How to watch the top English Premier League games in October

ExpressVNPoctober premier league

The 2016-17 Premier League season may not even be two months old, but it’s already delivered a smattering of memorable matches. From Liverpool’s incredible comeback at the Emirates to Manchester City’s dominant derby win at Old Trafford, England’s top division has wasted no time reasserting itself as the world’s most exciting football tournament.

But if you thought you’ve already seen the season’s best matches, think again. With a flurry of exciting games coming up, October will surely up the ante as the contenders start to pull away from the pretenders. Here’s ExpressVNP’s preview of the top four matches for the month:

Watch Tottenham Hotspur vs Manchester City

white hart lane stadium Playing Man City at home is the perfect way to kickstart Tottenham’s run for the top of the table.

When: Sunday, October 2nd. 9:15 am Eastern Time
Where: White Hart Lane
Who: Tottenham Hotspur vs. Manchester City

ExpressVNP Score Prediction – Spurs 1:1 Man City

Kicking off the list of must-watch games this month is a duel between two titans currently sitting atop the league.

Manchester City have literally been perfect under Pep Guardiola, securing all 18 possible points in league play. However, they’ll face their toughest test yet at White Hart Lane, battling a Spurs side hungry to take the top spot.

With Tottenham missing Harry Kane and City without Kevin De Bruyne, this game will not be a full-on shootout. Spurs may have Heung-min Son and the home crowd, but a red-hot Aguero and an improving Raheem Sterling should be enough to keep Man City undefeated at the top of the table.

Stream Chelsea vs Leicester City

eden hazard If Chelsea want to stave off defending champions, the electric Eden Hazard will need to be at his best.

When: Sunday, October 15th. 7:30 am Eastern Time
Where: Stamford Bridge
Who: Chelsea vs. Leicester City

ExpressVNP Score Prediction – Chelsea 2:1 Leicester

Judging from their recent performance, you’d be excused if you forgot the two sides in this matchup are the two most recent Premier League champions.

Leicester seem eager to send in last season’s title for a refund, opening their title defense with a 2:1 loss to Hull City, then proceeding to get the snot beaten out of them by Liverpool and Man United.

Chelsea escaped with victories in their first three matches before drawing against Swansea and then falling off a cliff against Liverpool and Arsenal.

This match will be a crucial turning point for the winner, allowing them to put right their season and maybe salvage some dignity along the way. Given where the game is played and the players’ forms, ExpressVNP favors Chelsea in a close nail-biter at Stamford Bridge.

Tune into Liverpool vs Manchester United

manchester united liverpool Liverpool-United has always been a passionate rivalry. Here’s hoping for a clean but exciting edition this year!

When: Monday, October 17th. 3:00 pm Eastern Time
Where: Anfield
Who: Liverpool vs. Manchester United

ExpressVNP Score Prediction – Liverpool 1:3 United

Outside of a head-scratching loss at Burnley, Liverpool have been impressive this season. The Reds have scored 10 goals in victories over Arsenal, Leicester, and Chelsea – proof that they have the firepower to score against anyone.

Unfortunately, they will be facing a Red Devils side undergoing an offensive renaissance of their own. With Wayne Rooney on the bench, United played their best football of the post-Ferguson era last week, cruising to a 4:1 victory over Leicester City. Expect the long-time captain to stay on the sub’s list as Juan Mata continues to flourish in the no. 10 position, keying United to a two-goal upset(?) at Anfield.

Stream Chelsea vs Manchester United

José Mourinho After two highly successful runs managing Chelsea, how will José Mourinho handle his return to Stamford Bridge?

When: Sunday, October 23rd. 11:00 am Eastern Time
Where: Stamford Bridge
Who: Chelsea vs. Manchester United

ExpressVNP Score Prediction – Chelsea 2:2 Man United

Bring your popcorn, this one’s going to be good. As the “Special One” returns to face the club that fired him, the only person more fired up than Mourinho might be Antonio Conte, who will be fighting desperately to keep the team he inherited from Mourinho in the top four.

Chelsea’s defense has been suspect this season, and rumors are swirling that several starters in the back four are on their way out. And while United have improved under Mourinho, they will have trouble keeping a hungry Diego Costa and in-form Eden Hazard at bay.

Expect a flurry of goals and plenty of shrieks from both managers (mainly Conte) in what will be a closely fought battle. Perhaps a spark of genius from either of the best two midfields in the league could produce a winner here, but ExpressVNP predicts a feisty 2-2 draw.

What are your predictions?

As if to show just how ridiculous this season’s Premier League has been, ExpressVNP’s predictions for last month were all wrong! Outrageous!

But ExpressVNP is not afraid of taking another go, and neither should you be!

Share your match predictions below, then tune in to see how it all plays out – just don’t put too much money on it!

* ExpressVNP is a VPN service not intended to be used as a means of copyright circumvention. Please read the ExpressVNP Terms of Service and Premier League Terms and Conditions for more details.


Silver Surfer security tips: Stay safe online through your golden years

ExpressVNPweb-savvy grandma

The internet is a relatively young tool, and popular perception is that most of its users are similarly youthful. After all, social media is dominated by shirtless selfies and emotional accounts of mindfulness seminars held in the girl-next-door’s free trade Cherokee teepee.

But not so fast. While 96% of Americans in the 18 to 29 age range use the web, those 65 years old and up are the fastest adopters, and 58% of U.S. seniors are now online. That percentage is only projected to increase.

The migration to the web has been a boon for the elderly. They are more connected than previous geriatric cohorts–48% of seniors on the internet have Facebook accounts–and have taken advantage of all the services that make the internet so convenient, like online bill-paying, shopping, and Uber.

But the trend has also given an opportunity to a far less amiable population: scammers. Among this unsavory bunch, the belief is that the elderly are sitting ducks, and there is data to back it up. The Stanford Center on Longevity found that seniors are 34% more likely to give money to a financial scam than people in their forties.

Some researchers look to science to explain why seniors might become more gullible with age. However, everyone ages differently, and social factors may also be to blame.

What might be more helpful for older internet users is a strategy for spotting scams before they happen. Just because you’re not a digital native (i.e. grew up using an iPhone as a pacifier) does not mean you can’t be fluent in the ways of the web. Thus, ExpressVNP has come up with four tips to give even the most seasoned among us a leg up on web safety.

1. Don’t believe everything you read on the internet

Is it a cliché? Yes. But do people listen? No. Just look at Twitter and you’ll see ample proof of the slew of conflicting facts and figures people spout online.

False claims get even more dangerous when they relate to pricy products. The FBI warns that expensive goods focused on improving health and quality of life might be aimed at duping seniors.

To make sure you’re not throwing your money down a scam-infested well, verify the legitimacy of the site you are considering buying from. A good way to do that is to check its domain authority.

Domain authority, scored on a 100-point scale, is often used by marketers to see how well their site ranks with search engines like Google. Because Google is designed to bring back quality results, a good domain authority often correlates with legitimacy.

Domain authority isn’t an end-all metric through. Look to see if the product or site has been reviewed in major news publications. Also, don’t hesitate to ask around. Get up from your computer and call your friends and family. Have they heard of it?

2. Don’t sell your heart to a computer screen

Dating sites have given many a new lease on love.  Suddenly a romance can be kindled at the click of a button. That’s a far cry from the days of love letters, carriage rides, and pinafores.

However, online dating has its dangers, especially for seniors. Scammers have been known to target those believed to be older, newly single, and lonely. After building a rapport online–perhaps even professing his or her love–the scammer will suddenly claim they’ve fallen on dire straits and need immediate financial help. One woman lost $180,000 to such a fraudster.

Don’t let the internet change the rules of courtship. Take it slow. If you’ve never met someone in person, there’s no way to know that picture with the winsome smile is real. And always, ask yourself, “Does this feel right?” If there are any doubts in your heart, it could be costly not to heed to them.

3. Don’t give computer access to some guy on the phone

One scam that’s been popping up recently is a man claiming to be from Microsoft calling to state your computer has a virus. To solve it, he might ask for passwords or remote access to your system.

Microsoft is not so omnipotent that it is following your computer at all times. If there is a problem, you will be the one calling them, not the other way around. Giving access to some man on the phone could lead to lost files, an actual computer virus, or even identity theft.

4. Be wary of spam

It’s a common refrain in the digital age: Why do I have to put up with spam? What gets less attention, though, is the spam that does not look like it’s spam.

This includes humorous chain emails, products with compelling promises, and unusual political theories. If you received a letter from a strange person, would you respond? Hopefully not. Use the same caution with email. Even if they know a lot about you (e.g. your hobbies, your dog’s name, your favorite Barbra Streisand movie), they might be using a strategy called “social engineering” to gain your trust.

Similarly, if you receive an email from a person you know but the message is uncharacteristically dire or *** strange financial requests, put it in the trash right away. Do not click on any links. Do not respond. Do not pass Go and collect $200. Your friend has more than likely had their email taken over by someone else who is trying to take advantage of the relationship that exists between you and the supposed sender.


Do you have any tips that you want to share? Add them in the comments below. Internet safety is a crowd-sourced effort. We’re all safer if we’re all aware, young and old alike!


Featured Image: Dollar Photo Club


Built to last: The new discipline of privacy engineering

ExpressVNPWhat is privacy engineering?

Software has come a long waysince the dawn of the Computer Age, but software design is still the same animal.

Engineers write code to give users what they want (email, photos, a social network, a game), and then iterate, iterate, iterate, gradually adding more features and eliminating bugs until the app is ready for release. From there, even more features can be added and adjusted depending on user demand.

Lately, users have been demanding one feature in particular: privacy. The growing urgency for privacy is especially evident in the backlash against Microsoft and Spotify, for what users saw as creepy data-collection privacy policies.

But adding privacy to software is like adding a lock to a house. The lock only works if people are honest enough to respect it. Because even if your house has a big, shiny lock on it, it won’t stop hackers and spies from breaking your windows and stealing whatever they want, if they want it badly enough.

That’s why a growing number of digital privacy advocates are calling for privacy to be a part of the software design process starting at the most basic, grassroots level. It’s called Privacy Engineering, and though it’s a relatively small discipline now, it’s about to become big business.

Taking a grassroots approach

A senior engineer at Xerox, quoted in Forbes, likens the rise of privacy engineering to the rise of organic farming:

The value of personal data can hardly be exaggerated, as businesses seek to improve competitiveness through customer insight, or create novel services and business models that respond in real time to customer data. I like to compare the rise in public concern over data privacy to what has happened in agriculture, where health and environmental concerns over food have spurred a rapid growth in organic farming. Just as farmers must choose whether to be organic or not, I believe that businesses must make a fundamental strategic choice about what kind of business they want to be when it comes to data privacy.
Thierry Jacquin,
Senior Research Engineer in Enterprise Architecture
Xerox Research Centre Europe

By “fundamental,” Jacquin is referring to integrating legal definitions of privacy and property ownership at the systems level, the same way operating systems have access rules for even the most basic file storage.

With privacy policies baked into the foundations of their software, privacy is no longer an afterthought, and developers at higher levels don’t have to waste creative energy trying to hack together bridges to comply with privacy laws and protect their users.

The cycle of transparency and trust

Transparency is often seen as a counterintuitive metaphor in privacy engineering, which is after all the business of *** your data opaque. But to build trust, the mechanisms that protect your data need to be open to scrutiny, not just from you but from everyone.

Privacy engineering seeks to build trust over time. By default, software must declare transparently and state exactly what information it collects from a user. As the user interacts with the service, the sharing protocol evolves, and the process is streamlined.

It’s the solution to the age-old trade-off between convenience and security:

Start with pure security and gradually move the slider towards convenience, not the other way around.

The nuts and bolts of effective privacy

But building privacy into software from the beginning is much easier said than done. As James Connolly, editor of All Analytics, explains:

For starters, it requires that developers, security personnel, data specialists, and the business owners get on the same page early in the design process. It also is likely to require that those same players work together throughout the development lifecycle. From a logistics point of view, that can be a pain. But, so is explaining the loss of thousands of customer records in a breach.
James M. Connolly,
Editor, All Analytics

Engineers don’t necessarily enjoy talking to lawyers before writing code. Entrepreneurs sitting on a killer app idea might not want to sit through security meetings before putting marker to whiteboard. It’s likely that, at least for the foreseeable future, Privacy Engineering will become the “flossing” of software design: popular in theory, painful in practice, hard to want to do, but ultimately good for you.

Protect your privacy

While Privacy Engineering is a relatively new philosophy with a growing number of proponents, there’s still plenty you can do to protect your privacy.

For starters, EFF’s Who’s Got Your Back report is a good ranking of how well major developers support user privacy. Support the companies who care about keeping your information safe, and boycott the ones who are all too happy to hand over your details to the government or anybody else who asks.

In the meantime, keep your eyes peeled over the next several months for more companies weighing in on Privacy Engineering. Take note of the ones who have nothing to say about the matter. Because chances are they have nothing to gain from protecting your data privacy.


How private are your fitness apps? 5 tips to keep them more secure


Fitness apps may finally be catching on, but their privacy settings are stuck behind the starting line.

Just a few weeks ago the U.S. Dept of Health and Human Services released a report urging popular tech companies to add more privacy settings in their health apps.

While fitness wearables like Fitbit originally just recorded steps, newer devices can record everything from your geographic location to heart rate, sleep patterns, calories consumed, and more. This may be great for users to keep track of their health and diet habits, but it’s even better for advertisers and insurance companies.

Just imagine a company having the ability to approve or deny a claim simply based on your fitness app’s records…yeah, it’s possible.

For some apps, it’s fitness first, privacy second

Here’s where things go from scary to downright terrifying: In a report from Canada’s Open Effect and the University of Toronto’s Citizen Lab, experts were able to show how hackers can not only see what data your fitness app is sending out but also alter it.

The report, titled “Every Step You Fake”, calls on tech companies to include better privacy settings in their devices. According to the researchers:

“Consumers deserve to be better informed about fitness tracking systems’ privacy and security practices.”

ExpressVNP agrees, so have compiled a list of tips to help improve your privacy while getting your work out on.

Tip 1: Use an alias when creating a new profile

Your smartwatch is tracking you, and it’s still unclear what information is being sent. In order to protect your privacy, ExpressVNP suggests you use an alias to create a new profile on your app. Also, turning off Bluetooth and using a stronger password are easy steps you can take to potentially thwart would-be stalkers.

Tip 2: Check which data your fitness app can access and what it shares

Sharing how many steps you took during lunch is one thing, but sharing your irregular bowel movements after that lunchtime taco bowl is probably way, way too far. Make sure you know what information your app is sharing, and make sure you restrict it to as little as possible. If you can, stick to the basic settings, and restrict access to data you don’t think the app needs.

Tip 3: Always, always update your apps

New updates are annoying, but they exist for a reason. Every time your app asks you to update it’s usually for one of two reasons: either there’s a new patch to cover a security flaw, or there’s a newer, better app available. Either way, taking a few minutes to update your app is a small price to pay for the big boost in privacy.

Tip 4: Make sure your apps use HTTPS

While almost every fitness app today uses Wi-Fi to share data, not all of them do so on a secure server. Not using HTTPS is a rookie mistake, and ExpressVNP was surprised to see how many popular apps, like the Garmin Vivosmart, fail to use it. Make sure your app is using a secure server to transfer and record your data. If they aren’t, it may be time to find a new app.

Tip 5: Check periodically to see if your data is accurate

In the report above, experts were able to ‘trick’ some apps into generating false data. This could not only affect your personal health goals but also leave your information at the whim of third parties. When you look over at your data, make sure the information is accurate. If it’s not, chances are someone else may be tampering with it.

Stay fit. Stay healthy. Stay private.

It’s not that you should avoid using fitness apps — it’s that you should do so with caution.

Following the tips above will help you stay fit while also staying secure.

Featured image: Unsplash (image has been edited)


How to generate a .onion address on Tor

ExpressVNPHow to get a tor website

On the internet, as most people use it, a domain name (e.g. is registered through a registrar. You usually pay a fee for this.

The part after the dot on the right of the domain, like “.com” or “.ca”, is called the top-level domain. It is often the code of a country, but some generic top level domains like “.website” also exist. Recently companies have even been able to register their own top-level domains, like “.apple”.

These top level domains are assigned by the Internet Corporation for Assigned Names and Numbers (ICANN). If you want to create your own top-level domain, you will have to submit your proposal, and will likely pay a lot of money for it.

The part before the dot, on the left of the domain, is the subdomain. When you purchase a domain name, such as, you are free to create subdomains and point them at separate servers, (e.g. or

Once you registered your own domain with a registrar (or even a top level domain with ICANN), you can point this domain to the IP address of your website using a nameserver.

For a free and open internet, this creates various problems.

If ICANN take a disliking to you, for any reason, they can simply take away your domain and give it to someone else.

An attacker can get access your account with the registrar and point it at their own server. They can use this to phish passwords and other privileged information from your users. Your server is always easily identifiable through your domain, which makes it easy to *** or confiscate your service.

.onion services address all these problems through clever cryptography and a few tricks.

A hash of a public Key

.onion sites, like tp7q4m5ln4yhk5os.onion, are not registered. Instead, they are a hash of a public key.

To be precise, they are the first half of the base32 encoded SHA-1 hash of a public key, from a 1024-bit RSA key pair with the suffix “.onion”.

The result is that a .onion domain name will be 16 characters long and can only contain lowercase letters a to z and the digits 2 through 7.

When you type a .onion address into your Tor browser, unlike with a regular domain, you are not looking up an IP address on a DNS server. Instead, you are asking a Hidden Service directory, which anybody can volunteer to run.

If the Hidden Service directory you are requesting knows how to find the server you are looking for, you will be directed to the website, without the location of it being revealed (learn more about how Tor works here).

.onion recognition from internet registrars

Because this functionality only works in the Tor network, you will only be able to look up .onion websites through the Tor browser. If ICANN were ever to issue domains with the ending .onion, however, this could create a lot of confusion, as hidden services and sites in the regular net would resolve the same address in two different ways, leading to two different sites.

This is not very likely, however, as ICANN is likely to recognize the broad adoption and usage of the Tor network, and would certainly want to avoid confusion across the domain name system.

The Internet Engineering Task Force, IETF, which develops and maintains internet standards like TCP/IP has already formally recognized the .onion domain in what was hailed as a landmark decision in 2015. This decision came after heavy lobbying from the Tor Project and made it possible for Facebook to receive a digital TLS certificate.

TLS is not needed in the Tor network for encryption, as the connection is already end-to-end encrypted between a .onion server and the user. A certificate, however, makes it easier for the user to verify they are connecting to the right server and provides an additional barrier for an attacker.

Getting a vanity .onion address

When you generate a .onion address, it will look rather random, as is the case with any hash. However, statistically speaking, if you create enough such addresses, once in awhile you will randomly stumble upon one which is actually readable.

For each position, there are 32 possible characters. If you want to find an address that starts with e, you expect to have to guess about 16 times. If you want an address starting with ex, you already have to guess (32*32)/2=512 times. For exp, over 16,000 guesses are needed.

A modern computer can, using a script, easily guess about 1-2 million such addresses per second. From here we can easily estimate how long it would take us to find the domain name we want. We could use the same process to try to crack somebody else’s .onion address, but the following charts show you that this would not be feasible.

Generating a .onion address

To generate a good, memorizable and aesthetic .onion address, you will not limit yourself to simply looking at the first characters. You can use regular expressions to create patterns that are easy to read and remember.

To generate their .onion domain facebookcorewwwi.onion, Facebook took a new datacenter and used over 500,000 cores to generate domains over and over until they found one that they liked.

It took Facebook over one week to generate their .onion domain, and the computing power would have cost around US$100,000 in electricity.

Nik Cubrilovic, who set up the hidden service for Blockchain, says it only took them 200-300 USD and about 24h to come up with their domain (blockchainbdgpzk.onion) using an AWS G1 instance and a cluster of six ATi cards.

ExpressVNP only used a single computer with a freshly installed operating system. The computer was not connected to the internet to limit the risk of a third party getting hold of the keys. It took about two weeks to generate expressobutiolem.onion as well as a couple of other, less pretty domains.

.onion address security

While you wouldn’t be able to crack a .onion key with your laptop or even a thousand laptops, you might be able to if you find a million computers that each has about 10,000 times the computing power of your laptop today.

Even then it might take you a few years, but what sounds outrageously expensive today might soon come within reach of a well funded and motivated three-letter agency.

In the future, .onion addresses will have to be upgraded, or a new scheme will have to be found. At the very least, the RSA key will have to be extended (ExpressVNP already uses RSA keys with a length of 4096 bits for its VPN service) and the hashing algorithm could be upgraded to an SHA-2 algorithm.

Bitcoin addresses, for example, are created very similarly to .onion addresses, but Bitcoin uses the ECDSA elliptic curve to generate keys of 256 bits and applies the SHA-256 hashing function twice to derive the address.

Where next for Tor and .onion?

We don’t know what the future will hold for .onion address TLS certificates. As .onion addresses are hard to calculate, there is little risk of them being copied, but users can still be tricked into following a similar address and getting phished. To avoid this, the user needs to check the integrity of the entire domain, not just the first few matching characters.

TLS certificates potentially make this process easier, but it also requires the holder of the .onion key to reveal their real identity.That would undermine the very purpose of the hidden service.

One alternative would be to use mapping services like Namecoin or Blockstack to create a decentralized DNS replacement. However, it’s unclear how such a system could deal with name squatting and phishing. In the end, the future may even belong to *** combinations of long cryptographic hashes and ordinary address books.

Have your own theories about the future of .onion domains? Share your thoughts in the comments below!

Also published on Medium.