[{"data":1,"prerenderedAt":443},["ShallowReactive",2],{"project-7200043":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":45,"post_text":48,"what":49,"said":95,"maker_in_thread":211,"shape":221,"grid":225,"attempts":403,"same_week":404,"maker_shows":43,"maker_hidden":435,"reader_version":436,"card":437},"7200043","Automatic VPN Generator","Protect Yourself at Sochi and Starbucks","title","Show HN: Automatic VPN Generator – Protect Yourself at Sochi and Starbucks","https:\u002F\u002Fwww.tinfoilsecurity.com\u002Fvpn\u002Fnew","tinfoilsecurity.com","borski",1391826489,2014,125,70,217,2272,10,"notable","security_privacy","vpn generator","web_app",[24,25,26,27],"vpn","openvpn","public wifi security","vpn server setup","mixed",-0.268,{"positive":31,"neutral":32,"mixed":33,"critical":32},6,16,0,38,{"execution":36,"privacy":39,"docs":41,"idea":42,"pricing":44},{"positive":37,"critical":38},1,2,{"positive":33,"critical":40},8,{"positive":37,"critical":37},{"positive":38,"critical":43},4,{"positive":33,"critical":33},[46,46,37,47,37,46,37,37,33,37,33,46,46,33,47,33,37,37,46,46,33,37,46,46,33,46,47,46,33,46,37,37,37,37,46,46,37,33,33,33],3,5,null,{"problem":50,"audience":62,"pricing":72,"motivation":78,"time_to_build":48,"stack":84,"openness":92,"stage":93,"team_size":94},{"value":51,"source":52,"evidence":53},"Setting up a personal VPN server is too hard for non-technical users","commenter",[54,58],{"id":55,"by":56,"text":57},"7200124","ekianjo","\"vpns are too painful to set up for everyone else\" Its been a long time i did not not see as much bullshit. In linux, its as simple as going into the vpn tab of your connections,…",{"id":59,"by":60,"text":61},"7200139","xur17","They are referring to the server side of the setup process, which is painful.",{"value":63,"source":64,"evidence":65},"Non-technical users wanting secure browsing on public wifi","maker",[66,69],{"id":67,"by":11,"text":68},"7200092","We hear you. We think that getting more people using VPNs is more important, so we made that trade-off. We built this for people who are mostly non-technical, but we wanted to…",{"id":70,"by":11,"text":71},"7200163","We're totally OK with you using the script. :) Most people, especially those just looking for a way to be secure without knowing anything about the command line, was whom this…",{"value":73,"source":64,"evidence":74},"Server costs paid to cloud provider, about $5\u002Fmonth per server at DigitalOcean lowest tier",[75],{"id":76,"by":11,"text":77},"7200289","There's no harm in that at all, and you're correct. But keep in mind it's $5\u002Fmo\u002Fserver at the lowest tier, so if you have multiple running simultaneously you'll get charged more.…",{"value":79,"source":64,"evidence":80},"Get more people using VPNs, timed around Sochi and public wifi",[81,82],{"id":67,"by":11,"text":68},{"id":83},"post",[85],{"value":86,"source":52,"evidence":87},"OpenVPN",[88],{"id":89,"by":90,"text":91},"7200271","ainsleyb","That's awesome. We used OpenVPN because that's what we were familiar with, but your L2TP script looks great. Would you mind if we tried to integrated that at some point?","open_source","launched","unknown",{"praise":96,"objections":105,"requests":139,"questions":165,"alternatives":184},[97],{"value":98,"source":52,"evidence":99},"Useful for less technical people; script is open source",[100,104],{"id":101,"by":102,"text":103},"7200152","StavrosK","Very nice! You could make the linked script a bit more prominent, but the API key way is a good tradeoff between security and convenience. I'd still use the script myself, but I…",{"id":70,"by":11,"text":71},[106,121,132],{"value":107,"source":52,"evidence":108},"Asking for cloud API keys is a serious trust and abuse risk",[109,113,117],{"id":110,"by":111,"text":112},"7200079","akerl_","Need secure internet? Just drop your API key in here. Yes, I know they link to the script, but you don't have any assurance that they're running the same script when you give…",{"id":114,"by":115,"text":116},"7200070","jpdlla","This is awesome, but there's always something that makes me feel uneasy when asked for API keys like this. They could probably list and delete any and all of my droplets with…",{"id":118,"by":119,"text":120},"7200956","jlgaddis","I found it ironic that an organization called \"Tinfoil Security\" expected users to blindly trust them.",{"value":122,"source":52,"evidence":123},"Default crypto weak: 512-bit DH modulus and AES-128",[124,128],{"id":125,"by":126,"text":127},"7200423","KMag","The script is currently generating a 512-bit (EDIT: 2048-bit after merging my pull request) DH modulus. DH over a finite field modulo a 512-bit prime is weak sauce, about as hard…",{"id":129,"by":130,"text":131},"7202052","revelation","Note that deep packet inspection will be able to identify this as OpenVPN traffic the way its configured right now. You can configure OpenVPN to use a fixed key [1] at which…",{"value":133,"source":52,"evidence":134},"Server setup lacks hardening such as updates, key-only SSH and firewall",[135],{"id":136,"by":137,"text":138},"7200430","chrissnell","A couple of things that I'd like to see in this script: 1. Go ahead and apply all of the software updates. The RAX Ubuntu images are behind on a lot of security updates. ```…",[140,149,157],{"value":141,"source":52,"evidence":142},"Link the script more prominently so users can run it themselves",[143,146],{"id":144,"by":111,"text":145},"7200096","Can you possibly link the script more prominently, with a suggestion that folks run it themselves? I found it easily enough, but I was also browsing with the primary intention of…",{"id":147,"by":115,"text":148},"7200091","Thanks for the info! That's definitely helpful. Maybe it should be a bit more prominent, like adding that \"Why should I trust you?\" section to the main page below(or above) \"What…",{"value":150,"source":52,"evidence":151},"Add fail2ban and other server hardening",[152,156],{"id":153,"by":154,"text":155},"7201993","gibbonsd1","I'd also install fail2ban. I looked at the auth logs for my DigitalOcean VM, and it's amazing how many bots\u002Fpeople try to log into it, even though it doesn't contain anything…",{"id":136,"by":137,"text":138},{"value":158,"source":52,"evidence":159},"Support L2TP as well as OpenVPN",[160,164],{"id":161,"by":162,"text":163},"7200260","pixelcort","If you're looking for an L2TP setup (iOS, etc), check out this script for EC2: http:\u002F\u002Fwww.sarfata.org\u002Fposts\u002Fsetting-up-an-amazon-vpn-server.md\u002F I'm still trying to find a VPN…",{"id":89,"by":90,"text":91},[166,177],{"value":167,"source":52,"evidence":168},"Does the VPN protect DNS and browser plugin traffic",[169,173],{"id":170,"by":171,"text":172},"7200208","WizzleKake","If you just need secure browsing and you have a shell somewhere (like a VPS, EC2 instance, a Linode, etc.) just use ssh. ssh -D \u003Cport> user@host Then configure your browser (I…",{"id":174,"by":175,"text":176},"7200972","gabemart","Am I correct in thinking that browser plugins like flash, java and silverlight will not use the browser proxy and will leak data?",{"value":178,"source":52,"evidence":179},"Can it be used for BitTorrent",[180],{"id":181,"by":182,"text":183},"7200176","dietsprite","Can you use these services' VPN (Rackspace et al) for using BitTorrent?",[185,193,204],{"value":186,"source":52,"evidence":187},"Plain SSH SOCKS tunnel",[188,189],{"id":170,"by":171,"text":172},{"id":190,"by":191,"text":192},"7200717","scottydelta","Isn't setting up a ssh tunnel easier?",{"value":194,"source":52,"evidence":195},"Sidestep",[196,200],{"id":197,"by":198,"text":199},"7200203","unepipe","Why not just use Sidestep?",{"id":201,"by":202,"text":203},"7201032","pbhjpbhj","http:\u002F\u002Fchetansurpur.com\u002Fprojects\u002Fsidestep\u002F : >\"Sidestep is an open-source application for Mac OS X that sits quietly in the background, protecting your security and privacy as…",{"value":205,"source":52,"evidence":206},"Tinc",[207],{"id":208,"by":209,"text":210},"7201297","kh_hk","Just use tinc http:\u002F\u002Fwww.tinc-vpn.org\u002F",{"comments":212,"answered":43,"key":213},11,[214,217,220],{"id":215,"text":216},"7200460","We agree with all but the last point. We do provide the script but sadly most people using this won't know how to run such a script. We tried to make it as easy as possible.…",{"id":218,"text":219},"7200451","Would you mind submitting a pull request? We're happy to take a look, and if we merge it it will update for all future VPN provisions. That would be awesome.",{"id":67,"text":68},{"commenters":222,"max_depth":47,"maker_replies":212,"first_comment_mins":223,"lifespan_hours":224},45,12,190,[226,228,230,231,235,237,239,242,243,245,247,250,253,256,257,261,262,265,268,270,273,275,278,281,283,285,286,288,292,293,295,296,298,299,302,306,308,311,315,318,321,323,328,330,333,336,340,341,342,346,348,353,355,357,360,364,366,368,369,374,376,379,382,384,386,389,393,397,400,401],[136,33,46,227,137,33],"project\u002Fneutral\u002Fexecution",[215,33,33,229,11,37],"maker\u002Fpositive\u002Fnone",[153,33,46,227,154,33],[232,33,33,233,234,33],"7202099","commenter\u002Fneutral\u002Fnone","j45",[125,37,37,236,126,33],"project\u002Fcritical\u002Fprivacy",[218,37,33,238,11,37],"maker\u002Fneutral\u002Fnone",[240,37,47,229,241,33],"7200556","bensedat",[110,38,37,236,111,33],[67,38,33,244,11,37],"maker\u002Fneutral\u002Fprivacy",[144,38,46,246,111,33],"project\u002Fneutral\u002Fdocs",[248,38,33,249,11,37],"7200112","maker\u002Fneutral\u002Fdocs",[251,38,37,252,119,33],"7200958","project\u002Fcritical\u002Fidea",[254,38,37,236,255,33],"7200318","thatthatis",[118,38,37,236,119,33],[258,38,33,259,260,33],"7201052","other\u002Fneutral\u002Fnone","dasil003",[170,46,37,252,171,33],[263,46,33,259,264,33],"7200323","hrjet",[266,46,33,259,267,33],"7201520","barrkel",[269,46,33,233,137,33],"7200431",[271,46,33,272,119,33],"7200925","other\u002Fneutral\u002Fprivacy",[174,46,46,274,175,33],"project\u002Fneutral\u002Fprivacy",[276,46,46,274,277,33],"7201080","ultrasandwich",[279,46,33,272,280,33],"7201179","mjn",[282,46,33,259,267,33],"7201508",[161,43,46,284,162,33],"project\u002Fneutral\u002Fidea",[89,43,47,229,90,33],[287,43,33,233,162,33],"7209336",[289,43,33,290,291,33],"7201310","other\u002Fneutral\u002Fperformance","t0asterb0t",[129,47,37,236,130,33],[294,47,33,238,11,37],"7202090",[114,31,37,236,115,33],[297,31,46,274,241,33],"7200074",[147,31,46,246,115,33],[300,31,47,301,241,33],"7200109","maker\u002Fpositive\u002Fdocs",[303,31,37,304,305,33],"7200325","project\u002Fcritical\u002Fdocs","judk",[307,31,33,249,11,37],"7200359",[309,31,37,236,310,33],"7200080","kbar13",[312,313,46,284,314,33],"7200389",7,"znowi",[316,313,33,259,317,33],"7200496","voltagex_",[319,40,46,227,320,33],"7200395","umami",[322,40,33,259,241,33],"7200565",[324,325,46,326,327,33],"7200283",9,"project\u002Fneutral\u002Fpricing","abuehrle",[76,325,33,329,11,37],"maker\u002Fneutral\u002Fpricing",[331,18,46,284,332,33],"7200687","btgeekboy",[334,18,33,259,335,33],"7200734","finnn",[337,212,47,338,339,33],"7246069","project\u002Fpositive\u002Fidea","ferrouswheel",[101,223,47,338,102,33],[70,223,33,229,11,37],[343,344,46,246,345,33],"7200594",13,"mrblues",[347,344,33,249,11,37],"7202096",[349,350,46,351,352,33],"7207508",14,"project\u002Fneutral\u002Fnone","sstanfie",[181,354,46,284,182,33],15,[356,354,37,236,241,33],"7200191",[358,354,33,259,359,33],"7200196","kristianp",[361,32,37,362,363,33],"7200213","maker\u002Fcritical\u002Fnone","nblavoie",[365,32,33,238,11,37],"7200217",[197,367,37,252,198,33],17,[201,367,33,259,202,33],[370,371,37,372,373,33],"7202464",18,"project\u002Fcritical\u002Fexecution","just3ws",[375,371,33,238,11,37],"7202474",[377,371,46,378,241,33],"7202480","maker\u002Fneutral\u002Fexecution",[380,371,47,381,373,33],"7202648","project\u002Fpositive\u002Fexecution",[383,371,37,372,373,33],"7203535",[190,385,37,252,191,33],19,[387,385,33,388,130,33],"7202079","commenter\u002Fneutral\u002Fidea",[390,391,33,259,392,33],"7201906",20,"coherentpony",[394,395,33,259,396,33],"7200901",21,"inanov",[55,398,33,399,56,33],22,"commenter\u002Fcritical\u002Fnone",[59,398,33,233,60,33],[208,398,33,402,209,33],"other\u002Fcritical\u002Fidea",[],[405,410,415,420,425,430],{"id":406,"name":407,"points":408,"category":409},"7201353","InstantClick",426,"languages",{"id":411,"name":412,"points":413,"category":414},"7224436","Siri-as-a-Service Speech API",242,"ai",{"id":416,"name":417,"points":418,"category":419},"7191187","Eliss Infinity",214,"games",{"id":421,"name":422,"points":423,"category":424},"7188119","Hacker News Hack",149,"consumer_social",{"id":426,"name":427,"points":428,"category":429},"7219025","Abacus",120,"web_saas",{"id":431,"name":432,"points":433,"category":434},"7193353","Pullup",96,"dev_tools",false,"v2",{"id":438,"name":5,"line":6,"ai":435,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":439,"top":18,"kw":440,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":441,"url":9,"mix":442,"praise":98,"objection":107,"sub":21},7200043,-0.27,[24,25,26,27],"3315131101033050113301330353031111331000",[31,32,33,32],1793990902671]