Windscribe VPN Security Breach

[SearchLight]

@windscribe appreciate the effort that you are making to overcome the security breach.

In your blog you also mentioned that Wireguard will be made your default protocol.

Other VPNS using Wireguard claim to erase the users actual IP address after a session or obfuscate that address with a Double NAT solution. You state that you designed a system that makes the users originating IP address known to your Wireguard system but difficult to read by your operations people within the Windscribe system. This implies that there is still a chance that someone could access that information as that IP stays within the "server". Will you be taking additional steps like the other VPNS claim to erase that IP information immediately after the user logs out of your app and/or system? Thanks.

Introducing WireGuard

Here at Windscribe, we’re always thinking about the next big thing and what the future holds. How will AI shape the fabric of human…

blog.windscribe.com

 

[codswollip]

At least Windscribe have the honesty to admit this problem.

Not at all. They were forced to admission when caught with their pants down. They deserve no laurels.

 

[windscribe]

@windscribe appreciate the effort that you are making to overcome the security breach.

In your blog you also mentioned that Wireguard will be made your default protocol.

Other VPNS using Wireguard claim to erase the users actual IP address after a session or obfuscate that address with a Double NAT solution. You state that you designed a system that makes the users originating IP address known to your Wireguard system but difficult to read by your operations people within the Windscribe system. This implies that there is still a chance that someone could access that information as that IP stays within the "server". Will you be taking additional steps like the other VPNS claim to erase that IP information immediately after the user logs out of your app and/or system? Thanks.

Introducing WireGuard

Here at Windscribe, we’re always thinking about the next big thing and what the future holds. How will AI shape the fabric of human…

blog.windscribe.com

This is already in place, as per the article above.

 

[SearchLight]

This is already in place, as per the article above.

So the users originating IP is erased after session logout from Wireguard?

 

[windscribe]

Not at all. They were forced to admission when caught with their pants down. They deserve no laurels.

Not true. You have us confused with NordVPN, Torguard, and PIA (who lied completely).

We voluntarily disclosed this July 8th: OpenVPN Security Improvements and Changes

We could have hidden the reason from you, and nobody would ever know since gov seizures rarely get leaked online for profit/lulz. For shady VPN companies like above, it's an easy choice:

Say nothing, silently "fix" it, keep all the users you have, and pretend it never happened.
OR
Disclose it, fix it properly, lose customers and reputation.

They chose the former, we chose the later.

 

[windscribe]

So the users originating IP is erased after session logout from Wireguard?

Yes, everything is cleaned up when the tunnel doesn't send any data for longer than 60s.

 

[windscribe]

Then that network boot is somewhat your persistent storage

Also, >grub

The fact that you're using grub also means that attestation is not being done correctly. This combined with the fact that grub doesn't even do secure boot well. The only verification grub has is weak GPG keys which aren't as strong as secure boot. It has a colossal amount of attack surface

So yes, you still have a very serious problem on your hands. Are we ignoring badbios or just the fact that an attacker can modify grub on the servers?

The main issue here seems to be the fact that openvpn is quite complex a protocol to manage (as you've said others haven't got it right either). Maybe it is time to find one that is easier then?

No idea whether the neuralyzer tool verifies the OS being sent to it and even if it does, you're ignoring the fact that an attacker can modify grub/bios so the verification is meaningless anyway

The flow I posted is simplified, there are several other security checks and balances in place. All will be described in detail in a technical writeup that will be posted when we release it.

 

[zkSnark]

Those who have uninstalled Windscribe and have a premium lifetime license, if you would like to give away, I am glad to accept it.

 

[Deletedmessiah]

Those who have uninstalled Windscribe and have a premium lifetime license, if you would like to give away, I am glad to accept it.

Same here

 

[windscribe]

An update: Ukrainian server seizure — a commentary and state of the industry

 

[oldschool]

An update: Ukrainian server seizure — a commentary and state of the industry

My faith has been restored. Thank you!

 

[Andrew3000]

An update: Ukrainian server seizure — a commentary and state of the industry

In case of doubt I gladly accept an offer for a lifetime license of windscribe

 

[I Walk MY Way]

Good for you windscribe my faith has not been restored, I am one customer that wont be back.