Slashdot Mirror
US Senators Ask DHS To Look Into US Government Workers Using Foreign VPNs (zdnet.com)
Two US senators have asked the Department of Homeland Security (DHS) to look into the possible dangers of US government workers using VPN apps that are owned by foreign companies and which redirect sensitive government-related traffic through servers located in other countries -- namely China and Russia. From a report: "If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia," said Senator Ron Wyden (D-OR) and Marco Rubio (R-FL) in a letter sent to Christopher Krebs, Director of the DHS' newly founded Cybersecurity and Infrastructure Security Agency (CISA). The two would like the DHS to issue an emergency directive and ban the use of foreign VPN apps if intelligence experts deem them a national security risk.
As if a VPN located anywhere even in the US is rated for any clearance.
I don't see why some congressional oversight is needed -- just block VPN apps on government owned laptops. If employees are using the apps on their personal devices, they should not have sensitive government data on those devices.
the secret back-channel between "Individual 1" and Alfabank.
At my corporation I sure as hell am not allowed to use third-party VPN or traffic anonymizer services.
Allowed? No. But in companies with strict firewalls and web proxies, many people who have the know-how to do it, are doing it. I have never used a VPN, I always have been able to create an SSH tunnel to a server I own, one way or another. But given the popularity of VPNs for bypassing other forms of spying and eavesdropping, it's not a surprising this ends up being the more popular way of doing the same thing... just not a good idea whether you work for the government or the corporate world. Plenty of shady Chinese companies are looking for the opportunity to steal trade secrets, don't open the door for them.
If your companies forces web proxies, or lets your bosses spy on your browsing habits, or has some other ridiculous oppression over their network, expect it to happen.
I needed to ssh into a server for testing. Company policy blocked ssh outgoing.
If you get desperate enough, you can probably do it over DNS.
I just changed the DNS server to the Google one. Kind of scary that actually worked.
Yep, the real solution is to change the Internet so that VPNs aren't needed.
No sig today...
The network is hostile. If you think you don't need it, you are very naive.
$15 lifetime VPN.... so no then?
[($)]
Actually if you assume the user is basically competent and knows how to apply his own security updates or switch router vendors when one refuses to issue a necessary one, everything he said is true. Maybe you're forgetting the possibility of conflicts-of-interest amongst the staff at any free 3rd party VPN service (the part where the traffic they're supposed to be hiding for you is more valuable than the service of hiding it for you) evaporates any possible improvement in network security unless you're assuming it's a given that the user is functionally illiterate and technically inept.
When the Ds and the Rs get together on something it means money. Someone is afraid that a US citizen might be hiding some wealth somewhere.
Have gnu, will travel.
1. Learn to read and parse English.
2. Wash your mouth out with soap.
I never said anything about the motivations of the ends users. "their" clearly refers to the VPN services. I question to motivations of the services that give services away for free. How are they making money?
Testing how your site looks from other countries/regions is a good use case of a VPN service. But MOST users do not need this.
On-site VPN server for access to corporate systems is the right way to go for remote access.
Trusting a third party who un-encrypts and re-encrypts for anything that you need/want to be secure is not.
I'm guessing my original post got modded down to 0 by Russian/Chinese/North Korean operatives.
In those cases, obviously you run your own VPN.
Depends on why you are running it. If I run my own VPN from home or a local co-loc data center, then it looks to the remote site like I am at or near my present location. One uses a foreign VPN when one wants to appear to be in that country*. If Evil Foreign governments can hijack that VPN, they can also hijack the sites I am visiting. So this isn't about me being safe from Evil Foreigners. This is about the NSA not being able to (easily) sniff my traffic.
*There are other reasons to run a VPN. Like connecting to an internal network or I just don't trust the local coffee shop ISP. But if I've gone out of my way to establish a virtual foreign presence, then in all probability I am connecting to a foreign site.
Have gnu, will travel.
I don't see anybody here arguing against VPNs. I argued against VPN SERVICES. Even though I put SERVICES in caps, some people still didn't get it.
YOU DON'T NEED TO USE A VPN "SERVICE" TO USE A VPN! The VPN Service companies have thoroughly muddled the minds of the public.
For most use cases, there is no need to involve a third-party SERVICE. Certainly, for work-related stuff - which is what the article was about - the workplace should install a VPN server. The article didn't say WHY government workers were using VPN services. (Indeed, it didn't even say that they ARE...) It is an investigation.
OK, I get it about the sadsacks who are stuck with cable companies that spy on them for the sake of advertising dollars. If that's you're situation - and you are paranoid - fine. Go ahead and tunnel through a proven liar to an unproven liar. But let me ask them - are you on Facebook? HAHAHAHAHAHAHAHA! Most of the paranoids that are worried about their cable company spying on them - FOR THE PURPOSE OF PROFIT, SO REALLY WHO GIVES A SHIT - have almost certainly already given their privacy away to others.
I have to guess that it's been discovered that government workers are inadvertently using the VPN services that they use to hide their pr0n browsing - or guard against being inundated with advertising for products they've already bought - to access work/government websites.
Useless for what? Evading the law?
MOST users are not evading the law. For MOST users, this is not a concern. I would be more concerned about somebody in a foreign country scraping credit cards, personal details with which to commit financial fraud. Unfriendly countries building up databases of personal details of the general public that can be banked and used in the future to create disruption.
Interesting how a reasonable post with a reasonable opinion, not flame bait, got modded to 0. While an obscenity-laced response that shows lack of comprehension gets modded up.
Presume it was done by bots from hostile countries. I now have to presume the existence of a hostile bot net with /. mod points.
I don't think there is a real solution. I don't even think I want one. A little bit of crime is a good thing.
Well, you're obviously astro-turfing because you've assumed i'm using a shitty off-the-shelf plastic router in the first place, rather than something a little bit more auditable like a Linux or BSD box.
The government already gets it from both my cable company that provides wired Internet and Verizon which controls wireless for my phone. If the government wants to get that information, especially if they have a warrant, they will.
If I spent all my time worrying about what the government is doing I would not have time for anything else. This is not to say I trust the government but merely that they have such a stacked deck that I should probably either avoid committing crimes or I should definitely avoid getting caught because they will likely win.
The most security you can really provide for yourself is owning a home off the grid that's not in the city with a well, water treatment and preferably a large enough solar power system to sustain your family. Owning guns and having lots of like-minded people in the surrounding region also helps a lot.
That means 99.99% of us are in trouble when things hit the fan.
I might want to watch a foreign news stream. Some of these are geo-blocked outside of their home markets. BBC is notorious for doing this.
Have gnu, will travel.