‍ ‍‍‍ᓭ cryptostorm ᓯ

The VPN provider for the truly paranoid

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

Regarding the https://t.co/ePxwXdfKBa vulnerability that was disclosed a few hours ago, our servers aren't vulnerable since we're not using the affected modules.

Now go buy tokens - https://t.co/Kn3671t19a

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

Regarding the https://t.co/6JiJCL6lvr vulnerability, our servers do run Arch Linux, but they're not vulnerable since support for the affected kernel crypto API (AF_ALG) isn't enabled, and the module is blacklisted as described on https://t.co/FIUxpU6xIk

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We added public DNS-over-HTTPS endpoints with optional ad/tracker blocking
See https://t.co/XxqZ7JHASf

The post also includes setup instructions for popular browsers, age/ID verification law comments, lifetime token news, and a Windows client update.

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

Our current supply of minted lifetime tokens is down to 24, and when those are sold we will be removing the option to purchase new lifetime tokens
https://t.co/Kn3671t19a <- buy one now before they're all gone
And no, they will not return for the annual Black Friday sale

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We finally got around to updating our Linux kill switch page + scripts:
https://t.co/8zvE4RvHHU

Replaced the old pile of legacy scripts with one clean, unified solution (WireGuard + OpenVPN, nftables + iptables).

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We updated https://t.co/9smKpjERo1 to include xtls-rprx-vision support.
The old configs should still work, but updgrading is recommended. Our CSXRAY Android app has also been updated - https://t.co/CxMUPx2im7 and so has the server-side Xray instances (Xray-core v26.3.27)

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We added better isolation to the backend endpoints for https://t.co/DktTq9xALK and /wireguard_man but a (now fixed) bug was causing keys to not propagate the network correctly for the past 24 hours. If you used either page in that time, please go back and add/del your key again.

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We wrote a blog post about our new server-side multihop feature.
See https://t.co/Fe8kSGseqb

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We added a new server-side multihop feature: connect like normal and go to http://10.31.33.7/multihop to use it.
Also updated to OpenVPN 2.7.0 on all the servers, and re-enabled DCO on the UDP instances since 2.7.0 is using a newer (less buggy) DCO

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

@R4CC00N3D @vxunderground @YJB52888982 👀

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

Xray support is live and our custom Android app is finished, see https://t.co/lxWAIXU4rF

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

For those already asking: Yes, we will be doing the Black Friday to Cyber Monday half-off sale this year (Nov 28 - Dec 1), same as we've done every year for the past decade or so.
Xray support is live and our custom Android app is finished, but the blog post is still in-progress

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We extended the ports you can connect to our VPN entry IPs on (was 1-29999, now 1-65535).
That was leftover from when the entry IP was the exit IP, but they're separate now so we can use all ports.
Port forwarding is still restricted to ports >30000.
https://t.co/Ny8zKMPMrk

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We wrote a quick blog post better explaining the post-quantum stuff involving SSH that we tweeted about on July 3. Also added a couple of other things to the post (fixed an ad/tracker blocking issue, and info about the Xray setup we're working on).
https://t.co/i3PXXkLLQN

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

the result=$(wait "$real_pid") line was incorrect, since that doesn't get the output, it just gets the return code from the wait command. The corrected code has been pushed to the server and updated on https://t.co/ITAs4Qxui6

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We added jittered, obfuscated API calls to OpenVPN's auth logic to blunt timing and size-based side-channel attacks—even with TLS 1.3 + PQ KEX in place.
See https://t.co/ITAs4Qy27E — the comments in the last four scripts have more details.

[‍ ‍‍‍ᓭ cryptostorm ᓯ @cryptostorm_is]

We added support for post-quantum key exchanges to our SSH tunneling/obfuscation.
OpenVPN can't do PQ KEX yet, but with this you can add a PQ layer on top of your OpenVPN (TCP) traffic.
This requires a recent OpenSSH/OpenSSL version.