3 ms·

Thought experiment: build your own VPN company that doesn't log anything and try to convince people like you that you don't do any logging

zirgs 3y ago
If you don't do any logging and don't want to know what your users are doing - it means that you won't have to deal with the cops as much. And there won't be any risk of those logs getting leaked or stolen . Unless you're de-facto part of the government like Google and Microsoft - I see no good reason to log anything more than what's legally required.
- waithuh 3y ago
  ...why do that when you can simply sell though?
  - zirgs 3y ago
    Sell what? Browsing data of VPN users? That would be easy to check.
    - waithuh 3y ago
      How easy is the question. 1. Browsing habits would hardly have an affect on the vast array of data to have an effect on ads presented to you, unless you care about your privacy. Its all target auidence and marketing (look at ExpressVPN or Surfshark. They all offer privacy but never follow up) 2. Their algorithms can avoid showing you ads derived from the VPN if it detects the usage of your actual IP
      - zirgs 3y ago
        If they sell data then it's possible to buy that data. So a security researcher could simply try buying that data and then expose that VPN provider.
        waithuh 3y ago
        The market for data is shady. They can simply sign contracts with a few reputable "market intelligence" firms. I am also very sure that another VPN firm wouldnt mind being a proxy seller the browsing data in return for some comission.
red-iron-pine 3y ago
how do you troubleshoot? how do you monitor? how do you check for malicious behavior from clients or 3rd parties? how do you keep your providers honest? actually a very interesting experiment
sneak 3y ago
I think you misunderstood me. You seem to take my comment as input to an assumption that I think they are logging. I don't know if they are logging or not. They say they aren't. The audit says they didn't see evidence that they are. It's impossible to prove a negative.

zirgs 3y ago

If you don't do any logging and don't want to know what your users are doing - it means that you won't have to deal with the cops as much. And there won't be any risk of those logs getting leaked or stolen . Unless you're de-facto part of the government like Google and Microsoft - I see no good reason to log anything more than what's legally required.

waithuh 3y ago
...why do that when you can simply sell though?
- zirgs 3y ago
  Sell what? Browsing data of VPN users? That would be easy to check.
  - waithuh 3y ago
    How easy is the question. 1. Browsing habits would hardly have an affect on the vast array of data to have an effect on ads presented to you, unless you care about your privacy. Its all target auidence and marketing (look at ExpressVPN or Surfshark. They all offer privacy but never follow up) 2. Their algorithms can avoid showing you ads derived from the VPN if it detects the usage of your actual IP
    - zirgs 3y ago
      If they sell data then it's possible to buy that data. So a security researcher could simply try buying that data and then expose that VPN provider.
      - waithuh 3y ago
        The market for data is shady. They can simply sign contracts with a few reputable "market intelligence" firms. I am also very sure that another VPN firm wouldnt mind being a proxy seller the browsing data in return for some comission.

red-iron-pine 3y ago

how do you troubleshoot? how do you monitor? how do you check for malicious behavior from clients or 3rd parties? how do you keep your providers honest? actually a very interesting experiment

sneak 3y ago

I think you misunderstood me. You seem to take my comment as input to an assumption that I think they are logging. I don't know if they are logging or not. They say they aren't. The audit says they didn't see evidence that they are. It's impossible to prove a negative.