Summary: on 7 August a critical vulnerability was disclosed in BTCPay Server, the open-source software we self-host to accept Bitcoin payments. It was being exploited before disclosure, and we were among the merchants hit: an attacker extracted our Lightning node credentials and transferred out our operating funds.
Continue reading
Consistent with our commitment to regular independent security audits, we have scheduled our eighth annual security audit with Cure53, to be conducted over the course of two weeks in July. As in previous years, audits target systems and services that have undergone significant updates and where review provides the most value to customers in terms of security and auditability.
Continue reading
Consistent with our commitment to regular independent security audits, we have scheduled our seventh annual security audit with Cure53, to be conducted over the course of two weeks in May. As in previous years, audits will target systems and services undergoing significant updates.
Continue reading
In summary: We identified a potential DNS leak issue affecting our iOS app in brief intervals during WireGuard key regeneration. Details of the issue When IVPN iOS app rotates WireGuard keys while VPN is connected, the app calls the asynchronous method setTunnelNetworkSettings to update VPN tunnel with new configuration.
Continue reading
The key points IVPN has acquired Safing ICS Technologies GmbH*, the company behind the consumer firewall application Portmaster and the SPN network Over the coming months, the IVPN team will take over the operation of the Portmaster and SPN services IVPN is committed to continuing the improvement of the VPN service, Portmaster, and the SPN network with a focus on better integration across our services The why and how We believe a trustworthy VPN service is just one part of the essential toolkit for resisting online surveillance.
Continue reading
We’re pleased to announce that a sixth annual independent security audit has concluded. The assessment focused on Web UI, backend components, API endpoints, underlying web servers, and web infrastructure. We’d like to share two key excerpts from the report:
Continue reading
Consistent with our pledge to conduct a yearly review of our systems, we have commissioned the independent security auditing organisation Cure53 to perform a security audit in March 2024. As we remarked last year, audits we arrange focus on parts of our systems that received significant updates.
Continue reading
The phrase in the title is a common trope that comes up when VPN services are discussed. While this statement is technically correct, it can be misleading, as it implies that all providers handle law enforcement requests and prepare for worst case scenarios similarly, so their conduct cannot be a differentiating factor when you evaluate them.
Continue reading