7 ms·

Sure, nothing has changed yet. That's how it goes with acquisitions. But people (including myself) are more concerned about the future. At some point in the fut

Sure, nothing has changed yet. That's how it goes with acquisitions. But people (including myself) are more concerned about the future. At some point in the future there will pressure from within Kape to increase revenues. And at that point I don't want my browsing data to be sold to advertisers and marketing agencies.

rasengan 7y ago
The merger agreement includes a written guarantee to never log. I don't think there is any other VPN that has that, and I _know_ that many other VPNs will not sign that with us.
- liability 7y ago
  The idea of suing a shell corp of an intelligence agency for breach of contract seems laughable. Maybe they aren't that, but why should anybody without personal knowledge of the situation trust that they aren't? This is the sort of scenario where 'better safe than sorry' overrules giving the benifit of the doubt.
  - rasengan 7y ago
    That is a great question - all of our information is public whereas most other VPN companies go out of their way to hide where they are located and who they are. Verification and transparency are more important than trust.
    - icebraining 7y ago
      How can users verify that PIA doesn't log?
      - w0uld 7y ago
        You can only infer that as the result of court case demanding logs. And even then, it would have to be born out of the discovery process that PIA was truthful, in my opinion. Yet that only gives you comfort that they hadn't maintained logs up to that point. You have no guarantees from that point forward, which is what we're all concerned about. We aren't concerned about PIA's past operations, but rather what this new partnership means for their future behavior. I realize your question is most likely rhetorical, but I felt the need to articulate my concerns.
        dd36 7y ago
        Or they claim no logs in court cases while making them anyways. Thereby creating cover.
        nickpsecurity 7y ago
        "You can only infer that as the result of court case demanding logs. " You can't be sure. In the Lavabit case, Lavabit argued giving up the key protecting all their users... compromising them to the FBI... would cost them customers due to damaged reputation and privacy. The FBI argued they could do it without telling them. Then, Lavabit would still look private with no financial harm. The judge agreed. That proposal and the judge agreeing changed how I looked at a lot of companies' claims about law enforcement. I already assumed this would happen with Patriot Act requests by FBI/NSA partnership given they'd be hit with secrecy orders. I didn't see a judge straight up telling a privacy company to defraud all of its customers. I figured the order would be more narrow than that. Now, I have a blanket recommendation to avoid U.S. for privacy tech over both secret government (Patriot Act stuff) and regular, court system.
        w0uld 7y ago
        While I agree with you, I think there's some nuance. In the Lavabit case, the FBI was investigating a national security threat whereas the PIA case involved the hacking of local social media sites. I can see a judge not wanting to rule against the FBI in a case of national security whereas I think a judge would be hesitant to do the same in the case of a misdemeanor offense. Then again, I'm continually surprised by the U.S. government in the "war against terror" era.
        jammygit 7y ago
        Snowden was not a national security threat, he was a government embarrassment threat. It’s not okay to conflate the two
        w0uld 7y ago
        I'm not conflating anything nor am I making a judgement on the FBI's motives. The FBI issued a national security letter that Lavabit fought in court, which I feel Lavabit should have won. The point you missed is the FBI and the judge put a bit more weight towards forcing Lavabit's hand than it did in PIA's case because of the scope and severity of the offenses, perceived or otherwise.
- ampersandy 7y ago
  Er, why isn't this prominently mentioned in the blog post? https://www.privateinternetaccess.com/blog/2019/11/bellum-omnium-contra-omnes-the-war-of-all-against-all/ https://www.privateinternetaccess.com/blog/2019/11/bellum-om... I didn't lose trust in PIA because of Kape, I lost it because your blog post was poorly written and inadequately communicated some very important news. You bury mentions of a merger in the 7th paragraph, wtf? I can't trust PIA if you can't be trusted to clearly communicate such important information.
  - lithogen 7y ago
    I'm getting a "This Connection is Not Private" page when I try to access the website. Andrew please look into this if you see my comment.
- mirimir 7y ago
  Did you ask AirVPN and IVPN? https://airvpn.org/faq/logs/ https://airvpn.org/faq/logs/ https://airvpn.org/forums/topic/891-important-notice-about-security/?tab=comments#comment-891 https://airvpn.org/forums/topic/891-important-notice-about-s... https://www.ivpn.net/privacy https://www.ivpn.net/privacy
  - MertsA 7y ago
    Don't forget Mullvad. https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
    - mirimir 7y ago
      Thanks, sorry.
- probably_wrong 7y ago
  Serious question: what happens if they decide to start logging anyway? For context: Facebook told the EU Commission they wouldn't link Facebook and WhatsApp accounts. Then they did it anyway. Sure, they got fined for it, but it's hard to believe that the fine was not factored in from the beginning. So if they break that part of the agreement with PIA, then what? Is the merger canceled?
- _emacsomancer_ 7y ago
  Yet the only seeming relevant principle of the 'Kape principles' is: > 3. Zero Data – sanctity of personal data – we believe each individual owns his own data therefore we will never store or attempt to sell what does not belong to us. Which is vague in the extreme. It does not clarify what 'personal data' means. Is my internet activity when using PIA/Kape's network still my own? Or does Kape now make a claim on this data? If there is really a 'never log' guarantee, why is this not prominently displayed in the discussion of the merger?

rasengan 7y ago

The merger agreement includes a written guarantee to never log. I don't think there is any other VPN that has that, and I _know_ that many other VPNs will not sign that with us.

liability 7y ago
The idea of suing a shell corp of an intelligence agency for breach of contract seems laughable. Maybe they aren't that, but why should anybody without personal knowledge of the situation trust that they aren't? This is the sort of scenario where 'better safe than sorry' overrules giving the benifit of the doubt.
- rasengan 7y ago
  That is a great question - all of our information is public whereas most other VPN companies go out of their way to hide where they are located and who they are. Verification and transparency are more important than trust.
  - icebraining 7y ago
    How can users verify that PIA doesn't log?
    - w0uld 7y ago
      You can only infer that as the result of court case demanding logs. And even then, it would have to be born out of the discovery process that PIA was truthful, in my opinion. Yet that only gives you comfort that they hadn't maintained logs up to that point. You have no guarantees from that point forward, which is what we're all concerned about. We aren't concerned about PIA's past operations, but rather what this new partnership means for their future behavior. I realize your question is most likely rhetorical, but I felt the need to articulate my concerns.
      - dd36 7y ago
        Or they claim no logs in court cases while making them anyways. Thereby creating cover.
      - nickpsecurity 7y ago
        "You can only infer that as the result of court case demanding logs. " You can't be sure. In the Lavabit case, Lavabit argued giving up the key protecting all their users... compromising them to the FBI... would cost them customers due to damaged reputation and privacy. The FBI argued they could do it without telling them. Then, Lavabit would still look private with no financial harm. The judge agreed. That proposal and the judge agreeing changed how I looked at a lot of companies' claims about law enforcement. I already assumed this would happen with Patriot Act requests by FBI/NSA partnership given they'd be hit with secrecy orders. I didn't see a judge straight up telling a privacy company to defraud all of its customers. I figured the order would be more narrow than that. Now, I have a blanket recommendation to avoid U.S. for privacy tech over both secret government (Patriot Act stuff) and regular, court system.
        w0uld 7y ago
        While I agree with you, I think there's some nuance. In the Lavabit case, the FBI was investigating a national security threat whereas the PIA case involved the hacking of local social media sites. I can see a judge not wanting to rule against the FBI in a case of national security whereas I think a judge would be hesitant to do the same in the case of a misdemeanor offense. Then again, I'm continually surprised by the U.S. government in the "war against terror" era.
        jammygit 7y ago
        Snowden was not a national security threat, he was a government embarrassment threat. It’s not okay to conflate the two
        w0uld 7y ago
        I'm not conflating anything nor am I making a judgement on the FBI's motives. The FBI issued a national security letter that Lavabit fought in court, which I feel Lavabit should have won. The point you missed is the FBI and the judge put a bit more weight towards forcing Lavabit's hand than it did in PIA's case because of the scope and severity of the offenses, perceived or otherwise.
ampersandy 7y ago
Er, why isn't this prominently mentioned in the blog post? https://www.privateinternetaccess.com/blog/2019/11/bellum-omnium-contra-omnes-the-war-of-all-against-all/ https://www.privateinternetaccess.com/blog/2019/11/bellum-om... I didn't lose trust in PIA because of Kape, I lost it because your blog post was poorly written and inadequately communicated some very important news. You bury mentions of a merger in the 7th paragraph, wtf? I can't trust PIA if you can't be trusted to clearly communicate such important information.
- lithogen 7y ago
  I'm getting a "This Connection is Not Private" page when I try to access the website. Andrew please look into this if you see my comment.
mirimir 7y ago
Did you ask AirVPN and IVPN? https://airvpn.org/faq/logs/ https://airvpn.org/faq/logs/ https://airvpn.org/forums/topic/891-important-notice-about-security/?tab=comments#comment-891 https://airvpn.org/forums/topic/891-important-notice-about-s... https://www.ivpn.net/privacy https://www.ivpn.net/privacy
- MertsA 7y ago
  Don't forget Mullvad. https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
  - mirimir 7y ago
    Thanks, sorry.
probably_wrong 7y ago
Serious question: what happens if they decide to start logging anyway? For context: Facebook told the EU Commission they wouldn't link Facebook and WhatsApp accounts. Then they did it anyway. Sure, they got fined for it, but it's hard to believe that the fine was not factored in from the beginning. So if they break that part of the agreement with PIA, then what? Is the merger canceled?
_emacsomancer_ 7y ago
Yet the only seeming relevant principle of the 'Kape principles' is: > 3. Zero Data – sanctity of personal data – we believe each individual owns his own data therefore we will never store or attempt to sell what does not belong to us. Which is vague in the extreme. It does not clarify what 'personal data' means. Is my internet activity when using PIA/Kape's network still my own? Or does Kape now make a claim on this data? If there is really a 'never log' guarantee, why is this not prominently displayed in the discussion of the merger?