The Privacy Paradox: When a VPN Needs a Tracker

Description

A screenshot of a tweet from the official AdGuard Twitter account, posted on April 30, 2021. The main tweet sarcastically remarks, 'Who would have thought that Google Analytics can be so critical for a VPN to function!'. This is a quote tweet of a post by Andrey Meshkov, which explains the technical issue: 'Some users report that they cannot log in to @NordVPN Android app when AdGuard DNS is used. That's because Google Analytics is blocked and Nord cannot live without it. We definitely won't remove GA from the blocklist so @NordVPN, could you please fix this?'. This exchange highlights a significant architectural flaw and a privacy contradiction. A VPN service (NordVPN), marketed for user privacy, is shown to have a hard dependency on Google Analytics, a major user tracking service. When a DNS-level blocker (AdGuard) does its job and blocks the tracker, it breaks the VPN's functionality. For experienced engineers, this is a prime example of poor design, dependency issues, and the hypocrisy sometimes found in commercial privacy products

Common Tags

DependencyHell VPN DataPrivacy PrivacyConcerns Android Google WebAnalytics MobileDevelopment

Comments

Anonymous ★ Top Pick NordVPN's login flow is the Schrödinger's cat of privacy: it simultaneously protects your identity and reports it to Google Analytics, and you don't know which state it's in until you check your DNS logs

Anonymous ★ Top Pick

NordVPN's login flow is the Schrödinger's cat of privacy: it simultaneously protects your identity and reports it to Google Analytics, and you don't know which state it's in until you check your DNS logs
Anonymous

The privacy stack, in prod: tap “Connect” → POST to google-analytics.com → wait for 204 → begin ‘zero-log’ tunnel - because nothing says security like a tracking pixel as your single point of failure
Anonymous

Nothing says 'we protect your privacy' quite like a VPN that literally won't let you log in without phoning home to Google Analytics first. It's like a bank vault that requires you to livestream yourself entering the combination
Anonymous

A VPN company - whose entire value proposition is privacy and blocking trackers - ships an Android app that literally cannot authenticate without Google Analytics. It's the architectural equivalent of a locksmith who can't open their own front door without first checking in with the neighborhood watch. This is what happens when product analytics become so deeply embedded in your auth flow that your privacy tool becomes a tracking dependency. The real kicker? Users discovered this by using *another* privacy tool. It's turtles blocking turtles all the way down
Anonymous

If blocking Google Analytics breaks your VPN login, you’ve put telemetry in the auth hot path - zero trust, except for Google
Anonymous

If blocking GA bricks auth, you didn’t add observability - you shipped Single Point of Failure as a Service; move telemetry off the critical path and let it fail open
Anonymous

NordVPN's auth flow: OAuth optional, but GA pings mandatory - because in privacy engineering, the tracker is the trusted root CA
@qtsmolcat 5y

jazz music stops
@AnarchistForLife 5y

Reads like satire. Dayum
@xlib4k 5y

Поясните плз
1. dev_meme 5y
  
  and warning 1/3 for @PupokSlona as well - didn't see that at first, thanks to @Sokolovskiy01 for bringing my attention to it :P
@gromilQaaaa 5y

Впн приложение не работает когда блокировщик рекламы выключает гугл аналитику внутри впн приложения... Не надо так... делать приложения...
1. dev_meme 5y
  
  This is an english-speaking community, so please speak english. warning 1/3 for @gromilQaaaa
  
  @gromilQaaaa 5y
  
  https://ru.m.wikipedia.org/wiki/Языковая_дискриминация
  
  dev_meme 5y
  
  Is it discrimination or inclusion if I keep an eye on people so everyone can understand everyone? I don't care what you think, I've got my opinion and if you don't follow the rules, you're free to leave. warning 2/3 for @gromilQaaaa
@gromilQaaaa 5y

Пф, так я в итоге и свалю. Не ожидал что подобные картинки такой клоун выкладывает. Предупреждения он мне делает... Не переоценивай себя, программист-неудачник который свой потенциал слил в телеграм канал и пытается тут поднять своё эго
1. dev_meme 5y
  
  warning 3/3 for @gromilQaaaa
2. @mainfme 5y
  
  Такой ты клоун обиженный бля Сразу видно, фамилия оканчивается на ко Stupid clown, this is English language community
  
  Deleted Account 5y
  
  ээ, ты то про фамилию не говори basically discrimination bad
  
  @mainfme 5y
  
  Ладно-ладно, я погорячился и это тупо звучало Ок
  
  dev_meme 5y
  
  Does this whole line of russian actually translate to just Ok? Not trying to moderate you, I'm just curious.
  
  Deleted Account 5y
  
  it to more like "ok, i overreacted and sounded dumb"
@gromilQaaaa 5y

Есть нормы ответа. Человек задал вопрос на русском - на том же языке ему дали ответ
1. dev_meme 5y
  
  …and you're out
dev_meme 5y

and for the record: if anyone here isn't good at english, please just start practicing it. Asking over and over for translations isn't the way. You can start by translating stuff you don't understand with google translate (or something similar) and get better from there.
@MetalBall887 5y

Do you really think there is at least one non-slavic member?
1. Deleted Account 5y
  
  the mod is from germany
  
  dev_meme 5y
  
  *austria but close enough
2. @AmindaEU 5y
  
  hi I speak a few words of Czech and Russian though
@MetalBall887 5y

So he does this because he can't understand us?
1. Deleted Account 5y
  
  also bc shat rules say en only
2. dev_meme 5y
  
  the rules included english only long before I became mod btw
  
  @DIEMN 5y
  
  Wow , it's so wierd
@MetalBall887 5y

Gooduck with that
1. Deleted Account 5y
  
  i mean, i do support him
  
  Deleted Account 5y
  
  even tho i'm ukrainian
@MetalBall887 5y

It's just funny how here and on some other channels the comment section is just a bunch of slavs speaking english hoping it will attract international audience. This usually doesn't work
1. Deleted Account 5y
  
  i was once in a en chat where everyone spoke indonesian
  
  Deleted Account 5y
  
  this is pure shit
  
  dev_meme 5y
  
  I'm in several arab chats and I hate when they speak arabic. They pretty much ignore any requests to use english.
  
  @artur_odesa 5y
  
  Maybe they ask each other Who is that english-speaking guy and what is he doing in their chat?
  
  dev_meme 5y
  
  no, they regularly speak english as well
  
  @its_sauce 5y
  
  if it's arabic-speaking chat then why not speaking Arabic? as an Arab, I hate when Arab people in an Arabic chat full of other Arab people but use English, even tho I'm good in English but I just love arabic. but ofc I would use English if there are non-arab people in the chat.
  
  dev_meme 5y
  
  I can't speak arabic, obviously.
@MetalBall887 5y

But of course if those are the rules...
@MetalBall887 5y

Would that even be an en chat
1. Deleted Account 5y
  
  by the rules it was, but noone enforced the rule
@pixelsex 5y

aight, now that we're done with the rules, any more info on NordVPN relying on GA? sounds bad enough for everyone to be aware of this shit for a long time already, so how come nobody knew this?
1. dev_meme 5y
  
  sounds like the average big company making shitty apps to me.
@qwnick 5y

Totally support decision to kick that russian-speaking 🍑🍩
@slnt_opp 5y

If App doesn't work without Ads while on free Tier, then it makes sense Traffic and compute resources aren't free I don't know much about NordVPN as a company, but I don't think they have something like Google behind them, to not care about ads as much as YouTube does
1. dev_meme 5y
  
  > to not care about ads as much as youtube does …what? elaborate pls
  
  @slnt_opp 5y
  
  Idk if it works now, but at least couple years back it was yet possible to watch YouTube without Ads buy using some AdBlocker And they never ever made any "traps" like some websites do(unno "turn of AdBlocker to see the article"). Terrific amounts of storage and traffic to pay for And all that while YouTube were not bringing money like at all. Why? Because Google can afford that
  
  dev_meme 5y
  
  Oh, they've tried plenty of tricks to keep adblockers from blocking their ads. But have you seen the state of the site? There's clearly not much compentence there, and I believe they've just eventually given up.
  
  @slnt_opp 5y
  
  Indeed, just they wouldn't give up if it would be death or life issue, would they?:)
  
  dev_meme 5y
  
  yesn't? I mean, regardless of if they can afford it, they're just unable to change it.
  
  @slnt_opp 5y
  
  In Apps at least, can't they?
  
  dev_meme 5y
  
  well, yes. I'm not aware of any method to remove ads from the official youtube app. …but there is youtube vanced.
  
  @slnt_opp 5y
  
  *iOS users left the chat*😅
  
  @dugeru42 5y
  
  Jailbreake users entered
  
  @AmindaEU 5y
  
  You can throw money at YouTube Premium and the ads go away 😛
  
  @dugeru42 5y
  
  It works
dev_meme 5y

aight, the magic of google translate wasn't in my hands today…
@Nefrace 5y

Such funny conversation here :D How many russians on this channel?
1. @NiKryukov 5y
  
  Sometimes I think there are only russians here in telegram
  
  @Nefrace 5y
  
  Same thing
2. @DIEMN 5y
  
  More than we thought 😅

Use J and K for navigation

The Privacy Paradox: When a VPN Needs a Tracker

Description

Categories

Common Tags

Comments

More like this

The Cyberpunk Dystopia Has Reached Production

European Cybersecurity, Now Fully GDPR-Compliant Pseudocode

Chat Control Meets the Trust-Me-Bro Exception