I contacted Proton VPN about the TunnelVision exploit and I got a response. I feel great about it, thank you Proton!
Hi,
Thank you for your patience.
Our engineers have conducted a thorough analysis of this threat, reconstructed it experimentally, and tested it on Proton VPN. Please note that the attack can only be carried out if the local network itself is compromised.
Regardless, we’re working on a fix for our Linux application that will provide full protection against it, and it’ll be released as soon as possible.
If there’s anything else that I can help you with in the meantime, please feel free to let me know.
Have a nice day!
I suppose you have a degree in it, then? What was your major, what qualifications do you have that make you more than an “armchair netsec quarterback”? Obviously you must have years of experience in the field, no?
Many people who travel for work are explicitly banned from using public networks to connect in the first place. I know every corporation I’ve worked at has expressly forbidden it if we are accessing confidential data. With the ability of all modern phones to share their internet connection with PCs they are connected to through USB, there shouldn’t be many circumstances where you are forced to use public WiFi unless you specifically want to use an unsecured network for some reason.
Of course, many people accessing corporate data on the go will be using SSH, and a bad actor using TunnelVision can’t read that encrypted data any easier than anyone else, as the exploit breaks only the VPN encapsulation, according to the CVE.
You did read the CVE, correct? You are, after all, not an armchair netsec quarterback.
Your derogatory tone and little-dick energy is hilariously over-the-top and just completely unwarranted. Go big or go home eh?
Why would I have any desire to be nice to somebody tossing around insults? Especially some random idiot on the internet? When I talk to people, they get one chance to not be a dick. After that, fuck them, and I’ll piss in their bean curd all I want. And if that bothers you, then fuck off?
Not a fucking thing you said matters if the exploit still exists because it can be used to get someone, somewhere.
Oh, there’s an air-tight solution. Let’s rely on everyone doing exactly the right thing every time, especially those nontechnical people. That never goes wrong.
Not at all, but when there is a fucking CVE about it, blowharding about “eh it’s not really a big deal guy, trust me I know better” kinda makes me question the blowhard’s experience. I think I’ll go with the CVE and say that yeah, this is an issue that needs to be addressed.
Also did you think my comment was a direct reply to yours? Have you not seen the multitude of other comments in other threads just writing this off like as if it can be ignored entirely? Yours, while flippant, was not even the worst of the bunch.