Xerobank questions ?

Steve, a few questions...

(1) Does the introduction of SafeHouse mean that xB VPN will no longer be using OpenVPN?

(2) Will Xero Networks be making the source code for SafeHouse available for public inspection?

(3) Is SafeHouse an additional component that users can optionally choose to include or omit when using xB VPN – or, is it a replacement for xB VPN and therefore must be used when accessing the XeroBank network?

Thank you.

 

You will still be able to connect using OpenVPN directly if you like.

We'll do you one better. It will be released open source and free (GPL) for individuals.

It is a direct replacement for xB VPN... and all other vpn clients as well.

 

Sounds great Steve, hope it's worth the wait. Like many here I still think XB could have handled their customer relations a bit better but the end product seems superb and looks to be getting even better.

 

Is Xerobank just a one-man operation ?

Seriously. I 'm interested in privacy/anonymity services, but I have my doubts about every single provider.
One that doesn't log at all ??

Those services can be used as a convenient tool for collecting sensitive information.

 

Even after using XeroBank for two years, reading everything that I can find about it, and hanging around online, I still don't know just what it is. Perhaps that's a good thing. Steve is obviously the public face of Xero Networks USA, which markets XeroBank. But Xero Networks USA is reportedly just a marketing operation, which is not privy to network operations (also a good thing).

I gather that Xero Networks AG, a Panama corporation, handles network operations. I have no clue who or what they are. I do get the sense that XeroBank collaborates with other crypto-anarcho-capitalist operations, such as Cryptohippie. If you're interested, I recommend reading the XeroBank and Cryptohippie websites, and then some of the crypto-anarcho-capitalist literature, including the fiction (which is fascinating). A good place to start is http://secondrealm.net.

That's prudent.

AFAIK, XeroBank says that they have never logged, and would never log without overwhelming evidence of truly evil behavior. See their LEO Contact Information for specifics. Anyway, I trust them, and I'm quite paranoid.

Yes, indeed they can. I don't believe that XeroBank does. They'd be fools to put their reputation at risk in that way.

 

I read the first 8 pages and the last 3 pages of this post. I still cannot understand what the problem is with xerobank. Could anybody possibly explain it to be in one go. I would really appreciate it.

 

Hi Medex

The "problem" with Xerobank depends on the timeframe you're talking about.

Previously, until about 6-8 months ago (or whenever their forums went down, I can't remember exactly when this happened), the only "problem" with Xerobank, was their lousy customer service. If you needed any kind of help, the best way to get it was from other customers on their forum. Occasionally Steve or Wizard would help you, but mostly it was other customers (myself included) who would try to help. The good news is (or rather WAS) that for most people their service worked without any troubles except occasionally a node would go down for a short period of time. These were usually pre-announced by Steve however.

However some time ago, their forum went down for "maintenance", and has to this day not not come back up. Since this happened their service has been noticeably worse. Nodes would go down, and not come back up, there has been no customer service whatsoever unless you personally email Steve or Wizard. I was about to permanently cancel my account and sign on with another service, but then Steve has made this announcement that on March 1st things will suddenly improve. I have my doubts, but we will see.

There are also other things like a promised, but never materialized secure remote file storage service, and other things that Steve has promised. Overall, until their website went down, I liked Xerobank enough to pay the $35/month even though they never had the file storage which I really wanted. I did really like all the 2-hop nodes that they offered, and the single hop "turbo-privacy" nodes which were really fast, and of course the email service. However now I'm just waiting to see what will happen on March 1st, which will decide if I will finally call it quits, or stay on.

Also, there are of course several people on these forums who appear to have some sort of personal vendetta against Steve, but you will have to ask them about that.

 

Thank you axle00. But I have to ask if it is really wise to trust a company that seems to not care about their customers. What is the incentive to stay?

 

Good question...

 

Well Xerobank is not perfect but as another poster said, what exactly do we know about all the other services? At least Steve/Xerobank seem to know what they are talking about, unlike lots of the other providers that seem to think anonymity means giving out lots of different IP addresses

 

That's a loaded question. Given the circumstances, and clues that I've found here and there about consultants who helped develop the service, XeroBank has essentially been a beta release of "strong anonymity/privacy for the masses". Also, consider the "first month for $1" offer. XeroBank plainly didn't have the resources to support the churn of new users, many of which were probably up to no good. Perhaps it would have been better to handle it all differently, but I have no interest in "could-a, should-a, would-a".

It's one of the best, and -- in its class -- is AFAIK the least expensive. Indeed, most services in its class are not openly available on a retail basis, are considerably more expensive, and require considerable expertise to manage.

 

After emailing wizardsupport@xerobank.com, I've had one reply. Five days ago I logged into my Dalpay.is account, and sent a message using their support link, and followed it up with an email. I'll post here when I get a reply.

The one email I did receive from wizardsupport mentioned authentication failures, but that hasn't happened for some weeks now. The DNS for the vpngate nodes is not consistently resolving to working IP addresses.

So, if you want to use Xerobank, you can change the following to reach at least two working entry nodes consistently (for now):

Use 174.142.36.113:443 instead of vpngate.ca-fr.xerobank.com. This is a two hop from Montreal to the Netherlands.

Use 94.75.217.247:80 or 94.75.217.246:80

instead of vpngate.unlimited-nl.xerobank.com:80. But this has been working all along, I think, so you can just use the domain name. But that's a one hop, TurboPrivacy.

The jury is still out as to what happens to Xerobank. I wish them well, but we probably can't use them with this kind of erratic strangeness. But it is funny; if you look at their front splash page, the first thing you read is:

<<
Find out if you've got what it takes to disappear.
>>

Well, we found out that Xerobank certainly has what it takes to disappear. Their forum, support, service, and most of their nodes disappeared, at least for many of their paying customers.

So I'm going to give it a few days, and if they maintain radio silence from the Velostat shielded bunker (tin foil, obviously, is inadequate), I'll stop the payments from DalPay, and see if they come up with something semi-consistent later on. Great idea, good initial execution, and very, very educational as an experience, but it has to work with some consistency.

I can do a few more dig commands from the terminal line if anyone else wants to know the actual IP addresses they are using, and post that here. Let me know.

Any other ideas out there?

 

Xerobank, a small one man operation revolving around Steve Topletz

The growing body of evidence suggests strongly that Xerobank=Steve Topletz. Steve, in turn, surrounds himself with a layer of advisors who he can pretend are the bosses. When Steve has the money, he contracts out bits and pieces of work.

Go through Steve's postings at Wilders as well as those of the Xerobank forum (if it ever comes back on) and you'll see one support desk plan after another unveiled that Steve promises will solve the problems of very poor support to Xerobank clients. Each one flops within a few months and once again, one man show Steve is back answering support requests himself, inasmuch as he has the time.

Nearly all the evidence suggets that Xerobank is a tiny operation. There is zero evidence to suggest that it is a large operation. If Steve would only admit to that truth, people would cut him a lot more slack in giving him the time he needs to solve technical problems.

I would guess that the number of users is in the hundreds, and Steve gets the bulk of his money through contracts for customized anonymity/privacy.

Despite all this, which is fairly obvious, Eteve persists as only an arrogant, somewhat narcisstic personality is capable of. That's why he gets so much flack. He's a smart guy but prone to hoopla and exaggeration as you can see just from his recent posts.

It has been said many times before that Steve Topletz' worst enemy is Steve Topletz.

BTW are the festivities of the new unveiling still in progress? Somehow the trumpets stopped blowing when Steve disappeared again from the forum.

 

As far as i know the new site, and forum are still scheduled to be unveiled 3/1/11.

 

I assume you still haven't heard anything from Xerobank? If so, not good, not good. Not even a promise of some free goodies or services from Steve (which may or may not actually be delivered)

 

Xerobank has often failed to make good on its promises.
That's one way to judge a company.

Remember the 'evil' Utrasurf ?

What about the high-end services for businesses Steve talked about ? Do they actually exist ?

 

On Jan. 19, wizardsupport directed me to log in to the DalPay site, and file a ticket from there. After double checking my vpn set up, I did that on Feb. 5. I haven't gotten any authentication failures for weeks, so the problem now (as far as I can tell) is twofold: the vpngate. address is not resolving to the correct IP addresses, and when it does, the server at the particular IP address is down, or unreachable. At least two entry nodes have been reachable, and have authenticated, all along: TurboPrivacy Netherlands:

# dig vpngate.unlimited-nl.xerobank.com

...

vpngate.unlimited-nl.xerobank.com. 600 IN A 94.75.217.247
vpngate.unlimited-nl.xerobank.com. 600 IN A 94.75.217.246

...

And one IP address (174.142.36.113) for the three that resolve to vpngate.unlimited-nl.xerobank.com:

# dig vpngate.ca-fr.xerobank.com

...

;; ANSWER SECTION:
vpngate.ca-fr.xerobank.com. 600 IN A 174.142.98.105
vpngate.ca-fr.xerobank.com. 600 IN A 174.142.36.145
vpngate.ca-fr.xerobank.com. 600 IN A 174.142.36.113

...

There may be other working Xerobank entry nodes out there; if anyone has found others, please post on this thread. I sent all this info, and more, in the follow up email on Feb. 5 to the wiz. I'll let post here when I get a reply.

Steve has already promised freebies here on this thread, on Jan. 22:

<<
In anticipation for March 1, the jubilation has begun: All XeroBank
accounts have been granted Turbo Privacy access (even those with
delinquent payments or payment notification errors in the last 50
weeks). All account tokens have been extended from 1 month to 3 month
expiration so that customers having issues within the last three
months should be resolved.

Inactive nodes have been removed from the DNS. USA exit nodes taken
offline during conversion to clarion network design. 1000 Mbps
dedicated USA entry node in Washington DC up, will push into DNS on
Monday when keying is provisioned.

The suggested high availability routes to use at this time are
Canada<->Netherlands. For users contact support who have comcast or
sbcglobal addresses: the replies you have been sent are bouncing back
due to blocklisting, we are setting up a new smtp relay just for
official notices to resolve this issue. Anyone having unresolved
support issues should email wizardsupport at xerobank. Have a nice
weekend!
>>

So I take that as a positive sign, but I'll believe it when I see it, and hear it confirmed from wizardsupport (I asked them specifically about this quote).

If the service remains at sub par, and there is no reply in the next few days, I will start the process with Dalpay to refund the last three months. If that happens, then I'll move on to another vpn service. If not, I think it would be worth the effort making sure Xerobank gets dinged with DalPay and other online payment services. That's regrettable, because it makes it more difficult for them to get paid, and it raises their transaction cost, but sometimes necessary.

 

The other responses above cover this, but I don't think it's too complicated. You shouldn't trust them or anyone else. Evaluate their competency, and consider how exposed you will be if they are compromised. Assume they will roll over on you, and anyone else, if they get a subpoena, or other governmental pressure. Do they log? If not, they don't have the information to give. Do you use a double hop in two jurisdictions? Combine that with no logging in every jurisdiction, and your exposure goes down further. What are the chances that your traffic is being duplicated or snooped at the server at the entry node? That requires a bit more research, so ask them about it.

Well meaning incompetence, especially in execution, is fatal. One troubling thing here is that Xerobank can't keep most of the domain names for their entry nodes resolving to servers at working IP addresses, and this has been the case for almost three months. You want the IP addresses for both entry and exit nodes to change on occasion, and you want the domain name to accurately reflect that. The 16 possible routes could be just 4 or 5 vps servers, each having 4 or more IP addresses.

As usual, I wish Steve and Xerobank the best, but the service has to work, and work consistently, and there has to be some seriousness in execution, not this erratic strangeness. The next great thing is meaningless if you can't make the current thing work well.

 

I see the disinformation attacks in this thread are increasing; our competitors appear to be very worried for themselves.

William G,

I've forwarded your dns inquiries, however be aware that dig may not work properly against xb as we've been known to employ dns enumeration resistance. CA-FR should route to a NL exit from CA entry (FR node nullrouted due to previous interference attempts). unlimited-NL (Turbo Privacy NL) is up and operating without issue, if you're having trouble on the node and have a valid account, message me.

Historically, no xerobank nodes are VPSes, all are dedicated or collocated machines because it is not safe to use VPS/cloud systems for cryptographic termination (memory and sessions trivial to compromise). If you're having trouble, you can email me directly.

 

Oh Gaaaaad - here we go again

Steve - just cut the crap and run a proper business and you won't get these type of responses

 

lol......u r funny...
anyway, not too worry ..... i wont even consider xerobank...

 

I don't think you are a client, so I'm unsure of what ground you have to comment unless you are also part of the disinformation compaign.

For those of you who are reading this thread and have no idea what is going on, there is a schizophrenic person named Adem who has been banned from wilders forum and continually abuses wilders to post under multiple usernames in attempts to disaparage xerobank, especially in this thread. Not only is adem/genady/poosey/ari/etc using fake user accounts here on wilders again, he is also trying to impersonate me and other xb team members and xb allies on usenet as well. I don't visit usenet, so unless it has my valid pgp signature, it isn't me. (Adem is on this very page, guess who, just follow his first-posts and all subsequent ones, they only focus on xb. lol busted again).

Feel free to investigate the sloppy work on the links below. I'm sure other members on this forum who've been the attempted impersonation victims can provide more info, but these links are typical.


impersonation
fake reports
wilders content conflation
more fud
oops busted!

This was a common tactic used by Adem of Privacy.li/Trilight etc., who holds a vendetta against metropipe after metropipe et al outed Adem for stealing user creditcard data and spying on client exit traffic on privacy.li. For those wondering what that has to do with xb, the answer is not much, except one of our previous traffic management partners (meshmx) also did traffic mixing with metropipe for a time.

 

Thanks for that, Steve.

As hierophant who posts on Wilders, I've been caricatured on several Usenet newsgroups for some months as (chronologically) heresmypants, heirophant, heremypants and now hierophant. As soon as I saw that, I created the email address and website in my sig. Please see that website for additional comments and analysis of the Usenet action. As I have time, I plan to post more results to that site. Also, FWIW, the attacker has created a satire of the site, which is quite amusing.

 

There's more than one person involved in the impersonations, which have affected me in that they have posted in both my real name and "nix." I've also received phone calls from two separate people, as well as a steady stream of threatening emails that could have come from one or several parties. I have been specifically warned not to criticize a certain one of xb's competitors, although that has not been the only focus in their communications with me.