2

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) like Hola or FriGate.

As far as I can understand browser plugins use webRequest API (from WebExtensions API) and mobile apps simply install VPN profile to the device.

I see two possible vulnerabilities:

  1. Reading the whole traffic (MITM)
  2. Reading DOM (only applies to browser extensions). The extension may read all forms' input and steal your credentials.

There is nothing I can do with DOM reading, but I believe that it is pretty safe to enter your password with this extensions on.

But I fear of MITM attack. Is Hola for example able to read the content of TLS-secured connections in both mobile and web edition? Does browser extension create a tunnel with some point-to-point L2 protocol or redirect http requests? Who is validating the certificates: browser or extension?

Improve this question
1
  • When it comes to Hola, never mind how securely it protects your own outgoing traffic. Worry instead about how, by design and without your consent, it turns your computer into an open VPN endpoint for anyone in the world to do with as they please. Just as your outgoing traffic is going to somebody else's computer to get around a country block, somebody else's traffic -- including any illegal activities they may be doing -- is now hitting the open Internet from your computer.
    – ArrowCase
    Commented Jul 23, 2018 at 16:51

1 Answer 1

Reset to default
1

I cannot speak on FriGate or other freemium VPN services, though I have used payed services without any issues and will provide some alternatives at the end of the answer.

Hola, at least the free version, works by allowing your computer to be a node within a P2P system of sharing bandwidth when idle, this way helping people to bypass geo-restrictions on content, which sounds like what you are after. As a participant in this network, you are responsible for helping to further route the traffic of other Hola users, which- as they state on their FAQs- is unfortunately not always fully encrypted. And since other Hola users' traffic is being proxied through you, any malicious or otherwise disruptive behavior that might get them ordinarily blacklisted from a website now is associated with your IP, potentially resulting in you not being able to access content due to the actions of this peer.

The best article I've read that about the Hola service provides an in-depth technical analysis of the VPN offering and is authored by AI-powered threat research company, Vectra.

In my mind the single biggest takeaway from the article was that the Hola VPN service is allowed to download additional software without the user being notified by the OS or browser due to the creation of its own code-signing certificate on the host system during installation.

Further, Hola, and its parent company, Luminati, have been known in the past to have had the users of their VPN offering serve as unwitting participants in DDoS attacks.

If you are going to use a VPN, it is up to you to determine if the above concerns are worth living with otherwise you may want to consider using a paid offering like PIA or NordVPN.

Further sources for your consideration:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .