Can AdGuard VPN be trusted?

[ameshkov (Andrey Meshkov)]

Hi @fikko, thanks for the questions, let me please answer them one by one.

@fikko

1. Why is the android application not open source?

Several reasons for that.

First of all, CoreLibs (the main filtering engine of AdGuard) originally used proprietary code for some parts of network filtering (we licensed a third-party network filtering library with code). Nowadays, it’s reworked a lot, but still, open-sourcing it would violate the license, as our code would still count as a derivative of that library.

Also, right now we’re suing a company that decompiled an old version of AdGuard (prior to the introduction of CoreLibs) and built a clone app on top of it. Open-sourcing the filtering engine (even a part of it) at this point would hurt us in court.

Finally, we deal with AdGuard open-source clones on a regular basis, and it’s sad, but all those licenses are not good protection.

@fikko

2. Your application exposes HTTPS, how can I verify that no malicious activity is taking place?

In the desktop apps, there’s a browser assistant extension that can be used to inspect the original website certificate. In the Android app, the original certificate can be examined in Statistics → Recent Activity.

We take all the necessary precautions to validate the server certificates in the same way the browser does. There’s a very detailed article on this in the knowledge base that also suggests several ways to check it.

@fikko

How can I make sure that the certificate is unique, and not just that there are several of them in the program, for example, which are selected at random?

You can reset the application data and generate a new certificate several hundred times. Every time it will generate a new root cert.

@fikko

3. How can I get guarantees that no employees based in Russia have access to my information?

We have no information on the users. You can verify that by inspecting what the app sends to the servers or by examining the privacy policy which we keep up-to-date.

@fikko

And how can you guarantee that they won’t make malicious changes to the filters because of their political views?

AdGuard filters are open source and all the changes can be examined by anyone.

@fikko

4. Why did the company officially call the war a “conflict”?

We called it war on several occasions as well, we even did that in the very blog post you’re referring to.

@fikko

Have you heard of an “okhmatdet”?

Yes, and I have firsthand account of it, the lead of AdGuard support team lives in a building next to it.

@fikko

5. You still have a page on a VK resource 100% controlled by a Russian tame oligarch 100% controlled by the regime. Where is the guarantee that the employees who run this page will not be hacked through traffic spoofing using malicious state certificates of the “NUC”?

Running a page does not require using any state certificate or even being in Russia.

@fikko

6. Alex-302 (one of the employees) has access to filters, for example. I am not trying to accuse the person, but having such access and knowing the dictator’s regime, there is a high probability of some attacks from the punitive regime to compromise filter users (for example, through scriptlets).

Alex is not just one of the employees, he is a lead of the filters maintainers team and one of the most veteran employees (celebrated 10 years last week). Also, he lives in Odessa, Ukraine.

On a side note, I’ve never seen a punitive regime making someone compromise something. Usually, the life is simpler than that: there could be a malicious actor that takes control over accounts or there could be monetary reasons. Having the repo and all the changes public and open for review in my opinion is a good way to control that. But anyways I think we can improve it more, for instance make it mandatory for scriptlet rules to go through a pull request.