3 ms·

It's also kind of silly when you're not anonymous to Mullvad or to the data centers Mullvad pays to run its services out of. They have your IP address, and it'

It's also kind of silly when you're not anonymous to Mullvad or to the data centers Mullvad pays to run its services out of. They have your IP address, and it's not that hard to go from an IP address to an ISP to an identity. Don't get me wrong. I think Mullvad is a great VPN service. But if people think it's a bullet-proof solution to the problem of anonymity, they're fooling themselves.

abliefern 4y ago
The point is that typically privacy-first VPN providers promise not to store your IP but have to store your payment details for practical reasons.
- POPOSYS 4y ago
  The VPN provider does not, but the owner of the data center still can store whatever she likes or some entity asks her to store.
- pnt12 4y ago
  They actually removed subscriptions just because of that: they were required to keep some info to process payments, but this was incompatible with their vision for privacy. With single payments they don't need to keep it for so long.
zucker42 4y ago
Here's the threat model that justifies uses a public VPN: 1. The VPN provider and its infrastructure is trusted. 2. Attackers (private or government) can access data the VPN stores some period of time after you use it, but not while you are using the VPN. 3. Given assumptions (1) and (2) are true, attackers should not be able to determine which websites you visited. A VPN does nothing if you don't trust the VPN provider (since they can always be lying about keeping logs) or if the government can access the VPN's servers/data while you're using it. But it does protect against one of the most common ways a government/private party could gain access to your browsing history: the government/private party subpoenas the websites you visited or your ISP for all pages visited by a given IP. In this case, providing an alternate way to pay protects against storing data that an attacker can use to connect your account to your identity.

abliefern 4y ago

The point is that typically privacy-first VPN providers promise not to store your IP but have to store your payment details for practical reasons.

POPOSYS 4y ago
The VPN provider does not, but the owner of the data center still can store whatever she likes or some entity asks her to store.
pnt12 4y ago
They actually removed subscriptions just because of that: they were required to keep some info to process payments, but this was incompatible with their vision for privacy. With single payments they don't need to keep it for so long.

zucker42 4y ago

Here's the threat model that justifies uses a public VPN: 1. The VPN provider and its infrastructure is trusted. 2. Attackers (private or government) can access data the VPN stores some period of time after you use it, but not while you are using the VPN. 3. Given assumptions (1) and (2) are true, attackers should not be able to determine which websites you visited. A VPN does nothing if you don't trust the VPN provider (since they can always be lying about keeping logs) or if the government can access the VPN's servers/data while you're using it. But it does protect against one of the most common ways a government/private party could gain access to your browsing history: the government/private party subpoenas the websites you visited or your ISP for all pages visited by a given IP. In this case, providing an alternate way to pay protects against storing data that an attacker can use to connect your account to your identity.