As an American living in Canada, there’s one Chrome extension I cherish more than any other: Hola Unblocker, a free VPN designed to help people abroad watch American Netflix, and other streaming US media. Unfortunately, it turns out Hola is up to some dubious business practices, ones that could put its users at risk.
Hola is a peer-to-peer VPN, so if you’re using it in Denmark to watch a show from the US, you’d get routed through US-based users’ IP addresses. Fair enough. Except the IP sharing didn’t stop there. Hola couldn’t pass up a chance to make money off a free service.
Hola has been bundling and selling users’ bandwidth to a third party company called Luminati, which then re-sells the connections. That means anyone who uses the free version of Hola is having their connection sold without their knowledge.
Motherboard compared this to a voluntary botnet, and highlighted how screwed it could leave users:
By becoming an exit node for a Tor-like network, Hola users are exposed to the same risks that Tor exit nodes operators are. Their connection can be abused by someone else, by trafficking in child pornography or downloading illegal material, for example. To police authorities, it would look like the innocent Hola user was responsible for those actions, since his or her IP address would be associated with them.
A spammer recently used Hola users’ connections, purchased by Luminati, to conduct a denial of service attack on 8Chan, so this isn’t just a hypothetical.
Hola updated its FAQ to tell users about its sales scheme, and claims that criminals can’t use its service because “Hola is a managed and supervised network and thus any illegal activity such as CP, etc. would be reported to the authorities with the real IP of the user.” Yet that wouldn’t prevent people from getting initially pinpointed as bad actors.
It’s good that Hola is finally being more upfront about this shady side business, but this business practice does leave users vulnerable.
If you’ll excuse me, I’ll be over here watching The Good Wife on Canadian Netflix. I guess I should’ve known that a service this helpful had to have a secret cost.
Image via VIPFanAuctions
Contact the author at kate.knibbs@gizmodo.com.
Public PGP key
PGP fingerprint: FF8F 0D7A AB19 6D71 C967 9576 8C12 9478 EE07 10C