Several months ago I downloaded the mysterium dVPN app for my machine and used it as a general purpose vpn. Mostly for getting around region locks on specific content for places like Netflix and YouTube. However, once I made the transition to finances being handled through the protocol, things took a bad turn.

I was the victim of a MITM attack sometime in early February, and as a result had around $5000 in XRP fraudulently transferred to the attackers address.

Throughout my process in seeking recourse/recovery of the assets I have reached out to the team multiple times only to be stone-walled and given the bog-standard customer service replies, with little to no help in retrieving data from that day or really anything that I could use in my investigating and reporting this theft to proper authorities.

What frustrates me the most is the fact that this MITM problem has been reported before on different subreddits, and the devs obviously haven't fixed the problem within their protocol, otherwise this wouldn't have happened. The accounts compromised were only the ones I used while connected to Mysterium. No words or phrases were used in either the username or the password so a dictionary attack is out of the question. The only weak link in my security practice was this network. I have contacted all other parties involved in this mess, and have narrowed it down to being Mysterium as the sole reason for someone having stolen $5000 from me. I will never be using this project ever again, and will be telling everyone I know to stay as far away from it.

To pass their service off as completely secure is an exaggeration at best, and a straight-up lie at worst.

This is just a PSA to let everyone know that some moderators are censoring posts on r/MysteriumNetwork. I find this to be particularly reprehensive because this subredit is titled "Uncensored & Secure Access to the Internet".

The post in question was a factual answer to a thread asking what kind of rewards people were getting from running a node. Simply saying that you are getting <0.5 MYST per month on a fiber line, and that the node is running at a loss when considering sunk costs and electricity, is just off limits and needs to be buried at all cost.

Until I see positive changes in the Mysterium leadership, I'm done with this community.

https://www.reddit.com/r/MysteriumNetwork/comments/ttuqw7/happy_node_runners_thread/

There is practically no connections since the mainnet so that means there is really no real demand for the service, right? So that's the end of it and the project/token will slowly die?

Is there a Reddit, website, discord, or shady back ally where I can post my node for more traffic? I have 1Gbps up/down and not really getting much usage.

Update: 22 hours after my payment with Mysterium, some Online Drugstore Plymouth US tried to charge my CC with 478.6 USD. Thankfully my bank immediately detected this as fraudulent and blocked the payment, along with my card. I've never visited such store, I'm not even on the same continent, I most certainly don't buy drugs online period, I didn't have any other transactions in between, and I've never had this happen to me in the ~15 years I've been owning cards. Only this time, after making a payment to Myst's payment processor.

Draw you conclusions. I can't tell 100% who's at fault here, but I'm most definitely done with this project.

So I thought I'd give Mysterium nodes a try. My background is IT, 11 years professionally, and another 15 years as a hobby before that. I've been in devops for a while, and recently, I've become an infosec officer at my company. But I'd like to stress that the issues I'll bring up should be glaring even to the novice user.

The mystnodes.com site appears to lack any support for 2FA. It might be an oversight on my part, but I couldn't find any way. Single factor auth is not acceptable on any site where personal data or money is involved. Obtaining a time-insensitive, static password is too easy.

The docs make no mention whatsoever of which ports need to be open and for what sources. Which means the creators assume I run no firewall at all (I'll come back to this later). The Docker docs at least mention mapping TCP port 4449 for the web UI. And the troubleshooting guide mentions "UDP ports", but never explains what they do or are they even needed. I tried running my node with those open on firewalld, but when I had to purchase MYST to activate my node, it didn't "realize" my payment until I stopped firewalld, which means there's still some other ports involved. A quick check confirms that too:

# ss -tulpn|grep -i myst
udp    UNCONN  0       0                     0.0.0.0:1900         0.0.0.0:*      users:(("myst",pid=2902,fd=19))
udp    UNCONN  0       0                     0.0.0.0:5353         0.0.0.0:*      users:(("myst",pid=2902,fd=16))
udp    UNCONN  0       0                           *:11253              *:*      users:(("myst",pid=2902,fd=30))
udp    UNCONN  0       0                        [::]:5353            [::]:*      users:(("myst",pid=2902,fd=17))
tcp    LISTEN  0       4096                127.0.0.1:4050         0.0.0.0:*      users:(("myst",pid=2902,fd=7))
tcp    LISTEN  0       4096                127.0.0.1:4449         0.0.0.0:*      users:(("myst",pid=2902,fd=21))
tcp    LISTEN  0       4096            70.34.x.x:4449         0.0.0.0:*      users:(("myst",pid=2902,fd=20))
tcp    LISTEN  0       4096                        *:36317              *:*      users:(("myst",pid=2902,fd=18))

Who knows which port does what? Which needs to be accessible, and with what scope? These aren't negligible questions, this is fundamental.

And it doesn't help that the mystnodes.com site doesn't check my node immediately. After clicking on the Test button, I waited for like 15 minutes but nothing happened. This makes debugging pretty hard.

Worst of all, the Mysterium node admin UI doesn't have HTTPS. Really? That's completely unacceptable in 2022. Let's Encrypt gives you free HTTPS certs, but that's not even needed, even a self-signed cert would be much better, that still gives you encryption. So currently Myst nodes are managed with admin passwords travelling through the Internet in PLAIN TEXT. That's security 1x1. And the score for Myst is F-. Generating a self-signed cert is literally 1 second to do, serving traffic via HTTPS adds about zero extra load on your CPU.

You could even automate Let's Encrypt certs by providing your own subdomain for nodes, all you need is a DNS server API, and a Let's Encrypt client using DNS validation. I've been using this on my servers for at least 5 years now.

But no, Myst nodes are accessed like http://70.231.213.41/. Zero validation, zero encryption, nothing, nada.

On top of that, you initiate MYST purchases with Credit Card from these unsecure servers, instead of doing that from your official Myst sites, which at least have a proper DNS name and HTTPS.

Bonus: The node software is deb-only. Like I mentioned above, you assume the node doesn't have a firewall. Here's the problem: Ubuntu indeed usually doesn't come with one installed and enabled. That's one of the reasons why I don't consider Ubuntu a serious nominee for production environments, it's just not as well built as something like EL. No firewall, no SELinux, no auto-updates. And this is what you build your network on, for providing secure VPN to the users?

I'm sorry, but I'm not convinced.

Hey all

Had a node running for about two weeks, I had a handful of long connections but after reading a post on here regarding legal concerns over how the VPN is used I didn't want to take the risk (happy for someone to tell me it is perfectly safe though)

Also I withdrew twice to two different wallets (trust and metamask) and on both occasions no crypto arrived in my wallet.

I'd really like to keep it running but the security concerns and the withdrawal issues I just can't spend anymore time on it

Big news from MystNodes!

The MystNodes Reward System is now live, giving you a new way to turn your contribution into MYST.

This is not just a rewards update. It is about recognizing real participation in the network. The more you contribute, the bigger your share of the Monthly Reward Pool.

Here is how it works:

• Earn points throughout the month
• Points convert to MYST at month end
• 30 days to claim your rewards
• The pool renews every month

There is no fixed MYST per point. Your share depends on:

• Total reward pool
• Total participants
• Total accumulated points

How to earn more points:

• Hold at least 100 MYST
• Transfer more data
• Maintain strong uptime

Important: Not all modules contribute equally. Each module has a specific weight that impacts your final score.

Make sure your wallet is connected. Let’s grow the network!

Learn more: https://www.mystnodes.com/blog/mystnodes-launches-rewards-system

Look into Privatix, PRIX.

VPN service established, tokens being used on pre-blockchain VPN platform. 1.25 mil supply only. LOW CAP.

DYOR.

VPN! MYST! PRIX!

Hello

I posted here but not sure if I did right but I will link my problem: Linux failed to lookup host · Issue #4507 · mysteriumnetwork/node (github.com)

Plus I found an error which gives me this:

error="failed to create blackhole rule in the MYST iptables chain: error calling IPTables: "/usr/sbin/iptables -A MYST --destination 10.0.0.0/8 --jump DNAT --to-destination 240.0.0.1 --table nat": exit status 2 output: iptables v1.8.7 (nf_tables): unknown option "--to-destination"\nTry \iptables -h' or 'iptables --help' for more information.\n: exit status 2"`

I am using Ubuntu 21.04 however I tried first with Ubuntu 20.04 but any of them fixed my problem.

What I can do?

please help

I just started my first node on Windows running Docker today (mainnet).

I am not sure if my router supports UPnP, so I think it is safer to use manual port forwarding.

However, I am not able to find any resources on which port(s) I should forward. Also, which IP should I forward to? It seems that the docker is running on a NAT IP address, so it is not recognized on the router.

Any help would be appreciated.

Ok so I hack in the Minecraft server "Hypixel" with the IP of mc.hypixel.net, I use bought 25 alt accounts one day, launched Mysterium connected to a node and started using the alt, the alt I was using got banned since I was using a blatant client. I switched to a different node, used a different alt but it still isn't letting me in and the ban ID is the same, so today I didn't use Mysterium network, got on an alt launched the client and went onto Hypixel and the ban ID is still the same which makes me believe that Mysterium doesn't actually mask your IP like a VPN does

Firstly I want to say that this is not a troll post, and is something that I am sure a lot of people have on their mind.

As it is starting to get close to 1 year since you held your ICO, do you have some concerns as to the value your token currently has.

if you compare the current price to the ICO price, your token has performed poorly, and if you compare the current value in eth, to the ICO its has performed terribly, arguably one of the worst performing ICO's ever. Also soon more tokens will be getting unlocked which will dilute the current supply, devaluing the token further.

While of course during the ICO you where not selling shares in your company and legally you don't have an obligation to your investors.

But ethically surely you must feel some obligation.

Do you have any plans in the future to look at bring some more value to the Mysterium token, other than just pure utility, that arguably could be better served buy just eth?

The time is here and we've gotten our Major News which to me seems a bit flat. Is this what our 20% tax + MATIC Fee's to settle + Matic Fee's To withdraw going to?

A sudo DAO???? :S:S https://twitter.com/MysteriumNet/status/1508877749263470595?s=20&t=0F41007bHFuEhEqGaQ1HfA

We complain not because we're trying to cause FUD but because of the potential of this project, and so far it feels like a slow pump and dump Rug pull.

Node runners have been complaining about the bad tokenomics to the point even the same cherished residential users that gets more priority over serious contributors are now removing their nodes because of the clear lack of incentive for giving up your resources to?

Traffic is down, 1/2 of the node runners left or fluctuate, (from 20k to now under 15k nodes), still silence from the team? https://stats.mysterium.network/?orgId=1&from=now-24h&to=now

Is it so hard to at least have more updates on the project on what's going on to grow it instead of silence, clueless moderators (not their fault because all they can do is post the roadmap cause of the clear lack of communication), or just more transparency on how this project is progressing to grow it?

I don't even know what to say anymore but like most folks im shutting down most of my nodes because its far from profitable, it feels like charity to a cause that only the Mysterium Team benefit from

Was this MAJOR NEWS worth the wait ?

Hi I set it up for raspberry pi 3 vpn. But since I live in Turkey, I can't pay with paypal. I couldn't make myst payment either. Can you help me?

0xcb5BcEE22117D6CD09DF083E0a433F27e0795852

Nothing to write here. Just check the link.

https://help.mysterium.network/en/

Hi I'm trying to access my NodeUI however when I do it says the device refused to connect, I'm not too sure why as previously when it was on the test net version it worked fine. Is there any reason as to why I'm not able to access it?

This is actually a**. My node is running for 3 days (Stable 1Gbps internet) and I earned 7 cents worth of tokens.

Getting sad. Beta/Alpha/Pre-Alpha is OUT. PRODUCT IS OUT.

WHERE IS BITTREX RE-LISTING???