10 ms·

I might be uninformed here, but on the surface Mullvad says they don't record customer data but there's always a chance they might be recording some data or lyi

by talhah 3y ago

I might be uninformed here, but on the surface Mullvad says they don't record customer data but there's always a chance they might be recording some data or lying. So I figure that authorities still obtained a search warrant to atleast see what data they can get their hands on and to verify that this is true. In that case, it doesn't really illustrate any disconnect. > Basic knowledge and a quick investigation would make clear that Mullvad is not storing any customer data. This is something more along the lines of trust. Sure you don't have to provide PII but Mullvad could supppsedly still be recording other data which would count as customer data.

capableweb 3y ago
> but there's always a chance they might be recording some data or lying. As mentioned in another comment, at least they would have to be lying + the external companies who've done the third-party audits would have to be lying too (including companies like Cure53).
- lxgr 3y ago
  An audit is always just a point-in-time (or possibly periodic) snapshot. A VPN company is also not a monolith: They have servers literally distributed around the globe. Ensuring physical security for all of them is not trivial, and I doubt that their auditors have visited every single data center. This is to say nothing of global traffic correlation capabilities of state-level actors; access to their servers network uplink is all that's needed to deanonymize many connections. Besides that, they have human staff as well, and while it's possible to distribute permissions and require four eyes for all important changes, there's always loopholes in a complex system. I have no reason to doubt that Mullvad is being truthful about any of their efforts or aspects of their service, but even if they're not, this is by no means equivalent to absolute security.
PragmaticPulp 3y ago
> So I figure that authorities still obtained a search warrant to atleast see what data they can get their hands on and to verify that this is true. In that case, it doesn't really illustrate any disconnect. They also need to follow process and make a reasonable attempt to follow a lead. They can’t just read a company’s website, assume that no evidence exists, and then give up on that line of exploration. Note that in several high profile cases, companies have publicly claimed to not be storing data but later been found to have incriminating logs. It would be irresponsible for them to not follow up with Mullvad, despite what they advertise. It doesn’t make sense to suggest that this is a disconnect with law enforcement.

by talhah 3y ago

capableweb 3y ago

> but there's always a chance they might be recording some data or lying. As mentioned in another comment, at least they would have to be lying + the external companies who've done the third-party audits would have to be lying too (including companies like Cure53).

lxgr 3y ago
An audit is always just a point-in-time (or possibly periodic) snapshot. A VPN company is also not a monolith: They have servers literally distributed around the globe. Ensuring physical security for all of them is not trivial, and I doubt that their auditors have visited every single data center. This is to say nothing of global traffic correlation capabilities of state-level actors; access to their servers network uplink is all that's needed to deanonymize many connections. Besides that, they have human staff as well, and while it's possible to distribute permissions and require four eyes for all important changes, there's always loopholes in a complex system. I have no reason to doubt that Mullvad is being truthful about any of their efforts or aspects of their service, but even if they're not, this is by no means equivalent to absolute security.

PragmaticPulp 3y ago

> So I figure that authorities still obtained a search warrant to atleast see what data they can get their hands on and to verify that this is true. In that case, it doesn't really illustrate any disconnect. They also need to follow process and make a reasonable attempt to follow a lead. They can’t just read a company’s website, assume that no evidence exists, and then give up on that line of exploration. Note that in several high profile cases, companies have publicly claimed to not be storing data but later been found to have incriminating logs. It would be irresponsible for them to not follow up with Mullvad, despite what they advertise. It doesn’t make sense to suggest that this is a disconnect with law enforcement.