3 ms·

I'm always curious at how these VPN providers aren't being hit with false advertising. They claim to keep basically no data about you. "You are Invisible – Eve

I'm always curious at how these VPN providers aren't being hit with false advertising. They claim to keep basically no data about you. "You are Invisible – Even We Cannot See What You Do Online We DO NOT keep any record of your browsing activities, connection logs, records of the VPN IPs assigned to you, your original IPs, your connection time, the history of your browsing, the sites you visited, your outgoing traffic, the content or data you accessed, or the DNS queries generated by you." [0] [0] https://www.purevpn.com/privacy-policy.php https://www.purevpn.com/privacy-policy.php

crankylinuxuser 8y ago
Them not keeping a record may be true... But the rsyslog was delivering the logs to *.fbi.gov And not retaining logs would still be correct. They said nothing about transporting them to the relevant feds.
- rayvy 8y ago
  Ahhh. They aren't keeping the logs, they're merely forwarding the logs to another "non-associated entity" (giving them legal cover), and storing the logs there. Makes sense. They can advertise "we don't keep logs" (we meaning the corporate entity itself) so they have legal cover, and they make the three letter agencies happy (and thus are allowed to continue to operate)
  - crankylinuxuser 8y ago
    Indeed. And those tools to do such an analysis already exist. Its the formerly NSA tool called "Apache NiFi". It even has a syslog server plugin specifically for this purpose (it's built in already; drag, drop, configure, done): https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-standard-nar/1.5.0/org.apache.nifi.processors.standard.ListenSyslog/ https://nifi.apache.org/docs/nifi-docs/components/org.apache... Link/proof asserting Apache NiFi is one of the NSA data analytics tools: https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa-nifi-big-data-automation-project-out-in-the-open/#1377a1e555d6 https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa...
    - willstrafach 8y ago
      Proof also can be found here: https://code.nsa.gov https://code.nsa.gov
- mrsteveman1 8y ago
  And there's still real value in that, even if they work with law enforcement. If you actually need a VPN, the last thing you want is for the service to create an opportunity, which wouldn't otherwise exist, for a malicious 3rd party to quietly obtain existing records of DNS queries, connections, and other traffic data. By not storing the data in advance, the risk is reduced. A malicious actor would have to compromise the servers and either use one as a network tap to send the traffic somewhere else, or enable logging or other analytics locally. Both are more likely to be detected than a one-time access or leak of data that was already stored.
elliekelly 8y ago
Their privacy policy looked very different at the time Lin was allegedly using it: > We Do Not monitor user activity nor do we keep any logs. We therefore have no record of your activities such as which software you used, which websites you visited, what content you downloaded, which apps you used, etc. after you connected to any of our servers. Our servers automatically record the time at which you connect to any of our servers. From here on forward, we do not keep any records of anything that could associate any specific activity to a specific user. The time when a successful connection is made with our servers is counted as a “connection” and the total bandwidth used during this connection is called “bandwidth”. Connection and bandwidth are kept in record to maintain the quality of our service. This helps us understand the flow of traffic to specific servers so we could optimize them better. They appear to have made the policy (and presumably connection logging) change in June 2018. For reference, Lin pleaded guilty to charges related to the criminal complaint posted by OP in April 2018. I would imagine PureVPN's lawyers had advised them to wait until the case had ended before enacting the new policy. Source: https://web.archive.org/web/20170128142453/https://www.purevpn.com/privacy-policy.php https://web.archive.org/web/20170128142453/https://www.purev...

crankylinuxuser 8y ago

Them not keeping a record may be true... But the rsyslog was delivering the logs to *.fbi.gov And not retaining logs would still be correct. They said nothing about transporting them to the relevant feds.

rayvy 8y ago
Ahhh. They aren't keeping the logs, they're merely forwarding the logs to another "non-associated entity" (giving them legal cover), and storing the logs there. Makes sense. They can advertise "we don't keep logs" (we meaning the corporate entity itself) so they have legal cover, and they make the three letter agencies happy (and thus are allowed to continue to operate)
- crankylinuxuser 8y ago
  Indeed. And those tools to do such an analysis already exist. Its the formerly NSA tool called "Apache NiFi". It even has a syslog server plugin specifically for this purpose (it's built in already; drag, drop, configure, done): https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-standard-nar/1.5.0/org.apache.nifi.processors.standard.ListenSyslog/ https://nifi.apache.org/docs/nifi-docs/components/org.apache... Link/proof asserting Apache NiFi is one of the NSA data analytics tools: https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa-nifi-big-data-automation-project-out-in-the-open/#1377a1e555d6 https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa...
  - willstrafach 8y ago
    Proof also can be found here: https://code.nsa.gov https://code.nsa.gov
mrsteveman1 8y ago
And there's still real value in that, even if they work with law enforcement. If you actually need a VPN, the last thing you want is for the service to create an opportunity, which wouldn't otherwise exist, for a malicious 3rd party to quietly obtain existing records of DNS queries, connections, and other traffic data. By not storing the data in advance, the risk is reduced. A malicious actor would have to compromise the servers and either use one as a network tap to send the traffic somewhere else, or enable logging or other analytics locally. Both are more likely to be detected than a one-time access or leak of data that was already stored.

elliekelly 8y ago

Their privacy policy looked very different at the time Lin was allegedly using it: > We Do Not monitor user activity nor do we keep any logs. We therefore have no record of your activities such as which software you used, which websites you visited, what content you downloaded, which apps you used, etc. after you connected to any of our servers. Our servers automatically record the time at which you connect to any of our servers. From here on forward, we do not keep any records of anything that could associate any specific activity to a specific user. The time when a successful connection is made with our servers is counted as a “connection” and the total bandwidth used during this connection is called “bandwidth”. Connection and bandwidth are kept in record to maintain the quality of our service. This helps us understand the flow of traffic to specific servers so we could optimize them better. They appear to have made the policy (and presumably connection logging) change in June 2018. For reference, Lin pleaded guilty to charges related to the criminal complaint posted by OP in April 2018. I would imagine PureVPN's lawyers had advised them to wait until the case had ended before enacting the new policy. Source: https://web.archive.org/web/20170128142453/https://www.purevpn.com/privacy-policy.php https://web.archive.org/web/20170128142453/https://www.purev...