Password-less VPN authentication

Releases By Nick Pestell | Posted on December 12, 2019

TL;DR - We no longer require customers to specify a password when connecting to the VPN as we have randomly generated usernames and the password doesn’t affect the security of the VPN tunnel in any way. You still require a password to login to the website Client Area.

To understand more about this decision read on.

An authenticator is the means by which an identity is confirmed e.g. password or 2FA token. When designing information systems its important to choose an authenticator that is commensurate with the sensitivity of the information to which the use of the authenticator permits access. Companies use VPN technology to permit offsite staff secure access to their corporate networks. If an attacker were able to steal an employees credentials they would have full access to all the internal servers on the corporate network. Privacy VPN services use the same technology but instead of providing secure access to an internal network they provide secure access to the Internet. If an attacker were able to steal some credentials they would simply gain access to the Internet like any other IVPN customer and could do no more than use our service without paying for it.

The username and password are only used to check that you have a paid account. They are not used in any way to establish the security of the VPN tunnel itself i.e. cryptographic keys are not derived from them.

IVPN have always generated random usernames (62^8 combinations), so from now on we will use the username as the identifier and remove the requirement for a password. This not only simplifies user experience, but removes the confusion about needing a strong password for the VPN tunnel.

New versions of the IVPN apps will be released today with the username field renamed to ‘Account ID’ and the password field removed. If you are connecting with a non-IVPN app simply specify any password.

Please note: This has no effect on the client area. To access the IVPN Client Area on the website you still need to enter the email address and password you signed up with.

Apps Security
We invite you to discuss this post in our Reddit community or on Twitter. You can also send your feedback to blog@ivpn.net.
IVPN News

Independent security audit concluded

By Nick Pestell

IVPN News

IVPN applications are now open source

By Viktor Vecsei

Releases

Beta IVPN Linux app released

By Viktor Vecsei

DNS over HTTPS (DoH) support on macOS, Linux and Windows Releases

DNS over HTTPS (DoH) support on macOS, Linux and Windows

Posted on April 5, 2022 by IVPN Staff

IVPN offers custom DNS servers which, when accessed through the VPN ensure that your DNS queries are encrypted between your device and our DNS server. This is a necessity, as DNS queries are not encrypted by the DNS protocol and can be easily read by an adversary observing your traffic (even when using HTTPS for your web traffic).
WireGuard Port Forwarding enabled Releases

WireGuard Port Forwarding enabled

Posted on February 16, 2022 by Viktor Vecsei

After the recent addition of Multi-Hop for WireGuard, we are now introducing port forwarding support for Wireguard. Port forwarding allows incoming connections on a specific port, enabling you to run various services on your device that need to be accessible from the Internet.
Spotted a mistake or have an idea on how to improve this page?
Suggest an edit on GitHub.