5 ms·

You can pay for the service by mailing them cash: https://mullvad.net/en/pricing https://mullvad.net/en/pricing They run servers with no hard drives: https://m

You can pay for the service by mailing them cash: https://mullvad.net/en/pricing https://mullvad.net/en/pricing They run servers with no hard drives: https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infrastructure-to-more-locations-system-transparency-stboot/ https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infr...

dharmab 3y ago
Not just no drives but, but also no logs, and per their last audit they're working towards no administrator access to the shell.
- foobiekr 3y ago
  If they can update software they have administrator access any time they want it.
  - dharmab 3y ago
    But that requires compromising the supply chain rather than a single admin's account.
    - foobiekr 3y ago
      No it just requires the company wanting to do it due to a government order. The “compromise” is coming from inside the house. Might as well claim no one knows the admin passwords because they are written in a notebook that the management keeps in their home safe.
- Thaxll 3y ago
  How do they comply with countries that requiere logs actually?
  - lolinder 3y ago
    Presumably by operating in a country that doesn't.
foobiekr 3y ago
The cash thing is awesome and good for them. That said, I don't know if Mullvad is good or evil, but one of the ways you can evaluate companies is to recognize when they're making sketchy, not-relevant claims to create an air of legitimacy. This "our servers have no disks" thing is kind of thing is marketing. It is meant to imply something that it doesn't actually demonstrate. Who cares if there are local disks? It doesn't change the threat model at all, it's mostly to convince people who don't know very much about claims which are basically impossible to prove. It's the higher-tier version of "we use military grade encryption." Lawful Intercept on the public internet does not rely on local hard drives on any node in the network and has not since the 90s, as a specific example of how meaningless this is.
- dharmab 3y ago
  In Sweden, physical search of the drives is a real concern. The Swedish national police attempted to search Mullvad once, but since there was no data to seize they left empty handed.
  - anigbrowl 3y ago
    Realistically, what prevents police from just sticking in a USB device and doing a memory dump? I'm not sure I buy this story since police with a sufficiently strong warrant can always just take over a firm's premises and bring in their own forensic people until they find what they want.
    - cstrahan 3y ago
      I could be wrong, but I would think that a conveniently timed power outage would prevent the memory dumping scenario :)
      - anigbrowl 3y ago
        Unless you automate this process to flush all memory periodically, this seems like a good way to get charged for interfering with an investigation or have your assets seized and thrown into legal limbo. Police aren't complete morons, in the real world goofing around like this has consequences.
vinay_ys 3y ago
You cannot hide from governments. If they want you badly enough they can track you anywhere. So, don't do anything illegal and expect any VPN to protect you because paid in cash! Remember, all governments have secret national security laws to surveil all data all the time and almost all governments' (even supposed enemies) secret national security agencies cooperate if they badly want to catch someone. You cannot hide from advertisers if you use a smartphone with apps. App developers who put ads within their app control the apps behavior completely and hence they can fingerprint your device and track you very well without using IP addresses. And within browsers, they can fingerprint you through many javascript features of the browser. Hiding your source IP does very little for your privacy. Almost all traffic (apps and websites) are encrypted via TLS (https, for example). So, even if you are on an insecure network, unless your OS's TLS certificate store is compromised, your communications are encrypted and protected against snooping from that insecure network. Also, even on open wifi networks, today, it is very unlikely that the wifi is running without at least WPA2 encryption. Most modern airports run secure wifi. (But they also monitor all traffic metadata for illegal activities). So, using a VPN as an exit node is just privacy theatre. VPN exit nodes in faraway countries are useful for bypassing content censorship in your own country, but it works only if the content streaming service cooperates with you. Remember, all ISPs are heavily regulated by governments and can be asked to mirror specific customer's traffic for analysis. I would be very surprised if they don't proactively do it for all VPN operator nodes by default.
- ballenf 3y ago
  Are there browser plugins that can "fake" your browser fingerprint somewhat? Like, e.g., only showing OS default fonts installed, or fixing screen dimension info, etc? Or would this require forking a browser's code? Maybe futile, but I'd still consider using it.
  - bananapub 3y ago
    yes, and it's one of the things the Tor browser does to make fingerprinting harder.
    - 3y ago
SleekEagle 3y ago
You can mail in cash for ivpn too

dharmab 3y ago

Not just no drives but, but also no logs, and per their last audit they're working towards no administrator access to the shell.

foobiekr 3y ago
If they can update software they have administrator access any time they want it.
- dharmab 3y ago
  But that requires compromising the supply chain rather than a single admin's account.
  - foobiekr 3y ago
    No it just requires the company wanting to do it due to a government order. The “compromise” is coming from inside the house. Might as well claim no one knows the admin passwords because they are written in a notebook that the management keeps in their home safe.
Thaxll 3y ago
How do they comply with countries that requiere logs actually?
- lolinder 3y ago
  Presumably by operating in a country that doesn't.

foobiekr 3y ago

The cash thing is awesome and good for them. That said, I don't know if Mullvad is good or evil, but one of the ways you can evaluate companies is to recognize when they're making sketchy, not-relevant claims to create an air of legitimacy. This "our servers have no disks" thing is kind of thing is marketing. It is meant to imply something that it doesn't actually demonstrate. Who cares if there are local disks? It doesn't change the threat model at all, it's mostly to convince people who don't know very much about claims which are basically impossible to prove. It's the higher-tier version of "we use military grade encryption." Lawful Intercept on the public internet does not rely on local hard drives on any node in the network and has not since the 90s, as a specific example of how meaningless this is.

dharmab 3y ago
In Sweden, physical search of the drives is a real concern. The Swedish national police attempted to search Mullvad once, but since there was no data to seize they left empty handed.
- anigbrowl 3y ago
  Realistically, what prevents police from just sticking in a USB device and doing a memory dump? I'm not sure I buy this story since police with a sufficiently strong warrant can always just take over a firm's premises and bring in their own forensic people until they find what they want.
  - cstrahan 3y ago
    I could be wrong, but I would think that a conveniently timed power outage would prevent the memory dumping scenario :)
    - anigbrowl 3y ago
      Unless you automate this process to flush all memory periodically, this seems like a good way to get charged for interfering with an investigation or have your assets seized and thrown into legal limbo. Police aren't complete morons, in the real world goofing around like this has consequences.

vinay_ys 3y ago

You cannot hide from governments. If they want you badly enough they can track you anywhere. So, don't do anything illegal and expect any VPN to protect you because paid in cash! Remember, all governments have secret national security laws to surveil all data all the time and almost all governments' (even supposed enemies) secret national security agencies cooperate if they badly want to catch someone. You cannot hide from advertisers if you use a smartphone with apps. App developers who put ads within their app control the apps behavior completely and hence they can fingerprint your device and track you very well without using IP addresses. And within browsers, they can fingerprint you through many javascript features of the browser. Hiding your source IP does very little for your privacy. Almost all traffic (apps and websites) are encrypted via TLS (https, for example). So, even if you are on an insecure network, unless your OS's TLS certificate store is compromised, your communications are encrypted and protected against snooping from that insecure network. Also, even on open wifi networks, today, it is very unlikely that the wifi is running without at least WPA2 encryption. Most modern airports run secure wifi. (But they also monitor all traffic metadata for illegal activities). So, using a VPN as an exit node is just privacy theatre. VPN exit nodes in faraway countries are useful for bypassing content censorship in your own country, but it works only if the content streaming service cooperates with you. Remember, all ISPs are heavily regulated by governments and can be asked to mirror specific customer's traffic for analysis. I would be very surprised if they don't proactively do it for all VPN operator nodes by default.

ballenf 3y ago
Are there browser plugins that can "fake" your browser fingerprint somewhat? Like, e.g., only showing OS default fonts installed, or fixing screen dimension info, etc? Or would this require forking a browser's code? Maybe futile, but I'd still consider using it.
- bananapub 3y ago
  yes, and it's one of the things the Tor browser does to make fingerprinting harder.
  - 3y ago

SleekEagle 3y ago

You can mail in cash for ivpn too