Barrett Lyon

Hacker formerly know as doxx. Builder. Artist.

[Barrett Lyon @BarrettLyon]

This is only going to get worse. Adults should be allowed to use their devices anyway they want. Parents should control their kids content not old men with no tech background writing laws!

[Ophuscado @Ophuscado]

Ha llegado el día: mi teléfono Apple, de más de 1.000 €, ha dejado de ser mío y de obedecer mis intereses. Un teléfono inteligente que se ha revelado en contra de su dueño y se ha convertido en un pisapapeles por voluntad propia. Espero que más gente se oponga a esta vigilancia masiva. No habrá más oportunidades.

[Barrett Lyon @BarrettLyon]

I’ve seen their storage arrays in the United States and it’s unreal. They have full city block sized disk arrays saving what appears to be everything. It’s insane.

[Martti Malmi @marttimalmi]

Reminder: Telegram is not a secure messaging app. It is a plaintext database.

[Barrett Lyon @BarrettLyon]

@svenja_hahn An IP address is not a passport! Privacy is key.

[Barrett Lyon @BarrettLyon]

@OrdinaryGamers An IP address is not a passport

[Barrett Lyon @BarrettLyon]

IP addresses are not a passport!! The network shouldn’t be involved in this stuff. It’s up to parents and opt in on devices to filter content not the network. This is a case of morons making laws they themselves do not understand. Idiots following China, Russia, and Iran. So if you like their networks go support Utah.

[Barrett Lyon @BarrettLyon]

@matthew_d_green I'm sorry but identity should not be done at the network level, it will never work. IP addresses are not drivers licenses. Maybe this should start with better parenting and controls on the devices, not asking the network to do stuff it can't.

[Barrett Lyon @BarrettLyon]

@nirzuk Data is a data problem

[Barrett Lyon @BarrettLyon]

The current internet is a mess due to NAT and CGNAT; the idea is the Internet can be both open and private at the same time. The best part of the Internet is there is no privacy and the best part of the future is there can be both at the same time.

[Barrett Lyon @BarrettLyon]

I've started multiple companies around global traffic: DDoS mitigation, large-scale video streaming, network visibility. When I say the current internet wasn't built for privacy, it's because I've spent 20 years staring at its guts.

[Barrett Lyon @BarrettLyon]

From a threat-model perspective, a random VPN exit node is often worse than your ISP: less regulated, less accountable, and more incentivized to quietly monetize whatever they see. Exit nodes that are not network controlled by the VPN provider are honey pots.

[Barrett Lyon @BarrettLyon]

The industry loves to point at one or two heavily audited providers as proof the model is fine. Meanwhile the long tail of "no-log" services ranges from sloppy to outright hostile. Continuous audit by AI will show the true extent of their depravity.

[Barrett Lyon @BarrettLyon]

Researchers found most mobile VPN apps leaked traffic, and a chunk didn't encrypt at all. Leaking is easy because most VPNs don't support IPv6 properly. That leaks real quick on mobile networks. Their behavior is gross.

It's clear NordVPN leaks everything because they allow CloudFlare to decrypt their traffic between you and their origin servers. It's all just a bunch of words, no actions.
https://t.co/Uet8AV0ZjB

[Barrett Lyon @BarrettLyon]

Re the situation in Russia, most VPNs get blocked because they were never designed to be unblockable. They either use basic tech and don't support hardcore covert communications or they get blocked in the app stores. However, there are ways around all of that. More to come soon..

[Barrett Lyon @BarrettLyon]

Even though your VPN says they don't track anything, that doesn't mean the follow through with it. VPNs like NordVPN or Mullvad use 3rd party services that often have flow monitoring.... really the SNI requests, DNS requests, everything you do leaves a trace. Do they monitor it? Who knows. Is it there? Yes.

[Barrett Lyon @BarrettLyon]

Your VPN can see EVERYTHING about you: IPs, timestamps, servers, session lengths, and more. What devices you have, what time you wake up, what sites you go to, what you're doing, all your unencrypted stuff, the job you have. It knows more about you than you know about yourself.

Even more... they see all your dns, what you request, what you download, even if encrypted. SNI requests are not, which means every site you visit they see. Do they log? Who knows? Can they deploy anti-log software when they're audited? Yes. Can that change after? Also yes.

[Barrett Lyon @BarrettLyon]

Why would you trust NordVPN more than your ISP with your bits? Moving your data to a shady VPN isn't the way to go, VPN tech is good but the players behind them may not be.

[Barrett Lyon @BarrettLyon]

"End-to-end encryption" from an app like WhatsApp, Telegram,etc doesn't mean peer-to-peer. It means they have servers in the middle and use E2E (who knows what kind of encryption) to make you feel special. It's all your #$%^& on our servers, eat it human.

[Barrett Lyon @BarrettLyon]

"No-log" VPNs have been caught leaking user data or keeping connection logs that were handed to investigators. What's worse is they lie about where their servers are, and their GEO location is pay-for-play to save costs https://t.co/iawbm7SfJf

[Barrett Lyon @BarrettLyon]

A lot of ‘privacy’ services like VPNs totally expose their customers’ data by sending it to CDNs for full description. How the hell can they say they care about customer privacy when their APIs are proxied via a 3rd party?

[Barrett Lyon @BarrettLyon]

"We don't log" is BS. VPNs allow 3rd party tools all over their products, which means they allow everyone else to log you. They give zero fucks about your privacy. The only safe assumption: every VPN provider logs something.