4 ms·

I get the immediate appeal of “open source servers that run from RAM”… but it’s the same thing as always, you just have to believe your VPN provider. There is

I get the immediate appeal of “open source servers that run from RAM”… but it’s the same thing as always, you just have to believe your VPN provider. There is just no saying that they don’t swap gear out for the auditors or for the disk less servers or whatever it is. I like that they say the right things. But I think the current models of Facebook and Google show just how much money there is in data, so it’s just faith that the VPN provider won’t fall to temptation.

c_o_n_v_e_x 4y ago
Wouldn't there be a clear performance difference between a RAM based and disk based (even if it's NVMe SSD) machine? If so, isn't that something you can routinely/programmatically authenticate?
- dietr1ch 4y ago
  Would it be clear from 100km+ away? I think that low latency can act as a proof of being close and fast, but once the apparent network latency goes up how do you know that server times are low if the server can claim the time was spent on the network?
- dundarious 4y ago
  I doubt there would be any detectable difference. Logging to disk can easily be done out of the hot loop, and I doubt any service with disks has any relevant memory in swap/page file. The point of the RAM-only server is not that it ensures that everything is operating from RAM. Everything is operating from RAM already even on servers that have attached disks. The point is that RAM-only means there is no intentional or even unintentional logging to non-volatile memory or storage. Think of it as a physics enforced capability system (no disk is physically connected).
  - c_o_n_v_e_x 4y ago
    Fair enough on there not being a performance difference. I suppose you could run an IPMI or redfish query (assuming they expose it to you) to get hardware specs on the server to see if any storage is physically connected? I guess there's a larger question - is it possible to construct a completely transparent architecture for customers who are trustless in you as a service provider?
    - mlyle 4y ago
      No. I mean, you need some kind of trust, somewhere. Maybe you don't have to trust the service provider, if it provides some type of TPM attestation traced to the key of someone you do trust. On the other hand, they have physical access. Even with efforts at remote attestation, etc, the game is lost.
    - NavinF 4y ago
      You just described https://en.m.wikipedia.org/wiki/Software_Guard_Extensions https://en.m.wikipedia.org/wiki/Software_Guard_Extensions The CPU essentially signs running code and API responses using a key that only the CPU manufacturer knows. That way, you can verify that your cloud services are running the binaries you told them to run. Note the long list of vulnerabilities on that page and the removal of this feature from desktop CPUs. (Let’s be real, its only use case on desktop is DRM)
  - SV_BubbleTime 4y ago
    > RAM-only means there is no intentional or even unintentional logging to non-volatile memory or storage Let’s say worst case, there is an unintentional leak to a another machine, pretty likely that machine has a disk. These are very obviously highly connected machines. Sorry, but it can never be anything but faith - which is fine if you have or, or chose to.
    - dundarious 4y ago
      I don't have a lot of faith in such things, at base, you always have to trust the provider as people or an organization. I'm just describing what this technical measure is and what it is not. It's also not a silver bullet that on its own means you can trust their service enough for your needs -- no purely technical measure can do that.
- TakeBlaster16 4y ago
  Forwarding packets doesn't need much if any disk i/o, so the server will be running mostly from RAM either way, even if the hard drive isn't physically unplugged.
gruez 4y ago
I was going to say that theoretically this was something that trusted computing can solve, but then I realized even if you could guarantee that the server was behaving as advertised (ie. diskless, no log), there's nothing preventing the provider from putting a middlebox in front of the server to log all packet flows. From there it's fairly trivial to deanonymize every connection through traffic analysis.
- sanroot99 4y ago
  I bet some kind of blockchain based trust can solve some issues ,for eg , hardware ownership delegated with blockchain trust .It will add p2p ownership/rent of hardware
- oceanplexian 4y ago
  The provider doesn’t have to do anything. Their upstream transit provider probably has a span port plugged directly into the NSA. Which is what was happening with Room 641A over a decade ago. On one hand, they won’t be able intercept encrypted VPN traffic, but on the other, they are definitely collecting IP addresses, timestamps and traffic heuristics. With enough resources to pick out patterns and bulk collection on both sides, encryption and logging might not even matter.
glowiesvpn 4y ago
"fall to temptation" implies they were legitimate actors in the first place. Most VPNs are run by small and relatively non-transparent private companies. It would be trivial and in fact the obvious thing to do for law enforcement and similar agencies to setup VPN companies and advertise them to their targets. ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data.
- gruez 4y ago
  - deleted 4y ago
    [deleted]
- TakeBlaster16 4y ago
  > ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data. To be fair this applies to VPNs too. Their customers give them money, and that should make their business sustainable without needing to spy on people. To be honest I trust Mullvad way more than I trust my ISP not to sell my DNS queries.
- Shared404 4y ago
  > ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data. And yet they do, largely because many people _can't_ vote with their dollars. I can move which VPN provider I use. Also, VPN's are a big benefit on filtered wifi if that's something you have to deal with.
LeoPanthera 4y ago
You are right. But. Mullvad is more trustworthy that most, and possibly more trustworthy than all other public VPN providers. They have a good history, and are regularly audited: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/ Don't get me wrong, you still have to believe them. But they're easier to believe than others.
- patrakov 4y ago
  Well, I have a blog post regarding audits: https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-and-privacy-threats.html https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-a... In short: auditors audit providers against their own privacy policies. If there is a loophole, the result, with some auditors, might still be a legitimate "pass" - e.g. because exfiltration is not logging, and the privacy policy says only "we don't log". P.S. Mullvad's privacy policy falls into the same bucket: "we never store any activity logs of any kind". Sending data to a third party who stores it would be 100% compliant. Mullvad, please fix the wording.
  - gzer0 4y ago
    Edit: thanks for bringing this to light.
    - patrakov 4y ago
      I don't know if this happens at all. I am only pointing out that their privacy policy does not prohibit them from doing this.
  - cmeacham98 4y ago
    Their most recent audit contains this quote: > In regards to information leakage and logging of customer data the configuration is sound I cannot imagine this could ever mean that Mullvad sends data to third parties.
    - patrakov 4y ago
COGlory 4y ago
Yup. But you can use crypto or mail cash to Mullvad without your name attached, and then just multihop to them as an endpoint, and it's about as secure as a VPN can be.
- SV_BubbleTime 4y ago
  I like the idea. But it’s pointless if the connections do log - or leak data in some way. You are mostly connecting to the VPN with a same or similar IP. So right there; you are back to having to trust they aren’t logging or leaking. If they are, it doesn’t matter Mull is missing your name, you are already correlated from ISP to endpoint in this case. Likewise, if they aren’t logging, what does it matter if they have your name and account info?
  - tjoff 4y ago
    It is not pointless, it is a huge practical win. That means that you don't have to trust your VPN to have a reasonable guarantee that adding VPN won't reduce your privacy (depending on your goals). As many VPNs are sketchy (and even the best one might get bought out or otherwise get compromised) relying on one might seriously reduce your privacy. Especially considering that in many jurisdictions your ISP has much higher legal requirements on integrity and privacy. But if the VPN don't know who you are the absolute worst case is that you fall back to your ISP. Whether that is good enough for you is something you have to check against your threat model. But in a world where adding a VPN in many cases threatens to reduce your privacy it is massive win.
hajhatten 4y ago
I may be wrong. But OVPN is the only one I know that has actually been proven in court not to store any user activity. https://www.ovpn.com/en/blog/ovpn-wins-court-order https://www.ovpn.com/en/blog/ovpn-wins-court-order
- m3adow 4y ago
  PIA (Privateinternetaccess) had a similar case: https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-... This was before they were bought by some shady company though, so I wouldn't rely on this policy being unchanged anymore.
- BonoboIO 4y ago
  The bad things is, the past does not predict the future ( would be awesome ^^ ) They did not log, but maybe they are now. I don’t say that ovpn logs, but the 3 letter agencies can infiltrate a company.
  - afiori 4y ago
    Or as the catchphrase of the scientist character of Welcome to Night Vale goes: Past performance is not an indicator of future results.
panick21_ 4y ago
Did you read Mullvad plan for System Transparency? They are doing a lot so that they can actually verify where the server is running.
- Foxboron 4y ago
  So you, the user, can verify what the server is running :) Disclaimer: I work on this.
INTPenis 4y ago
Mullvad is pretty much the only VPN provider saying the right things and doing the right things. They actually publish open source code and articles backing up their statements. Ontop of that many of us here in Sweden know people at Mullvad and can attest to them being conscious of privacy issues.
- rekoil 4y ago
  > many of us here in Sweden know people at Mullvad and can attest to them being conscious of privacy issues Me for example, I can vouch for them if that matters to anyone, but it's the same problem isn't it, if people can't trust Mullvad on their word, why should they trust two random HN users they've never met or conversed with before? Trust in IT systems is super complicated.
hatware 4y ago
> you just have to believe your VPN provider Do you have a better plan...?

c_o_n_v_e_x 4y ago

Wouldn't there be a clear performance difference between a RAM based and disk based (even if it's NVMe SSD) machine? If so, isn't that something you can routinely/programmatically authenticate?

dietr1ch 4y ago
Would it be clear from 100km+ away? I think that low latency can act as a proof of being close and fast, but once the apparent network latency goes up how do you know that server times are low if the server can claim the time was spent on the network?
dundarious 4y ago
I doubt there would be any detectable difference. Logging to disk can easily be done out of the hot loop, and I doubt any service with disks has any relevant memory in swap/page file. The point of the RAM-only server is not that it ensures that everything is operating from RAM. Everything is operating from RAM already even on servers that have attached disks. The point is that RAM-only means there is no intentional or even unintentional logging to non-volatile memory or storage. Think of it as a physics enforced capability system (no disk is physically connected).
- c_o_n_v_e_x 4y ago
  Fair enough on there not being a performance difference. I suppose you could run an IPMI or redfish query (assuming they expose it to you) to get hardware specs on the server to see if any storage is physically connected? I guess there's a larger question - is it possible to construct a completely transparent architecture for customers who are trustless in you as a service provider?
  - mlyle 4y ago
    No. I mean, you need some kind of trust, somewhere. Maybe you don't have to trust the service provider, if it provides some type of TPM attestation traced to the key of someone you do trust. On the other hand, they have physical access. Even with efforts at remote attestation, etc, the game is lost.
  - NavinF 4y ago
    You just described https://en.m.wikipedia.org/wiki/Software_Guard_Extensions https://en.m.wikipedia.org/wiki/Software_Guard_Extensions The CPU essentially signs running code and API responses using a key that only the CPU manufacturer knows. That way, you can verify that your cloud services are running the binaries you told them to run. Note the long list of vulnerabilities on that page and the removal of this feature from desktop CPUs. (Let’s be real, its only use case on desktop is DRM)
- SV_BubbleTime 4y ago
  > RAM-only means there is no intentional or even unintentional logging to non-volatile memory or storage Let’s say worst case, there is an unintentional leak to a another machine, pretty likely that machine has a disk. These are very obviously highly connected machines. Sorry, but it can never be anything but faith - which is fine if you have or, or chose to.
  - dundarious 4y ago
    I don't have a lot of faith in such things, at base, you always have to trust the provider as people or an organization. I'm just describing what this technical measure is and what it is not. It's also not a silver bullet that on its own means you can trust their service enough for your needs -- no purely technical measure can do that.
TakeBlaster16 4y ago
Forwarding packets doesn't need much if any disk i/o, so the server will be running mostly from RAM either way, even if the hard drive isn't physically unplugged.

gruez 4y ago

I was going to say that theoretically this was something that trusted computing can solve, but then I realized even if you could guarantee that the server was behaving as advertised (ie. diskless, no log), there's nothing preventing the provider from putting a middlebox in front of the server to log all packet flows. From there it's fairly trivial to deanonymize every connection through traffic analysis.

sanroot99 4y ago
I bet some kind of blockchain based trust can solve some issues ,for eg , hardware ownership delegated with blockchain trust .It will add p2p ownership/rent of hardware
oceanplexian 4y ago
The provider doesn’t have to do anything. Their upstream transit provider probably has a span port plugged directly into the NSA. Which is what was happening with Room 641A over a decade ago. On one hand, they won’t be able intercept encrypted VPN traffic, but on the other, they are definitely collecting IP addresses, timestamps and traffic heuristics. With enough resources to pick out patterns and bulk collection on both sides, encryption and logging might not even matter.

glowiesvpn 4y ago

"fall to temptation" implies they were legitimate actors in the first place. Most VPNs are run by small and relatively non-transparent private companies. It would be trivial and in fact the obvious thing to do for law enforcement and similar agencies to setup VPN companies and advertise them to their targets. ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data.

gruez 4y ago
- deleted 4y ago
  [deleted]
TakeBlaster16 4y ago
> ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data. To be fair this applies to VPNs too. Their customers give them money, and that should make their business sustainable without needing to spy on people. To be honest I trust Mullvad way more than I trust my ISP not to sell my DNS queries.
Shared404 4y ago
> ISPs are actually more transparent and their business model does not fundamentally relies on exploiting customer data. And yet they do, largely because many people _can't_ vote with their dollars. I can move which VPN provider I use. Also, VPN's are a big benefit on filtered wifi if that's something you have to deal with.

LeoPanthera 4y ago

You are right. But. Mullvad is more trustworthy that most, and possibly more trustworthy than all other public VPN providers. They have a good history, and are regularly audited: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/ Don't get me wrong, you still have to believe them. But they're easier to believe than others.

patrakov 4y ago
Well, I have a blog post regarding audits: https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-and-privacy-threats.html https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-a... In short: auditors audit providers against their own privacy policies. If there is a loophole, the result, with some auditors, might still be a legitimate "pass" - e.g. because exfiltration is not logging, and the privacy policy says only "we don't log". P.S. Mullvad's privacy policy falls into the same bucket: "we never store any activity logs of any kind". Sending data to a third party who stores it would be 100% compliant. Mullvad, please fix the wording.
- gzer0 4y ago
  Edit: thanks for bringing this to light.
  - patrakov 4y ago
    I don't know if this happens at all. I am only pointing out that their privacy policy does not prohibit them from doing this.
- cmeacham98 4y ago
  Their most recent audit contains this quote: > In regards to information leakage and logging of customer data the configuration is sound I cannot imagine this could ever mean that Mullvad sends data to third parties.
  - patrakov 4y ago

COGlory 4y ago

Yup. But you can use crypto or mail cash to Mullvad without your name attached, and then just multihop to them as an endpoint, and it's about as secure as a VPN can be.

SV_BubbleTime 4y ago
I like the idea. But it’s pointless if the connections do log - or leak data in some way. You are mostly connecting to the VPN with a same or similar IP. So right there; you are back to having to trust they aren’t logging or leaking. If they are, it doesn’t matter Mull is missing your name, you are already correlated from ISP to endpoint in this case. Likewise, if they aren’t logging, what does it matter if they have your name and account info?
- tjoff 4y ago
  It is not pointless, it is a huge practical win. That means that you don't have to trust your VPN to have a reasonable guarantee that adding VPN won't reduce your privacy (depending on your goals). As many VPNs are sketchy (and even the best one might get bought out or otherwise get compromised) relying on one might seriously reduce your privacy. Especially considering that in many jurisdictions your ISP has much higher legal requirements on integrity and privacy. But if the VPN don't know who you are the absolute worst case is that you fall back to your ISP. Whether that is good enough for you is something you have to check against your threat model. But in a world where adding a VPN in many cases threatens to reduce your privacy it is massive win.

hajhatten 4y ago

I may be wrong. But OVPN is the only one I know that has actually been proven in court not to store any user activity. https://www.ovpn.com/en/blog/ovpn-wins-court-order https://www.ovpn.com/en/blog/ovpn-wins-court-order

m3adow 4y ago
PIA (Privateinternetaccess) had a similar case: https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-... This was before they were bought by some shady company though, so I wouldn't rely on this policy being unchanged anymore.
BonoboIO 4y ago
The bad things is, the past does not predict the future ( would be awesome ^^ ) They did not log, but maybe they are now. I don’t say that ovpn logs, but the 3 letter agencies can infiltrate a company.
- afiori 4y ago
  Or as the catchphrase of the scientist character of Welcome to Night Vale goes: Past performance is not an indicator of future results.

panick21_ 4y ago

Did you read Mullvad plan for System Transparency? They are doing a lot so that they can actually verify where the server is running.

Foxboron 4y ago
So you, the user, can verify what the server is running :) Disclaimer: I work on this.

INTPenis 4y ago

Mullvad is pretty much the only VPN provider saying the right things and doing the right things. They actually publish open source code and articles backing up their statements. Ontop of that many of us here in Sweden know people at Mullvad and can attest to them being conscious of privacy issues.

rekoil 4y ago
> many of us here in Sweden know people at Mullvad and can attest to them being conscious of privacy issues Me for example, I can vouch for them if that matters to anyone, but it's the same problem isn't it, if people can't trust Mullvad on their word, why should they trust two random HN users they've never met or conversed with before? Trust in IT systems is super complicated.

hatware 4y ago

> you just have to believe your VPN provider Do you have a better plan...?