3 ms·
Well, I have a blog post regarding audits: https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-and-privacy-threats.html https://patrakov.blogspot.com/202
by patrakov 4y ago
Well, I have a blog post regarding audits: https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-and-privacy-threats.html https://patrakov.blogspot.com/2020/01/vpn-privacy-policies-a...
In short: auditors audit providers against their own privacy policies. If there is a loophole, the result, with some auditors, might still be a legitimate "pass" - e.g. because exfiltration is not logging, and the privacy policy says only "we don't log".
P.S. Mullvad's privacy policy falls into the same bucket: "we never store any activity logs of any kind". Sending data to a third party who stores it would be 100% compliant. Mullvad, please fix the wording.
- gzer0 4y agoEdit: thanks for bringing this to light.
- patrakov 4y agoI don't know if this happens at all. I am only pointing out that their privacy policy does not prohibit them from doing this.
- cmeacham98 4y agoTheir most recent audit contains this quote: > In regards to information leakage and logging of customer data the configuration is sound I cannot imagine this could ever mean that Mullvad sends data to third parties.
- patrakov 4y agoWe are talking about different documents. I mention the privacy policy, which contains a "leaky" wording, likely unintentionally. You mention the audit report that plugs the leak and confirms that Mullvad protects customer data even better than written in their privacy policy.