3 ms·

I know PIA likes to talk a big game here but I didn't see anything in your link that would instill overwhelming confidence in their marketing claims. Specifical

I know PIA likes to talk a big game here but I didn't see anything in your link that would instill overwhelming confidence in their marketing claims. Specifically: If you click on the Almanac News source in your link, it states: >"John Allan Arsenault, general counsel for London Trust Media, a VPN company, testified about how many VPN companies, including his, intentionally don’t retain logs of internet activity of their clients so that they cannot be produced in response to subpoenas from law enforcement or others." Note it doesn't say they don't log only that they don't retain them. So it's quite possible that the subpoena process simply lagged behind the log retention window. Also the claim in only for "internet activity" and nowhere do we see that defined. Does that include client authentication? Then article then goes on to state: >"Arsenault said he could not find any record of Ross Colby subscribing to the VPN service when he searched using Ross Colby’s two known email addresses, which he received from law enforcement." Could not find is not the same thing as there was nothing to search.

shalomhomes 8y ago
It's all marketing claims when all is said and done. PIA is still the only VPN company that has proven its no log policy not once but twice. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
- bogomipz 8y ago
  I'm not sure why you are providing that second link as proof that they don't log. That is just a link to the same story being discussed here and the same one I am quoting in my comment. Also the first link continues its insistence on using the phrase "user activity" logging. That's a rather nebulous term. Nowhere is "user activity" defined and it's certainly not a term that meaning in the context of syslog/journald. Does "user activity" logging preclude RADIUS authentication?
rasengan 8y ago
Interesting analysis, but it's wrong. We don't log, period. By stating that we don't retain logs, it means that we don't EVER retain them, not even for 0.001ms. Hope this helps.
- bogomipz 8y ago
  And nobody has any way of knowing if this is actually true do they? There is no independent third-party verification of your assertions is there? So why not commission such an audit then. Why not make actual verification your distinguishing characteristic then? I am also very curious how support and operations troubleshoot client issues in the absence of any logging.
  - Karunamon 8y ago
    An audit only proves the claims were valid at the time the auditor was present. I see them as the health inspections at the local greasy spoon.
    - bogomipz 8y ago
      No, health inspections are instaneous spots checks. Audits are far more extensive and look at historicals. This is how nearly all audits work - financial audits, tax audits, compliance audits etc. They are not the same at all. Furthermore an independent audit is still far more credible than believing something is true simply "because the CEO said so."

shalomhomes 8y ago

It's all marketing claims when all is said and done. PIA is still the only VPN company that has proven its no log policy not once but twice. [1] https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ https://torrentfreak.com/vpn-providers-no-logging-claims-tes... [2] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...

bogomipz 8y ago
I'm not sure why you are providing that second link as proof that they don't log. That is just a link to the same story being discussed here and the same one I am quoting in my comment. Also the first link continues its insistence on using the phrase "user activity" logging. That's a rather nebulous term. Nowhere is "user activity" defined and it's certainly not a term that meaning in the context of syslog/journald. Does "user activity" logging preclude RADIUS authentication?

rasengan 8y ago

Interesting analysis, but it's wrong. We don't log, period. By stating that we don't retain logs, it means that we don't EVER retain them, not even for 0.001ms. Hope this helps.

bogomipz 8y ago
And nobody has any way of knowing if this is actually true do they? There is no independent third-party verification of your assertions is there? So why not commission such an audit then. Why not make actual verification your distinguishing characteristic then? I am also very curious how support and operations troubleshoot client issues in the absence of any logging.
- Karunamon 8y ago
  An audit only proves the claims were valid at the time the auditor was present. I see them as the health inspections at the local greasy spoon.
  - bogomipz 8y ago
    No, health inspections are instaneous spots checks. Audits are far more extensive and look at historicals. This is how nearly all audits work - financial audits, tax audits, compliance audits etc. They are not the same at all. Furthermore an independent audit is still far more credible than believing something is true simply "because the CEO said so."