7 ms·

Which vpn was no-log-but-logging? I was shopping around for an alternative after mullvad blocked port forwarding, but it seems like no one else is as trustworth

Which vpn was no-log-but-logging? I was shopping around for an alternative after mullvad blocked port forwarding, but it seems like no one else is as trustworthy. Not that I need it for my “attempt to port forward smash ultimate from within crummy hospital internet” purposes, but hey, principle of the thing and all that.

julesallen 3y ago
You might like iVPN.net, been using them for years. A little more money but solid support and mission.
foobiekr 3y ago
All of them.
- trogdor 3y ago
  I am all-but-certain that NordVPN doesn't. I am in possession of records from a recent police investigation in which law enforcement subpoenaed NordVPN and the company replied, essentially, that they had no information connecting a particular IP address, at a specific date and time, to any specific user. (I am a reporter who covers law enforcement and crime.)
  - ejiblabahaba 3y ago
    Are you sure you're not thinking of Mullvad? Related: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917
    - trogdor 3y ago
      Yes. This is a totally unrelated case that never made the news.
      - wallaBBB 3y ago
        Countless examples of Nord supplying logs. They all have to keep logs or would be banned from offering services to US citizens.
        Timber-6539 3y ago
        Provide just one example. Am curious.
        wallaBBB 3y ago
        Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... Exact examples are hard to find in the press. One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed.
        Timber-6539 3y ago
        > Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. > Exact examples are hard to find in the press. You said there are countless examples of Nord logging user data, why are you backtracking now? > One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed. Give source or it did not happen.
        wallaBBB 3y ago
        >This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” Why you don't find articles googling is that Nord puts a lot of effort in removing or burring it (google their dispute with TorGuard). Same what they tried to do with the breach in 2018, they half-ass disclosed at least 6 months later after being known to them. (at a point in time the breach already leaked) Example I gave was a talk in a hacker conference, with no recording (common request for hacker conference talks).
  - rvba 3y ago
    Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. The (law enforcement) agencies can just go to the few biggest VPN suppliers. Just like they go to FAANG.
    - chollida1 3y ago
      > Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. Based on what? You just seem to be making a wild unsubstantiated conjecture here.
      - tarboreus 3y ago
        It's obviously an unsubstantiated statement, but given all the concrete information on the MOs of alphabet agencies, it seems like a reasonable bet. If they haven't done one of those things, they probably just haven't gotten around to it yet.
        deleted 3y ago
        [deleted]
        lazide 3y ago
        Frankly, they’d have to be criminally incompetent or negligent considering all the things we know for sure they’ve done.
      - KeplerBoy 3y ago
        It's the perfect honeypot situation, isn't it?
        foobiekr 3y ago
        Watering hole.
      - Nanana909 3y ago
        Is it that wild? There are a few questions we have to ask 1. Do these agencies have the motivation to do the above? I think the answer here is an obvious yes to everyone 2. Do these agencies have the technical ability to hack the VPNs, the finances to pay them for access, or some other reasonable measure to coerce compliance? If 1 and 2 are both true, then the OP claim is also certainly true. Given that 1 is true, I don’t think it’s “wild” to claim that these agencies cannot satisfy 2. In fact I’d say given the historical record, the more wild claim is that the CIA/NSA etc is incapable of satisfying #2.
  - Etheryte 3y ago
    You must be mistaking NordVPN for Mullvad.
    - trogdor 3y ago
      I am not. This is an unrelated case that has never been reported publicly.
      - Etheryte 3y ago
        This sounds somewhat hard to believe. If the description of events is accurate, this would be superb marketing for the VPN provider. Why would they not talk about it publicly?
  - dingle_thunk 3y ago
    There's no reason to have a link with intelligence agencies when you're already run by an intelligence agency...
  - nullc 3y ago
    Then that is a service then which might be safe for people who's opponents are the police. But some people also worry about threats from the obscenely rich, from their own intelligence agencies, from foreign intelligence agencies, from organized crime, and/or from popular mob outrage. Your experience doesn't indicate the safety of the service against those other threats, and not only may they not be correlated but they may be anti-correlated. E.g. I bet both CIA and mob run VPN services are really good at saying no to the police. The fundamental thought that drives my opinion on this subject is this: We already know for a fact that some state actors do broad scale full take surveillance of the internet. VPN services are even more attractive to monitor because the users are somewhat self-selecting as people who have something to hide, more intel bang per megabit monitored. Without surveilling VPNs these entities would have a blindspot in their expensive internet monitoring machine, so its important just for completeness sake. The VPN provider game is also a much lower barrier to entry, smaller players that don't have the power to push around AT&T can get in on it. Russia, for example, isn't in that much of a position to engage in world wide telecom monitoring (except perhaps that one fiber that goes through sibera and has really low latency between europe and china)-- but they sure can stand up some VPNs and get the worlds traffic to come to them. Plus, if you run a VPN service people will pay you to run their secret data through you. It's a profit center even before you get to the potential revenue streams from abusing your position. Perhaps it becomes so profitable that you'd prefer to protect it and so you minimize your abuse, but the optimal amount of abuse will pretty much never be zero. So, If you're the head of a clandestine service or serious organized crime group and you haven't launched at least one VPN service you should be immediately fired for grave incompetence. The best reason to not run one would just be that you've already infiltrated many existing ones through operatives and backdoored hardware. And also the heat you take running these services is much easier to deal with if you have 'connections' either of the run-by-a-TLA sort or the we-have-blackmail-material-and-can-break-your-fingers sort. And corrupt VPNs have a whole extra potential revenue/benefit source so they can afford to under-price any honest competition. Given that, we should expect that many VPNs are honeypots. Probably not all of them, but by their very nature it should be hard to impossible to tell which.
  - TedDoesntTalk 3y ago
    Here’s one such subpoena and reply (full PDF linked in the article): https://blog.getfoxyproxy.org/2017/11/04/secret-service-subpoena/ https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...
- djtango 3y ago
  I figured the Mozilla VPN might be safe...?
  - CyanBird 3y ago
    ... We'll figure it out in ten years or so after the eventual leaks happen
- LeBit 3y ago
  Trust me bro.
jokethrowaway 3y ago
buy a cheap vps server with btc and setup your own vpn
- UnixSchizoid 3y ago
  Or you could use a cloud providers free tier, but then you have to give up your credit card info and name for “verification”
- remram 3y ago
  You'd have to hope the VPS host is not logging...
  - deleted 3y ago
    [deleted]
  - LeBit 3y ago
    BuyVM supposedly ignores DMCA for their Luxembourg VPSs. Though, that IP you are using is not shared with anyone else and BuyVM doesn't promess not to log. That IP is directly correlated to you in BuyVM's books. That is the very worst option.
- Etheryte 3y ago
  Running your own VPN is the worst option though? There is no shared anonymity and all data is directly linked to one node, you.
ljm 3y ago
tl;dr if you want your network to be private, maybe don’t pay a saas to do it. Your ISP already tracks ingress and egress.
- anonym29 3y ago
  This is really the unfortunate truth. >90% of global ISP's not only collect but also sell netflow metadata commercially. Nanosecond timestamps, packet sizes, source IPs, destination IP's. Doesn't matter what VPN provider you use, whether you're using Tor, how many residential proxies you're routing through via a complex proxychains config... commercial entities can correlate virtually all of it. Team Cymru is one such buyer of bulk netflow metadata from ISP's (and their upstream providers) around the globe, who do all of the correlation work on their side, and then sell it, under product names like Pure Signal Recon (formerly Augury)... including to law enforcement agencies and the US military... There are also no laws dictating that ISP's must disclose whether or not they are selling that information, and they have no commercial incentive to choose to honestly disclose that they do. If your adversary is NSA/FBI/US Army, or any other deep-pocketed nation-state-level adversaries who Team Cymru is willing to sell to, the safest assumption is that there is absolutely nothing you can do to obscure the origin of your traffic with 100% certainty.
  - LeBit 3y ago
    Let's keep this simple. Let's say you are using an ISP to connect to a VPN provider. That VPN provider does what most of them do and SNATs multiple customers connections to a single exit public IP. How can they correlate the encrypted wireguard data from my ISP connection to the VPN provider and then from the VPN provider to the final endpoint (say, ProtonMail)?
    - anonym29 3y ago
      There is a known traffic pattern for a GET request to Protonmail - size of the initial request, # of subsequent requests (for subresources, like CSS, JS, images, etc), and size of those requests, as well as size of those responses. There is a known overhead for encapsulating these requests in an OpenVPN or WireGuard tunnel. So even without looking at the contents of the traffic at all, the metadata your ISP collects can easily reveal that you sent outbound traffic and received inbound traffic that had a high statistical correlation with the expected traffic flow of a request to Protonmail encapsulated within a Wireguard tunnel, to a known VPN node, and then a (known) number of milliseconds before that VPN's upstream provider also made a request that perfectly matched the expected packet flow of Protonmail. If you have visibility into the traffic netflow of both your ISP and the VPN's upstream provider, consider yourself confidently unmasked. The initial fingerprinting laid firm groundwork for your adversary to suspect you went to protonmail, and then the network behavior of the first destination machine you connected to simply offered confirmation of that. In case you're unfamiliar with the concept of website traffic metadata fingerprinting I've discussed above: https://www.ietf.org/archive/id/draft-irtf-pearg-website-fingerprinting-00.html https://www.ietf.org/archive/id/draft-irtf-pearg-website-fin...
dan15 3y ago
> I was shopping around for an alternative after mullvad blocked port forwarding AirVPN let you forward several ports (up to 20, if I remember correctly) and you can pick the port numbers.

julesallen 3y ago

You might like iVPN.net, been using them for years. A little more money but solid support and mission.

foobiekr 3y ago

All of them.

trogdor 3y ago
I am all-but-certain that NordVPN doesn't. I am in possession of records from a recent police investigation in which law enforcement subpoenaed NordVPN and the company replied, essentially, that they had no information connecting a particular IP address, at a specific date and time, to any specific user. (I am a reporter who covers law enforcement and crime.)
- ejiblabahaba 3y ago
  Are you sure you're not thinking of Mullvad? Related: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917
  - trogdor 3y ago
    Yes. This is a totally unrelated case that never made the news.
    - wallaBBB 3y ago
      Countless examples of Nord supplying logs. They all have to keep logs or would be banned from offering services to US citizens.
      - Timber-6539 3y ago
        Provide just one example. Am curious.
        wallaBBB 3y ago
        Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... Exact examples are hard to find in the press. One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed.
        Timber-6539 3y ago
        > Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. > Exact examples are hard to find in the press. You said there are countless examples of Nord logging user data, why are you backtracking now? > One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed. Give source or it did not happen.
        wallaBBB 3y ago
        >This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” Why you don't find articles googling is that Nord puts a lot of effort in removing or burring it (google their dispute with TorGuard). Same what they tried to do with the breach in 2018, they half-ass disclosed at least 6 months later after being known to them. (at a point in time the breach already leaked) Example I gave was a talk in a hacker conference, with no recording (common request for hacker conference talks).
- rvba 3y ago
  Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. The (law enforcement) agencies can just go to the few biggest VPN suppliers. Just like they go to FAANG.
  - chollida1 3y ago
    > Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. Based on what? You just seem to be making a wild unsubstantiated conjecture here.
    - tarboreus 3y ago
      It's obviously an unsubstantiated statement, but given all the concrete information on the MOs of alphabet agencies, it seems like a reasonable bet. If they haven't done one of those things, they probably just haven't gotten around to it yet.
      - deleted 3y ago
        [deleted]
      - lazide 3y ago
        Frankly, they’d have to be criminally incompetent or negligent considering all the things we know for sure they’ve done.
    - KeplerBoy 3y ago
      It's the perfect honeypot situation, isn't it?
      - foobiekr 3y ago
        Watering hole.
    - Nanana909 3y ago
      Is it that wild? There are a few questions we have to ask 1. Do these agencies have the motivation to do the above? I think the answer here is an obvious yes to everyone 2. Do these agencies have the technical ability to hack the VPNs, the finances to pay them for access, or some other reasonable measure to coerce compliance? If 1 and 2 are both true, then the OP claim is also certainly true. Given that 1 is true, I don’t think it’s “wild” to claim that these agencies cannot satisfy 2. In fact I’d say given the historical record, the more wild claim is that the CIA/NSA etc is incapable of satisfying #2.
- Etheryte 3y ago
  You must be mistaking NordVPN for Mullvad.
  - trogdor 3y ago
    I am not. This is an unrelated case that has never been reported publicly.
    - Etheryte 3y ago
      This sounds somewhat hard to believe. If the description of events is accurate, this would be superb marketing for the VPN provider. Why would they not talk about it publicly?
- dingle_thunk 3y ago
  There's no reason to have a link with intelligence agencies when you're already run by an intelligence agency...
- nullc 3y ago
  Then that is a service then which might be safe for people who's opponents are the police. But some people also worry about threats from the obscenely rich, from their own intelligence agencies, from foreign intelligence agencies, from organized crime, and/or from popular mob outrage. Your experience doesn't indicate the safety of the service against those other threats, and not only may they not be correlated but they may be anti-correlated. E.g. I bet both CIA and mob run VPN services are really good at saying no to the police. The fundamental thought that drives my opinion on this subject is this: We already know for a fact that some state actors do broad scale full take surveillance of the internet. VPN services are even more attractive to monitor because the users are somewhat self-selecting as people who have something to hide, more intel bang per megabit monitored. Without surveilling VPNs these entities would have a blindspot in their expensive internet monitoring machine, so its important just for completeness sake. The VPN provider game is also a much lower barrier to entry, smaller players that don't have the power to push around AT&T can get in on it. Russia, for example, isn't in that much of a position to engage in world wide telecom monitoring (except perhaps that one fiber that goes through sibera and has really low latency between europe and china)-- but they sure can stand up some VPNs and get the worlds traffic to come to them. Plus, if you run a VPN service people will pay you to run their secret data through you. It's a profit center even before you get to the potential revenue streams from abusing your position. Perhaps it becomes so profitable that you'd prefer to protect it and so you minimize your abuse, but the optimal amount of abuse will pretty much never be zero. So, If you're the head of a clandestine service or serious organized crime group and you haven't launched at least one VPN service you should be immediately fired for grave incompetence. The best reason to not run one would just be that you've already infiltrated many existing ones through operatives and backdoored hardware. And also the heat you take running these services is much easier to deal with if you have 'connections' either of the run-by-a-TLA sort or the we-have-blackmail-material-and-can-break-your-fingers sort. And corrupt VPNs have a whole extra potential revenue/benefit source so they can afford to under-price any honest competition. Given that, we should expect that many VPNs are honeypots. Probably not all of them, but by their very nature it should be hard to impossible to tell which.
- TedDoesntTalk 3y ago
  Here’s one such subpoena and reply (full PDF linked in the article): https://blog.getfoxyproxy.org/2017/11/04/secret-service-subpoena/ https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...
djtango 3y ago
I figured the Mozilla VPN might be safe...?
- CyanBird 3y ago
  ... We'll figure it out in ten years or so after the eventual leaks happen
LeBit 3y ago
Trust me bro.

jokethrowaway 3y ago

buy a cheap vps server with btc and setup your own vpn

UnixSchizoid 3y ago
Or you could use a cloud providers free tier, but then you have to give up your credit card info and name for “verification”
remram 3y ago
You'd have to hope the VPS host is not logging...
- deleted 3y ago
  [deleted]
- LeBit 3y ago
  BuyVM supposedly ignores DMCA for their Luxembourg VPSs. Though, that IP you are using is not shared with anyone else and BuyVM doesn't promess not to log. That IP is directly correlated to you in BuyVM's books. That is the very worst option.
Etheryte 3y ago
Running your own VPN is the worst option though? There is no shared anonymity and all data is directly linked to one node, you.

ljm 3y ago

tl;dr if you want your network to be private, maybe don’t pay a saas to do it. Your ISP already tracks ingress and egress.

anonym29 3y ago
This is really the unfortunate truth. >90% of global ISP's not only collect but also sell netflow metadata commercially. Nanosecond timestamps, packet sizes, source IPs, destination IP's. Doesn't matter what VPN provider you use, whether you're using Tor, how many residential proxies you're routing through via a complex proxychains config... commercial entities can correlate virtually all of it. Team Cymru is one such buyer of bulk netflow metadata from ISP's (and their upstream providers) around the globe, who do all of the correlation work on their side, and then sell it, under product names like Pure Signal Recon (formerly Augury)... including to law enforcement agencies and the US military... There are also no laws dictating that ISP's must disclose whether or not they are selling that information, and they have no commercial incentive to choose to honestly disclose that they do. If your adversary is NSA/FBI/US Army, or any other deep-pocketed nation-state-level adversaries who Team Cymru is willing to sell to, the safest assumption is that there is absolutely nothing you can do to obscure the origin of your traffic with 100% certainty.
- LeBit 3y ago
  Let's keep this simple. Let's say you are using an ISP to connect to a VPN provider. That VPN provider does what most of them do and SNATs multiple customers connections to a single exit public IP. How can they correlate the encrypted wireguard data from my ISP connection to the VPN provider and then from the VPN provider to the final endpoint (say, ProtonMail)?
  - anonym29 3y ago
    There is a known traffic pattern for a GET request to Protonmail - size of the initial request, # of subsequent requests (for subresources, like CSS, JS, images, etc), and size of those requests, as well as size of those responses. There is a known overhead for encapsulating these requests in an OpenVPN or WireGuard tunnel. So even without looking at the contents of the traffic at all, the metadata your ISP collects can easily reveal that you sent outbound traffic and received inbound traffic that had a high statistical correlation with the expected traffic flow of a request to Protonmail encapsulated within a Wireguard tunnel, to a known VPN node, and then a (known) number of milliseconds before that VPN's upstream provider also made a request that perfectly matched the expected packet flow of Protonmail. If you have visibility into the traffic netflow of both your ISP and the VPN's upstream provider, consider yourself confidently unmasked. The initial fingerprinting laid firm groundwork for your adversary to suspect you went to protonmail, and then the network behavior of the first destination machine you connected to simply offered confirmation of that. In case you're unfamiliar with the concept of website traffic metadata fingerprinting I've discussed above: https://www.ietf.org/archive/id/draft-irtf-pearg-website-fingerprinting-00.html https://www.ietf.org/archive/id/draft-irtf-pearg-website-fin...

dan15 3y ago

> I was shopping around for an alternative after mullvad blocked port forwarding AirVPN let you forward several ports (up to 20, if I remember correctly) and you can pick the port numbers.