General Help

I signed up for XeroBank service, now what?

When you open an account with XeroBank, you get a 16 digital Access Code. This was displayed on your checkout page, and emailed to you if you asked for it. Go download the XeroBank Installer, input your code, and the software will do the rest. If you are a linux or mac user visit here.

Website

What is XeroBank?
XeroBank is a digital security firm that specializes in turn-key solutions for private communications, data, and commerce. Our products are customer focused in their design, because we think security and privacy shouldn't have to be complicated or inconvenient.

What happened to Torpark?

Torpark, along with Torrify, was renamed. It is now known as xB Browser.

Is xB Browser still free like Torpark was?

Yes, and it always will be. All our softwares are free of charge and open-source.

Does XeroBank have a support forum?

Yes. The XeroBank Forum is available from our website menu under support.

How do I get XeroBank?

Sign up for an account, download the software, and input your access code.

Software

xB Browser: Is temporarily allowing scripts or plugins dangerous?

Inherently, yes, they are dangerous. Allowing script to run on your computer is a situation where you trust the website who hands you the code to run. If you don't trust the website, don't allow it to run scripts or plugins on your computer. These scripts and plugins could attempt to install malicious software, spyware, viruses, and could be used to breach your privacy. Even websites you trust can be hacked, and have malicious code inserted. So it is better to not lend your trust at all, than to trust blindly. The bottom line is if you don't explicitly trust the website you are visiting, you shouldn't share data with them, or allow them to run ../scripts/plugins.

xB Browser: Is it okay to use webmail?

Yes, but just because you are using xB Browser doesn't mean you can't compromise your anonymity or security.

• Only log in to websites that have secure logins such as HTTPS or that display a lock in the bottom right hand corner. If you are using a free version of xB Browser, but you don't see the lock, you are passing your login and password credentials in plaintext (unencrypted) format. An observer of your plaintext web traffic could capture your data, and then log into your account to read your mail, steal your identity, or worse.
• Webmail itself is very risky, and prone to security flaws. We suggest using only IMAP or POP connections, that are encrypted and use secure authentication. All XeroBank accounts come with such secure and anonymized e-mail accounts.

xB Browser: My firewall keeps crashing, what is going on?

Sometime, with the free version of xB Browser, it crashes the firewall. This is often caused by the Tor process. This is known to happen on outdated versions of Kerio firewall, or when new versions of Tor are released. This problem has not been seen in versions of xB Browser that use the XeroBank network.

xB Browser: Why is it that sometimes I can connect, other times I get a timeout error?

In the free versions of xB Browser, it relies on the free but slow anonymity network called Tor. Unfortunately Tor often suffers from network congestion due to heavy use, and is sometimes blocked entirely because it is often abused by hackers. If you get these errors, try a free trial of XeroBank and see if that clears up the problem.

xB Mail: Are all e-mails I send with xB Mail anonymous?

Only if the e-mail server you are connecting to does not have information to discover who you are, and your message contents and recipient don't have any identifying information. So if someone was to ask what IP connected to the e-mail server in order to send the message, they would only see the IP address of an anonymous proxy, and not your true IP address. If you ever connected to that e-mail account with a non-anonymized connection, it can be traced back to you if they log IP addresses, which all do except some anonymous e-mail services. xB Mail anonymizes your connection to the e-mail server. In order to have effective anonymity of the message, it should be paired with an anonymous e-mail account. All XeroBank accounts come with secure and anonymous e-mail accounts.

xB Mail: Error trying to validate certificate from smarthost.xeromail.com using OCSP

A server along the chain has failed to verify the certificates. This typically means that an OCSP server is bogged down. However, it could represent a rogue network trying to block certificate verification, which is pretty unlikely. This situation is sometimes a cost of sending email securely. To be on the safe side, wait a few minutes for the problem to resolve itself. Save the email as a draft, and retry it later. You can also disable OCSP, because the xB Mail software automatically will update if a certificate is revoked.

Is it safe for me to change the network settings of XeroBank software?

No. xB Browser, xB Mail, etc. are set up with fail-secure settings. That means that if you can't get a secure connection, you get no connection at all. Changing these settings inside the browser is only for network professionals who may be changing internal XeroBank settings. Users behind firewalls/proxy servers should not change the software settings, but instead use xB Config, which comes automatically installed.

What should I do if I changed the network settings?

For most issues regarding network settings, you can just close and restart the program, and XeroBank will know which settings to use. However, if you have edited internal preference files, you should redownload your software and install it ontop of your current installation.

How do DNS lookups work with XeroBank software?

When your computer requests a website, it first has to know the address of the website in order to reach it. This is just like needing to know the address for the library if you want to get there. Your computer will first ask a Domain Name Server what the IP address is for the "www.website.com' you requested when you typed it into your browser. When browsing without XeroBank, this can be a vulnerability, because when you request a website, it is sent in plain text so an observer such as a coworker, administrator, or ISP could see the request for the website address. This is called "DNS Leaking". DNS Leaking could be potentially embarrassing or compromising if the website is about a private or sensitive subject. XeroBank network has solved this problem by performing remote DNS lookups when using the free version, and secured DNS lookups when using a XeroBank account. That means that instead of performing the request with your School / Work / ISP"s normal DNS server, your request is encrypted and sent through an anonymous network for the request. So when you use a XeroBank software, the information about what websites you want to visit does not leak, it is protected.

Why did my anti-virus report a XeroBank software had a trojan or suspicious file?

It is a false alarm. Often times outdated anti-virus definitions are the cause of false alarms. However, some anti-virus software will consistently report false alarms against privacy software. Corporate clients of anti-virus software may want to spy on their employees, and XeroBank stops them. Therefore anti-virus software providers can be pressured into misclassifying privacy software as malware.

I need help with XeroBank software. What should I do?

Clients can log in to their account and enter a support ticket. Non-Clients can request support from the contact area of the XeroBank web site.

What operating systems does XeroBank work on?

All major operating systems can access XeroBank services. However, most of our software is primarily designed to run on Windows operating systems. Mac and Linux users to not require custom XeroBank software, but can instead use Tunnelblick or OpenVPN respectively.

xB Machine, the secure virtual workstation, can be used to access all XeroBank services. It can run on Mac, Linux, Windows, and can also be booted from directly.

I did a port scan using a remote port scanner, and it showed I have some open ports, should I be concerned?

No. The IP address that is seen by the remote port scanning service is the IP address of our network. This is not your machine. The ports open on our machines are secure and part of our operating service. These are not ports open directly on your machine. XeroBank will act as a firewall to keep uninvited communications from being able to reach your computer from the internet.

Services

How do your services work?

It is simple: You connect to XeroBank in scrambled code, XeroBank bounces your signal from server to server, then unscrambles your code and then connects to the internet for you as an intermediary.

Our Encrypted Email service automatically anonymizes the origination of your message, and will not reveal your identity to the outside world.

Our File Vault service allows you to securely store your files on our remote servers.

Can XeroBank be my ISP, or do I already need internet service?

You will need existing internet service. The way XeroBank works is that it exists on top of virtually any current internet access that you have.

Can my ISP / Boss / School / Government see where I go and what I do?

If you aren't using XeroBank, they probably can. When using XeroBank software and services, all that snoops can see is that you have an encrypted connection to the XeroBank network. They have no idea where you go, what you do, or what you say when you are online.

How can an anonymity service accept Credit Cards and other personal payments but still have clients remain anonymous?

We use multiple methods to ensure the privacy of our clients. We seperate the activity of an account holder, from the identity of the accont holder. In other words, we only know that an account in question is valid, but not who owns it. This is most similar to a Swiss numbered account.

Does XeroBank offer webmail?

Not yet. Webmail is extremely insecure, and every major webmail software is frequently compromised. Beware of any privacy service that offers webmail access that is not entirely custom created and designed for that specific company and its use.

Are XeroBank serivces available outside the US?

Absolutely. As long as you aren't living in a country where encryption and privacy is illegal, we welcome you to become a XeroBank client. If you are a XeroBank client but visiting an ISP that restricts your connection to XeroBank, our Business level service has solutions for you, such as a private entry node into our network.

Policies

Does XeroBank log user activity?
Absolutely not. We will never log user activity unless compelled by a court of law with applicable jurisdiction, or unless malicious traffic is detected, for a specific account. XeroBank will not allow “fishing expeditions” under any cirumstance. However, we may collect non-personally identifying data for analytics and network health.

If XeroBank doesn't log, how do they know if someone is abusing the network?

We have lots of ways we can discover abuse without violating the privacy of our clients. Our pro-active methods are by using hueristic algorithms that notify us if someone attempts to do network scanning, perform malicious activities such as Denial of Service attacks, mail spamming, etc. We take client privacy very seriously: in the case that malicious traffic is suspected, it is then reviewed by a human auditor. If it is not clear that it is abusive traffic, an ethics advisor will be consulted. If deemed not to be malicious, the log is wiped.

What kind of data does XeroBank collect?

XeroBank may collect anonymous usage statistics and activity levels of our servers for diagnostic purposes. None of the data that is collected is personally identifiable. All collected data is stripped of IP addresses.

How does XeroBank protect clients?

We offer the strongest Privacy Policy in the world, and engage in best practices. Our best practices include security audits, no retention of personally identifying information from clients, no activity logging, pro-active network stress testing, mutliple levels of data encryption, encrypted-only e-mail access, distributed client data, tamper-proof servers, encrypted and hardened operating systems, redundant hot backups, distributed server locations, and strategic corporate structuring.

Does XeroBank have to comply with EU data retention laws?

Not at present. But if things change, we'll let you know. In the case that EU retention laws do apply, we render the impotent by channeling our traffic outside the EU to non-retention servers, where the connection is broken.

Network

Can people tell I am using XeroBank?

Yes. However, they cannot see what information you transmit through XeroBank. Further, your browser and email client do not generate signatures that tell them you are using xB Browser or xB Mail specifically. Both of these softwares blend in with the millions of Mozilla Firefox and Mozilla Thunderbird users.

Does the XeroBank network rely on Tor or use any public Tor nodes?

No. The XeroBank network is entirely independent of the Tor network. The only Tor affiliation is that our free software is compatible to run on the Tor network instead of XeroBank if the user so chooses.

Can my Work /ISP / Government block access to XeroBank?

Yes. Networks have the capability to implement blocking rules for any internet services. However, there is no legitimate reason to block access to the XeroBank network in a free country because XeroBank enhances the security of anyone using our software.

How many IP addresses do I get when I use XeroBank?

XeroBank rotates exit node IP addresses regularly, through an expanding and contracting pool. It is a common misconception that one needs many IP addresses to remain anonymous. In fact, with more people who crowd through a single IP address, the anonymity is increased.

Where are XeroBank's servers located?

XeroBank servers are scattered across the globe, including North America, Europe, Australia, South America, and Asia. None of our servers with sensitive client data are located in the US or the UK. Communications servers may be secured in any country, because server theft will not render any unencrypted operations data or signal origination data, nor will servers continue to function. The location of our internal servers is secret. Some may confuse the desirable security tactic of “Leveraged Unpredictability” with the undesirable “Security through Obscurity”. The reason we do not disclose the location of our servers is because this would present tactical information to those who might like to compromise our clients' anonymity. The communication servers themselves are extremely secure and hardened. An analogous situation would be how armies do not broadcast their location to the enemy, not because they are weak, but because there is a tactical advantage in the secrecy of their location. — Idea attribution to Bruce Schneier, Secrets & Lies, p371 2004