Slashdot Mirror
HideMyAss.com Doesn't Hide Logs From the FBI
An anonymous reader writes "People use VPN services to hide their identities online, right? And a UK-based service called HideMyAss would seem to fit that bill perfectly. Not so, unfortunately: they have to hand over the logs to the FBI when a UK judge tells them to." Reader wiredmikey points to a story at SecurityWeek, too.
But another question is why they kept logs anyway? Are they required to keep logs by law?
If you're expecting to use public VPN servers to "hide your ass" you're doing it wrong.
If you're not competent enough to "hide your own ass" then you really shouldn't be fucking with other people's networks.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I was hoping something like hidemyass.com would be devoted to the anti-muffin top movement :P
Monstar L
HMA is designed to avoid censorship, not mask illegal activities. Although their may be some gray area where using the internet to organize people in political actions may be illegal, the sharing information itself is not illegal, and should not be censored. People that then actually commit cyber crimes or real crimes, will be subject to applicable laws by involved governments, and of course, the governments will take action to find the responsible parties.
I've heard /dev/null is a pretty neat place to store logs. Compression ratio is quite high too - no need to worry about filling disks with uncompressed logs.
It's quite clear that HMA see their service as a way of doing things that are not illegal through a VPN. There's plenty of perfectly legitimate reasons to want to do this, and that's what the service is there for.
It's not there to allow someone to break the law with impunity. So it's not been engineered to be particularly difficult to dig into the logs and figure out who was using the service. So if they get served with a court order saying "Hand over the logs", they have to.
Want something which is a lot harder to be traced? Don't use a commercial VPN service, use something like Tor.
This isn't a story of "HideMyAss selling out". This is a story of "Person uses a service in a way it's not meant to be used and is surprised when it blows up in his face".
at least they wait till a judge tells them to.Too many companies/websites are handing over information if they are asked.
Not everyone understands computers, that doesn't mean they're incompetent, wikileaks, openleaks and other needs to help their submitters keep anonymous, and there are better ways to do this, follow my instructions below, and you'll be as safe as you CAN be in this world:
1) First of all, you need to download TAILS
http://tails.boum.org/download/index.de.html
2) Burn this .ISO on a CD
3) Get a second computer
4) Tear out its harddisks
5) Make sure there are NO USB-memory sticks either.
6) Make it boot from the CD only, (enter the bios and set Boot Priority to CDROM)
7) Now you can surf relatively safely, but you're not done yet!
8) When surfing, do NOT surf into familiar places of yours, do NOT use your real name, do NOT search for your real name or even your internet alias, if it's known in combination with your name (if you surfed with it on your computer, google already knows your IP, so forget it!)
TAILS uses TOR, google it if you're truly curious. It can't keep you 100% anonymous but it's the safest "service" out there, and it's only relatively safe if YOUR SURFING HABITS ARE SAFE TOO.
Good luck!
What this world is coming to - is for you and me to decide.
Something we suspected for a long time...
Don't get me wrong, we're truly grateful you stepped in 70 years ago to help save us being conquered by the nazis (even if you did take 2 years to finish your breakfast before getting your spurs on) , but jings, we do seem to have a procession of Prime Ministers whose real dream seems to be made a governor of a USA state...
I use a VPN because i firmly believe that a malicous neighbor on the same cable trunk does not need to know what i am doing or intercept certain connections. I use a VPN because public and free WLANs and Hotels LANs are uncontrolled cesspools. I use a VPN because i dont want every server operator to be able to identify my location to the block-level (and combine it with other techniques to identify me). I use a VPN because i dont trust GSM encryption. I use a VPN because i dont want to be throttled based on IP or content.
If the FBI wants to see the log of my VPN provider, they can. If i would want anonymity i would go to other measures.
Would the same go for anonymouse.org? I have visited my own website through their proxy, and it remains unlogged in (wordpress) WassUp stats. Hidemyass actually shows up though, along with my browser type and screen res. Also, why do more people not consider that these anonymity services are not honey pots?
Laws are like sausages. It's better not to see them being made. - Otto von Bismarck
Unless you're some kind of super 4Chan, you can't run a business that actively keeps no logs and relies upon -- as your buisness model -- the idea that you can keep people 100% anonymous online no matter what they do. That's just retarded.
Generally speaking, the best you can hope for is, "We will keep you safe from basically anyone who doesn't come knocking with a court order or warrant. Depending on your country, they may not even have that, but they'll definitely have to be law enforcement related."
I mean, really. Would you willingly operate a legitimate business that had, as its business model, the idea that your clients give you a hunk of money and then you give them back an entirely different set of money (minus 15%) in non-sequential bills? Do you think such a business would operate without being investigated by the FBI/CIA/ASIO etc? Who would you think the primary clientele of such a business would be and is it really ethical to protect them?
Somewhat more tin-foil-hatty is the idea that anyone who runs a business that promises to give the finger to the law, doesn't keep any logs and is prepared to go to jail to project your online anonymity... well, to me, that screams that they're a honeypot. Probably paid for directly by the FBI, with 95% of their clientelle being 13 year old 4Chan script kiddies, PirateBay users and other harmless folk who are utterly ignored and left in peace... but that other 5% being pedos (there are *very very* few pedophiles online; don't buy into the panic!), drug runners and organized crime members who are kept under close surveillance.
In short, I would rather use an anonymizing VPN service who spells out exactly what is kept and why, and what level of law enforcement intervention is required. A service I would use would probably have the following terms of service:
1) If you commit any crime, or transmit evidence of any crime, that has a minimum of one year in jail OR do anything *truly* retarded (like Skype-out over the VPN and call the White House legitimately threatening to assassinate the President of the United States) then your arse is grass.
2) If you are DDOSing from behind the VPN service, or sending spam e-mail, or operating any form of spam/volume based attack behind the VPN we'll disconnect you since that typically rapes our already overloaded services. Generally no legal butthole-raping, just a D/C, one day timeout, and an e-mail explaining why. Note rule #1 still applies if you are scamming people.
3) If the cops come with a 100% legal warrant issued by a judge, irrespective of the crime, we'll comply with its order.
I believe that's entirely fair and I know some people will scream for more, but realistically, I think that if your business doesn't basically follow those three rules it's not going to survive... or is a honeypot.
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8
Anyone who doesn't want logs/wants them deleted quickly is an evil criminal.
Filthy, filthy copyrapists!
In most cases, changing your MAC is pointless. It doesn't go beyond your segment anyway, and your ISP will be tracking you based on either modem identifier or physical line your connection comes in via.
The only exception is if you are using a public(/hacked) wireless hotspot, in which case they may be able to use the MAC to track you down (Some OEMs, like Apple, keep the MAC on record and associated with purchaser) or else use it as proof if they already have enough suspicion to sieze your laptop.
A lesson in paranoia, it's all logic:
Do you seriously think you can surf for free, unlimited bandwidth on some service out there in internet land? Sure, they may finance their services with advertising, and that's probably the main idea and intentions with their services to BEGIN WITH, but as with all such services, no one is ABOVE the LAW, and don't think for a minute you'll even be safe under such services.
Sure...your ISP won't see your actions
But the Service you use (eg. Hidemysorryass.dot.com) WILL know your every move, they have to...why? Liability, that's why! No one can truly circumvent their own countrys laws, not even the best of them, the only reason you don't get caught, is because you ain't important enough, if you do the CRIME, you WILL eventually do the TIME.
It's all a giant game of who do you trust (to quote Jack Nicholson) - Who DO YOU TRUST? Some free internet service out there, are you freaking KIDDING me? They WILL COVERTHEIROWNASS.com when the feds come knocking on their doors, they're in it for the money, not to save your ass, that's for sure.
Networks like TOR (google it and learn) works, because it's a giant network of private individuals that lend their computers to forward encrypted chopped packets of information they have no chance of assembling, only that makes sense as you couldn't really assemble this unless you owned the entire network ...or...figured out who where behind the originating address trough mistakes such as leaving your name on a forum, user name + previous IPs with that user name etc... Nevermind that, we're getting too technical, point remains though.
Learn to surf safely first
And then you may use TOR!
What this world is coming to - is for you and me to decide.
I would set up services like HideMyAss and run it in a competent way .... and let my analysts have a look at what people want to hide.
If people are trying to hide something then it is likely to be interesting or embarassing. OK: most of it would be uninteresting from the point of view of a national security agency, but there would probably be an occasional gem from some dumb ass who believes that such a service really does give him the secrecy that he wants.
Actually, there is a ton of things the government will attempt to do to try to get you, even if it is a puny, pariah, poor government. I was helping a few friends of mine who live in a country, where people who laugh at politicians are still beaten up, to publish some funny videos about their top politician. Since I also visit there occasionally, we took full precautions. Private VPN to a foreign country, rather unfriendly to the regime, chained proxies, then TOR, new email addresses and video upload accounts, different chained proxies to access each of those, etc.
Once the videos hit the tubes,some people got mightily pissed off, and started an official, but silent investigation. Imagine my surprise, when two of our e-mail accounts (free, with a large US-based web mail provider) that we used for the services were blocked, and login attempts redirected us to customer support barely a day into the operation. Since the investigation in these countries tends to leak like a sieve, we got info that that particular country was paying someone mid-level in customer support dept. to give them data on customers.
They hit the video upload sites with official requests and apparently tried to hack into one, obtained logs from the ISPs of all online forums that we used to advertise the videos to, had videos deleted and did other funny things. They persisted into this business for about 18 months until they decided to close it down.
Given this much effort about a few videos from a near-third world country, imagine what a really powerful government can do to you, and despair :)
If you have to admit to having been hacked (and its hard not to when its already gone public), its less shameful to be hacked by an elite group of hackers than a bunch of script kiddies.
All about PR spin.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
But if the Egyptian government went through the appropriate channels and got a UK court order, presumably HMA would turn over the logs immediately. Besides, there are a number of censorship-related situations where HMA would apparently pass out user information like cookies at a bake sale regardless of whether a boogedy-boogedy scary middle east country is involved or if it is the US/UK... the wikileaks fiasco would be an obvious example.
Why not at least keep the connections logs for only 2 or 3 days? I would imagine that would still enable them to crack down on abuse while avoiding having to comply with most court orders.
Log this!
Your log appears to be a floater.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire