Once again we must explore the dark side of "free" services. No one denies that the big names of the Web and social networks obtain specific benefits from our information, but what is happening with Hola VPN seems to be a bit more delicate. Its CEO Ofer Vilenski confirmed that the user's idle resources are used and marketed by Hola, but there is something else: Each user is an exit point, and if someone uses Hola for criminal activities, you could become involved.
It all started when the operator of the 8chan portal, Fredrick Brennan, reported being bombarded with several DDoS attacks, apparently originating from the Hola network. When we refer to the Hola network, it is necessary to understand a bit more how it works. From a certain point of view, Hola VPN is a huge botnet. The company registers about 46 million users, of which more than seven million use the extension compatible with Google Chrome. Now, there is no doubt that Hola fulfills what it promises: its users avoid censorship on multiple sites and access content without problems, even in the free mode. So, what is the trick?
In reality, there is no trick. Hola's CEO Ofer Vilenski explains that the company never hid its financing methods. In the free option, the traffic of the Hola network is redirected among users, while the commercial option works like any other VPN. However, Hola markets the "idle resources" of users on its network through the Luminati brand. The CEO confirmed that the attack on 8chan used the Luminati network only because the attacker (identified so far as "BUI") wanted it that way, and stressed that he could have used any other VPN service. Although Hola evaluates users before allowing access to Luminati, the infamous BUI managed to evade the looks and launch his attack.
Hola's people contacted Brennan, and once BUI's account was suspended, 8chan returned to normal. However... Hola sells its users' bandwidth. The most complicated thing about all this is establishing whether it is a problem or not. As far as we have been able to find out, Hola never hid this procedure, and it is clearly explained in its FAQ. The only way a Hola user can avoid becoming an endpoint is by paying 5 dollars a month and accessing the premium service. I don't know if it is entirely appropriate to invoke the classic phrase "if you don't pay, you are the product", because there are portals and services that are totally free (Wikipedia, and downloading a copy of Debian are the first two examples that come to mind), but if someone feels a bit weird after this, I can't blame them. The moral of the day: you have to read the damn FAQ.
