6 ms·

Well then why is it if you actually try and sue a VPN provider for the logs, you won't be able to get them. this is the case for one scenario I know of where

by delbel 9y ago

Well then why is it if you actually try and sue a VPN provider for the logs, you won't be able to get them. this is the case for one scenario I know of where a subject got hacked and it was traced to a VPN service. Article is just FUD -- which this conversation could be warranted in some cases, but realistically I've found that it isn't the case. This doesn't mean that their outbound service isn't being logged by a third or unknown party like a government entity (which we know all traffic is logged), but hey it is what it is.

ocdtrekkie 9y ago
They have logs, they just don't keep them very long. (Allegedly.) So in theory, while they might not have logs for a past incident if it's been long enough, they most certainly have logs in very short term and/or can tell who's connected to what at the present time. So while many copyright actors will be too slow to get a hold of said logs, a government actor with significant interest will. The biggest issue for me is that VPN providers have given me no particular reason to trust them. If I already have reasons to distrust large international corporations that say they care about my privacy, why would I go trust one I've never heard of on the Internet that says it cares about my privacy?
- jopsen 9y ago
  Under EU privacy regulations you could probably demand that your VPN provider gives you a copy of all information they have on you, including logs. In the EU I've seen this successfully done with ISPs, ie. customers request logs and get a CD by mail. You'll have to insist and it might involve a small service fee.
  - SaturateDK 9y ago
    I did this and the fee was 200 DKK, and that is around 33 USD.
    - sumedh 9y ago
      So what exactly was in the logs?
      - jopsen 9y ago
        Probably what is required under Danish "law", which would be every 20th TCP session or so... Note: I write "law" because afaik the current logging directives have been found in violation of the European Human Rights declaration, I hear a legal battle is pending: https://ulovliglogning.dk/en/ https://ulovliglogning.dk/en/
- bigiain 9y ago
  To be fair - I'd never rely on a VPN provider to protect me from government actors with significant interest. "YOU’RE STILL GONNA BE MOSSAD’ED UPON" (from https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf ) Whether or not your VPN provider gives you any particular reason to trust them - for some of us, the government has passed laws to require our ISPs to be "untrustworthy".
cgb223 9y ago
Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible
- godelski 9y ago
  A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...
  - kuschku 9y ago
    Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
    - tonyztan 9y ago
      I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
    - reaperducer 9y ago
pasbesoin 9y ago
The way I see it (guessing, not knowing anything specific), the better commercial VPN services -- at least in or ensared into U.S. law -- may not keep logs, in general. But when a three letter agency with relevant authority (being more generous WRT some VPN services, maybe only unavoidable authority), asks for logging for specific users or perhaps some other narrow logging profile, then such logging starts and is made available.
Godel_unicode 9y ago
That's hardly the only concern. What if they have an arrangement to sell your traffic data to ad networks? Inject ads via dns poisoning? Inject Bitcoin mining JavaScript into http? Throttle traffic unless e.g. Netflix pays for bandwidth? VPN just substitutes an unregulated ISP for a somewhat regulated ISP.
- jessaustin 9y ago
  Someone would notice a VPN firm fucking with their only service in those ways (well, maybe not the first way), and then they wouldn't have any more customers. That's the difference between these firms and ISPs: they face actual competition!
  - Godel_unicode 9y ago
    Someone technical enough to notice would notice, I think that’s a small portion of people who are being preyed on by Big Privacy.
emmanuel_1234 9y ago
The VPN I used is based in a country where the US can't come and subpoena / sue people, which is the main protection I can think of. Worst that can happen is their servers being shutdown in countries that can, and it happens on a daily basis. Using a US-based VPN seems like a bad idea either way. Additionally, why would a VPN keep logs at all? With no traces, they have "plausible deniability" that some of their users are doing horrible, horrible things online. This is the main reason I trust my VPN provider to not have logs. IIRC, the only thing they look for is email spam (which is fairly easy to detect with very minimal / time restricted logging), as it spoils their IP addresses too quickly.
- dredmorbius 9y ago
  Debugging and assessing abusive behaviour is far easier with some level of history. That might be a few minutes, hours, or days. Weeks, months, years, not so much.
SmirkingRevenge 9y ago
There is a point to be made in there somewhere, that your VPN needs to be an entity you trust (at least more than the alternatives), if you pay for its services, expecting privacy for the price. A more helpful rant than the OP provided, would be one that informs you of ways to evaluate the trustworthiness of various VPN providers.

by delbel 9y ago

ocdtrekkie 9y ago

They have logs, they just don't keep them very long. (Allegedly.) So in theory, while they might not have logs for a past incident if it's been long enough, they most certainly have logs in very short term and/or can tell who's connected to what at the present time. So while many copyright actors will be too slow to get a hold of said logs, a government actor with significant interest will. The biggest issue for me is that VPN providers have given me no particular reason to trust them. If I already have reasons to distrust large international corporations that say they care about my privacy, why would I go trust one I've never heard of on the Internet that says it cares about my privacy?

jopsen 9y ago
Under EU privacy regulations you could probably demand that your VPN provider gives you a copy of all information they have on you, including logs. In the EU I've seen this successfully done with ISPs, ie. customers request logs and get a CD by mail. You'll have to insist and it might involve a small service fee.
- SaturateDK 9y ago
  I did this and the fee was 200 DKK, and that is around 33 USD.
  - sumedh 9y ago
    So what exactly was in the logs?
    - jopsen 9y ago
      Probably what is required under Danish "law", which would be every 20th TCP session or so... Note: I write "law" because afaik the current logging directives have been found in violation of the European Human Rights declaration, I hear a legal battle is pending: https://ulovliglogning.dk/en/ https://ulovliglogning.dk/en/
bigiain 9y ago
To be fair - I'd never rely on a VPN provider to protect me from government actors with significant interest. "YOU’RE STILL GONNA BE MOSSAD’ED UPON" (from https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf ) Whether or not your VPN provider gives you any particular reason to trust them - for some of us, the government has passed laws to require our ISPs to be "untrustworthy".

cgb223 9y ago

Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible

godelski 9y ago
A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...
- kuschku 9y ago
  Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
  - tonyztan 9y ago
    I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
  - reaperducer 9y ago

pasbesoin 9y ago

The way I see it (guessing, not knowing anything specific), the better commercial VPN services -- at least in or ensared into U.S. law -- may not keep logs, in general. But when a three letter agency with relevant authority (being more generous WRT some VPN services, maybe only unavoidable authority), asks for logging for specific users or perhaps some other narrow logging profile, then such logging starts and is made available.

Godel_unicode 9y ago

That's hardly the only concern. What if they have an arrangement to sell your traffic data to ad networks? Inject ads via dns poisoning? Inject Bitcoin mining JavaScript into http? Throttle traffic unless e.g. Netflix pays for bandwidth? VPN just substitutes an unregulated ISP for a somewhat regulated ISP.

jessaustin 9y ago
Someone would notice a VPN firm fucking with their only service in those ways (well, maybe not the first way), and then they wouldn't have any more customers. That's the difference between these firms and ISPs: they face actual competition!
- Godel_unicode 9y ago
  Someone technical enough to notice would notice, I think that’s a small portion of people who are being preyed on by Big Privacy.

emmanuel_1234 9y ago

The VPN I used is based in a country where the US can't come and subpoena / sue people, which is the main protection I can think of. Worst that can happen is their servers being shutdown in countries that can, and it happens on a daily basis. Using a US-based VPN seems like a bad idea either way. Additionally, why would a VPN keep logs at all? With no traces, they have "plausible deniability" that some of their users are doing horrible, horrible things online. This is the main reason I trust my VPN provider to not have logs. IIRC, the only thing they look for is email spam (which is fairly easy to detect with very minimal / time restricted logging), as it spoils their IP addresses too quickly.

dredmorbius 9y ago
Debugging and assessing abusive behaviour is far easier with some level of history. That might be a few minutes, hours, or days. Weeks, months, years, not so much.

SmirkingRevenge 9y ago

There is a point to be made in there somewhere, that your VPN needs to be an entity you trust (at least more than the alternatives), if you pay for its services, expecting privacy for the price. A more helpful rant than the OP provided, would be one that informs you of ways to evaluate the trustworthiness of various VPN providers.