Whilst continuing on my never ending device security quest I stumbled upon this:
( luckily before attempting to make OpeNyx phone clone after first flash of GrapheneOS on new Pixel )
Are NordVPN users compromised?
Based on all available evidence, the answer appears to be no . NordVPN users have not been compromised by an attacker gaining access to one expired TLS key for a single server in Finland.
First, the hacker would not have any access to server logs because NordVPN is a no logs VPNprovider that does not store anything on its servers. NordVPN passed a third-party audit by PricewaterhouseCoopers verifying its no-logs policy.
Second, NordVPN utilizes perfect forward secrecy, which generates a unique key for every session using ephemeral Diffie-Hellman keys. This means that even with a TLS key there’s little a hacker could even do , since the keys are used for server authentication and not traffic encryption. As NordVPN pointed out above, the hacker would need direct access to the user’s device or network for an effective attack (extremely unlikely).
However more worrying is their article on Tor – though cannot ascertain if it ALL applies to LIVE USB usage. I knew about some of this, but not to this extent. Need to reassess my thoughts and consider withdrawing past recommendations – what do you guys think?
Of interest and note is the difference in tone between the two articles – NordVPN pay restoreprivacy for trade. Does auditing do anything but rubber stamp NordVPN and others? No – then how did the banking crises happen – with all those bundles of bad debt being eagerly bought, accounted for and audited – Ah questions…………
So you jump out of Tails+Tor and into a paid for VPN and you still get scr…
Seem to be no further forward than when I started? So many blind alleys…
Is my quest futile?