4 ms·

>"Out of a sea of "private, no logs" VPN services, ..." Has this ever been verified in any way?

jlgaddis 9y ago
Honest question: Short of root-level access to the entirety of their infrastructure, how would you verify it? I work for an ISP and have toyed with the idea of offering a "private, no logs" VPN service. As someone running such a service, what would it take to convince you that I wasn't logging information that could be used to identify you? (Obviously, there would be logs of some stuff -- just not the kind of things that would allow you to be individually or personally identified.)
- toyg 9y ago
  Get a reputable auditor to vouch for you, by giving them access to your infrastructure for a while. Of course it’s not foolproof (you could change everything the minute he leaves) but it’s the best you can do. Bonus points for making it a yearly event.
remar 9y ago
How exactly would an entity that makes such a claim, as in this case of "we don't log access", be able to allow external parties to verify this without handing over access to their infrastructure for manual inspection? I've read a little about zero knowledge proofs, but don't really know much about the subject to know if it could be used to verify these sorts of claims.
- bogomipz 9y ago
  Well these were kind of my points I guess. It's a service differentiator probably the biggest one and yet it can never be verified.
toyg 9y ago
I don’t know about PIA, but I believe Malaysian vpn provider Hide.me brought in an independent auditor to validate their claims. I expect you could do that in any country.
- bogomipz 9y ago
  Interesting I had not heard this. It actually says as much on this page: https://hide.me/en/features/logs https://hide.me/en/features/logs Maybe PIA should do the same since that's their biggest differentiating claim.
  - mmjaa 9y ago
    One issue, is they have an App for every platform, and thus is distributed through .. less than auditable .. means.

Honest question: Short of root-level access to the entirety of their infrastructure, how would you verify it? I work for an ISP and have toyed with the idea of offering a "private, no logs" VPN service. As someone running such a service, what would it take to convince you that I wasn't logging information that could be used to identify you? (Obviously, there would be logs of some stuff -- just not the kind of things that would allow you to be individually or personally identified.)

toyg 9y ago
Get a reputable auditor to vouch for you, by giving them access to your infrastructure for a while. Of course it’s not foolproof (you could change everything the minute he leaves) but it’s the best you can do. Bonus points for making it a yearly event.

remar 9y ago

How exactly would an entity that makes such a claim, as in this case of "we don't log access", be able to allow external parties to verify this without handing over access to their infrastructure for manual inspection? I've read a little about zero knowledge proofs, but don't really know much about the subject to know if it could be used to verify these sorts of claims.

bogomipz 9y ago
Well these were kind of my points I guess. It's a service differentiator probably the biggest one and yet it can never be verified.

toyg 9y ago

I don’t know about PIA, but I believe Malaysian vpn provider Hide.me brought in an independent auditor to validate their claims. I expect you could do that in any country.

bogomipz 9y ago
Interesting I had not heard this. It actually says as much on this page: https://hide.me/en/features/logs https://hide.me/en/features/logs Maybe PIA should do the same since that's their biggest differentiating claim.
- mmjaa 9y ago
  One issue, is they have an App for every platform, and thus is distributed through .. less than auditable .. means.