IVPN plan updates live today - we now offer three tiers, no price changes.
Standard ($60/yr): 5 devices, includes Multi-hop
Plus ($80/yr): new tier with Mailx and modDNS
Pro Suite ($100/yr): 10 devices, Mailx, modDNS and Portmaster Pro
Details: ivpn.net/blog/ivpn-plan-chan…
We have temporarily paused web logins for IVPN accounts created before November 2020 and for Teams plans. This is a precaution while a newly disclosed vulnerability in PHP is patched, not a response to an incident on our systems. We will update this thread when logins are back.
App logins, VPN connections and our other services work as normal for all customers, including legacy and Teams accounts. Accounts created after November 2020 (Account ID format i-XXXX-XXXX-XXXX) are not affected.
IVPN for macOS v3.16.1 is out with Split Tunnel: you can now exclude selected applications from the VPN, see details and caveats in blog post. Requires macOS 12 or later. Available via our website and in-app updates.
ivpn.net/blog/split-tunnel-n…
IVPN for Android is temporarily unavailable on Google Play due to an issue with Google's payouts to our merchant account. Existing installs keep working. How this affects you, and how to install the app on a new device - in thread >
What happened: Google requires a verified bank account to pay out merchant earnings. We switched banks and Google payout verification failed with multiple new bank accounts. We have been working to resolve this for months without a response from Google support.
We appealed the removal in time. Google did not respond within its own stated seven-day window and the app was subsequently removed. We are working on resolving the bank account issue. Once Google verifies the account, IVPN returns to Google Play. We will update this thread.
Quantum-resistant Wireguard connections are no longer limited to the IVPN apps.
The Wireguard config generator now adds a quantum-resistant PresharedKey to configs for routers and native clients, automatically or from keys you generate yourself.
ivpn.net/account/wireguard-c…
Automatic: "Enable quantum-resistant connection" is on by default when you select "Generate key".
Your browser generates Kyber-1024 and Classic-McEliece-348864 keypairs, derives the PresharedKey from the server's response and embeds it in the config.
Manual: select "Add key", tick "Add post-quantum public keys (optional)" and paste two KEM public keys you generated locally. Decapsulate the two cipher keys the server returns with your private keys to derive the PresharedKey.
Step-by-step guide: ivpn.net/knowledgebase/gener…
New in Mailx:
- passkey login without email
- CSV import
- bulk actions and pins for aliases
- permanently delete custom domain aliases
- many other fixes and additions
On 7 Aug a critical vulnerability in BTCPay Server, which we self-host to accept Bitcoin payments, was exploited to steal Bitcoin from our Lightning node. The funds were ours: no customer data accessed, no customer funds lost, no action needed. Report: ivpn.net/blog/security-incid…
@BtcpayServer disclosed and patched the issue quickly. We sent them a report with transaction identifiers and destination addresses, which may help correlate our case with other victims, and three findings about the default configuration that might affect every deployment.
We could have avoided this entirely by handing Lightning payments to a processor. We won't, so nobody but us sees who pays us. Occasionally absorbing the cost of a vulnerability in open-source software we rely on is part of the trade-off. We'd still rather you heard this from us.