5 ms·

I've always loved that Mullvad wouldn't let you accidentally compromise your own security. For example, the port-forwarding feature won't work if you have a re

by mig39 4y ago

I've always loved that Mullvad wouldn't let you accidentally compromise your own security. For example, the port-forwarding feature won't work if you have a recurring subscription. This just extends that kind of thinking to the service in general. Been a Mullvad customer for a long time now, and it's always been awesome.

Cyph0n 4y ago
> For example, the port-forwarding feature won't work if you have a recurring subscription. Yep, I had to cancel my subscription recently to get port forwarding working. I've been a customer for a few years now and trusted that they were doing this because it made sense from a privacy standpoint.
contravariant 4y ago
What's the exact reasoning behind that? How does paying via paypall impact the privacy of a forwarded port? Is this something to do with state-level actors?
- capableweb 4y ago
  Presumably there are details linking together payments coming from Paypal and the account number. And obviously there is a link between account number and forwarded port. So following with that, you'd be able to make the connection between the account number and Paypal account, which is definitely not private nor even pretending to protect your privacy.
  - contravariant 4y ago
    Maybe but doesn't all of that apply equally to just about any payment method other than sending them cash anonymously?
    - shrimpx 4y ago
      I think in the case of a one-time payment there’s a record that you paid Mullvad, but there’s no link to an account number.
    - bigiain 4y ago
      For a single payment, they can throw away all the metadata once the funds hit their bank account. They _can't_ do that with recurring subscriptions, since they need something that links to your CC or PayPal details to re-bill it next month/year. They've chosen to not do that any more, possibly as performative privacy, also possibly as having real privacy concerns for their clients, and also also possibly so they can tell law enforcement and courts to stop bothering them when needed. (realistically, it'll be some combination of those three things, and possibly others I've not thought of, that triggered them into this)
      - chii 4y ago
        but then as a bad actor, you could reverse the credit card charge, and then the company would not be able to tell which customer reversed the charge!
    - rtpg 4y ago
      I think the idea is that money reaches the company, the company then increments how much time you have left on the account, then deletes records linking payment to the account Like you show up and give me $5, tell me it’s for account XYZ, I go into my admin console and increment the remaining usage time, but don’t write that you were the one giving me $5 There’s a window of time where the link exists of course! But you can get rid of it. (I Hope that they are not storing things like an account start date or too many payment records… it could easily be deanonymized through time stamp correlation and the banks/stripe/PayPal have the data)
    - NickRandom 4y ago
      As far as I am aware, Mulvad only holds on to the payment details for a few weeks and then deletes it so the idea is that you 'age' the account for that time period and then can Torrent Linux ISO's on the forwarded port to your hearts content with any payment information long since deleted. I don't currently use them but am considering switching to them for this reason.
    - alwayslikethis 4y ago
      Monero is a (practically) untraceable [1] cryptocurrency. I figured that I didn't really need the VPN, but when the news came out that they added support for Monero earlier this year, I decided to support them by giving them another 4.5 EUR deposit in Monero. 1. https://www.getmonero.org/ https://www.getmonero.org/
- rebelpixel 4y ago
  I normally don't use VPNs, so please correct me if I am wrong. I think from a law enforcement/accountability standpoint, if an "actor" is accused of wrongdoing while using Mullvad's port forwarding service, Mullvad might have some evidence linking the "actor" to an actual identity, since they have the payment information. Depending on the laws of whatever territories, Mullvad may be compelled to leak that info to a judge. Without that information, then there's no information they can ever be forced to leak.

by mig39 4y ago

Cyph0n 4y ago

> For example, the port-forwarding feature won't work if you have a recurring subscription. Yep, I had to cancel my subscription recently to get port forwarding working. I've been a customer for a few years now and trusted that they were doing this because it made sense from a privacy standpoint.

contravariant 4y ago

What's the exact reasoning behind that? How does paying via paypall impact the privacy of a forwarded port? Is this something to do with state-level actors?

capableweb 4y ago
Presumably there are details linking together payments coming from Paypal and the account number. And obviously there is a link between account number and forwarded port. So following with that, you'd be able to make the connection between the account number and Paypal account, which is definitely not private nor even pretending to protect your privacy.
- contravariant 4y ago
  Maybe but doesn't all of that apply equally to just about any payment method other than sending them cash anonymously?
  - shrimpx 4y ago
    I think in the case of a one-time payment there’s a record that you paid Mullvad, but there’s no link to an account number.
  - bigiain 4y ago
    For a single payment, they can throw away all the metadata once the funds hit their bank account. They _can't_ do that with recurring subscriptions, since they need something that links to your CC or PayPal details to re-bill it next month/year. They've chosen to not do that any more, possibly as performative privacy, also possibly as having real privacy concerns for their clients, and also also possibly so they can tell law enforcement and courts to stop bothering them when needed. (realistically, it'll be some combination of those three things, and possibly others I've not thought of, that triggered them into this)
    - chii 4y ago
      but then as a bad actor, you could reverse the credit card charge, and then the company would not be able to tell which customer reversed the charge!
  - rtpg 4y ago
    I think the idea is that money reaches the company, the company then increments how much time you have left on the account, then deletes records linking payment to the account Like you show up and give me $5, tell me it’s for account XYZ, I go into my admin console and increment the remaining usage time, but don’t write that you were the one giving me $5 There’s a window of time where the link exists of course! But you can get rid of it. (I Hope that they are not storing things like an account start date or too many payment records… it could easily be deanonymized through time stamp correlation and the banks/stripe/PayPal have the data)
  - NickRandom 4y ago
    As far as I am aware, Mulvad only holds on to the payment details for a few weeks and then deletes it so the idea is that you 'age' the account for that time period and then can Torrent Linux ISO's on the forwarded port to your hearts content with any payment information long since deleted. I don't currently use them but am considering switching to them for this reason.
  - alwayslikethis 4y ago
    Monero is a (practically) untraceable [1] cryptocurrency. I figured that I didn't really need the VPN, but when the news came out that they added support for Monero earlier this year, I decided to support them by giving them another 4.5 EUR deposit in Monero. 1. https://www.getmonero.org/ https://www.getmonero.org/
rebelpixel 4y ago
I normally don't use VPNs, so please correct me if I am wrong. I think from a law enforcement/accountability standpoint, if an "actor" is accused of wrongdoing while using Mullvad's port forwarding service, Mullvad might have some evidence linking the "actor" to an actual identity, since they have the payment information. Depending on the laws of whatever territories, Mullvad may be compelled to leak that info to a judge. Without that information, then there's no information they can ever be forced to leak.