IVPN Multihop

[jeremy99746409 0]

Does AirVPN have any plans to implement a multihop feature like that found in IVPN? This could help to improve privacy; even if a VPN provider does not store any logs, your ISP provider most certainly will keep a log of the IP addresses that you connect to along with a timestamp. With a multihop solution, your ISP can only see the first VPN server that you connect to, not the exit server, which I imagine would make it far more difficult to track. While AirVPN over TOR is an option, the speeds are unacceptable for most people.

[Staff 9972]

Hello!

 

It's already allowed, but it needs that you specifically set it up. For example, there is no explicit function in Eddie, the Air client software, but you have the option to connect to one of our VPN servers over a proxy or Tor.

 

Anyway the implementation by yourself is trivial, although multi-hopping on nodes which are all operated by the very same entity is not a good solution for obvious reasons. In the forum this topic has been faced multiple times in the past, give the search engine a chance to help you.

 

An outstanding member of our community wrote a software for GNU/Linux which will let you muti-hop in a very easy way, even between different VPN providers (this makes more sense). Please note that this software has NOT been tested extensively by Air Staff. Have a look here:

https://airvpn.org/topic/26327-alternative-airvpn-client-with-provider-independent-double-hop-support-gnulinux/

 

Kind regards

[jeremy99746409 0]

Hello!

 

It's already allowed, but it needs that you specifically set it up. For example, there is no explicit function in Eddie, the Air client software, but you have the option to connect to one of our VPN servers over a proxy or Tor.

 

Anyway the implementation by yourself is trivial, although multi-hopping on nodes which are all operated by the very same entity is not a good solution for obvious reasons. In the forum this topic has been faced multiple times in the past, give the search engine a chance to help you.

 

An outstanding member of our community wrote a software for GNU/Linux which will let you muti-hop in a very easy way, even between different VPN providers (this makes more sense). Please note that this software has NOT been tested extensively by Air Staff. Have a look here:

https://airvpn.org/topic/26327-alternative-airvpn-client-with-provider-independent-double-hop-support-gnulinux/

 

Kind regards

Thankyou for the reply. Can you explain the "trivial" steps needed to get multi-hop working on Windows 10? Preferrably a solution which has been tested extensively by Air Staff. Also, wouldn't it be beneficial to have a fully tested multi-hop option in the Eddie client itself? That way average users like myself could benefit from an increased layer of privacy without any additional setup.

[Staff 9972]

Thankyou for the reply. Can you explain the "trivial" steps needed to get multi-hop working on Windows 10? Preferrably a solution which has been tested extensively by Air Staff. Also, wouldn't it be beneficial to have a fully tested multi-hop option in the Eddie client itself? That way average users like myself could benefit from an increased layer of privacy without any additional setup.

 

 

Hello!

 

Probably the easiest solution is just running a VM attached to the host via NAT. You connect the host to some Air VPN server and the VM to some other VPN server, in this way you have double-hop on the VM. Each account can use up to five connection slots at once, this solution would take two of them.

 

Another solution is using an external proxy and configure Eddie (just a few clicks are needed for that, in "AirVPN" > "Preferences" > ") to have OpenVPN connect over that proxy (OpenVPN over a proxy). This makes more sense for the mentioned reason (you would have two hops controlled by different entities, enforcing a valid "partition of trust": the proxy would not see anyway your traffic content, because it's still encrypted by OpenVPN, while our servers would not see your "real" IP address).

 

A multi-hop solution on the servers side is not planned at the moment (multi-hop is used only for the "micro routing" we use for "geo-routing").

 

If you run GNU/Linux with a DM supporting Qt you can check Qomui here:

https://airvpn.org/topic/26327-alternative-airvpn-client-with-provider-independent-double-hop-support-gnulinux/

 

keeping into account that this is an open source software released by a community member and tested by AirVPN community, not staff (anyway, community testing may be even more extensive than ours, since our GNU/Linux community is becoming huge, and many persons are very skilled).

 

Kind regards

[JSD 6]

For example, there is no explicit function in Eddie, the Air client software, but you have the option to connect to one of our VPN servers over a proxy or Tor.

 

My greatest problem with this solution is that Network Lock seems not to work then yet. Is it planned for future versions to change this?

 

I think there are many people who have no “extensive” need for privacy and who are willing and can afford to trust in AIR VPN sufficiently to abstain from partition of trust.

 

Many of these folks seem to believe, however, that it would be quite easy to crack the anonymization of those people who are using a one-hop VPN.

 

It seems that this is not true, because any such attack would not be trivial, but rather difficult and require considerable effort - and therefore, it was unlikely that the average VPN user will be compromised easily, if he or she is not specifically targeted.

 

For instance, could an adversry from the distance (at an internet backbone, for example) who is monitoring a VPN server with multiple users connected simultaneously correlate incoming and outgoing streams just by analyzing the traffic patterns of the flows? I read somewhere that this would be very difficult, and that such a correlation attack would rather require someone to wiretap a VPN server at close quarters with some special equipment.

 

Perhaps Staff could eleborate a little on this, because it seems to me that many people have such questions, and that there are few articles fr laypersons who address such questions. Maybe many people overestimate the ease that it would take to overcome the privacy a good VPN offers.

[Staff 9972]

 

For example, there is no explicit function in Eddie, the Air client software, but you have the option to connect to one of our VPN servers over a proxy or Tor.

 

My greatest problem with this solution is that Network Lock seems not to work then yet. Is it planned for future versions to change this?

 

Hello!

 

Network Lock works with OpenVPN over an HTTP or SOCKS proxy. It does not work with OpenVPN over Tor, because the Tor guard IP address can't be known before the circuit is established, obviously. There are no plans to change this in Eddie 2.14.x, maybe in Eddie 3 future branch. Use Tor over OpenVPN with Network Lock enabled and you have an even safer solution.

 

I think there are many people who have no “extensive” need for privacy and who are willing and can afford to trust in AIR VPN sufficiently to abstain from partition of trust.

 

 

We have been writing about that since 2012, so we agree and we know that a minority of our customers can't afford to trust us or especially the datacenters personnel.

 

In every case where the threat model prescribes the need of partition of trust and Network Lock, a strong solution is Tor over OpenVPN. Double hopping on different VPN providers is the next weaker solution for different threat models. Double-hopping on servers handled by the same provider should be evaluated carefully because it is the weakest solution of the mentioned set: it is ineffective in every threat model which takes into consideration an adversary with the power to (legally or illegally) wiretap a set (even a small set) of servers operated by the same provider, but it is effective for a threat model in which the adversary has the power to wiretap only one datacenter (think of the datacenter personnel as an adversary, for example).

 

Perhaps Staff could eleborate a little on this, because it seems to me that many people have such questions, and that there are few articles fr laypersons who address such questions. Maybe many people overestimate the ease that it would take to overcome the privacy a good VPN offers.

 

 

Check this article, it was written 6 years ago:

https://airvpn.org/topic/54-using-airvpn-over-tor/?do=findComment&comment=1745

 

In the informative sections of our service we inform people about the importance of the issue. Our web site does have a dedicated page for AirVPN over Tor and Tor over AirVPN.

 

Kind regards

[JSD 6]

Hello Staff,

thank you for the link.

 

Perhaps you could elaborate on which adversaries can be defeated by AIR alone and which ones would require a partition of trust (if you have not already done that and I just got it wrong).

 

Concerning AIR alone (without partition of trust), a complete layman tends to think that it might be very easy to correlate all the incoming and outgoing traffic from a server, even from a great distance (for example at an internet backbone). This seems NOT to be that easy, but perhaps someone could elaborate a little on this?

For example, it seems that "simple" data center logging is not sufficient to know who is doing what.

Staff once wrote:

Anyway, this kind of logging is not the real issue here. The real issue is whether traffic logging is assisted by timing correlations on the VPN server, otherwise the logging would be ineffective to produce anything valid (unless there's only one client connected to the server).

 

You can imagine wiretapping boxes put on the servers ends, methods of undetectable servers control that do not leave trace and that would make correlations easy etc., assuming that a datacenter is willing to spend on such things.

 

My understanding from that is that a data center could in principle wiretap a server effectively, but that this would require some complex and costly extra steps that are not applied as a routine, and that therefore it is rather unlikely that such measures are taken in reality.   

 

TOR over VPN may be the most anonymous solution; the problem with Tor (as the exit point) is just that it is difficult to use sometimes. For example, I was not able to register an email account even with the lowest security settings (JavaScript enabled in general), and this was NOT because of exit node blocking. Although some sites do block Tor exit nodes (Google, for instance), of course. Sometimes, Tor is also very slow. So in my subjective view, Tor not so suitable for everyday use, particularly not as an "exit" to the internet.