4 ms·

> These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. What exactly do you base this on

by hnarn 4y ago

> These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. What exactly do you base this on? First of all, Mullvad (like any serious VPN operator) do not log IP:s and one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. But let’s assume for the sake of argument that they did: let’s assume they log IP:s and sales of gift cards down to the social security number of the person who bought it. Now assume that I’m running a corner store where I sell among other things these gift cards, that I bought from Amazon at a small markup. Someone uses these gift cards and the tracking (that doesn’t exist) leads back to my store. I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. The jury (in the US) or the judge (anywhere else) is informed that I buy these cards in bulk, I sell dozens of them a week, and the IP (that Mullvad doesn’t log) is a dead end. Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? This is almost exactly analogous to selling anonymous SIM cards (where they still exist). One is used for a drug deal. Me, the shop keeper, is prosecuted in this alternate universe because I’m selling the cards. Really?

nickstinemates 4y ago
Strawman arguments are weird. Especially owning the corner store piece. Nevermind the fact that you're at trial where a judge and jury is looking at this. Nevermind that the point the GP made was that if you have someone knocking on your door motivated to find something they will find something. I am assuming if you are a nefarious actor, the goal is to not have this kind of attention, ever. You do this in all of the traditional ways - insulate and delegate.
- hnarn 4y ago
  How is it in any way a straw man argument? I was giving an example of exactly what the comment said was “not a thing”: plausible deniability when buying the cards. If you buy these cards and re-sell them, you have plausible deniability. If you buy them from a re-seller you have increased anonymity. Obviously the goal for a nefarious actor (or anyone, probably) is to not end up in court. But it’s objectively true that the idea of Amazon gift cards does in some scenarios actually give you increased anonymity compared to other payment options, if nothing else because of the timing offset if you want to disregard re-sellers.
  - deleted 4y ago
    [deleted]
  - nickstinemates 4y ago
    So you think that prosecution is going to go to court with just 1 piece of evidence and the entire case is going to hinge on the provenance of a Mullvad account? Sounds extremely unlikely.
    - hnarn 4y ago
      We’re talking about hypotheticals. If you want to make up a new hypothetical where tying the suspect to the VPN account is irrelevant, what is even your point?
thaumasiotes 4y ago
> I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. There are no such countries; that standard would make it impossible to get convictions for almost every crime that ever occurred. Compare this case from the United States: https://volokh.com/2014/01/02/wrongful-convictions-proof-beyond-reasonable-doubt/ https://volokh.com/2014/01/02/wrongful-convictions-proof-bey... > In October of 2007, Elizabeth P. Coast, then seventeen, reported that when she was ten years old a neighborhood boy named “Jon” sexually assaulted her while the two were alone in her grandmother’s backyard > [the trial court] tried and convicted Montgomery in a one-day bench trial for the assault of Coast. Coast testified under oath that Montgomery had sexually assaulted her in 2000. > no other witnesses to the incident testified at Montgomery’s trial. Neither was any corroborating physical evidence that an assault occurred ever presented. The trial judge categorized this case as a “word against word situation.” In reaching his verdict, the trial judge concluded that Coast was more credible then Montgomery because she had “no motive whatsoever” to lie. The trial court then found Montgomery guilty of forcible sodomy, aggravated sexual battery, and object sexual penetration. On April 10, 2009, the trial judge sentenced Montgomery to 45 years in prison, with 37 years and 6 months suspended… > On November 1, 2012, Coast voluntarily made a videotaped statement at the Hampton Police Department. After consulting with counsel and receiving Miranda warnings, Coast recounted how she had falsely testified that Montgomery had assaulted her. > Coast explained that immediately before she accused Montgomery, her mother caught her looking at “sex stories” on the Internet. Out of fear of her mother, Coast said that she was looking at inappropriate material because she had been molested when she was ten years old. After she reluctantly named Montgomery as her attacker, the lie snowballed. Coast felt like she could not admit that the assault never happened
- mynameisvlad 4y ago
  An anecdote does not a system make. Generally speaking, "innocent until proven guilty" is a cornerstone in most legal systems. This has been the case, literally, for millennia, dating back to Roman times. It is also one of the UN's human rights, and is enshrined in several countries' constitutions.
  - 4y ago
Bilal_io 4y ago
> one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. You bring up a very good point. Unlike an electronic payment system [0], I assume the amazon gift card is not linked to your account on Mullvad's servers, so probably Mullvad marks the account as paid, but doesn't log the Amazon card number 0. Even that should be safe. Mullvad made a recent decision to get rid of subscriptions. Now that your account is never linked to your payment method, and we can assume that it's safe to use your personal credit/debit card. But I'd be careful, if someone is important, there is a possibility of someone tracking and logging their activities, credit card use, IPs before Mullvad purchase and after they connect.
caeril 4y ago
type0 4y ago
> Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? In some jurisdictions, like Sweden (where Mullvad is based) there is such a thing as "help to commit a crime" that does get prosecuted
- hnarn 4y ago
  The crime you’re referring to, like many crimes, requires intent. You can’t charge someone giving a murderer a ride if that person had no idea they had committed a murder. Unless you’re in an authoritarian regime where the courts simply follow the whims of the political leadership, selling SIM cards, gift cards for a VPN, knives or ski masks will hardly in separate cases by itself be considered obvious intent to assist criminal activity.
mike_d 4y ago
> What exactly do you base this on? The law and law enforcement are two different things. Law enforcement works roughly like this: they get an IP of a website, they go to an ISP, the ISP says its this reseller, they go to the reseller, the reseller says it is this customer, they go to the customer, the customer says this IP posted the bad thing, they take the new IP and go to the ISP, ISP hands over the original users details, they go knock on the users door. It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. At each step YOU are responsible for the bad thing that happened until you give them a new person to look at. If you think it works any differently, take a look at what happened to the "TheDonald" forum after January 6th. You can shout and scream about freedoms and rights all you want, but when your girlfriend has to explain to her boss why the FBI came around asking questions about you - you hand over the next guy down the line super quick.
- TedDoesntTalk 4y ago
  > look at what happened to the "TheDonald" forum after January 6th. What happened? I missed it.
- hnarn 4y ago
  > It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. You’re just making assumptions without referring to the facts. Mullvad is a Swedish company and falls under Swedish and EU jurisdiction. ISPs in the EU are indeed required to keep track on what subscriber had what IP at what point in time. Some do this gladly and some try their absolute best to sabotage the process (like Bahnhof). However, Mullvad is a VPN provider. They are not an ISP. If you claim that Mullvad is legally required to log IPs, then source that claim, because they clearly are not and if that claim is true that would mean they are breaking the law, which I doubt they would be willfully doing. In your example, the buck stops with the VPN provider (which again, is not an ISP) because the info they provide is of no use. In some cases, the buck even stops with the ISP without a VPN, because in many jurisdictions there are demands placed upon the seriousness of the alleged crime to allow personal data to be supplied to law enforcement.

by hnarn 4y ago

nickstinemates 4y ago

Strawman arguments are weird. Especially owning the corner store piece. Nevermind the fact that you're at trial where a judge and jury is looking at this. Nevermind that the point the GP made was that if you have someone knocking on your door motivated to find something they will find something. I am assuming if you are a nefarious actor, the goal is to not have this kind of attention, ever. You do this in all of the traditional ways - insulate and delegate.

hnarn 4y ago
How is it in any way a straw man argument? I was giving an example of exactly what the comment said was “not a thing”: plausible deniability when buying the cards. If you buy these cards and re-sell them, you have plausible deniability. If you buy them from a re-seller you have increased anonymity. Obviously the goal for a nefarious actor (or anyone, probably) is to not end up in court. But it’s objectively true that the idea of Amazon gift cards does in some scenarios actually give you increased anonymity compared to other payment options, if nothing else because of the timing offset if you want to disregard re-sellers.
- deleted 4y ago
  [deleted]
- nickstinemates 4y ago
  So you think that prosecution is going to go to court with just 1 piece of evidence and the entire case is going to hinge on the provenance of a Mullvad account? Sounds extremely unlikely.
  - hnarn 4y ago
    We’re talking about hypotheticals. If you want to make up a new hypothetical where tying the suspect to the VPN account is irrelevant, what is even your point?

thaumasiotes 4y ago

> I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. There are no such countries; that standard would make it impossible to get convictions for almost every crime that ever occurred. Compare this case from the United States: https://volokh.com/2014/01/02/wrongful-convictions-proof-beyond-reasonable-doubt/ https://volokh.com/2014/01/02/wrongful-convictions-proof-bey... > In October of 2007, Elizabeth P. Coast, then seventeen, reported that when she was ten years old a neighborhood boy named “Jon” sexually assaulted her while the two were alone in her grandmother’s backyard > [the trial court] tried and convicted Montgomery in a one-day bench trial for the assault of Coast. Coast testified under oath that Montgomery had sexually assaulted her in 2000. > no other witnesses to the incident testified at Montgomery’s trial. Neither was any corroborating physical evidence that an assault occurred ever presented. The trial judge categorized this case as a “word against word situation.” In reaching his verdict, the trial judge concluded that Coast was more credible then Montgomery because she had “no motive whatsoever” to lie. The trial court then found Montgomery guilty of forcible sodomy, aggravated sexual battery, and object sexual penetration. On April 10, 2009, the trial judge sentenced Montgomery to 45 years in prison, with 37 years and 6 months suspended… > On November 1, 2012, Coast voluntarily made a videotaped statement at the Hampton Police Department. After consulting with counsel and receiving Miranda warnings, Coast recounted how she had falsely testified that Montgomery had assaulted her. > Coast explained that immediately before she accused Montgomery, her mother caught her looking at “sex stories” on the Internet. Out of fear of her mother, Coast said that she was looking at inappropriate material because she had been molested when she was ten years old. After she reluctantly named Montgomery as her attacker, the lie snowballed. Coast felt like she could not admit that the assault never happened

mynameisvlad 4y ago
An anecdote does not a system make. Generally speaking, "innocent until proven guilty" is a cornerstone in most legal systems. This has been the case, literally, for millennia, dating back to Roman times. It is also one of the UN's human rights, and is enshrined in several countries' constitutions.
- 4y ago

Bilal_io 4y ago

> one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. You bring up a very good point. Unlike an electronic payment system [0], I assume the amazon gift card is not linked to your account on Mullvad's servers, so probably Mullvad marks the account as paid, but doesn't log the Amazon card number 0. Even that should be safe. Mullvad made a recent decision to get rid of subscriptions. Now that your account is never linked to your payment method, and we can assume that it's safe to use your personal credit/debit card. But I'd be careful, if someone is important, there is a possibility of someone tracking and logging their activities, credit card use, IPs before Mullvad purchase and after they connect.

caeril 4y ago

type0 4y ago

> Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? In some jurisdictions, like Sweden (where Mullvad is based) there is such a thing as "help to commit a crime" that does get prosecuted

hnarn 4y ago
The crime you’re referring to, like many crimes, requires intent. You can’t charge someone giving a murderer a ride if that person had no idea they had committed a murder. Unless you’re in an authoritarian regime where the courts simply follow the whims of the political leadership, selling SIM cards, gift cards for a VPN, knives or ski masks will hardly in separate cases by itself be considered obvious intent to assist criminal activity.

mike_d 4y ago

> What exactly do you base this on? The law and law enforcement are two different things. Law enforcement works roughly like this: they get an IP of a website, they go to an ISP, the ISP says its this reseller, they go to the reseller, the reseller says it is this customer, they go to the customer, the customer says this IP posted the bad thing, they take the new IP and go to the ISP, ISP hands over the original users details, they go knock on the users door. It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. At each step YOU are responsible for the bad thing that happened until you give them a new person to look at. If you think it works any differently, take a look at what happened to the "TheDonald" forum after January 6th. You can shout and scream about freedoms and rights all you want, but when your girlfriend has to explain to her boss why the FBI came around asking questions about you - you hand over the next guy down the line super quick.

TedDoesntTalk 4y ago
> look at what happened to the "TheDonald" forum after January 6th. What happened? I missed it.
hnarn 4y ago
> It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. You’re just making assumptions without referring to the facts. Mullvad is a Swedish company and falls under Swedish and EU jurisdiction. ISPs in the EU are indeed required to keep track on what subscriber had what IP at what point in time. Some do this gladly and some try their absolute best to sabotage the process (like Bahnhof). However, Mullvad is a VPN provider. They are not an ISP. If you claim that Mullvad is legally required to log IPs, then source that claim, because they clearly are not and if that claim is true that would mean they are breaking the law, which I doubt they would be willfully doing. In your example, the buck stops with the VPN provider (which again, is not an ISP) because the info they provide is of no use. In some cases, the buck even stops with the ISP without a VPN, because in many jurisdictions there are demands placed upon the seriousness of the alleged crime to allow personal data to be supplied to law enforcement.