4 ms·

>The design of the activation code removes the possibility for third parties to link a payment to a Mullvad account, for privacy. Considering that a primary us

>The design of the activation code removes the possibility for third parties to link a payment to a Mullvad account, for privacy. Considering that a primary use-case for a VPN is as one of the tools to help shield your data from the rampant data thieves, of which Amazon is a particularly powerful adversary, I would need a much clearer explanation of how this is a privacy enhancer. Mullvad having a business relationship with Amazon is inherently troubling.

cycomanic 4y ago
Mullvad has been selling these cards at various retailers, one of them webhallen which is both an online and physical store in the nordics. However, many/most people in the US get a large fraction of their purchases through amazon. So to sell to people in the US they need some way of doing it. The important bit is that the actual account code is hidden behind on of those scratch panels. So amazon does not know your Mullvad account. Now an adversary with enough geographic information about who connected and access to all of amazon's data could possibly correlate purchases with connections. 10 years ago I would have considered that infeasible, after Snowden I'm not so sure. If you live in a big city it is like still no issue, but if you are in some small town with a population of 1000 things might still be traced back to you. Still it's likely significantly superior than pretty much any other method including using crypto. If you are a possible target of a state actor you hopefully are thinking about this already.
gorbypark 4y ago
I think the idea is that what you are getting from Amazon is a card with a code on it. Amazon doesn't know which code it's sending you, you just get one at random. Mullvad likewise doesn't know which code Amazon sold you. So you get your card, enter the code into Mullvad, and none of that information is trackable to you. Amazon would know you bought a Mullvad card but would have zero way to link you to a specific code. Mullvad might know the code was purchased from Amazon, but not who was the purchaser. Worst case scenario is that Amazon rats you out to the police/CIA/NSA/etc and now you are on a list of people that purchased Mullvad VPN services.

cycomanic 4y ago

Mullvad has been selling these cards at various retailers, one of them webhallen which is both an online and physical store in the nordics. However, many/most people in the US get a large fraction of their purchases through amazon. So to sell to people in the US they need some way of doing it. The important bit is that the actual account code is hidden behind on of those scratch panels. So amazon does not know your Mullvad account. Now an adversary with enough geographic information about who connected and access to all of amazon's data could possibly correlate purchases with connections. 10 years ago I would have considered that infeasible, after Snowden I'm not so sure. If you live in a big city it is like still no issue, but if you are in some small town with a population of 1000 things might still be traced back to you. Still it's likely significantly superior than pretty much any other method including using crypto. If you are a possible target of a state actor you hopefully are thinking about this already.

gorbypark 4y ago

I think the idea is that what you are getting from Amazon is a card with a code on it. Amazon doesn't know which code it's sending you, you just get one at random. Mullvad likewise doesn't know which code Amazon sold you. So you get your card, enter the code into Mullvad, and none of that information is trackable to you. Amazon would know you bought a Mullvad card but would have zero way to link you to a specific code. Mullvad might know the code was purchased from Amazon, but not who was the purchaser. Worst case scenario is that Amazon rats you out to the police/CIA/NSA/etc and now you are on a list of people that purchased Mullvad VPN services.