Automatic VPN Generator
Security and privacy
vpn generator
SHOW HN2014
125points
70comments
#217of 2,272 in 2014
Top 10%of 2014 by points
How HN took it
MixedNo clear lean
6 positive, 16 neutral or asking, 0 mixed, 16 critical, out of 38 comments about the project. Thread score -0.27.
Privacy: 0 for, 8 againstIdea: 2 for, 4 againstExecution: 1 for, 2 againstDocs: 1 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for less technical people; script is open source
From 2 comments
Very nice! You could make the linked script a bit more prominent, but the API key way is a good tradeoff between security and convenience. I'd still use the script myself, but I…
StavrosK on HNWe're totally OK with you using the script. :) Most people, especially those just looking for a way to be secure without knowing anything about the command line, was whom this…
borski on HN
Objections
Asking for cloud API keys is a serious trust and abuse risk
From 3 comments
Need secure internet? Just drop your API key in here. Yes, I know they link to the script, but you don't have any assurance that they're running the same script when you give…
akerl_ on HNThis is awesome, but there's always something that makes me feel uneasy when asked for API keys like this. They could probably list and delete any and all of my droplets with…
jpdlla on HNI found it ironic that an organization called "Tinfoil Security" expected users to blindly trust them.
jlgaddis on HN
Default crypto weak: 512-bit DH modulus and AES-128
From 2 comments
The script is currently generating a 512-bit (EDIT: 2048-bit after merging my pull request) DH modulus. DH over a finite field modulo a 512-bit prime is weak sauce, about as hard…
KMag on HNNote that deep packet inspection will be able to identify this as OpenVPN traffic the way its configured right now. You can configure OpenVPN to use a fixed key [1] at which…
revelation on HN
Server setup lacks hardening such as updates, key-only SSH and firewall
From 1 comment
A couple of things that I'd like to see in this script: 1. Go ahead and apply all of the software updates. The RAX Ubuntu images are behind on a lot of security updates. ```…
chrissnell on HN
Requests
Link the script more prominently so users can run it themselves
From 2 comments
Can you possibly link the script more prominently, with a suggestion that folks run it themselves? I found it easily enough, but I was also browsing with the primary intention of…
akerl_ on HNThanks for the info! That's definitely helpful. Maybe it should be a bit more prominent, like adding that "Why should I trust you?" section to the main page below(or above) "What…
jpdlla on HN
Add fail2ban and other server hardening
From 2 comments
I'd also install fail2ban. I looked at the auth logs for my DigitalOcean VM, and it's amazing how many bots/people try to log into it, even though it doesn't contain anything…
gibbonsd1 on HNA couple of things that I'd like to see in this script: 1. Go ahead and apply all of the software updates. The RAX Ubuntu images are behind on a lot of security updates. ```…
chrissnell on HN
Support L2TP as well as OpenVPN
From 2 comments
If you're looking for an L2TP setup (iOS, etc), check out this script for EC2: http://www.sarfata.org/posts/setting-up-an-amazon-vpn-server.md/ I'm still trying to find a VPN…
pixelcort on HNThat's awesome. We used OpenVPN because that's what we were familiar with, but your L2TP script looks great. Would you mind if we tried to integrated that at some point?
ainsleyb on HN
Questions
Does the VPN protect DNS and browser plugin traffic
From 2 comments
If you just need secure browsing and you have a shell somewhere (like a VPS, EC2 instance, a Linode, etc.) just use ssh. ssh -D <port> user@host Then configure your browser (I…
WizzleKake on HNAm I correct in thinking that browser plugins like flash, java and silverlight will not use the browser proxy and will leak data?
gabemart on HN
Can it be used for BitTorrent
From 1 comment
Can you use these services' VPN (Rackspace et al) for using BitTorrent?
dietsprite on HN
Alternatives named
Plain SSH SOCKS tunnel
From 2 comments
If you just need secure browsing and you have a shell somewhere (like a VPS, EC2 instance, a Linode, etc.) just use ssh. ssh -D <port> user@host Then configure your browser (I…
WizzleKake on HNIsn't setting up a ssh tunnel easier?
scottydelta on HN
Sidestep
From 2 comments
Why not just use Sidestep?
unepipe on HNhttp://chetansurpur.com/projects/sidestep/ : >"Sidestep is an open-source application for Mac OS X that sits quietly in the background, protecting your security and privacy as…
pbhjpbhj on HN
Tinc
From 1 comment
Just use tinc http://www.tinc-vpn.org/
kh_hk on HN