In light of the NSA leaks, is AirVPN Secure?

[Samad 2]

The leaks in this Guardian article are troubling, specifically the following line:

 

The document reveals that the agency has capabilities against widely used online protocols, such as HTTPS, voice-over-IP and Secure Sockets Layer (SSL), used to protect online shopping and banking.

 

Is the default configuration of the AirVPN client still secure? Are there changes that we should make to how the client functions to ensure our privacy online?

 

Thanks for any and all responses.

[Staff 9972]

Hello,

 

we need to create a FAQ for this!

 

In the meantime please see here:

https://airvpn.org/topic/9949-us-and-uk-spy-agencies-defeat-privacy-and-security-on-the-internet/

 

Executive summary: the answer to your question is yes.

 

Kind regards

[zeep 3]

Also relative to Samad's post and from the same article at the Guardian:

 

"Documents show that Edgehill's initial aim was to decode the encrypted traffic certified by three major (unnamed) internet companies and 30 types of Virtual Private Network (VPN) – used by businesses to provide secure remote access to their systems. By 2015, GCHQ hoped to have cracked the codes used by 15 major internet companies, and 300 VPNs."

 

300 VPN's. My, they are ambitious, aren't they?

 

How would/could they accomplish this?

 

The article is suggesting that GCHQ would "crack" the codes, not coerce the Internet comapnies to get the information as the NSA does through the Patriot Act.

[Staff 9972]

Hello,

 

currently there are more than 300 VPN services out there that actually offer a low security service. Just think of PPTP with MS-CHAP v1 or MS-CHAP v2 or MPPE authentication: cracking it is relatively easy and does not even require NSA capabilities. 

 

Then think about VPN services that run OpenVPN configured in Static Key Authentication mode. Obtaining the static keys in any way (sometimes it might be enough to just ask...) would give immediate capability to decrypt all past (if captured), present and future data streams. So the alleged purpose does not seem unrealistic at all.

 

Kind regards