Security

#How your traffic is protected

Colitu encrypts the traffic between your device and the Colitu VPN server. The encryption ends at the VPN server: from there to the website, your traffic is protected only by the site's own HTTPS.

• Every connection mode uses an established protocol (Hysteria2, VLESS Reality and XHTTP, Trojan, Shadowsocks 2022) through well-known implementations (Xray-core, sing-box, Hysteria). Colitu has no cryptography of its own.
• The server is authenticated on every connection (by its TLS certificate, its Reality key or a pre-shared key), so you can't be tricked into connecting to a fake server.
• The servers' TLS certificates renew automatically.
• Known limits: Trojan accepts TLS 1.2 or 1.3 (the server does not enforce 1.3 yet), and Shadowsocks 2022 has no forward secrecy.

People on the same Wi-Fi, your internet provider or a network administrator cannot see which sites you visit or what you send through the tunnel. They can see that you are connected to a Colitu server, when, and roughly how much data you use. Traffic that the apps send outside the tunnel, such as some regional sites on a built-in list and local network traffic, is not protected; see Split tunneling.

The VPN server itself technically sees your IP address and where your traffic goes, but not the content of HTTPS connections. A VPN does not make you anonymous. What every party can see is explained in the Security Whitepaper.

#Server addresses

Server addresses and connection settings are managed securely inside the apps and are never published. This lowers the risk of targeted attacks and blocking.

#Account protection

• Passwords are stored only as an Argon2id hash; nobody, not even Colitu staff, can read your password.
• Use a strong password that you don't use anywhere else, and turn on two-step verification for extra protection.
• Every device, every subscription link and every manual configuration export gets its own connection credentials on the servers. Removing a device in Device management cuts it off within about 15 seconds, and rotating a subscription link revokes the old link's credentials. If a device is lost, remove it and also change your password; this signs out every device and web session.
• No more devices than your plan allows can connect; refused attempts are recorded on your account.
• Check the sessions on your account page and end any you do not recognise; see Account security and Signing in with a passkey.

#Two-step verification (2FA)

Two-step verification asks for a code from an authenticator app in addition to your password.

• Turn it on on the website only

  go to colitu.com/account/security and follow the steps with an authenticator app (any app for time-based one-time codes, TOTP). It cannot be set up inside the apps.

• Recovery codes

  when you turn it on you get 10 one-time recovery codes. Keep them somewhere safe, apart from your phone. Each code works once if you lose access to your authenticator app.

• In the apps

  the apps only ask for the code when you sign in, also after a password reset. Supported from Windows 2.6.0, Android 2.6.0, Linux 1.2.0 and iOS 5.5.0; an older version asks you to update the app before you can sign in.

• Locked out?

  Write to support. After verifying that the account is yours, support can reset two-step verification.

#What you should do

• Never share your password or verification code. Colitu staff and Colitu Bot will never ask for them.
• Download the apps only from colitu.com/download.
• Don't share your account with other people; each person needs their own device slot.

#Open-source apps

The source code of our Windows, Android, iOS and Linux apps is published on GitHub under the GPL-3.0 licence: colitu/windows, colitu/android, colitu/ios and colitu/linux. Anyone can check what the app does on your device and build it themselves. The server software and the account system are not open source. Why we are open source and what you can verify in the code is explained on our Open source page.

#Audit status

Colitu has not yet had an independent security audit or penetration test. Our architecture, known limitations and what you can check yourself are described in the Security Whitepaper.

#Reporting a vulnerability

Send security issues privately to [email protected], with steps to reproduce and the affected version. We acknowledge reports within 3 working days and give an initial assessment within 10 working days. We take no legal action against good-faith research, credit researchers who want to be credited, and do not offer paid bounties. Please give us time to fix the issue before making it public. Full policy: Vulnerability disclosure.