)RULWVSDUW7RU*XDUGGHVFULEHGWKHDWWDFNDJDLQVWLWVLQIUDVWUXFWXUHWKLV
ZD\
³7RU*XDUGGLGQRWVWRUHRXUPDLQ>FHUWL¿FDWHDXWKRULW\@NH\RQDQ\
endpoint. But, even if the CA key was obtained and it was valid,
attacks like these would be virtually impossible to pull off because
OpenVPN has multiple layers of security. An attacker would have
to locate and synchronize multiple attack vectors [...] People
sometimes complain that OpenVPN is complicated, but that is one
reason it is highly regarded as a secure VPN protocol.”
:KDW¶VSHUKDSVPRUHWURXEOLQJLVWKDWWKHDWWDFNHUPD\KDYHEHHQDEOH
WRREVHUYHVRPHXVHUDFWLYLW\ZKLOHWKH\KDGDFFHVVWR1RUG931¶VVHUYHU
,KDYHUHDFKHGRXWWR7RU*XDUGWRFODULI\ZKHWKHUWKLVLVDOVRWKHFDVH
,QLWVUHSRUWLQJ%ORRPEHUJTXRWHG1RUG931DGYLVRU\ERDUGPHPEHU
7RP2NPDQZKRVSRNHDERXWWKLVVSHFL¿FLVVXH
“Okman said it was hard to determine if hackers obtained
information on the internet usage of Nord users because the
company doesn’t collect logs of activity on its servers, a selling-
point to privacy-conscious customers. ‘I think that the worst case
VFHQDULRLVWKDWWKH\FRXOGLQVSHFWWKHWUDI¿FDQGVHHZKDWNLQGRI
websites you could visit,’ Okman said. He said this would only
apply to Nord users who used its Finnish server and were accessing
websites that didn’t use the secure protocol HTTPS.”
%ORRPEHUJVDLG1RUG931HVWLPDWHVWKDWWRFXVWRPHUVXVHGWKH
D̆HFWHGVHUYHU
,UHDFKHGRXWWR1RUG931WRFRPPHQWRQWKLVVSHFL¿FLVVXH$FRPSDQ\
UHSUHVHQWDWLYHVWUHVVHGWKDWZKLOHLWZDVSRVVLEOHWKHUHLVQRHYLGHQFH
WKHDWWDFNHUREVHUYHGWUḊF7KHFRPSDQ\¶VUHVSRQVH
³(YHQLI>WKH@KDFNHUFRXOGKDYHYLHZHGWKHWUDI¿FZKLOHEHLQJ
connected to the server, he could only see what an ordinary ISP
would see, but in no way it could be personalized or linked to
SDUWLFXODUXVHUQDPHRUHPDLO+LVWRULFDO931WUDI¿FFRXOGQRWEH
monitored.”
M
a
x
E
d
d
y
