5 ms·

Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible

by cgb223 9y ago

godelski 9y ago
A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...
- kuschku 9y ago
  Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
  - tonyztan 9y ago
    I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
  - reaperducer 9y ago
    You assume the PDF was created by someone very tech-literate. It's far more likely it was created by some middle-level communications staffer.
    - cookiecaper 9y ago
      Yes, this is more likely than intentional leak of the info and I don't know why you're getting downvoted. Someone who works at your company doesn't understand how PDF works -- that's OK, most people don't need to. It's unlikely that the guys who are busy running the servers are going to be spending their time dragging boxes over documents before they get posted online.
      - kuschku 9y ago
        The whole point of a VPN is that you trust it more than your government or ISP. If your VPN allows any intern to simply post PDFs online that contain such info, without the legal or security department looking over it, you're not trustworthy. What's next? Next time they actually deliver someone's info, and it ends up in a PDF everywhere online, too? Trust is a fragile thing.
        cookiecaper 9y ago
        Well, uh, that's definitely not the point of VPNs when I use them. It's very unlikely that a private VPN provider is more trustworthy than either a decently-sized ISP or a government. VPNs are useful to avoid negative effects of traffic analysis and bad QoS, bad neighbors at a public access point, and give privacy or a different geolocation when accessing specific individual destinations on the web (e.g., an IRC server that would emit your IP into the public log). Generally, VPNs should be used as needed to serve one of these specific purposes, not 24/7. Expecting protection from your government or ISP for $10 / mo is a tad unrealistic.
        kuschku 9y ago
        Interesting. PIAs entirely marketing argues differently, even going as far as the typical 2000s era scare tactics of telling me where my IP is geolocated, and that the government can read my data.
  - godelski 9y ago
    Is anything that is blacked out dangerous or a violation? Could it have been done on purpose? To fulfill legal requirements and prove they aren't hiding anything. Or could it be an accident? If the latter, then there are certainty questions to ask. I'd expect the legal department to have different tech skills than the IT department though. But still questions. I don't know the answer, and really would like an answer if someone does know the correct one.
  - jessaustin 9y ago
    There's nothing confidential in those images. It is a matter of public record that Detective Andrew Perley #660 wanted to know who was routed through 184.75.214.66 on 2013-2-19, and that his interest was communicated to the VPN provider on 2013-4-22. I'm not sure why they went through the rigmarole of pretending to black something out. Maybe they were just fucking with him?
    - kuschku 9y ago
      They sent the blacked out version to the media, and Ars and others published them like that. So why did they black it out? As a childish joke? Also not inspiring trust in them. And if they just blacked it out, without need of doing so, and fucked that up, then the question is if they're trustworthy if their security team doesn't double check their blacked out PDFs. The problem isn't with the content, but with the process.
KSS42 9y ago
PIA seems to have gone through this: https://arstechnica.com/tech-policy/2013/10/how-one-small-american-vpn-company-is-trying-to-stand-up-for-privacy/ https://arstechnica.com/tech-policy/2013/10/how-one-small-am...
giobox 9y ago
To some extent it will be more credible, but the usual "Past Behavior is No Guarantee of Future Performance" type caveats are going to apply regardless. I know I certainly don't have the time, inclination, or frankly the expertise, to keep abreast of the internal developments in a VPN provider's business, which will likely be private anyway, as well as the evolving legal/regulatory framework wherever they operate. Similarly, policies regarding logs or data retention can evolve over time, one of course has to trust that any retention policy disclosed in public is actually adhered to in private. If you really are someone who has to give serious consideration to the risk of logs being pulled, I'm not sure any commercial third party provider is a "safe" option.
zipwitch 9y ago
While not exactly what you're looking for, Torrentfreak does an annual review of VPNs. Here's last year's : https://torrentfreak.com/vpn-services-anonymous-review-2017-170304/ https://torrentfreak.com/vpn-services-anonymous-review-2017-...

Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible

by cgb223 9y ago

Can you give us some known examples of VPN Providers that were sued and didn't give logs? I'd imagine a list of those ones would be considered more credible

godelski 9y ago

A quick google shows a few. I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario. There's also a list [2] (little old) I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition/ https://torrentfreak.com/vpn-services-that-take-your-anonymi...

kuschku 9y ago
Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF. So you can open it up in Acrobat, and see everything below. Are you going to trust a VPN provider that can’t even black out text in a PDF? For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png https://i.imgur.com/1a9YD0f.png
- tonyztan 9y ago
  I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?
- reaperducer 9y ago
  You assume the PDF was created by someone very tech-literate. It's far more likely it was created by some middle-level communications staffer.
  - cookiecaper 9y ago
    Yes, this is more likely than intentional leak of the info and I don't know why you're getting downvoted. Someone who works at your company doesn't understand how PDF works -- that's OK, most people don't need to. It's unlikely that the guys who are busy running the servers are going to be spending their time dragging boxes over documents before they get posted online.
    - kuschku 9y ago
      The whole point of a VPN is that you trust it more than your government or ISP. If your VPN allows any intern to simply post PDFs online that contain such info, without the legal or security department looking over it, you're not trustworthy. What's next? Next time they actually deliver someone's info, and it ends up in a PDF everywhere online, too? Trust is a fragile thing.
      - cookiecaper 9y ago
        Well, uh, that's definitely not the point of VPNs when I use them. It's very unlikely that a private VPN provider is more trustworthy than either a decently-sized ISP or a government. VPNs are useful to avoid negative effects of traffic analysis and bad QoS, bad neighbors at a public access point, and give privacy or a different geolocation when accessing specific individual destinations on the web (e.g., an IRC server that would emit your IP into the public log). Generally, VPNs should be used as needed to serve one of these specific purposes, not 24/7. Expecting protection from your government or ISP for $10 / mo is a tad unrealistic.
        kuschku 9y ago
        Interesting. PIAs entirely marketing argues differently, even going as far as the typical 2000s era scare tactics of telling me where my IP is geolocated, and that the government can read my data.
- godelski 9y ago
  Is anything that is blacked out dangerous or a violation? Could it have been done on purpose? To fulfill legal requirements and prove they aren't hiding anything. Or could it be an accident? If the latter, then there are certainty questions to ask. I'd expect the legal department to have different tech skills than the IT department though. But still questions. I don't know the answer, and really would like an answer if someone does know the correct one.
- jessaustin 9y ago
  There's nothing confidential in those images. It is a matter of public record that Detective Andrew Perley #660 wanted to know who was routed through 184.75.214.66 on 2013-2-19, and that his interest was communicated to the VPN provider on 2013-4-22. I'm not sure why they went through the rigmarole of pretending to black something out. Maybe they were just fucking with him?
  - kuschku 9y ago
    They sent the blacked out version to the media, and Ars and others published them like that. So why did they black it out? As a childish joke? Also not inspiring trust in them. And if they just blacked it out, without need of doing so, and fucked that up, then the question is if they're trustworthy if their security team doesn't double check their blacked out PDFs. The problem isn't with the content, but with the process.

KSS42 9y ago

PIA seems to have gone through this: https://arstechnica.com/tech-policy/2013/10/how-one-small-american-vpn-company-is-trying-to-stand-up-for-privacy/ https://arstechnica.com/tech-policy/2013/10/how-one-small-am...

giobox 9y ago

To some extent it will be more credible, but the usual "Past Behavior is No Guarantee of Future Performance" type caveats are going to apply regardless. I know I certainly don't have the time, inclination, or frankly the expertise, to keep abreast of the internal developments in a VPN provider's business, which will likely be private anyway, as well as the evolving legal/regulatory framework wherever they operate. Similarly, policies regarding logs or data retention can evolve over time, one of course has to trust that any retention policy disclosed in public is actually adhered to in private. If you really are someone who has to give serious consideration to the risk of logs being pulled, I'm not sure any commercial third party provider is a "safe" option.

zipwitch 9y ago

While not exactly what you're looking for, Torrentfreak does an annual review of VPNs. Here's last year's : https://torrentfreak.com/vpn-services-anonymous-review-2017-170304/ https://torrentfreak.com/vpn-services-anonymous-review-2017-...