4 ms·

There's also usually another disconnect: between tech industry publicity and tech industry reality. Mullvad could have been, and maybe even still is, lying abou

There's also usually another disconnect: between tech industry publicity and tech industry reality. Mullvad could have been, and maybe even still is, lying about how they operate, because it's good for business.

capableweb 3y ago
At least there have been some public and external audits that brings up the trust a bit, if you trust that those external companies are honest and putting their reputation on the line. List of the audits can be found here: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
- brookst 3y ago
  Government investigations pursue lots of avenues unlikely to be fruitful. It's basic due diligence to check all the boxes; you don't say "standard procedure is to issue a warrant, but we'll make an exception to our process in this case because their website suggests it won't get any data, plus they hired an auditor."
justsomehnguy 3y ago
> Mullvad could have been, and maybe even still is, lying about how they operate Could they? Sure. Do they have anything on me? * One BTC transfer * IPs where I'm connecting from (if they are lying and storing them) * My traffic (if they are lying and storing it) * My unencrypted traffic (if they are lying and storing it) Do they have ... on me? * Email? - nope * Phone number? - nope * Credit card? - nope * My first name, family name? - nope * My address? - nope * My mother's maiden name? - nope Because I never provided it to them because they never asked for them.
- ursuscamp 3y ago
  Might I suggest for the future: https://vpn.sovereign.engineering https://vpn.sovereign.engineering You can pay a Bitcoin lightning invoice on this site and get a redeemable Mullvad voucher instantly. Extremely convenient. Since you've only done 1 BTC transaction, I assume it was a large one for lots of time. However, when your time runs out, this option is great. It's an extra layer of privacy and you don't have to wait for the transaction to settle on chain.
  - pulpfictional 3y ago
    Monero is even better
- echoer_lyrist 3y ago
  Did you obtain the BTC that you used for the purchase from an exchange that requires PII?
  - justsomehnguy 3y ago
    Exchange has my CC number and the 'card holder' (though I never put my name there, lol). A non-business card is probably the most easy way to identify someone globally. If someone comes to exchange - they could identify me (and they can just tap their server to listen to email which do have all the transaction info, including CC# in the plaintext, lol). To establish a correlation between my wallet and Mullvad account someone needs to find that transaction in Mullvad customer data. Which - they claim they don't have. So yes, someone can identity what I bought services from Mullvad and... nothing more?
- tgsovlerkhgsel 3y ago
  Unless you're using another VPN/proxy/Tor/... to connect to the VPN, the IP where you're connecting from (respectively the full 4-tuple including source/destination port) likely does identify your address.
  - justsomehnguy 3y ago
    Of course. It doesn't help what I'm getting pretty much the same IPs from my provider. Double (triple|quad) hop, tied to different entities is necessary if you want at least plausible deniability. Thankfully I don't do things what may be of the interest of someone who can raid Mullvad offices. But I recently discovered a VPS provider who only needs an email address to confirm an order, so it can be used as a bootstrap for a something pretty anonymous. Still needs an email, but as I said in some other comment recently, you can do that (if you are okay with leaving some traces) with a Google device with WiFi only capability.

capableweb 3y ago

At least there have been some public and external audits that brings up the trust a bit, if you trust that those external companies are honest and putting their reputation on the line. List of the audits can be found here: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/

brookst 3y ago
Government investigations pursue lots of avenues unlikely to be fruitful. It's basic due diligence to check all the boxes; you don't say "standard procedure is to issue a warrant, but we'll make an exception to our process in this case because their website suggests it won't get any data, plus they hired an auditor."

justsomehnguy 3y ago

> Mullvad could have been, and maybe even still is, lying about how they operate Could they? Sure. Do they have anything on me? * One BTC transfer * IPs where I'm connecting from (if they are lying and storing them) * My traffic (if they are lying and storing it) * My unencrypted traffic (if they are lying and storing it) Do they have ... on me? * Email? - nope * Phone number? - nope * Credit card? - nope * My first name, family name? - nope * My address? - nope * My mother's maiden name? - nope Because I never provided it to them because they never asked for them.

ursuscamp 3y ago
Might I suggest for the future: https://vpn.sovereign.engineering https://vpn.sovereign.engineering You can pay a Bitcoin lightning invoice on this site and get a redeemable Mullvad voucher instantly. Extremely convenient. Since you've only done 1 BTC transaction, I assume it was a large one for lots of time. However, when your time runs out, this option is great. It's an extra layer of privacy and you don't have to wait for the transaction to settle on chain.
- pulpfictional 3y ago
  Monero is even better
echoer_lyrist 3y ago
Did you obtain the BTC that you used for the purchase from an exchange that requires PII?
- justsomehnguy 3y ago
  Exchange has my CC number and the 'card holder' (though I never put my name there, lol). A non-business card is probably the most easy way to identify someone globally. If someone comes to exchange - they could identify me (and they can just tap their server to listen to email which do have all the transaction info, including CC# in the plaintext, lol). To establish a correlation between my wallet and Mullvad account someone needs to find that transaction in Mullvad customer data. Which - they claim they don't have. So yes, someone can identity what I bought services from Mullvad and... nothing more?
tgsovlerkhgsel 3y ago
Unless you're using another VPN/proxy/Tor/... to connect to the VPN, the IP where you're connecting from (respectively the full 4-tuple including source/destination port) likely does identify your address.
- justsomehnguy 3y ago
  Of course. It doesn't help what I'm getting pretty much the same IPs from my provider. Double (triple|quad) hop, tied to different entities is necessary if you want at least plausible deniability. Thankfully I don't do things what may be of the interest of someone who can raid Mullvad offices. But I recently discovered a VPS provider who only needs an email address to confirm an order, so it can be used as a bootstrap for a something pretty anonymous. Still needs an email, but as I said in some other comment recently, you can do that (if you are okay with leaving some traces) with a Google device with WiFi only capability.