nym-product

fid02 I think a relevant question is why the audit report is still referenced on Nym's websites with a summary highlighting the positive aspects of the report, but with no explanation of why Cure53 unpublished their audit report. I'm guessing only Nym and Cure53 can answer that.

Hi, thanks for raising this, it was on Cure53 website (as shown by the Web Archive link posted) - let us get in touch with them. I'll see if we can also self-host the report. Other reports (Oak Security, JP Aumasson) are available.

0xsigsev Ok, so I have read the white paper, and once you get through the initial "we are bestest" sales pitch, we get to some technical details, which on paper sound good.

The whitepaper is the theoretical outline of the Nym mixnet idea, which was written in 2021. For practical implementation, the best is to check our server and client code, which is open source: https://github.com/nymtech

area51 Where has NYM-PRODUCT gone, are you still reading this post?

I'm here!

0xsigsev thinking that they maybe have some actual documentation

As shared by @argante above. You can also check https://nym.com/trust-center/papers-and-research. Especially "The Nym Network - The Next Generation of Privacy Infrastructure" which will give you an overview of the mixnet design (which powers the "Anonymous mode" toggle in the NymVPN apps).

The "Fast" mode relies on 2-hop, tunnel-in-a-tunnel, AmneziaWG (client-side).

N1b Threat actors like governments and big companies are aware of blockchain technology now and will attack any project that starts with similar traits.

It's possible if the project is of interest to them. However, remember that a significant share of Bitcoin is already owned by government-affiliated entities (so-called "US strategic reserve", seized assets, ...) and big companies (funds, ETFs, ...).

N1b Therefore any new idea that tries to be truly decentralized and trustless has to build on the Bitcoin network (usually as a layer on top of the Bitcoin network, like Lightning, Stacks, Liquid or Merlin).

How do you come to this conclusion? What would make a reputation system more decentralized if it was based on Bitcoin? Wouldn't the above Bitcoin whales have a head start with such a design?

N1b And how would it protect itself against threat actors? How would it incentivize individuals to contribute protection?

Threat actors can (and will) set up malicious nodes in the network (as acknowledged in a previous post). This is addressed by a combination of a reputation/reward system, active community management, multi-hop network configuration, and the choice given to the user to select and rotate the nodes they use.

We also provide extensive documentation on how to run nodes yourself (https://nym.com/docs/operators/introduction), and incentivize operators to run with high performance/uptime. Thus anyone can contribute and "dilute" potential bad actors. How do you see a Bitcoin-based reputation system significantly improving this design?

argante Do you have any ideas on how to protect yourself against this?

Nym's official take on it is https://nym.com/blog/privacy-under-threat-switzerland.

N1b Feedback: It's not easy to understand from the website what Nym is about. For fact finders it would be helpful to explain the background or link to a more extensive blogpost, e.g. why you claim that Nym is a trustless network.

Point taken.

N1b you offer 50% discount when paying with crypto. This is nowhere mentioned on the main page but a huge USP for privacy and Bitcoin/Monero enthusiasts.

Yes. This is a temporary launch offer, the team didn't want to promote it too much. It will be removed within a couple of weeks.

N1b So how does Nym plan to create a trustless system based on blockchain technology?

Let me get back to you with a more elaborate answer.

Hi, happy to answer any questions you have about NymVPN. Disclosure: I work at Nym Technologies.

Plobberfroth not going to register without knowing plan costs.

@Plobberfroth we launched our paid version a couple of weeks ago. You can check pricing at nym . com / pricing.

wuseman They are most definitely not the only VPN that can ping you around different nodes to make it harder to figure out who you are. Proton even has that, I believe.

@wuseman Indeed Proton does offer a multi-hop setup (not by default though). NymVPN offers 2 modes, both a multi-hop VPN, and our signature "mixnet" mode. This mode does aim to hide your metadata, something typical VPNs do not offer.

N1b I think it's shady that they hide their price

@N1b As a new product, we were in a free beta mode. We launched our paid version on March 13.

N1b Over time, it will become more reliable to judge one way or the other.

Indeed, trust is built over time! To jump start that trust, feel free to have a look around our Trust Center, which provides info about our open source code (server and clients), security audits, university partnerships, peer-reviewed papers, and more.

FlipSid in the end one question would still remain why one would, or should, use them over Mullvad, IVPN or Proton?

Indeed! Trust will be built over time, and it's up for everyone to try. Get 5 or 10 years back in time: Why one would, or should, use Mullvad, IVPN or Proton? And yet...

ryrona Actually, routing through more than 3 nodes does not improve anonymity any further, as the largest risk at that point is if the attacker control both your first and last hop, in which case they can deanonymize you reliably regardless of number of nodes in between.

@ryrona while we respect Tor a lot, the mixnet is built with a different architecture. Nym is not just "adding another 2 nodes". Packets are onion-encrypted, and also delayed and mixed with cover traffic to further improve the privacy properties of the network.

angela Can anyone create a node? What is to stop governments from creating 100 honeypot nodes?

Anyone (including you!) can run a node. Nodes can (and will be) run by governments. Limiting these behaviours is done by actively managing our community of operators, and making use of the mechanisms described in the “Reward sharing for mixnets” article (“costs” to setup a node + a reputation system). Limiting the impact of this is done by being multi-hop by default (so one node doesn’t see both your IP address and the destination of your traffic – which is not the case of single-hop VPNs). Users can also limit that by frequently rotating the nodes they use.

In the future we plan to include mechanisms to detect active attacks and penalize/exclude nodes found to engage in active malicious behavior, as well as to limit opportunities for passive (undetectable) malicious behavior through the use of secure hardware.

area51 so a direct link to crypto currency a G**gle engineer and a new "all singing all dancing" secure VPN and its free for now.. Its just too much to believe

The Nym founders also comprise renown computer scientists and cryptographers (MIT/Inria, KU Leuven). Ania Piotrowska designed the "Loopix Anonymity System", the communication system from which Nym originates, and which was presented in 2017 at the USENIX Security Symposium, a renown security conference. The advisory board comprises (co-)designers of cryptography all of us use (ChaCha, TLS 1.3, etc.).

Hi @JollyRancher @N1b — happy to answer any questions you have about NymVPN.

Disclosure: I work at Nym Technologies.