7 ms·

Mullvad spends money on open source development and is actively trying to increase privacy technology and being transparent what their servers run. Sure you ca

Mullvad spends money on open source development and is actively trying to increase privacy technology and being transparent what their servers run. Sure you can never prove anything 100% but VPN providers can still make moves that make them more or less credible.

Spooky23 4y ago
Sure. Apple made a big production about privacy and the Feds made a big production about how they need access to things. Then they both stopped. If you need this sort of anonymity, VPNs aren’t the way.
- panick21_ 4y ago
  Yes, we all understand that if you want best of breed anonymity you need Tor. However, I still appreciate a vendor making a credible effort with privacy just as an everyday value. If I'm gone use a VPN I much rather use a vendor that does a credible job at privacy protection.
  - gzer0 4y ago
    Tor isn't the almighty all-in-one-solution one might think it to be. Other OPSec measures need to be take in addition to Tor. FBI agents tracked Harvard bomb threats despite Tor [1]. [1] https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor https://www.theverge.com/2013/12/18/5224130/fbi-agents-track...
    - sanroot99 4y ago
      What opsec one might employee?
      - fudgefactorfive 4y ago
        Grandma's Wifi up the street -> Public Library Network -> VPN1 -> Tor -> VPN2 /s
        no-reply 4y ago
        Only to get the best dial up speeds /s
    - mobiclick 4y ago
      But it's leaps and bounds more private than any VPN including this (no shade on these guys, if I ever need a VPN that isn't tor, I'll choose them). E To me, comparing tor's privacy features against normal VPN is like comparing a jet plane to a tricycle
    - fudgefactorfive 4y ago
      Admittedly from the article: "used two separate anonymity tools to cover his tracks — the routing service Tor, which covered his web traffic, and the temporary mail service Guerrilla Mail, which offered a one-time email" Then they noticed that "that the originating IP address would have been revealed in the email header, which would have indicated Tor usage" And from there "agents checked to see if anyone had accessed Tor through the local wireless networks. That led them to <culprit>, who promptly confessed." Doesn't sound like they even had to engage with Tor infrastructure or Guerrilla Mail backends, just 'hmmm did a student use Tor, oh some did, let's check them out in full FBI livery' which freaked the kid out and he confessed. It's easy to check if an IP is a Tor exit node, but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.
      - kevin_thibedeau 4y ago
        > but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources. It's an easy problem if you control the majority of the nodes. All it takes is throttling traffic on an exit node and watching which inbound traffic is affected. It is cheap for the US to fund the operation of all Tor nodes in return for the massive intelligence boost it offers.
        fudgefactorfive 4y ago
        At the end of the day, it's a DARPA project originally, I'm sure the US Gov't has been _heavily_ invested in monitoring it for a while. Still I'd argue when doing anything on the web the behemoth that is the US could probably flex some of that spending muscle to levy massive resources. However FBI tracing bomb-threat is probably still not using NSA-level resources... given the whole not our citizens wink wink thing.
        kevin_thibedeau 4y ago
        > given the whole not our citizens wink wink thing. Intercepting encrypted domestic communication is fair game as far as the TLAs are concerned. They also always have the option of routing domestic traffic outside the country to make it "foreign origin".
- lelandfe 4y ago
  Is this an oblique reference to the San Bernardino iPhone access case? They “both stopped” because the government paid a company to unlock the phone, not because Apple caved. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
  - londons_explore 4y ago
    It was fairly clear that that phone was just the 'example case' for a larger dispute
    - tinus_hn 4y ago
      And the example case showed that there was a real chance of them losing the case and the government wasn’t prepared to risk it.
  - Spooky23 4y ago
    I don’t think that Apple “caved” per se, but the authorities seem to have found a path to what they want, and somehow Apple hasn’t been able, willing, or motivated to close those holes. Apple also tweaked things like iMessage to make that data available in the cloud (ie available via subpoena or warrant) in most common scenarios.
    - lelandfe 4y ago
      Didn't they just ship Lockdown Mode? And BlastDoor last year?
comboy 4y ago
If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. I don't think it should be like this but as far as I understand it is the current state of affairs. Even if they shouldn't be able to force you to do some things the best you can do is take them to court, still completely outside public eye, and they can provide some plausible reasons regarding say national security which are likely pretty much impossible to verify.
- johnchristopher 4y ago
  > If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. There is some nuclear options https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
  - silviot 4y ago
    Even if you go the nuclear option, you might risk being arrested: > Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
    - capableweb 4y ago
      > Even if you go the nuclear option, you might risk being arrested: Surely, in a free society, you are free to close down your business for whatever reason you want? Someone might feel like the business is no longer fun to run for X reason, it just happen to have coincided with law enforcement wanting to add wiretaps.
      - DistractionRect 4y ago
        He is free to close down his business//not take on new customers, but that doesn't change his non compliance with a warrant for previous customer information. Much like you are free to destroy your belongings in general, but not once their is or there will be a legal order for their surrender (I.e. Destruction of evidence).
lofaszvanitt 4y ago
No matter what they think and what they advertise. They use the same silicon, same motherboards, same designs as everyone else. So, they have all the risk that everyone else has, no matter the implementation. You don't know jackshit about the silicon and the firmwares that control them. Mullvad is not bad, but until average people don't have the means to create their own silicon in a cheapo way, you are just farting in the wind.
gigatexal 4y ago
Not saying that's not laudable. But any company beholden to any government that has any law with the wording along the lines of being able to get the logs of citizens using it and with a court system that can enforce such judgement then the only outcome I can see is: 1. Something happens (terrorism/cpam/insert-bad-thing-here) and a court case ensues and the defense says we don't have logs as we pipe them to /dev/null and the judge says haha nice try here's a fine that puts you out of business or worse jail time.
- panick21_ 4y ago
  Currently there is no such law. Should such a law be created it might be relevant.

Spooky23 4y ago

Sure. Apple made a big production about privacy and the Feds made a big production about how they need access to things. Then they both stopped. If you need this sort of anonymity, VPNs aren’t the way.

panick21_ 4y ago
Yes, we all understand that if you want best of breed anonymity you need Tor. However, I still appreciate a vendor making a credible effort with privacy just as an everyday value. If I'm gone use a VPN I much rather use a vendor that does a credible job at privacy protection.
- gzer0 4y ago
  Tor isn't the almighty all-in-one-solution one might think it to be. Other OPSec measures need to be take in addition to Tor. FBI agents tracked Harvard bomb threats despite Tor [1]. [1] https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor https://www.theverge.com/2013/12/18/5224130/fbi-agents-track...
  - sanroot99 4y ago
    What opsec one might employee?
    - fudgefactorfive 4y ago
      Grandma's Wifi up the street -> Public Library Network -> VPN1 -> Tor -> VPN2 /s
      - no-reply 4y ago
        Only to get the best dial up speeds /s
  - mobiclick 4y ago
    But it's leaps and bounds more private than any VPN including this (no shade on these guys, if I ever need a VPN that isn't tor, I'll choose them). E To me, comparing tor's privacy features against normal VPN is like comparing a jet plane to a tricycle
  - fudgefactorfive 4y ago
    Admittedly from the article: "used two separate anonymity tools to cover his tracks — the routing service Tor, which covered his web traffic, and the temporary mail service Guerrilla Mail, which offered a one-time email" Then they noticed that "that the originating IP address would have been revealed in the email header, which would have indicated Tor usage" And from there "agents checked to see if anyone had accessed Tor through the local wireless networks. That led them to <culprit>, who promptly confessed." Doesn't sound like they even had to engage with Tor infrastructure or Guerrilla Mail backends, just 'hmmm did a student use Tor, oh some did, let's check them out in full FBI livery' which freaked the kid out and he confessed. It's easy to check if an IP is a Tor exit node, but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.
    - kevin_thibedeau 4y ago
      > but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources. It's an easy problem if you control the majority of the nodes. All it takes is throttling traffic on an exit node and watching which inbound traffic is affected. It is cheap for the US to fund the operation of all Tor nodes in return for the massive intelligence boost it offers.
      - fudgefactorfive 4y ago
        At the end of the day, it's a DARPA project originally, I'm sure the US Gov't has been _heavily_ invested in monitoring it for a while. Still I'd argue when doing anything on the web the behemoth that is the US could probably flex some of that spending muscle to levy massive resources. However FBI tracing bomb-threat is probably still not using NSA-level resources... given the whole not our citizens wink wink thing.
        kevin_thibedeau 4y ago
        > given the whole not our citizens wink wink thing. Intercepting encrypted domestic communication is fair game as far as the TLAs are concerned. They also always have the option of routing domestic traffic outside the country to make it "foreign origin".
lelandfe 4y ago
Is this an oblique reference to the San Bernardino iPhone access case? They “both stopped” because the government paid a company to unlock the phone, not because Apple caved. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
- londons_explore 4y ago
  It was fairly clear that that phone was just the 'example case' for a larger dispute
  - tinus_hn 4y ago
    And the example case showed that there was a real chance of them losing the case and the government wasn’t prepared to risk it.
- Spooky23 4y ago
  I don’t think that Apple “caved” per se, but the authorities seem to have found a path to what they want, and somehow Apple hasn’t been able, willing, or motivated to close those holes. Apple also tweaked things like iMessage to make that data available in the cloud (ie available via subpoena or warrant) in most common scenarios.
  - lelandfe 4y ago
    Didn't they just ship Lockdown Mode? And BlastDoor last year?

comboy 4y ago

If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. I don't think it should be like this but as far as I understand it is the current state of affairs. Even if they shouldn't be able to force you to do some things the best you can do is take them to court, still completely outside public eye, and they can provide some plausible reasons regarding say national security which are likely pretty much impossible to verify.

johnchristopher 4y ago
> If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. There is some nuclear options https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
- silviot 4y ago
  Even if you go the nuclear option, you might risk being arrested: > Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
  - capableweb 4y ago
    > Even if you go the nuclear option, you might risk being arrested: Surely, in a free society, you are free to close down your business for whatever reason you want? Someone might feel like the business is no longer fun to run for X reason, it just happen to have coincided with law enforcement wanting to add wiretaps.
    - DistractionRect 4y ago
      He is free to close down his business//not take on new customers, but that doesn't change his non compliance with a warrant for previous customer information. Much like you are free to destroy your belongings in general, but not once their is or there will be a legal order for their surrender (I.e. Destruction of evidence).

lofaszvanitt 4y ago

No matter what they think and what they advertise. They use the same silicon, same motherboards, same designs as everyone else. So, they have all the risk that everyone else has, no matter the implementation. You don't know jackshit about the silicon and the firmwares that control them. Mullvad is not bad, but until average people don't have the means to create their own silicon in a cheapo way, you are just farting in the wind.

gigatexal 4y ago

Not saying that's not laudable. But any company beholden to any government that has any law with the wording along the lines of being able to get the logs of citizens using it and with a court system that can enforce such judgement then the only outcome I can see is: 1. Something happens (terrorism/cpam/insert-bad-thing-here) and a court case ensues and the defense says we don't have logs as we pipe them to /dev/null and the judge says haha nice try here's a fine that puts you out of business or worse jail time.

panick21_ 4y ago
Currently there is no such law. Should such a law be created it might be relevant.