had no idea until I looked at their site to see who bought ExpressVPN and saw the PIA logo.


ProtonVPN has a decent product and management team.


ProtonVPN is a white labelled version of NordVPN, source, HN yesterday.


NordVPN! But only because Internet Historian’s ads are too effective. In fact, it’s been a saga. https://www.youtube.com/watch?v=iFZ_N1Faf_E&ab_channel=vonFu... is probably my favorite, but there are like 40 more. (https://www.youtube.com/watch?v=0p9J9cI0t7M&ab_channel=vonFu... etc.)

But if you need security, roll your own VPN. You can set up a Digital Ocean droplet as one. It's a pain, but you only need to do it once.

I'm not sure there's much of a persuasive reason to use any of these big providers. That's why they always fall back on claims of security – unsophisticated users always fall for it.


Whats your threat model, that a Digital Ocean droplet is a viable VPN host? It's trivially tracebackable to you.


How so? All you see is that a random DO droplet is pinging your service. You'd need a legal request to get any further info about the droplet. And in that situation, it's equivalent to any other VPN service that will comply with legal requests.


He is talking about government level threats, DO provides no benefit.

I'll add that rolling your own means you're the only one exiting that IP address, so if your threat model involves websites profiling you and/or alternative accounts that won't help.


Where did someone mention government level threats?

If the threat model is a government, Tor is the only safe solution, and only after extensive training and safeguards. Using anything else is actually-crazy.


If your threat isn't a government level threat, then a digital ocean based VPN probably gives enough protection.


A good VPN won't _have_ logs, so they _can't_ comply with legal requests (instead of won't)


Do you really trust that? With your life?

This is precisely the point that the threat model bares its fangs. You can ignore it, but you should be aware that you're putting all your faith in that service.

A hypothetical Good VPN doesn't exist in China, for example, because they're legally not allowed to do what you suggest. Many of us don't live in China, but some do. Even outside of China, is it really true that a VPN service will simply give LEO the finger when they ask "Who was downloading child porn off your servers?" I'm skeptical they can.


That's the thing though, not all legal requests get the same weight or priority. I wouldn't trust a VPN to not roll over for your example cp case, but I think a middle finger equivalent isn't unreasonable for the less severe and more common case of receiving a complaint that the IP was observed as part of a swarm seeding copyrighted material. For lesser things, where does DO sit on the spectrum of will rat you out (which ISPs do), and likely won't rat you out (basically any paid VPN because their reputation depends on not doing so)?


It's traceable with a US warrant.

If you are outside the US this is sufficient protection for many people. For example even close US allies (eg five eyes) have to go through the US court system to get this warrant, and that is a slow, annoying process when you aren't based in the US.

It raises the level of friction to meaning it will only happen for somewhat major investigations. If you are a major drug dealer, then yes, they'll do it. If they catch you with some small amount of some drug, then it's unlikely they'll chase it.


NordVPN doesn't have an entirely spotless record.

https://www.theverge.com/2019/10/21/20925065/nordvpn-server-...


https://archive.is/qBBF3

The original article is deleted for some reason, though.


> How can such a company despite rebranding itself change the shoddy culture that it had

This is the nature of VPN companies. You must do your research. Sadly most consumers don't do their research and blindly trust that the VPN provider has their best interests at heart.

Should that mean we trust a provider that has zero scandalous pasts? Hardly. Treat every VPN provider as if they peddled malware in the past I say.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: