4 ms·
> “Although [OVPN] strive to store as little data as possible, there must be data connecting users and identities to make the VPN service work. In this case, a
by capableweb 6y ago
> “Although [OVPN] strive to store as little data as possible, there must be data connecting users and identities to make the VPN service work. In this case, a user has paid for a VPN account with the ability to connect a public static address to OVPN which the user has then chosen to link to the file sharing site ‘the piratebay’, i.e the user has configured his VPN account to point to the given domain.”
The article doesn't seem to go into why a VPN service _must_ have data connecting users and identities. AFAIK, Mullvad allows you to be completely anonymous with your purchase, granted they throw away the IP who made the purchase, which doesn't seem impossible to do. Simply store no data about the transactions and you have no data about it. Not sure I see the reason there has to be data about it.
- ubercow13 6y agoI think the article covers that. They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere. They are hoping that knowing this secret IP will let them find their true hosting provider.
- javajosh 6y agoThat's true - even if it's in memory somewhere the record exists, and is readable.
- capableweb 6y agoNot entirely sure what I'm talking about now, but couldn't you in theory implement this in Intel SGX and therefore be unable to read it unless from code running inside the enclave itself?
- saagarjha 6y agoPossibly, if SGX actually worked.
- cesarb 6y ago> They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere. Not necessarily. The stored mapping could also be public IP -> username, plus a separate mapping username -> password or username -> key; with a mapping public IP -> TCP connection or public IP -> UDP connection existing only in memory and only while the connection is active. And from what I understood from the article, and from an earlier article linked to by the first link in this article, the connection has last been active in June.
- wizzwizz4 6y agoSure, that works for outgoing connections. Incoming, though? Not so much; it has to know where to send the data.
- mac01021 6y agoIf you pay with a credit card, then they at least need to keep track of which account to deactivate when the card stops paying.
- capableweb 6y agoDepends on the implementation. Not sure exactly how OVPN works, but with Mullvad it works by top-up the account, so no need to keep track of CC <> Account number. When the account runs out, the VPN simply stops working until you refill.
- jacobush 6y agoMullvad at least used to take cash by mail, too. Pretty tough to correlate that.
- jeltz 6y agoOVPN also takes cash by mail.
- wyclif 6y agoAny thoughts on OVPN vs. Mullvad in terms of your preference for using one instead of the other?
- capableweb 6y agoMy personal reasons: been using Mullvad for a couple of years. Team and company based in Sweden, country known for it's strong privacy laws (FRA non-with-standing). One of the first VPN companies to launch Wireguard support with tons of their edge servers supporting it. Anonymous payments and finally super easy to use, even for non technical users.
- wyclif 6y agoBut...OVPN is also based in Sweden: https://www.ovpn.com/en/about https://www.ovpn.com/en/about
- blindm 6y ago> AFAIK, Mullvad allows you to be completely anonymous with your purchase I paid for Mullvad with Paypal and they used my Paypal email as the login email! Strange that they done that. Never assume a Paypal email is the one a user will use for the login. I like to compartment my emails for different things, so one dedicated to Paypal, another specifically for Mullvad etc
- capableweb 6y ago> they used my Paypal email as the login email Login email? There is no such thing in Mullvad. All you have is a Account Number, and there should be no identifiers beyond that. Where do you even find any inputs to enter your email?
- blindm 6y agoSorry I meant they sent some link to login at the email I use for Paypal. They probably have some new system. I done that about 2 years ago to try them out
- UncleEntity 6y agoSo they sent you login information to the email address you gave them to send you login information?
- blindm 6y agoYeah. They had instructions there to create my account using a unique identifier.
- SahAssar 6y ago> I paid for Mullvad with Paypal Well, there's your problem. If you want to be anonymous don't use payment methods that aren't. > they used my Paypal email as the login email! Mullvad has no login email at all. You seem to be mistaken.