[HN Gopher] Mullvad VPN was subject to a search warrant - custom...
___________________________________________________________________
Mullvad VPN was subject to a search warrant - customer data not
compromised
Author : coldblues
Score : 688 points
Date : 2023-04-20 12:27 UTC (10 hours ago)
(HTM) web link (mullvad.net)
(TXT) w3m dump (mullvad.net)
| hacb wrote:
| I'm glad they are so transparent about it.
| MPSimmons wrote:
| I also appreciate the lack of US-style warrant canary that
| might be necessary here, where depending on who comes asking,
| you're not allowed to post about it.
| galleywest200 wrote:
| I was just thinking that if this was in the US then the law
| enforcement officers would have gone "smash and grab" on the
| company property anyways.
| pphysch wrote:
| Why wouldn't they? It's free marketing material.
| raverbashing wrote:
| "They intended to seize computers with customer data.
|
| In line with our policies such customer data did not exist"
|
| But please tell me again how hard it is to comply with the GDPR
| 3np wrote:
| Mullvad is obviously running an illegal fly-by-night operation
| by not plastering their site in dark-pattern overlay banners.
|
| /s
| moffkalast wrote:
| Mullvad is 4 parallel universes ahead of NOA. This is the best
| kind of advertisement they could've ever gotten.
| unixgoddess wrote:
| the problem is, if this starts to become common, countries will
| move to make it illegal not to store data...
| em-bee wrote:
| data retention laws have already been proposed, if not even
| enacted in some EU countries.
| moffkalast wrote:
| Would be a shame if those hard drives failed accidentally on
| a regular basis.
|
| In unrelated news, Seagate stock rises to record high...
| actionfromafar wrote:
| At least that forces legislators to be overt.
| unixgoddess wrote:
| unfortunately that's useless if you can't do anything about
| it... just think about the recent unfruitful millions-
| strong street protests in france, how powerless we are even
| in self-proclaimed democracies.
| filleokus wrote:
| > But please tell me again how hard it is to comply with the
| GDPR
|
| I like Mullvad (and been a paying customer on-and-off for
| years), but perhaps it's easier to comply with GDPR when your
| whole business is essentially not storing data?
|
| Even if you are the most privacy conscious company ever, there
| is probably legitimate need storing more data than Mullvad in
| almost any other B2C scenario.
|
| (Although it would be exciting buying e.g a TV online by
| sending cash in an envelope and writing the shipping address
| inside, the novelty probably wears of once the postal service
| looses your package and you can't do anything about it. Or when
| you loose your paper note with the ASCII armored PGP proof-of-
| purchase and you can't do a warranty claim)
| doodlesdev wrote:
| https://archive.ph/y7y9E
| lionkor wrote:
| Full title: Mullvad VPN was subject to a search warrant. Customer
| data not compromised
|
| As a customer, I have no doubt about the "customer data not
| compromised". I'm a paying customer, yet I have never given them
| any PII. Great service.
| lxgr wrote:
| > I'm a paying customer, yet I have never given them any PII.
|
| By nature, every VPN gets at least the IP you are connecting
| from and the IPs (and almost always also hostnames) you are
| connecting to. I'd consider that PII.
| InCityDreams wrote:
| If you pay cash, and use the service the pii is 2 IP numbers?
| lxgr wrote:
| As long as you only connect from one IP and only ever
| access one host, sure! That's not trivial to achieve with
| most VPN clients and devices/operating systems, though.
| LeonM wrote:
| How would you pay cash for an online service?
| HDThoreaun wrote:
| you can mail them cash with your account number.
| pulpfictional wrote:
| Mullvad accepts mail-in cash.
| msdrigg wrote:
| One quick google away:
|
| > Can I really pay with cash?
|
| > You bet, and please! Stay anonymous all the way. Just
| put your cash and payment token (randomly generated on
| our website) in an envelope and send it to us. We accept
| the following currencies: EUR, USD, GBP, SEK, DKK, NOK,
| CHF, CAD, AUD, NZD.
|
| https://mullvad.net/en/pricing/
| csomar wrote:
| They accept Cash and also Crypto.
| lionkor wrote:
| No, most VPNs would ask for address, email, full name, and so
| on - thats PII that not everyone gets who I visit on the
| internet.
| wepple wrote:
| Technically they could have been logging your traffic, which is
| "customer data" even if it doesn't identify you by name
| hnarn wrote:
| > Technically they could have been logging your traffic
|
| Of course they "could have" but their entire business depends
| on them not doing it.
| bragr wrote:
| That's a specious argument, because the choice could be
| between logging your traffic and being forced to shutdown
| under some kind of Swedish NSL, or forced to keep operating
| and logging even if they want to shut down. Not saying this
| is what happened, just that your reasoning doesn't really
| hold. Hell it's entirely possible Mullvad is a honeypot
| operated by some foreign intelligence service.
| teaearlgraycold wrote:
| > being forced to shutdown under some kind of Swedish NSL
|
| Given Mullvad I think they'd rather shut down.
| nicce wrote:
| Law enforcements could force Mullvad to start logging
| some specific account if they manage to indentify the
| account.
|
| Service might not collect data but they could be forced
| with warrant to start doing so for specific entities.
|
| This has happened in Finland, for example.
| vorpalhex wrote:
| It's possible you're in a coma and everything you're
| experiencing is a terribly detailed dream.
|
| It's not very likely though.
| TJSomething wrote:
| That one's pretty easy to disprove though. Just have a
| computer solve a random NP-complete problem and then
| verify it by hand.
| gala8y wrote:
| Can you, please, explain?
| Dylan16807 wrote:
| We're assuming in this scenario that your memory is still
| basically functional, so the math on a sheet of paper
| won't be replaced suddenly without you noticing.
|
| If you can't even remember things in the medium term
| that's a level beyond "trapped in a dream" that's much
| more hopeless.
|
| So, with that assumption, you make a computer solve a
| problem that's impossible for a human to work through in
| a practical amount of time. And then you verify it got
| the right answer. This proves the math wasn't done by
| your dreaming brain. (At least it proves it to a pretty
| good certainty, and you can repeat the test.)
|
| Many NP-complete problems are good candidates here for
| slow solutions and fast verifications.
| tadfisher wrote:
| This assumes the dreamer is a human brain.
| therein wrote:
| Yeah I kept thinking about simulation stuff too but GP's
| method is a good one for being trapped in one's own mind
| situation.
|
| Also for situations that have the standard dream level of
| fidelity, you can try basic reality checks like putting
| your finger through your hand or more conspicuously
| spinning along your own axis.
| jonas21 wrote:
| At least in my dreams, nonsensical things happen all the
| time, but within the dream seem completely reasonable.
| Dylan16807 wrote:
| It's not so bad to miss a hundred signs if you have a
| reliable test to try.
| psychphysic wrote:
| How would this work?
| stametseater wrote:
| Read a page of text, then read it again to see if it
| changed. This test never seems to fail, at least in the
| sort of dreams I can remember having after waking up.
| Usually I can't read at all in dreams, and when I can,
| the text is different every time I read it.
| JohnFen wrote:
| > Usually I can't read at all in dreams
|
| I thought this was just me! There have been times when
| I've "read" in dreams (signs, usually), but I don't
| actually visualize the words. I just "know" what they
| say.
| RomanPushkin wrote:
| > not very likely
|
| I would even say "highly unlikely". I revisited how I
| understand "unlikely" after reading this:
|
| > Radioactive capsule that fell off truck found in
| Australia... Radiation Services WA general manager Lauren
| Steen describing it as a "highly unlikely" scenario.
| hnarn wrote:
| > it's entirely possible Mullvad is a honeypot operated
| by some foreign intelligence service.
|
| "Entirely" possible? Sure, I guess it's "entirely"
| possible that the NSA is actually controlled by a
| reptilian, illuminati cabal of extraterrestrials, while
| we're just making stuff up without any factual basis
| whatsoever.
| blargpls wrote:
| See Crypto AG (https://en.wikipedia.org/wiki/Crypto_AG)
| for a company in the cryptography / privacy industry that
| was owned by intelligence services.
| stametseater wrote:
| Bad faith responses like this lashing out at people like
| bragr make me even more suspicious. You know damn well,
| or _should_ know, that companies secretly being owned by
| intelligence agencies is something that has happened
| before and could happen again. Meanwhile there is no
| evidence at all for reptilian ETs ever existing.
|
| And furthermore, I am sure you know that when dealing
| with matters of security, it pays to exercise precaution
| and be wary of scenarios you cannot prove to be happening
| at the moment. E.g., you don't _know_ your new friend you
| met at the bus stop is secret police, an informant for
| the Vichy government, but until you 're damn sure he
| isn't then you don't let him know the location of your
| resistance safehouse. You don't need to have proof that
| your new friend has done anything wrong to be cautious of
| that possibility.
|
| https://en.wikipedia.org/wiki/Crypto_AG
| nabla9 wrote:
| There is no such laws in Sweden.
| bragr wrote:
| That does not appear to be factual:
| https://www.riksdagen.se/sv/dokument-
| lagar/dokument/svensk-f...
| SiempreViernes wrote:
| What do you mean? Lag 2008:717 does not contain any
| provisions about forcing companies to log or store data.
|
| Rattegangsbalken does have a provision that a prosecutor
| can order you to preserve information you _already have
| saved_ for a maximum of 180 days
| (https://lagen.nu/1942:740#K27P16S1). I can't find
| anything about what the punishment for ignoring such an
| order would be, but to say a company could be forced to
| keep operating seems extraordinarily unfounded.
| bragr wrote:
| Try this one [1] which contains an obligation for
| operators to comply and maintain secrecy. I'm not a
| lawyer, and definitely not a swedish lawyer, but my point
| is, despite baked in protections, like most countries,
| Sweden seems to have a robust set of overlapping national
| security and surveillance laws.
|
| [1] https://lagen.nu/prop/2006/07:63
| hnarn wrote:
| Mullvad is not an operator, and you're moving the goal
| posts.
| risho wrote:
| mullvad has time and again shown itself to be one of if not
| the best actors in the entire vpn space, but you still have
| no real way of knowing if they are being honest.
|
| also their business definitely doesn't depend on being
| honest or standing for their values. there are plenty of
| vpn's who run on fake marketing that give the impression
| that they have certain values and do certain things while
| actually not doing it and they are way more successful than
| mullvad.
| qzx_pierri wrote:
| > there are plenty of vpn's who run on fake marketing
| that give the impression that they have certain values
| and do certain things while actually not doing it and
| they are way more successful than mullvad.
|
| Yes, but Mullvad also doesn't whore themselves out to any
| YouTuber that will accept a sponsorship agreement. I've
| never seen an ad for them. I've only heard of them from
| people who tell me they're the best.
|
| Of course we shouldn't trust them 100%. Trust isn't
| required them competent OpSec is implemented within a
| workflow. Trust is a vulnerability.
| risho wrote:
| pretending you don't need trust when you actually do is a
| vulnerability. of course you need to trust that mullvad
| is doing what they actually say they are doing. there is
| literally no way for you to verify everything they claim.
| EGreg wrote:
| And yet you trust WhatsApp and Facebook and Signal with
| their claims of end-to-end encryption. Why?
| risho wrote:
| i never said you shouldn't ever trust anything. I
| personally do trust mullvad. I've been using it for over
| a decade. I'm just not in denial over the fact that there
| is trust required. Second of all, aside from signal which
| I have superficially played around with, I don't and have
| never used any of those services you mentioned and they
| have absolutely nothing to do with the topic at hand so
| maybe you can tell me why you brought them into this
| conversation?
| EGreg wrote:
| Because I don't think it's wise to trust ANY company with
| major secrets, just because they _claim_ to not view
| them. Thus I agree with your sentiment and recommend it
| be applied far more widely
| doublerabbit wrote:
| I don't myself. If it isn't on my own infra, I won't
| trust it.
|
| The idea that folk are keeping passwords in some cloud
| management portal owned by some company boggles my mind.
| But this is a very controversial opinion and offends
| many.
| zamnos wrote:
| Alright, I'll bite. Not all password managers are the
| same. In particular, the good ones have no direct access
| to your data. It's encrypted before reaching them, so
| even if they get hacked, the attacker can't access your
| passwords without your master password as well, which
| hopefully you're not giving out.
|
| You don't _have_ to trust password managers if you don 't
| want to, but if you want others to accept your reasoning
| as to why, you'll have to convince them using an argument
| that actually applies.
| rft wrote:
| While GP didn't spell this out, they have, in my opinion,
| a point. If you use a cloud portal, usually web based (be
| it browser, electron or similar), that asks for your
| master password, you need to trust the provider that the
| master password is not send to their servers. Even if you
| trust the provider to adhere to this principle, if their
| infrastructure is compromised an attacker can serve you a
| different webapp that sends your master password to the
| server. Same goes for auto-updating native apps.
|
| This does not render the model of keeping the master
| password client side only moot, it is more secure no
| matter what. You successfully mitigate the read-only
| attack of dumping the storage of the cloud provider.
| However, if you assume a full, on-going compromise of the
| infrastructure, your password is not secure anymore.
|
| I get that this is moving the goal posts a bit but I
| wanted to post this anyway. I think if you have highly
| valuable credentials and want the maximum security for
| them, you should play out as many possible attack vectors
| as possible.
| sangnoir wrote:
| > mullvad has time and again shown itself to be one of if
| not the best actors in the entire vpn space, but you
| still have no real way of knowing if they are being
| honest.
|
| There are parallels to the now-defunct Crypto AG.
| Impeccable reputation, but no way of independently
| verifying it it did what it said on the can. It took
| decades for the truth about its links to the CIA to come
| out.
| panick21_ wrote:
| mullvad is working on a fireware attestation system that
| can allow clients to verify the exact version of the
| software running on the server.
|
| But I think this is not fully deployed.
|
| https://mullvad.net/en/blog/2022/1/12/diskless-
| infrastructur...
| azalemeth wrote:
| This is also one of the very few uses of remote
| attestation that I support as a consumer.
| cormacrelf wrote:
| Some places passed laws during the pandemic allowing for
| the execution of a will using witnesses connected via
| video link. How does that sit with you
| sleepybrett wrote:
| Their entire business depends on them not telling you they
| are doing it.
| vkou wrote:
| > their entire business depends on them not doing it...
|
| _... in a way that you, as a customer, can detect._
|
| 1. You can't have any hard guarantees about what
| information is retained by third parties about you.
|
| 2. As other comments here have pointed out, something
| smells a bit weird with this.
| hnarn wrote:
| How profound. So what is your alternate theory of what is
| happening here?
| vkou wrote:
| My theory is that if you need an iron-clad guarantee of
| privacy, you're not going to get it from a VPN.
|
| If you're interested in hiding from civil snoops (RIAA,
| MPAA), by all means, use one. If you're interested in
| hiding from a government, then by all means, keep rolling
| the honeypot dice.
| john_the_writer wrote:
| Also, just because a company doesn't get your name, doesn't
| mean they don't know every little thing about you. PPI
| doesn't include my fingerprint, but Google 100% has my online
| fingerprint.
| raverbashing wrote:
| True, and it's a good reminder that VPN does not mean "more
| privacy". It means more privacy in relation to specific
| parts and less to others.
|
| You can get a lot of info through DNS queries for example.
| zamnos wrote:
| Dns-over-HTTPS (DoH) ftw
|
| https://mullvad.net/en/help/dns-over-https-and-dns-over-
| tls/
| raverbashing wrote:
| I know, I'm glad Mullvad is offering this service and I
| think the benefits outweigh the worries some had
|
| (of course, it all depends on the DNS provider you
| choose)
| ragnese wrote:
| Does anyone here know how to corroborate Mullvad's account of
| this event? Perhaps we can find the Swedish entity that wrote
| the warrant and any public information reported by the
| officers executing said warrant?
|
| If such information is publicly accessible, and it
| corroborates Mullvad's story here, I'd feel like that's
| pretty compelling evidence that we can trust that Mullvad
| isn't simply committing fraud by promising not to log
| customer data while actually logging it.
| larsnystrom wrote:
| When the prosecutor brings forth the charges to a court,
| this information will be public. Until then it is probably
| covered by "forundersokningssekretess", which just means
| that ongoing investigations are not public.[0]
|
| You can contact the "Aklagarmyndigheten" (the Swedish
| prosecutor authority) and ask them and they'll help you
| out. Generally speaking it is pretty easy to get
| information from government agencies in Sweden due to our
| constitution. Everything is public by default, with some
| exceptions like military secrets. I think it shouldn't be a
| problem for the prosecutor to confirm they had a warrant at
| Mullvads office, and maybe even to confirm they didn't
| seize anything, unless they think it could harm the ongoing
| investigation somehow.
|
| [0] https://www.aklagare.se/om_rattsprocessen/fran-brott-
| till-at...
| CodesInChaos wrote:
| How did you pay?
| kklimonda wrote:
| They also have vouchers you can buy from Amazon, which I find
| a nice alternative to sending cash in an envelope.
| lxgr wrote:
| At that point, you can probably just pay by credit card: If
| your aim is to frustrate invasive ad trackers and profilers
| on the web (and you assume that Mullvad isn't outright
| colluding with these), that should be good enough to break
| any links.
|
| On the other hand, if you don't trust Mullvad's assertion
| that they delete the link between accounts and credit card
| payment records after 40 days [1], what makes you think you
| can trust them to not keep a record of individual scratch
| cards sold on Amazon, which Amazon can then correlate to an
| order ID and by extension account and shipping address?
|
| At a higher level, if somebody can convince Mullvad to
| collude in that manner, they can likely also just ask them
| to outright hand over your traffic flows and connection
| data.
| kklimonda wrote:
| How would they do that? Those are shipped directly from
| Amazon, and don't have any external markings that could
| be used to link specific card to amazon account. Unless
| the idea is that vouchers arrive at amazon in some
| additional packaging and then are repackaged after
| linking voucher to the account.
|
| By the end of the day I agree, if you have any "real"
| reason for using VPN you pretty much have to implicitly
| trust your provider to not keep any traffic flows and
| connections that could correlate traffic to your IP, but
| not even sending money in envelope saves your from that.
| r3trohack3r wrote:
| I think it goes something like this:
|
| If your worried about anything in a 40 day window the
| credit card <-> account_id is a liability
|
| Amazon doesn't know the redemption code on the gift card.
| So Amazon knows that you purchased a Mullvad gift card,
| but can't associate the transaction with a Mullvad
| account. Likewise Mullvad knows service was paid for with
| a gift card (possibly that the gift card is from a lot
| sold on Amazon). But they do not know which Amazon
| transaction the card is associated with.
|
| Unless your behavior and the behavior of others
| deanonymizes the Amazon purchase <-> redemption your
| account should be indistinguishable from any other that
| purchased a Mullvad gift card from Amazon in that window
| of time.
| shever73 wrote:
| If you care about privacy, then Amazon is the last company
| I would buy from. From personal experience, I would be far
| more concerned about what Amazon does with your data than
| Mullvad.
| sunbum wrote:
| Mullvad lets you pay with just an envelope of cash via the
| mail if you want.
| fudgefactorfive wrote:
| Apparently you can literally mail them cash with your
| randomly generated user id on a card and they'll top up
| credit for you.
| [deleted]
| actionfromafar wrote:
| At least before, one could pay in cash in envelope.
| eitland wrote:
| Cash in envelope is still welcome.
| Maxious wrote:
| > Which payment methods do you accept? > We accept cash,
| Bitcoin, Bitcoin Cash, Monero, bank wire, credit card,
| PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and
| Przelewy24.
|
| > Can I really pay with cash? > You bet, and please! Stay
| anonymous all the way. Just put your cash and payment token
| (randomly generated on our website) in an envelope and send
| it to us. We accept the following currencies: EUR, USD, GBP,
| SEK, DKK, NOK, CHF, CAD, AUD, NZD.
|
| https://mullvad.net/en/pricing/
| andygeorge wrote:
| ah yes, notoriously-anonymous physical mail
| generalizations wrote:
| I mean, just don't put a return address on it, and drop
| it off in a random post office box.
| chrisdhoover wrote:
| They never caught Zodiac
| callahad wrote:
| All standard British stamps now have unique Data Matrix
| codes on them, which means you also have to source your
| stamps anonymously.
| panick21_ wrote:
| Wait what? If you go to the post office and pay with your
| debit card, how exactly do they figure out who you are
| based on the stamp?
| daveoc64 wrote:
| There's no evidence they're actually doing that, it's
| just possible that they could.
| digging wrote:
| Possible, quite easy, and certainly of political value.
| But, you know, maybe they're not.
| callahad wrote:
| It's all metadata correlation.
|
| The UK will know with certainty that a specific stamp was
| used to send a specific envelope to Mullvad. (e.g.,
| America has been logging images of every envelope that
| passes through its postal service for over two decades).
|
| It would also be trivial for the UK to know:
|
| - When and where that stamp was initially sold (and to
| whom, if buying online!)
|
| - When and where an envelope bearing that stamp entered
| the postal system
|
| - When and where envelopes with other stamps from the
| same booklet entered the postal system
|
| Add up enough bits and you can pierce anonymity.
| sgjohnson wrote:
| And all of this is null and void if you buy your stamps
| from aliexpress and for the low low effort of simply
| driving to a different city to throw the envelope into
| the postbox.
| saberience wrote:
| Not really very realistic is it though? I can only
| imagine this sort of thing is only done if the suspect is
| someone like Bin Laden, not the average Joe using a VPN
| for pirating Photoshop.
| jjav wrote:
| > Not really very realistic is it though? I can only
| imagine this sort of thing is only done if the suspect is
| someone like Bin Laden, not the average Joe using a VPN
| for pirating Photoshop.
|
| This is a misconception caused by the scale of
| surveillance today. In the old days you were right. To do
| this kind of tracing they'd have to assign someone to do
| it which takes human resources and is not infinitely
| scalable. So they'd only do it to people deemed
| interesting enough, so average Joe was safe.
|
| Today the scope has changed completely. Everything can be
| correlated all the time, so it is. No suspicion or
| probable cause needed.
| panick21_ wrote:
| To make this happen each stamp would during product have
| to know where it would will be sold. Is that actually how
| it works? Can you show me the evidence for that.
| netsharc wrote:
| If they scan the stamp's code at time of purchase, and
| associate it with your debit card, that'd be an obvious
| way of tracking you.
|
| If they don't do that, if they meet the stamp along the
| letter's journey, they can scan the code and check which
| batch it's from, and there could be a database of which
| post office got which batch, and then it's a matter of
| checking that post office's purchases/security cameras.
|
| If all stamps are indistinguishable from each other, then
| you could've bought the stamp months ago on the Isle of
| Skye and used it in London, they wouldn't be able to tell
| the difference.
| rvnx wrote:
| Can bet 99.99% that Mullvad throws the envelope in the
| trash and just forgets about it.
|
| So, yes, there is a theory that someone may go in the
| trash in Sweden, finds the envelope, the stamp (and it
| has to be a british one), investigate who bought the
| stamp, get the assistance of the shopkeeper in UK
| (without raising suspicions), successfully reviews tons
| of security cameras footage to find who bought, etc.
|
| And still don't know which activity to link it to.
|
| A perfect waste of public resources if the NSA really
| does that, when all they needed to do is to purchase a
| VPN provider or fund Tor and claim to be no-logs VPN ;)
| e4m2 wrote:
| > Can bet 99.99% that Mullvad throws the envelope in the
| trash and just forgets about it.
|
| Better yet, they shred it:
| https://mullvad.net/en/help/no-logging-data-
| policy/#payments.
| mhitza wrote:
| It would be better to burn those envelopes than shred
| them, IMO.
| SV_BubbleTime wrote:
| Remember, the PC way to burn trash is to call it a "micro
| biomass power plant".
| michaelt wrote:
| _> So, yes, there is a theory that someone may go in the
| trash in Sweden, finds the envelope[...]_
|
| Presumably the theory is more like [1] - that the postal
| service, when they scan the envelope to read the address,
| save the scanned image and give it to the cops.
|
| I agree that the NSA would be better off just running
| their own VPN services - or indeed intercepting
| everything on major backbones and just seeing what source
| IPs connect to Mullvad's servers.
|
| [1] https://arstechnica.com/tech-policy/2013/07/us-
| postal-servic...
| sangnoir wrote:
| > Can bet 99.99% that Mullvad throws the envelope in the
| trash and just forgets about it.
|
| Storage is cheap - _really_ cheap. I bet automatically
| capturing images of all mail during sorting and archiving
| that for years is not only viable, but a vital
| investigation /intelligence tool. One would ask Mullvad
| for the cash payment dates[1], and cross-reference with
| all mail sent to a Mullvad postal address. One city-level
| datapoint on where user was, cross-checked with the
| latest IP address, where stamps were bought[2], and
| you've massively trimmed the list of suspects, especially
| if they are behind a NAT and sharing the IP.
|
| 1. They have to keep track of payment dates, which is a
| side channel.
|
| 2. Where and _when_ stamps were bought. I 'm certain GCHQ
| can keep track of individual stamp IDs, the batches they
| belonged to, when they were procured by the retailer and
| have a reasonable guess when that specific stamp was
| bought by mail-sender.
| dghlsakjg wrote:
| USPS scans all envelopes.
|
| You can get scans of all your mail through the informed
| delivery program.
| noirscape wrote:
| Their official policy is to iirc put the envelope and the
| letter into a paper shredder after it's been processed
| fwiw.
| xp84 wrote:
| Wow, looks like you lost that bet! They indeed shred that
| envelope.
|
| "Put the money in an envelope together with the payment
| token and send it to us. We will open the envelope, add
| time to the account (corresponding to the amount of cash
| sent), and then use a shredder to destroy the envelope
| and its non-money contents."
|
| Source: https://mullvad.net/en/help/no-logging-data-
| policy/#payments
| blamarvt wrote:
| I'm confused by your sarcasm. A one-time physical mailing
| can be incredibly anonymous.
| stametseater wrote:
| It's also incredibly easy to fuck up and accidentally
| hand them a DNA sample, fingerprints, handwriting sample,
| etc.
| zaphar wrote:
| Anonymity is not binary. It's a spectrum. Phyical cash
| mailed to a company with only an account number is
| significantly more anonymous than a check or credit card
| they bill.
|
| Perfect anonymity is probably impossible because
| information theory is impossible to escape. Which means
| you are trying to determine how far along the spectrum
| you can reasonably get for your particular risk profile.
|
| Comments that pretend like perfect anonymity is the goal
| or act like it's binary are singularly unhelpful.
| PKop wrote:
| How is it not?
| [deleted]
| [deleted]
| ursuscamp wrote:
| I use https://vpn.sovereign.engineering to pay with Bitcoin.
|
| You can pay a Lightning invoice to get a voucher which is
| redeemable on the website. You get an extra layer of privacy,
| and also don't need to wait for an on chain transaction.
| colesantiago wrote:
| That is a shame.
|
| Is there an alternative VPN provider that wouldn't be subject to
| this?
|
| Huh? Why all the downvotes all of a sudden? this is a genuine
| question.
| boesboes wrote:
| None? Any VPN provider _will_ be subject to law enforcement in
| their jurisdiction.
| Entinel wrote:
| No.
| duxup wrote:
| I think one issue is, anyone who maybe could avoid the legal
| process would be located in the country and/or operate in a way
| .... where are you might not trust the business anyway.
|
| Mullvad and how they operate seem to be the best choice for
| consumer vpn.
| rgrieselhuber wrote:
| I think you missed the entire point of the article.
| MPSimmons wrote:
| To a legal inquiry via search warrant? Probably not unless it's
| operated in a country that doesn't have search warrants, but
| that sounds more like a lawless wasteland.
| moffkalast wrote:
| Still waiting for someone to convert an international waters
| oil rig to a lawless data center. Or like that submarine base
| that Microsoft did.
| FormulatedEdits wrote:
| In case you hadn't seen this story, which I believe fits a
| similar bill, here is the case of the Cyberbunker. This
| took place in the Netherlands.
|
| Darknet Diaries has an (excellent, as always) episode about
| it. If it wasn't that podcast it might have been Malicious
| Life.
|
| https://www.newyorker.com/magazine/2020/08/03/the-cold-
| war-b...
| bingobongodude wrote:
| You mean Sealand?
|
| https://en.wikipedia.org/wiki/Principality_of_Sealand
| Xylakant wrote:
| Your a bit more than 20 years late with the oil rig idea
| https://en.m.wikipedia.org/wiki/Principality_of_Sealand
| [deleted]
| Nextgrid wrote:
| Governments can and will just criminalize the act of
| peering with them, so any ISP/transit provider will be
| liable if they peer. Problem solved.
| roblabla wrote:
| You'd need every government to agree not to peer with
| them, otherwise you'd just route to whoever has agreed to
| peer. You might get shit latency, but it'd still work.
|
| Getting everyone to agree not to peer seems like a rather
| tall order.
| Terretta wrote:
| You might enjoy the book _Cryptomnicon_ which is remarkably
| truthalized.
|
| https://arstechnica.com/tech-policy/2012/03/sealand-and-
| have...
| fasterik wrote:
| That's like asking whether someone can run a business without
| being subject to local laws and regulations.
| LastTrain wrote:
| It will either be hosted in a country where they can access the
| data legally or will access it illegally. Pick your poison.
| bluehatbrit wrote:
| A VPN provider who wouldn't be subject to a search warrant? I
| suppose only one operating from a country where warrants aren't
| required for a search by police, but that would presumably be
| much worse.
|
| What's happened here is the best way it could possibly go. A
| warrant was needed which meant prosecutors / police had to meet
| a certain bar to conduct a search, and when the search happened
| the data does not exist anyway. That's exactly what you want
| from a VPN. This isn't "a shame", it's cause of celebration
| that the process actually worked and the provider can clearly
| demonstrate that.
|
| I guess the only alternative would be a country which passes a
| law saying that VPN data (or something including VPN data)
| could never be searched, but that's extremely unlikely of any
| country at the moment.
| pc86 wrote:
| > _Huh? Why all the downvotes all of a sudden?_
|
| Because the whole point of the article is that there was no
| data to be compromised. If anything this should make you _more_
| likely to go with Mullvad if you 're looking for VPN services.
|
| Reading no more than the title, making up the article content
| in your mind, and writing a comment based on that made up
| content is a pretty good recipe for downvotes.
| Ensorceled wrote:
| > Because the whole point of the article is that there was no
| data to be compromised.
|
| AND they were able to convince the police and prosecutor of
| that!
| pc86 wrote:
| I have to wonder what would have happened had the same
| thing occurred in the US. I'm really struggling to think of
| a scenario where the police have a warrant that says
| "$THING is on computers at this company, go get them" and
| you have literally any chance of convincing them that
| $THING is not anywhere.
|
| I could see them taking all the computers then six months
| later saying "here you can have them back now, come pick
| them up at the precinct and here's the storage bill."
| tricolon wrote:
| I would half expect them to sue the computers for
| obstruction of justice... and then just keep them.
| SV_BubbleTime wrote:
| Does anyone have a Nord vs Mullvad on speed of servers in the
| USA.
|
| I'm ending out my Nord and want to switch, but man, I'm actually
| surprised at how fast Nord's servers are, I can get 500mbps on
| non-peak times.
| hnarn wrote:
| The main difference is that Mullvad cares about privacy while
| Nord is a cash-grab operation that sponsors youtubers.
| asoneth wrote:
| > After demonstrating that this is indeed how our service works
| and them consulting the prosecutor they left without taking
| anything
|
| Setting aside impacts on customers, I wonder how common seizures
| would need to be to support a purely financial case that
| businesses that are known to not store identifying information
| are therefore less likely to incur the cost and effort of
| scrambling to replace seized hardware.
| tsukikage wrote:
| I did notice that phrase doing a lot of work there. I'm
| actually super curious: when a bunch of goons turn up on your
| doorstep fully expecting to cart away boxes of electronics,
| /how on earth/ do you "demonstrate that this is indeed how our
| service works", there and then on the spot, in a sufficiently
| convincing manner that they leave again empty-handed?
| input_sh wrote:
| They've invested a lot of resources in what they call
| "diskless infrastructure", as in everything's in server's
| RAM.
|
| I presume it wouldn't be difficult to argue that as soon as
| you shut off a server to transfer it away, things they're
| looking for would be lost.
| password4321 wrote:
| _HotPlug allows hot seizure and removal of computers from
| the field_
|
| https://news.ycombinator.com/item?id=982930 (2009)
|
| https://wiebetech.com/products/hotplug-field-kit/
| rekoil wrote:
| I guess their OS could defend itself from something like
| this by actively deleting any potentially compromising
| customer data as soon as it loses it's connection to the
| internet. No idea if it does though.
| cge wrote:
| The design of their diskless architecture (where
| everything is provisioned to RAM on boot, and no data
| needs to be stored at all), and the nature of their
| service, likely means that they could be even more
| sensitive, eg, reboot on a minimal acceleration from an
| internal accelerometer, minor power irregularities,
| momentary internet outage, etc.
| kevin_thibedeau wrote:
| Implement a deadman switch over X10.
| dathinab wrote:
| yes but requires the Police to have the right warrants
| and tools
|
| and the server to not detect it due to e.g. network
| disconnect, or you not giving it the latest versions of
| rooling keys etc.
| Scoundreller wrote:
| I'd go with something MEMS based. Always safely shutdown
| your hardware if you sense an earthquake!
| j16sdiz wrote:
| I guess they don't have them on hand today?
|
| They will come back another day with a pile of batteries.
| AnthonyMouse wrote:
| This is assuming the point of not having disks is to keep
| the confidential data in RAM.
|
| The problem with disks is they're hard to securely erase.
| Some NAT mapping gets written to a log or swap file and
| then you overwrite it but the device silently reallocated
| that sector and the old one is still there. DRAM doesn't
| do that. Then if you e.g. power cycle the machine once a
| day, it never contains data more than a day old.
| Marsymars wrote:
| I've got no real insight, but my guess would be that a) the
| goons have both technical and legal competence and b) Mullvad
| had legal representation show up quickly.
| kkielhofner wrote:
| Have legal representation show up quickly means nothing.
|
| Consider the many, many scenarios where search warrants are
| served on companies with in house legal. Law firms.
| Individual lawyers. Literally happens every single day.
|
| Law enforcement has a warrant signed by a judge. Just
| because a lawyer of some sort is there doesn't mean they're
| going to stand around paralyzed saying "Oh there's a lawyer
| here, better stop what I'm doing and wait for XYZ".
|
| They're going to say "Oh you're a lawyer? Good for you.
| Here's a copy. Get out of the way and stand over there."
|
| Same thing for any technical or legal competence on the
| part of the authorities. You assembled enough cause for the
| warrant to be issued and you're going to walk away because
| the subject of the warrant basically says "Well see, I can
| explain everything..."?
|
| This is probably the equivalent of Neil deGrasse Tyson
| talking his way out of a speeding ticket on the side of the
| road by giving one of his (in)famous "Well actually
| officer, the Earth revolves around the sun while turning on
| it's axis at 25k MPH so actually I was..."[0].
|
| Their version of events makes absolutely no sense to me.
|
| [0] - https://www.youtube.com/watch?v=TyZSBqQ813c
| singleshot_ wrote:
| This analogy breaks down at a certain resolution but
| imagine if the cop who pulled over Tyson brought the
| district attorney with him and Tyson has God in the
| passenger seat. I could absolutely envision a situation
| where God explained the facts to the DA who subsequently
| changed his mind about whether there was a substantial
| likelihood of a conviction, which is (usually) the
| ethical threshold for bringing prosecution.
| kelnos wrote:
| I don't know how things work in Sweden, but I wouldn't be
| surprised if this process was more reasonable than in the
| US.
|
| It's funny how much we talk about the 4th amendment and
| due process, when our level of due process is actually
| not that great. If police come knocking at your door in
| the US, they are likely to trend toward the most extreme
| actions they can get away with. That doesn't need to be
| how things work, and I wouldn't be surprised to learn
| that law enforcement behaves better somewhere like
| Sweden.
| troad wrote:
| This is quite silly. A warrant isn't a magic bullet that
| ends all your rights and gives the police superpowers. A
| lawyer can very much say "no, this information isn't
| responsive to the warrant", where a lay person may not
| realise this, and volunteer information that they have no
| legal obligation to hand over.
|
| The police absolutely rely on the information and power
| asymmetry between them and the public. You honestly don't
| think the police behave very differently being watched
| (and these days often filmed) by a dozen high powered
| lawyers in suits, who will challenge absolutely
| everything they've just done as soon as they're out the
| door?
| hammock wrote:
| Many cases the police don't let you watch, they make you
| wait outside. Reason to have cameras in your place (pros
| and cons)
| RoyGBivCap wrote:
| In America maybe. This was in Sweden.
| kkielhofner wrote:
| Yes it was. I don't understand how you could have a
| functioning legal system anywhere if a search warrant can
| be neutralized by saying "I don't have that" without any
| kind of search taking place.
| yellowapple wrote:
| Pros: excellent material for a music video mocking the
| cops doing the search.
| zhengyi13 wrote:
| Point of order: _multiple_ music videos, not just one.
| zaphirplane wrote:
| Items removed outside the scope of a warrant have similar
| standing to items seized without a warrant.
| u320 wrote:
| Yes, in the sense that they are both admissible in court.
| This is Sweden, not USA.
| kkielhofner wrote:
| This is extremely silly.
|
| I did not say it ends your rights. I did not say it gives
| them superpowers.
|
| What it does do is give them government and legally
| sanctioned power backed up by force to do whatever the
| warrant says. They can tear your house apart. Seize your
| property. They can withdraw your blood by force if
| necessary. Micheal Jackson (rich, famous, and powerful)
| had his genitalia examined. They can certainly (and do)
| go in your office and take every single thing computer or
| data related if those devices may contain information
| relevant to the warrant.
|
| "This information isn't responsive to the warrant?" - I
| feel like I'm living in an alternate universe at this
| point... That's borderline "One weird trick just say
| these magic words and the police disappear". Watch video
| of search warrants being executed. They walk out with
| TONS of material - anything electronic related, hand
| trucks with boxes of documents, etc. When the FBI
| searched a billionaire former US President they walked
| out with 28 boxes of documents[0].
|
| Is anyone here under the impression that a search warrant
| for relevant electronic records involves the police
| sitting down with you and looking at your computer? No.
| They'll take EVERYTHING, image it for evidentiary
| purposes, and then take as much time as they need to
| review it in search for whatever was specified in the
| warrant.
|
| A person or lawyer can say anything they want but the
| outcome in 99.9% of cases is the guys with the guns are
| going to do whatever they feel empowered to do. If
| there's anything questionable it can be argued in court
| later.
|
| High powered lawyers in suits? The FBI executed a search
| warrant on a billionaire former United States
| President... Yes they'll likely behave differently but
| they're certainly not scared of you or whatever you or a
| lawyer says in the moment.
|
| In street crime this is often called "You can beat the
| rap but you can't beat the ride".
|
| In the moment the power asymmetry is very real. I point
| you to thousands of hours of YouTube police body camera
| footage, etc that demonstrates it.
|
| [0] - https://www.youtube.com/watch?v=tcnJNfJqJTI
| semanticist wrote:
| This feels like a very American-centric perspective, this
| happened in Sweden.
|
| For a bunch of reasons policing outside the US is very
| different to policing in the US.
| kkielhofner wrote:
| I realize this happened in Sweden. My dad was a professor
| at the Karolinska Institutet in Stockholm; I practically
| grew up there. My first name is spelled "Kristian" for
| this reason.
|
| Yes Sweden is very different from the US. In fact, seven
| years ago some Swedish cops on vacation in NYC became
| somewhat famous and drew significant attention (at the
| time) to policing issues in the US[0]. People in the US
| were literally saying "WE NEED SWEDISH COPS".
|
| That said... Even by Swedish standards (of which I'm
| familiar) I find it very, very, very hard to believe the
| government would bother to do an initial investigation,
| draft and apply for a warrant, serve the warrant with SIX
| police officers, and then walk out with a handshake
| because some guy in the office says "we don't have that".
|
| [0] - https://www.youtube.com/watch?v=izdfnHBMwSs
| [deleted]
| hnarn wrote:
| > I find it very, very, very hard to believe
|
| Well I guess that settles it
| tiahura wrote:
| How about the possibility that this is Sweden with a
| different set of priorities, an underlying crime that's
| relatively petty, and a prosecutor that is mostly
| disinterested in the case but had to at least pretend to
| make an effort?
| burnte wrote:
| Maybe in Sweden, telling and proving to the prosecutor "I
| simply do not have what you want, and I can show you"
| works better than elsewhere.
| kkielhofner wrote:
| I don't know where this perspective of "Sweden has so
| many rights and protections the legal system is parallel
| to general practice in the rest of the world" comes from.
|
| See Julian Assange[0].
|
| [0] - https://en.wikipedia.org/wiki/Assange_v_Swedish_Pro
| secution_...
| AnthonyMouse wrote:
| Try to imagine the police executing a warrant against a
| Google datacenter because one of their customers is under
| investigation.
|
| If they want to be massive schmucks they could in theory
| cart off with every server in the building, but they're
| also not _supposed_ to do this, because the warrant is to
| seize particular things, and should be something like
| "servers containing the data of X user" and not just
| "servers" if the judge is doing what they ought to do.
|
| The police also don't really want to cart off a thousand
| tons of irrelevant equipment, because it's physical labor
| and they have to do paperwork to catalog it and it takes up
| a lot of space in their evidence room. The main reason they
| do this in practice is to grief the target of the
| investigation, or to be more charitable, to make sure the
| target of the investigation isn't lying about which
| equipment is relevant. But that doesn't really apply when
| they're searching the building of some independent third
| party who has done nothing wrong and has more to lose by
| making false statements to the police than by the police
| finding what they're looking for.
|
| So what they might do instead is ask the company which
| servers have relevant data on them. And if the true answer
| to that question is none, well, that _should_ be the end of
| it.
| mike_hock wrote:
| You mean, sufficiently convincing that they leave empty-
| handed for now, knowing they'll have to come back with bigger
| guns.
|
| I'll be watching the news feed for updates on this.
| michaelmrose wrote:
| It was Swedish cops. We all know I US cops would both be
| unlikely to comprehend the situation and would take
| everything that wasn't nailed down out of spite even if they
| did and would experience no consequences however other folks
| in better countries actually have rights.
|
| They had warrants to seize servers containing data relevant
| to a case. None such exists. They didn't have the right to
| just steal like US cops.
| jdmoreira wrote:
| This is in Sweden
| jerry1979 wrote:
| Perhaps a business would structure their physical
| infrastructure in anticipation of the language of search
| warrants. They could use documentation, the principle of
| separation of concern, and well-labeled physical devices.
| Etheryte wrote:
| I'm wondering this as well and I haven't seen a sufficiently
| good explanation yet. I know they've done audits of different
| kinds over the years, I've read up about their infrastructure
| and the way they run their services, but I don't
| realistically see any of that being enough of an argument,
| right there on the spot, when the police turn up with a
| warrant. What could they possibly have demonstrated and how?
| stametseater wrote:
| > _What could they possibly have demonstrated and how?_
|
| Affiliation with an intelligence agency, who tell the petty
| beat cops to turn around and mind their own business.
| Probably more or less the same way that BATFE agents
| pretending to coyly sell illegal machine guns turn away any
| regular cop who might wander into the fishing expedition.
| With phone calls to police chiefs I imagine.
| slowmotiony wrote:
| After getting a call from the CIA to leave their honeypot
| alone, they left without taking anything ;-)
| slekker wrote:
| Bold claim. Any more info on this?
| therein wrote:
| Absolutely none but they are getting into the too good to
| be true territory.
|
| Given they are legit, they should take this as a compliment
| I guess.
| WaitWaitWha wrote:
| "Once is happenstance. Twice is coincidence. Three times is
| enemy action."
|
| - Ian Fleming, Goldfinger
|
| I find this to be a reasonable subjective measure.
| hubraumhugo wrote:
| Once again this shows the huge disconnect between the government
| authorities and the tech industry. Basic knowledge and a quick
| investigation would make clear that Mullvad is not storing any
| customer data.
| PragmaticPulp wrote:
| > Once again this shows the huge disconnect between the
| government authorities and the tech industry.
|
| Authorities have to follow their process and collect evidence,
| or document the absence of discovered evidence. They can't
| simply read the website, shrug their shoulders, and decide not
| to investigate a key part of a criminal case because the
| website says the company won't have the data.
|
| They are obligated to explore the possibility of data existing
| and to document the fact that it could not be found. Assuming
| the evidence doesn't exist isn't an option. They have to
| document it.
|
| I know Mullvad is generally trusted by the community, but you
| also have to remember that several VPN companies have claimed
| to not keep logs but were later found to have data useful to
| criminal cases.
|
| I think the real disconnect is in the comments from people who
| think this is the government being dumb. They're not, they're
| just doing their job correctly.
| KyeRussell wrote:
| So you're suggesting that law enforcement take someone at their
| word?
|
| I understand that some people are more less clued in than
| others, but your snarkiness really misplaced.
|
| The VPN industry is notoriously shady, and that's not just code
| for "fights for users' rights against law enforcement".
| pdpi wrote:
| Police got a warrant and went to service it, Mullvad explained
| why it was pointless, police agreed and left without further
| incident. It's not "a huge disconnect", it's the system working
| exactly as I'd hope for.
| formerly_proven wrote:
| Police doesn't (can't) make these kinds of decisions, they
| communicated with the prosecutor and the prosecutor withdrew
| his warrant. Which actually does seem _very_ out of the
| ordinary to me. Might 've been the warrant was acquired on
| autopilot with no one actually checking the targeted entity
| (e.g. crime committed, IP traced, get warrant for IP "end-
| user", police show up, "oh we've gotten a warrant for an ISP
| oops").
| dannyw wrote:
| A service provider may claim to not store any user data, but
| they could be lying.
|
| From the article: "After demonstrating that this is indeed how
| our service works"
|
| Presumably, Mullvad employees showed this data does not exist
| live.
| rasengan wrote:
| > service provider may claim to not store any user data, but
| they could be lying.
|
| As someone who ran a VPN in the past, this blog post is
| extremely strange as well as the purported described sequence
| of events.
|
| Police in any jurisdiction aren't jokes - especially not
| Sweden where they can absolutely walk in and take your stuff
| according to mullvads website [1].
|
| It's 2023 - if a VPN is how you're doing your privacy you're
| probably doing it wrong.
|
| Don't trust. Verify.
|
| [1] https://mullvad.net/en/help/swedish-legislation/
| gerbilly wrote:
| > It's 2023 - if a VPN is how you're doing your privacy
| you're probably doing it wrong.
|
| I'm honestly interested, how could one 'do privacy' the
| right way then?
| Izkata wrote:
| I'm guessing they're thinking of VPN as OpenVPN, and are
| referring to WireGuard...? Mullvad also provides
| configurations for that.
| commoner wrote:
| I'm satisfied with the transparency Mullvad has shown by
| publishing its 9 audits[1] and with their efforts to ask
| for as little information from users as possible. I also
| appreciate how Mullvad releases up-to-date source code for
| all of its software clients, which I consider a bare
| minimum for any VPN to even be considered.[2]
|
| Private Internet Access, on the other hand, does not
| release up-to-date source code for its software clients:
|
| - PIA Android client: latest source release v3.14.0 (Mar
| 18, 2022) vs. latest Google Play release v3.18.0 (Feb 22,
| 2023)[3]
|
| - PIA iOS client: latest source release v3.14.0 (Mar 18,
| 2022) vs. latest App Store release v3.20.0 (Mar 1, 2023)[4]
|
| - PIA desktop client: latest source release v3.3.0 (Feb 23,
| 2022) / v3.4.1-beta1 (Aug 18, 2022) vs. latest downloadable
| release v3.3.1 (unknown)[5]
|
| - PIA browser extension: latest source release v3.1.0 (May
| 31, 2021) vs. latest Chrome Web Store release v3.2.0 (March
| 8, 2022)[6]
|
| It's not clear to me how much of a say you still have in
| PIA's operations, but if you have any influence, I kindly
| ask you to direct them to release the source code of PIA's
| clients on time, every time a new client version is
| released. Open sourcing PIA's clients was something you
| promised PIA would do to reassure customers after PIA was
| acquired by the former adware/malware distributor Kape
| Technologies.[7]
|
| ---
|
| [1] Mullvad's audits:
| https://mullvad.net/en/blog/tag/audits/
|
| [2] Mullvad's GitHub repos: https://github.com/mullvad
|
| [3] PIA Android client - GitHub: https://github.com/pia-
| foss/android/tags / Google Play: https://play.google.com/st
| ore/apps/details?id=com.privateint...
|
| [4] PIA iOS client - GitHub: https://github.com/pia-
| foss/vpn-ios/tags / App Store:
| https://apps.apple.com/us/app/vpn-by-private-internet-
| access...
|
| [5] PIA desktop client - GitHub: https://github.com/pia-
| foss/desktop/releases / PIA website:
| https://www.privateinternetaccess.com/download/linux-vpn
|
| [6] PIA Chrome extension - GitHub: https://github.com/pia-
| foss/extension-chrome/releases / Chrome Web Store:
| https://chrome.google.com/webstore/detail/private-
| internet-a...
|
| [7] Our conversation in 2019:
| https://news.ycombinator.com/item?id=21613267 (I
| appreciated your response at the time)
| rasengan wrote:
| commoner - Thank you for this comment, and I think it's
| definitely fair to trust in Mullvad given these
| transparencies. The sequence of events are simply
| peculiar to me, and doesn't seem like a professional
| police operation. That said, I've been keenly watching
| Mullvad and agree with you that it's rock-solid in
| transparency which is the number one reason to use/not
| use a VPN service, if for privacy.
|
| I salute Mullvad and consider it to be the top VPN in the
| world today, and specifically, the only one I would
| recommend to anyone looking for a VPN.
|
| In terms of PIA, I am no longer affiliated with the
| company, but I agree that getting the source out for the
| clients out on time is something they should try to
| address quickly.
|
| gerbilly (another poster in parallel) - In 2023, I don't
| think a VPN is not private, but, for sure this cannot be
| the only tool in one's arsenal to secure their privacy.
| Depending on your threat-levels, there are different
| things you may want to do. To be clear, if you're being
| targeted, you cannot maintain privacy.
|
| For the absolutist:
|
| 1. Get cash but not from an ATM (traceable)
|
| 2. Go buy a computer (must be Purism or something with
| trustworthy hardware) with said cash but wear a disguise
| when buying it. Disable all the location/etc. stuff at
| store parking lot.
|
| 3. Purchase a T-Mobile Prepaid Hotspot with cash.
|
| 4. Purchase mullvad, but wear gloves, mask and a hairnet
| when working with the envelope to send cash.
|
| 5. Never login to any service of any kind that would leak
| your identity.
|
| For everyone else:
|
| 1. Assume you're not private.
| grvgr wrote:
| Haha yeah.
|
| Don't trust Andrew Lee aka rasengan, a cartel operator and
| a lying sack of shit.
|
| Verify https://twitter.com/grvgr
|
| [bull] https://www.privateinternetaccess.com/blog/dont-
| trust-verify...
| jrootabega wrote:
| There's also usually another disconnect: between tech industry
| publicity and tech industry reality. Mullvad could have been,
| and maybe even still is, lying about how they operate, because
| it's good for business.
| justsomehnguy wrote:
| > Mullvad could have been, and maybe even still is, lying
| about how they operate
|
| Could they? Sure.
|
| Do they have anything on me? * One BTC
| transfer * IPs where I'm connecting from (if they are
| lying and storing them) * My traffic (if they are
| lying and storing it) * My unencrypted traffic (if
| they are lying and storing it)
|
| Do they have ... on me? * Email? - nope
| * Phone number? - nope * Credit card? - nope
| * My first name, family name? - nope * My address? -
| nope * My mother's maiden name? - nope
|
| Because I never provided it to them because they never asked
| for them.
| echoer_lyrist wrote:
| Did you obtain the BTC that you used for the purchase from
| an exchange that requires PII?
| justsomehnguy wrote:
| Exchange has my CC number and the 'card holder' (though I
| never put my name there, lol). A non-business card is
| probably the most easy way to identify someone globally.
|
| If someone comes to exchange - they could identify me
| (and they can just tap their server to listen to email
| which do have all the transaction info, including CC# in
| the plaintext, lol).
|
| To establish a correlation between my wallet and Mullvad
| account someone needs to find that transaction in Mullvad
| customer data. Which - they claim they don't have.
|
| So yes, someone can identity what I bought services from
| Mullvad and... nothing more?
| tgsovlerkhgsel wrote:
| Unless you're using another VPN/proxy/Tor/... to connect to
| the VPN, the IP where you're connecting from (respectively
| the full 4-tuple including source/destination port) likely
| does identify your address.
| justsomehnguy wrote:
| Of course. It doesn't help what I'm getting pretty much
| the same IPs from my provider.
|
| Double (triple|quad) hop, tied to different entities is
| necessary if you want at least plausible deniability.
| Thankfully I don't do things what may be of the interest
| of someone who can raid Mullvad offices.
|
| But I recently discovered a VPS provider who only needs
| an email address to confirm an order, so it can be used
| as a bootstrap for a something pretty anonymous. Still
| needs an email, but as I said in some other comment
| recently, you can do that (if you are okay with leaving
| some traces) with a Google device with WiFi only
| capability.
| ursuscamp wrote:
| Might I suggest for the future:
| https://vpn.sovereign.engineering
|
| You can pay a Bitcoin lightning invoice on this site and
| get a redeemable Mullvad voucher instantly. Extremely
| convenient. Since you've only done 1 BTC transaction, I
| assume it was a large one for lots of time. However, when
| your time runs out, this option is great. It's an extra
| layer of privacy and you don't have to wait for the
| transaction to settle on chain.
| pulpfictional wrote:
| Monero is even better
| capableweb wrote:
| At least there have been some public and external audits that
| brings up the trust a bit, if you trust that those external
| companies are honest and putting their reputation on the
| line.
|
| List of the audits can be found here:
| https://mullvad.net/en/blog/tag/audits/
| brookst wrote:
| Government investigations pursue lots of avenues unlikely
| to be fruitful. It's basic due diligence to check all the
| boxes; you don't say "standard procedure is to issue a
| warrant, but we'll make an exception to our process in this
| case because their website suggests it won't get any data,
| plus they hired an auditor."
| bflesch wrote:
| You never know until you check. There is a lot of things to
| understand by viewing the metadata. Also don't underestimate
| incompetence with many of the self-proclaimed pro-privacy
| companies. They might be expert in the VPN software but not in
| all aspects of system and network administration.
| lm28469 wrote:
| > a quick investigation
|
| So for example, going to their office and asking them ?
| talhah wrote:
| I might be uninformed here, but on the surface Mullvad says
| they don't record customer data but there's always a chance
| they might be recording some data or lying.
|
| So I figure that authorities still obtained a search warrant to
| atleast see what data they can get their hands on and to verify
| that this is true. In that case, it doesn't really illustrate
| any disconnect.
|
| > Basic knowledge and a quick investigation would make clear
| that Mullvad is not storing any customer data.
|
| This is something more along the lines of trust. Sure you don't
| have to provide PII but Mullvad could supppsedly still be
| recording other data which would count as customer data.
| capableweb wrote:
| > but there's always a chance they might be recording some
| data or lying.
|
| As mentioned in another comment, at least they would have to
| be lying + the external companies who've done the third-party
| audits would have to be lying too (including companies like
| Cure53).
| lxgr wrote:
| An audit is always just a point-in-time (or possibly
| periodic) snapshot.
|
| A VPN company is also not a monolith: They have servers
| literally distributed around the globe. Ensuring physical
| security for all of them is not trivial, and I doubt that
| their auditors have visited every single data center. This
| is to say nothing of global traffic correlation
| capabilities of state-level actors; access to their servers
| network uplink is all that's needed to deanonymize many
| connections.
|
| Besides that, they have human staff as well, and while it's
| possible to distribute permissions and require four eyes
| for all important changes, there's always loopholes in a
| complex system.
|
| I have no reason to doubt that Mullvad is being truthful
| about any of their efforts or aspects of their service, but
| even if they're not, this is by no means equivalent to
| absolute security.
| PragmaticPulp wrote:
| > So I figure that authorities still obtained a search
| warrant to atleast see what data they can get their hands on
| and to verify that this is true. In that case, it doesn't
| really illustrate any disconnect.
|
| They also need to follow process and make a reasonable
| attempt to follow a lead.
|
| They can't just read a company's website, assume that no
| evidence exists, and then give up on that line of
| exploration. Note that in several high profile cases,
| companies have publicly claimed to not be storing data but
| later been found to have incriminating logs.
|
| It would be irresponsible for them to _not_ follow up with
| Mullvad, despite what they advertise.
|
| It doesn't make sense to suggest that this is a disconnect
| with law enforcement.
| hammyhavoc wrote:
| Of course a for-profit entity wouldn't lie or fail to adhere to
| their own standards.
| nivenkos wrote:
| They can still try to seize equipment as an intimidation tactic
| though.
| pebble wrote:
| Mullvad has also been an outspoken critic of the chat control
| proposal. There may have been different motives at work here.
| PurpleRamen wrote:
| Just trusting public claims would be pretty bad investigation.
| There are so many companies claiming not saving any logs and
| data, yet occasionally it's revealed that they lied and still
| stored something significant for the police to fetch. Looking
| deeper at reality is a relevant part of a good investigation.
| And in the first place, we don't even know whether the story is
| true or just marketing, until someone can back it with an
| official police-report.
| hnarn wrote:
| The summary of many comments so far seems to be: "I don't believe
| this is what actually happened when this warrant was executed in
| Sweden, because it doesn't sound like something that would happen
| when a warrant is executed in the US."
| iio7 wrote:
| Exactly this! It's Sweden, not the US.
| jrootabega wrote:
| I predict a bold new operational exercise/publicity stunt for
| Mullvad or some other provider: every week they randomly pick a
| server/storage pod and send it to law enforcement.
| pedro_hab wrote:
| I don't understand why go after the VPN, I think most people
| don't use a VPN correctly.
|
| What good is a VPN when multiple apps on your computer are
| phoning home?
|
| If the law has a suspect IP, couldn't they just ask google,
| microsoft and facebook what accounts were accessed with that IP?
|
| To use a VPN correctly wouldn't have to use a fresh OS and
| absolutely not login to any accounts connected to the IP you are
| trying to hide?
| Kuinox wrote:
| To watch movies that are not licensed in your country, on
| legals platforms.
| nextaccountic wrote:
| > What good is a VPN when multiple apps on your computer are
| phoning home?
|
| The point of a VPN is that whenever an app phone home, they
| will do so through the VPN. Standard VPN configuration (which I
| supose the Mullvad client performs?) is to entirely disallow
| any traffic that doesn't go through the VPN
| Root_Denied wrote:
| You're missing the reason this is important - the companies
| that run those apps (spotify, facebook, steam, discord, etc.)
| will be able to correlate your VPN connection with your non-
| VPN connection, _and_ tie those both to an app account that
| identifies you.
|
| It means unless you've got a dedicated download/seed box
| running your torrent downloads, one that doesn't have
| anything else on it and never connects to anything without a
| VPN connect, it's possible to track you down way more easily
| than you would think.
| kelnos wrote:
| Another easier option is to run the VPN client and torrent
| client in a Docker container, with networking separate from
| the host machine. Then the only thing using the VPN is the
| torrent client.
| [deleted]
| mindslight wrote:
| I personally use a bunch of VMs for web browsing, all with
| different exit IPs.
|
| And yes, a lot of people use VPNs but don't use them correctly.
| But I'd rather help them to use them more effectively, rather
| than shout down that VPNs "don't work". And even when they're
| not used correctly, most people don't have particularly
| omniscient threats. And even imperfect use still helps everyone
| else by creating cover traffic, a fluid market for VPN
| services, and more evidence to websites that (IP-based)
| nagwalls hurt legitimate visitors.
| aborsy wrote:
| You use Qubes OS?
|
| Otherwise, a lot of ram, CPU and storage might be needed.
| lofaszvanitt wrote:
| You put the vpn on a physical device (router), so there is no
| way to circumvent it on the os level.
| terhechte wrote:
| Use the VPN from a VM. You can also configure Mullvad to use
| socks so that it can only be accessed from Firefox (which has
| OS independent socks settings)
| metadaemon wrote:
| I was under the impression the socks feature no longer works,
| are you currently using it?
| S201 wrote:
| It works the same as always for me on Linux with SSH port
| forwards.
| pulpfictional wrote:
| I am, through the mullvad add-on.
| therein wrote:
| Take their wireguard config, change allowed IPs to
| include only the IP of their SOCKS gateway.
|
| And then use the SOCKS proxy over Wireguard while nothing
| else on your system is routed through it.
|
| That's the only way you'll get Mullvad "split tunnel" on
| OSX.
|
| Edit: Should have replied to the sibling comment but I
| guess this will do.
| metadaemon wrote:
| TIL, thanks!
| autoexec wrote:
| You're right that this is a huge problem with modem OS/software
| that's constantly phoning home, and people would be wise to
| avoid using those programs/operating systems when using a VPN
| to hide their identity. but many VPNs offer plausible
| deniability by assigning many people the same IP.
|
| A request to MS asking for who had a given IP address at a
| certain time could return multiple devices in different
| countries/states/cities. Narrows things down significantly, but
| not always a dead give away.
| miohtama wrote:
| You want to use VPN in places like United Arab Emirates and
| China where there are issues with Internet traffic
|
| - WhatsApp calls and such are blocked, you force to use the
| local crappy app by the local ruler's cousin otherwise
|
| - They will outright send a re-educator to visit you if you
| browser the web about the sensitive topics
| autoexec wrote:
| > They will outright send a re-educator to visit you if you
| browser the web about the sensitive topics
|
| This also true if you post the wrong things to social media
| in Canada (https://northernontario.ctvnews.ca/sudbury-ont-
| police-say-yo...) and in Australia
| (https://www.youtube.com/watch?v=vWZ06UThHas) and in the UK
| if you post something offensive they'll outright arrest you.
| I'm sure I read an article at some point about someone in the
| US being questioned by police for posting a movie quote to
| social media, but I can't seem to find anything about it now,
| just finding tons of examples of police in the US getting in
| trouble for posting racists things.
| can16358p wrote:
| My country blocks many websites and I'm pretty sure spies
| users' traffic too.
|
| I can use VPN to access the web freely and while VPN provider
| can also log my traffic, I trust it MUCH MORE than my country's
| government.
| jorblumesea wrote:
| IP != user. You'd only narrow it down to 10k suspects or
| something.
| peer2pay wrote:
| When tunneling through a VPN ideally thousands of users will
| share the same exit IP. So even if all your apps "phone home"
| identifiable information there is no way to prove that whatever
| traffic "the law" is trying to pin you on actually originates
| from your machine.
|
| Unless of course if the VPN keeps detailed traffic logs which
| is why that's generally frowned upon.
| sdrinf wrote:
| Briefly, law requires establishing probable cause, that _one_
| specific person has done specific things, to underwrite search
| warrant. VPN IPs are shared between users, meaning any one of
| the ~X00 users sharing a single ip could be doing any number of
| things at the same time.
| formerly_proven wrote:
| Briefly, non-US jurisdictions are not US jurisdictions and
| have different standards and procedures.
| mthoms wrote:
| I think the comment was made under the assumption the user
| lives in a place with a reasonably fair legal system. _Of
| course_ all bets are off if you don 't.
| tourgen wrote:
| [dead]
| fareesh wrote:
| If an app phones home at 11:00 AM and the illegal act is at
| 11:01 AM wouldn't it narrow down the list of suspects
| considerably?
| robjan wrote:
| No, because at the same time x number of users have their
| apps phoning home with what appears to be the same IP
| ementally wrote:
| How can you be sure that you are the only one in your
| country not connected to the same IP address provided by
| a VPN server?
| therein wrote:
| Well if they have ISP flow logs, that'll be trickier
| because it will enable very granular inspection of the
| traffic and the timings of that traffic.
|
| However if they are trying to cast a wide net and inquire
| Google and other service providers for it, that will lead
| to a lot of collusions and they won't be able to tell it
| is from country A because it is from the VPN.
| fareesh wrote:
| Are you sure x is sufficiently large?
| troad wrote:
| > don't use a VPN correctly
|
| People have different use cases for a VPN. I use one because I
| travel a lot, and spend a lot of time on dodgy public Wi-Fi.
| Not because I'm living some Jason Bourne fantasy.
| causi wrote:
| Yeah. A commercial VPN that's demonstrated its record-keeping
| policy under subpoena is reasonably safe if your objective is
| pirating media. HN commentators act like the VPN target
| market is Sino-Iranian freedom fighters who split their time
| between rescuing Uyghurs and searching for a way to cure
| their magical curse that makes them dissolve into dust if
| Google can tell they did a search for good restaurants in the
| area.
|
| Most people are just trying not to get a scary letter from
| HBO.
| autoexec wrote:
| > Most people are just trying not to get a scary letter
| from HBO.
|
| It's safe to assume that VPN company operating in the US is
| compromised but I figure that three letter agencies aren't
| going to spoil their honeypot over some kid downloading
| movies and TV episodes, which just gives you an added layer
| of protection against raids while also preventing your ISP
| from selling your browsing history and avoiding DMCA
| letters which unfortunately can get you perma-banned from
| your ISP based on nothing but unproven accusations from
| unreliable 3rd parties.
| kleene_op wrote:
| That's what Jason Bourne would say.
| KronisLV wrote:
| > To use a VPN correctly wouldn't have to use a fresh OS and
| absolutely not login to any accounts connected to the IP you
| are trying to hide?
|
| Even then fingerprinting would still present an issue, even
| without explicitly logging in, with most browsers.
|
| For example: https://coveryourtracks.eff.org/
|
| Also have a look at this: https://www.amiunique.org/
|
| So you might need to have a browser that lies and presents
| configuration information that is common enough not to be
| unique, probably an OS inside of a VM might be one of the
| possible starting points. Outright denying access to some of
| that might actually help identify you, but pretending to be a
| common setup might not even work that well.
|
| I'm frankly not sure whether privacy on the web is even truly
| possible nowadays, at least without a lot of effort. Even with
| a VPN, I treat the web as something that is more or less
| "spying" on me regardless, in the metadata collection and
| storage sense.
| wing-_-nuts wrote:
| And if you _do_ go out of your way to avoid fingerprinting,
| get ready for endless captcha prompts, automatic
| shadowbanning, etc as punishment
| swapfile wrote:
| [dead]
| autoexec wrote:
| > So you might need to have a browser that lies and presents
| configuration information that is common enough not to be
| unique,
|
| there are so many ways to fingerprint a user that trying to
| blend in with the crowd is pointless. If anything, it's
| better to have your browser present a unique fingerprint that
| regularly changes than to have to pray that you've somehow
| managed to avoid every single thing that could possibly flag
| you individually.
| jenadine wrote:
| I believe the "a fresh OS" makes fingerprinting useless.
| akyuu wrote:
| Not really. Modern web browsers expose a lot of
| information, such as your language, time zone, screen
| resolution, CPU and GPU details (number of cores, vendor,
| model...), etc. There's even <canvas> fingerprint which
| depends on your GPU driver version.
|
| If you use a custom built desktop computer, you're going to
| have a pretty unique browser fingerprint because few people
| will use the same exact hardware configuration. On the
| other hand, if you use Apple hardware you'll look the same
| as other Mac/iPhone users. The other option is to use Tor
| Browser or Tails OS, but I don't think that's feasible for
| everyday browsing.
|
| As other people have said, it's suprisingly difficult to
| have privacy on everyday browsing today. Personally, I
| blame Google. I believe they purposefully pushed modern web
| standards into maximum user data exposure for their own
| profit.
| steve1977 wrote:
| So, one could think a solution would be to not use modern
| browsers. But then this alone makes you stand out again I
| guess.
|
| Maybe VPNs should start to offer "browser anonymization"
| as a service.
| akyuu wrote:
| That's also surprisingly hard. Even assuming that every
| feature you need will work (which won't probably be the
| case), many popular websites as well as nearly all
| banking/shopping sites are behind Cloudflare, captchas or
| something else that doesn't like non-standard browsers at
| all. You will be automatically flagged as a suspicious
| user or a bot and will be prevented from accessing the
| site or be presented with tons of captchas. Google won't
| even let you access your account or Gmail.
|
| At least that's been my experience. In fact, I've even
| encountered problems while using Chromium and Firefox on
| Linux, just because some sites didn't like the user
| agent.
|
| In short, to use the modern web you need a modern
| browser, and modern browsers are very leaky and
| fingerprintable by design.
|
| > Maybe VPNs should start to offer "browser
| anonymization" as a service.
|
| The problem is that they'd need to render the website
| server-side and then serve it to you. That has their own
| problems, as the VPN provider now has total control of
| all web content you see.
|
| That already exists, by the way:
| https://www.puffin.com/secure-browser
|
| I'd say the most realistic options to avoid browser
| fingerprinting is either using Apple hardware or
| sandboxing the browser inside a virtual machine. And it's
| better to use Chrome because it has the most users by a
| large margin. Firefox, Brave and the new Mullvad browser
| do implement some anti-fingerprint mitigations, but they
| have few users so you'll stick out more.
| ementally wrote:
| If your ISP suspects your IP address (can see your are
| connected to specific VPN server) they can just contact top
| websites, example: twitter, facebook or google and ask them if
| there are any users connected with the same IP at given
| specific time.
| woofcat wrote:
| This is a confusing take to me. So my ISP which has my
| billing information is trying to find out who I am by calling
| Google? They know who I am.
|
| The inverse is what you're trying to prevent. Service ABC has
| malicious activity and calls Google to ask which accounts are
| accessing from that IP address. However this has two main
| problems.
|
| a) Why would Google give this info over willingly.
|
| b) Most VPN's assign the same outbound IP address to multiple
| users. So it's not a 1-1 mapping.
|
| c) People who are using a VPN for something malicious are not
| also signed into Google.. I'd think.
| ementally wrote:
| a) If they are unable to identify the user by any means
| then this is their only resort and google is going to
| happily hand it over.
|
| b) Depends on the country you are in. You might be the only
| one connected to a specific VPN server at specified time,
| this also answers point c.
|
| c) Would be surprised. Have a read of this recent Affidavit
| https://s3.documentcloud.org/documents/23723268/pompourin-
| af...
| autoexec wrote:
| It's not a 1-1 mapping but it can narrow things down to you
| and maybe a handful of others. If you're doing something
| like file sharing repeatedly over several days/weeks they
| can pull data for all of that time and when your IP is the
| only constant they'd know it was you. If they have only a
| handful of people it could potentially be, and they care
| enough they can seize and search the devices of everyone to
| find the person.
|
| Also, you don't have to be logged into google for google to
| know who you are. If you're using windows, your OS is also
| phoning home constantly with identifying data. If you use
| steam, it's also phoning home. Run wireshark sometime and
| see how much your computer is sending to random servers
| without you doing anything or being "logged in".
| kijin wrote:
| a) This is why you go through the legal system instead of
| asking Google directly. Report malicious activity to a
| three-letter agency of your choice, and let them do the
| dirty work.
|
| b) You can reduce the list of suspects significantly by
| correlating activity on multiple services from the same IP
| address around the same time.
|
| c) You'd be wrong... especially since Google never really
| forgets who you are, even when you are not signed in.
| Darthy wrote:
| I assume you mean "If any opponent suspects your IP
| address..."
|
| You can counter that easily. That's why you should use a
| multihop VPN.
| tadfisher wrote:
| The point of a VPN-as-a-service is that many thousands of
| connections originate from that same IP, making it difficult to
| correlate individual connections to an identity.
| rasengan wrote:
| I'm confused. You're saying cops came to your office 6 deep and
| just left with nothing even though your privacy policy says you
| have data [1]? There was no court case or investigation of any
| kind?
|
| This blog post concerns me deeply for a number of reasons
| especially given a VPNs only actual differentiating
| value/proposition is trust.
|
| [1] https://mullvad.net/en/help/privacy-policy
| cinntaile wrote:
| It's likely not the kind of data they were after so there was
| no point in seizing equipment.
| rasengan wrote:
| Police investigations regarding 6+ officers showing up at
| your office do not end with "oh have a good day."
| colourgarden wrote:
| Maybe not in the US.
|
| > We argued they had no reason to expect to find what they
| were looking for and any seizures would therefore be
| illegal under Swedish law.
|
| If this line is to be believed then the police would have
| been committing a crime by proceeding.
| rasengan wrote:
| This is not how police work anywhere. There would be an
| entire legal process for this.
| nemetroid wrote:
| I don't see why it's so difficult to believe. As noted on
| Mullvad's "Swedish legislation" page that you linked to,
| search of premises in a case like this is only allowed if
| there is a reasonable expectation of finding items
| subject to seizure (or other evidence of the offense in
| question). For what it's worth, the law itself is very
| readable, if you know Swedish [1].
|
| Given that Mullvad are highly public about what data they
| store and why, Mullvad would arguably be able to make a
| strong case that there could be no such reasonable
| expectation. So the police had to weigh the potential
| gain of doing the search anyway against the risk of
| opening themselves up to lawsuits by doing so.
|
| I would not have been surprised if they had decided to do
| it anyway, but I'm not really surprised at this outcome
| either.
|
| 1: https://lagen.nu/1942:740#K28P1S2
| skjoldr wrote:
| What legal process? The officers were pursuing some kind
| of case and got a warrant for a possible lead, the lead
| turned out to be cold, the officers moved on to other
| evidence. What's so complicated about that?
| DANmode wrote:
| Police investigations regarding 6+ officers showing up at
| _your_ office do not end with "oh have a good day."
| jdironman wrote:
| I don't have a dog in this matter, but I read through their
| privacy policy. The data they might have or have access to is
| if you pay with anything other than cash. That data they are
| saying lies with the payment processor. They link their no
| logging user activity policy which cover that further. But, at
| the end of the day it's like you said, it comes down to trust
| if we are not able to / not going to verify.
| InTheArena wrote:
| This makes me highly suspicious that they're setting up a sting
| on mullvlad. There doesn't seem to be much other reasons to serve
| a physical warrant other then to establish non-compliance with
| some law they may interpret differently.
| hnarn wrote:
| You don't have a very rich imagination. It's entirely possible
| this warrant was executed for no other reason than compliance,
| if requests come from foreign agencies for example obviously
| they have to be acted upon even if you are almost certain you
| will find nothing.
| qikInNdOutReply wrote:
| Its funny, how the VPN providers basically become the avatars of
| the old anarchic web and the constant buisness and government
| overreach makes them ever stronger. Its basically a old "freedom"
| tax.
| quickthrower2 wrote:
| Tor exists though fwiw
| Etheryte wrote:
| Tor exists, but realistically the overhead of using Tor is
| not acceptable to the general public. As long as Tor is
| sufficiently slow compared to everyday traffic it will remain
| a niche use case. A good VPN on the other hand gives you at
| least a little bit of privacy without much of a cost.
| 93po wrote:
| I've looked at Tor recently just out of curiosity for the
| tech and I found browsing to be plenty fast. Admittedly it
| was plain text sites with no images or whatever. And the
| installation/use of the Tor browser was easy.
| quickthrower2 wrote:
| One does not need to justify Tor usage :-)
| KyeRussell wrote:
| That's incredibly generous.
|
| The VPN industry is deserving of its bad reputation. Collecting
| user data in clear contravention of their TOS. Using hacked
| boxes as VPN endpoints to get people onto residential IP
| ranges. And whatever else.
|
| I'm very confident in my completely baseless assertion that
| most people that use a "public" VPN are either bypassing
| geographical restrictions on a streaming service, or doing
| something outright shady.
|
| There's a reason that it's common for VPN providers to take
| cash and cryptocurrency, as this one does. It does precisely
| zilch to thwart the sort of tracking that affects the vast vast
| vast majority of Internet users.
|
| The VPN industry isn't being propped up by nerds indulging
| their crypto libertarian / anarchism fetish but are just
| spending their time reading Hacker News (with JS off,
| obviously). There just aren't enough of them.
| catminou wrote:
| Don't forget the VPN providers who turn their customers
| machines as egress nodes without making it obvious they're
| doing so.
| [deleted]
| aborsy wrote:
| What if the law enforcement, instead of saying give me your logs,
| rephrase it slightly and says, start logging this IP address and
| then give me your logs?
|
| They can do whatever they want.
| gameshot911 wrote:
| A warrant can compel the seizure of existing evidence, but I
| don't know if it legally can compel the creation of _new_
| evidence by a 3rd party. At least in the US. I 'm sure there
| are exceptions under various anti-terrorism laws, but in
| general it seems like the government can't compel corporations
| or individuals to assist in it's investigations.
| plasticsoprano wrote:
| That was my bad, y'all. Needed that full season of Milf Manor.
| blint_carton wrote:
| "After demonstrating that this is indeed how our service
| works..."
|
| I'm curious how they demonstrated that. Did they just review
| their policies with them or did they some how technically
| demonstrate this? Latter seems not really possible to do, even if
| you had a technically-savvy member of the department there.
| bingobongodude wrote:
| Mullvad has been very outspoken against the proposed
| "Chatcontrol" law. I suspect retaliation. Just my 2 cents.
|
| https://mullvad.net/en/chatcontrol
| Ansik wrote:
| If it had actually been in retaliation they'd left with the
| severs no matter if they contained anything of value, as with
| pirate bay
| GoofballJones wrote:
| With past experience with law enforcement, if they don't get what
| they want, they will continue to harass and needle and try to
| chip away at what they can until they get some semblance of what
| they wanted.
| H-2-O wrote:
| Just a speculation - if the story was true then the search
| warrant was just an excuse to seize remote admin access control
| key to some other server(likely RAM server). Also any one else
| noticed mullvad has a socks relay in russia(check the browser
| addon for firefox or Mullvad Browser > Switch location) .... well
| that might explain why /b
|
| OR ... something more fishy is going on behind the scene.
| rodolphoarruda wrote:
| Would it be possible that the warrant issued by Swedish
| authorities came via a prior request by the Interpol?
| tejohnso wrote:
| > Mullvad has been operating our VPN service for over 14 years.
| This is the first time our offices have been visited with a
| search warrant.
|
| Does a search warrant detail the reason and justification for the
| warrant, or are you left in the dark about what all the hassle
| and disruption was even about?
| hnarn wrote:
| Yes it does, but Mullvad may have good reasons for not sharing
| it. For example that it does nothing to improve their
| information to their customers (ie what exactly is being
| investigated is irrelevant for the public), while
| simultaneously damaging the investigation and therefore their
| relationship with the government.
| lnxg33k1 wrote:
| [misread the article]
| hnarn wrote:
| Your comment is very presumptive. How do you know what the
| warrant was for, and that it wasn't fulfilled?
| beltsazar wrote:
| I've been a Mullvad customer for some time and I'm quite
| satisfied. But the main issue I have is that many of its servers
| are blacklisted by Cloudflare and other services. Because Mullvad
| provides the strongest anonymity a VPN can provide, it attracts
| not only normal users, but also malicious users (scammers,
| hackers, or less malicious but more numerous scrappers).
| Etheryte wrote:
| I've run into this as well, but for what it's worth, this is a
| problem every VPN provider struggles with. The most colorful
| example I have is receiving an email from my bank telling me
| they've blocked access to online banking because someone tried
| to log into my account from a suspicious IP -- yes, it was me.
| Luckily I use a fairly small local bank who cuts through issues
| like this swiftly with a short phone call.
| sebiandev wrote:
| This right here is why I use Mullvad.
| benmmurphy wrote:
| Is this a warrant canary? Maybe the police seized machines but
| they were blocked from commenting so they published this
| implausible claim the police went away empty handed.
| kkielhofner wrote:
| I'm an American (keep that in mind) but I have been to Sweden
| many many times throughout my entire life (my dad worked
| there). It's a great place and somewhat famously the "Swedish
| Subway Cops"[0] highlighted the difference between US and
| Swedish policing seven years ago.
|
| All of that said I find it highly, highly implausible that law
| enforcement anywhere in the world would show up with a warrant
| and just walk out with nothing saying "Oh ok, sorry for the
| confusion!" because a subject of the warrant told them "Oh we
| don't have that. Here's my logging configuration file - see
| line 45 where logs go /dev/null?" (or whatever).
|
| Sweden is not the US and maybe I can't picture this because of
| our issues here but still - this narrative and explanation
| really strains credibility to me.
|
| [0] - https://www.youtube.com/watch?v=izdfnHBMwSs
| troad wrote:
| Warrants generally have to be _for_ something. It's possible
| that the police officers showed up with a warrant for user
| names and addresses, etc, and Mullvad was able to demonstrate
| that they don't possess any data responsive to the warrant.
| At that point there may not have been anything to (lawfully)
| carry away.
|
| It doesn't necessarily mean that the cops won't show up
| tomorrow with a more generic warrant, and Mullvad may have to
| hand over whatever information it does possess.
| hnarn wrote:
| The people that attend when these warrants are executed are
| highly technically skilled, and obviously Swedish
| surveillance agencies know Mullvad very well, probably
| intimately (ie it wouldn't surprise me if they even have an
| understanding of their infrastructure).
|
| It's not at all "highly implausible" that they showed up for
| a technical discussion to see if the data they wanted but
| were almost certain did not exist could be retrieved.
|
| If they are confident that this data does not exist, why
| would they start seizing hardware? As I said: they probably
| have a basic understanding of how their infrastructure works
| (especially since Mullvad is fairly open about it), and they
| likely understand that the second they power off those
| servers and move them, they are never booting up the same
| again.
|
| So yeah, what you describe as "look at line 45" is not a
| silly example, because it's probably more access than they
| would ever get than if Mullvad met them with hostility.
| kkielhofner wrote:
| The first line of the post:
|
| "On April 18 at least six police officers from the National
| Operations Department (NOA) of the Swedish Police visited
| the Mullvad VPN office in Gothenburg with a search
| warrant."
|
| 1) The government put together the cause/case for a
| warrant.
|
| 2) They got it issued.
|
| 3) They showed up with six cops from the national police.
|
| That doesn't sound like the setting for a "technical
| discussion" between two old friends to me...
|
| Have you ever seen a search warrant involving _anything_
| technical /electronic executed? They're looking for data
| and there's no way to know for sure where that data
| is/might be from anywhere from a single cell phone to a
| server farm. They show up and take anything/everything
| electronic (usually enumerated in the search warrant like
| "storage media, computing devices, etc, etc"). They walk
| out with it, take it back to a certified technician of some
| sort to clone/image it for evidentiary purposes, and then
| maybe give it back at some point (depending on the
| situation).
| DANmode wrote:
| > Have you ever seen a search warrant involving anything
| technical/electronic executed?
|
| What jurisdiction is your experience within?
| hnarn wrote:
| The fact that you call NOA "the national police" tells me
| everything I need to know.
| kkielhofner wrote:
| Outright dismissal without any substance says a lot too.
|
| "The National Operations Department (Nationella operativa
| avdelningen) is tasked with assisting the local police
| regions and is in charge of international police
| cooperation and all national operations."[0]
|
| So yes, this was above and beyond a few local cops.
|
| Do you have a better way to summarize this other than
| saying "the national police"?
|
| [0] - https://en.wikipedia.org/wiki/Swedish_Police_Author
| ity#Natio...
| nisegami wrote:
| >If they are confident that this data does not exist, why
| would they start seizing hardware?
|
| As retaliation or as a punitive measure. Basically, just to
| spite them.
| hnarn wrote:
| I understand that. So why would they want to spite them?
___________________________________________________________________
(page generated 2023-04-20 23:02 UTC)