6 ms·

Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name

by wepple 4y ago

john_the_writer 4y ago
Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.
- raverbashing 4y ago
  True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.
  - zamnos 4y ago
    Dns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
    - raverbashing 4y ago
      I know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had (of course, it all depends on the DNS provider you choose)
hnarn 4y ago
> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.
- bragr 4y ago
  That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
  - nabla9 4y ago
    There is no such laws in Sweden.
    - bragr 4y ago
      That does not appear to be factual: https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2008717-om-signalspaning-i_sfs-2008-717 https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-f...
      - SiempreViernes 4y ago
        What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data. Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1 https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.
        bragr 4y ago
        Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws. [1] https://lagen.nu/prop/2006/07:63 https://lagen.nu/prop/2006/07:63
- coconut08 4y ago
  mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest. also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.
  - qzx_pierri 4y ago
    > there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad. Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best. Of course we shouldn’t trust them 100%. Trust isn’t required them competent OpSec is implemented within a workflow. Trust is a vulnerability.
    - coconut08 4y ago
      pretending you don't need trust when you actually do is a vulnerability. of course you need to trust that mullvad is doing what they actually say they are doing. there is literally no way for you to verify everything they claim.
      - EGreg 4y ago
        And yet you trust WhatsApp and Facebook and Signal with their claims of end-to-end encryption. Why?
        doublerabbit 4y ago
        I don't myself. If it isn't on my own infra, I won't trust it. The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.
- sleepybrett 4y ago
  Their entire business depends on them not telling you they are doing it.
- vkou 4y ago
  > their entire business depends on them not doing it... ... in a way that you, as a customer, can detect. 1. You can't have any hard guarantees about what information is retained by third parties about you. 2. As other comments here have pointed out, something smells a bit weird with this.
  - hnarn 4y ago
    How profound. So what is your alternate theory of what is happening here?
    - vkou 4y ago
      My theory is that if you need an iron-clad guarantee of privacy, you're not going to get it from a VPN. If you're interested in hiding from civil snoops (RIAA, MPAA), by all means, use one. If you're interested in hiding from a government, then by all means, keep rolling the honeypot dice.
ragnese 4y ago
Does anyone here know how to corroborate Mullvad's account of this event? Perhaps we can find the Swedish entity that wrote the warrant and any public information reported by the officers executing said warrant? If such information is publicly accessible, and it corroborates Mullvad's story here, I'd feel like that's pretty compelling evidence that we can trust that Mullvad isn't simply committing fraud by promising not to log customer data while actually logging it.
- larsnystrom 4y ago
  When the prosecutor brings forth the charges to a court, this information will be public. Until then it is probably covered by “förundersökningssekretess”, which just means that ongoing investigations are not public.[0] You can contact the “Åklagarmyndigheten” (the Swedish prosecutor authority) and ask them and they’ll help you out. Generally speaking it is pretty easy to get information from government agencies in Sweden due to our constitution. Everything is public by default, with some exceptions like military secrets. I think it shouldn’t be a problem for the prosecutor to confirm they had a warrant at Mullvads office, and maybe even to confirm they didn’t seize anything, unless they think it could harm the ongoing investigation somehow. [0] https://www.aklagare.se/om_rattsprocessen/fran-brott-till-atal/brottsutredningen/sekretess-under-pagaende-forundersokning/ https://www.aklagare.se/om_rattsprocessen/fran-brott-till-at...

Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name

by wepple 4y ago

Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name

Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.

raverbashing 4y ago
True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.
- zamnos 4y ago
  Dns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
  - raverbashing 4y ago
    I know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had (of course, it all depends on the DNS provider you choose)

hnarn 4y ago

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

bragr 4y ago
That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
- nabla9 4y ago
  There is no such laws in Sweden.
  - bragr 4y ago
    That does not appear to be factual: https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2008717-om-signalspaning-i_sfs-2008-717 https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-f...
    - SiempreViernes 4y ago
      What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data. Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1 https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.
      - bragr 4y ago
        Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws. [1] https://lagen.nu/prop/2006/07:63 https://lagen.nu/prop/2006/07:63
coconut08 4y ago
mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest. also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.
- qzx_pierri 4y ago
  > there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad. Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best. Of course we shouldn’t trust them 100%. Trust isn’t required them competent OpSec is implemented within a workflow. Trust is a vulnerability.
  - coconut08 4y ago
    pretending you don't need trust when you actually do is a vulnerability. of course you need to trust that mullvad is doing what they actually say they are doing. there is literally no way for you to verify everything they claim.
    - EGreg 4y ago
      And yet you trust WhatsApp and Facebook and Signal with their claims of end-to-end encryption. Why?
      - doublerabbit 4y ago
        I don't myself. If it isn't on my own infra, I won't trust it. The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.
sleepybrett 4y ago
Their entire business depends on them not telling you they are doing it.
vkou 4y ago
> their entire business depends on them not doing it... ... in a way that you, as a customer, can detect. 1. You can't have any hard guarantees about what information is retained by third parties about you. 2. As other comments here have pointed out, something smells a bit weird with this.
- hnarn 4y ago
  How profound. So what is your alternate theory of what is happening here?
  - vkou 4y ago
    My theory is that if you need an iron-clad guarantee of privacy, you're not going to get it from a VPN. If you're interested in hiding from civil snoops (RIAA, MPAA), by all means, use one. If you're interested in hiding from a government, then by all means, keep rolling the honeypot dice.

ragnese 4y ago

Does anyone here know how to corroborate Mullvad's account of this event? Perhaps we can find the Swedish entity that wrote the warrant and any public information reported by the officers executing said warrant? If such information is publicly accessible, and it corroborates Mullvad's story here, I'd feel like that's pretty compelling evidence that we can trust that Mullvad isn't simply committing fraud by promising not to log customer data while actually logging it.

larsnystrom 4y ago
When the prosecutor brings forth the charges to a court, this information will be public. Until then it is probably covered by “förundersökningssekretess”, which just means that ongoing investigations are not public.[0] You can contact the “Åklagarmyndigheten” (the Swedish prosecutor authority) and ask them and they’ll help you out. Generally speaking it is pretty easy to get information from government agencies in Sweden due to our constitution. Everything is public by default, with some exceptions like military secrets. I think it shouldn’t be a problem for the prosecutor to confirm they had a warrant at Mullvads office, and maybe even to confirm they didn’t seize anything, unless they think it could harm the ongoing investigation somehow. [0] https://www.aklagare.se/om_rattsprocessen/fran-brott-till-atal/brottsutredningen/sekretess-under-pagaende-forundersokning/ https://www.aklagare.se/om_rattsprocessen/fran-brott-till-at...