3 ms·
> but there's always a chance they might be recording some data or lying. As mentioned in another comment, at least they would have to be lying + the external
by capableweb 3y ago
> but there's always a chance they might be recording some data or lying.
As mentioned in another comment, at least they would have to be lying + the external companies who've done the third-party audits would have to be lying too (including companies like Cure53).
- lxgr 3y agoAn audit is always just a point-in-time (or possibly periodic) snapshot. A VPN company is also not a monolith: They have servers literally distributed around the globe. Ensuring physical security for all of them is not trivial, and I doubt that their auditors have visited every single data center. This is to say nothing of global traffic correlation capabilities of state-level actors; access to their servers network uplink is all that's needed to deanonymize many connections. Besides that, they have human staff as well, and while it's possible to distribute permissions and require four eyes for all important changes, there's always loopholes in a complex system. I have no reason to doubt that Mullvad is being truthful about any of their efforts or aspects of their service, but even if they're not, this is by no means equivalent to absolute security.