5 ms·

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law en

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

aaomidi 3y ago
https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf https://www.assured.se/publications/Assured_Mullvad_relay_se... Honestly I don’t think audits are worth anything. But it’d be a huge conspiracy to mess with so many parties.
- foobiekr 3y ago
  This is a sec eval. It doesn’t eval what the service can do.
  - Ajedi32 3y ago
    Sections 2.1.1 and 3.1.18
- verandaguy 3y ago
  Audits are IMO worthwhile, but end users should be aware of the scope of an audit. In the context of commercial VPN providers, it's usually just a code security audit -- are there any memory leaks? Is sensitive data being passed around a little bit too loosely? Is there some way for unprivileged users to gain privilege escalation by crafting a malicious request against one of your services? In this sense, they're valuable. As someone working in software, I can figure out if the bugs were subtle or blatant, which is often a good proxy metric for the competence of the team behind the product. Are the same bugs cropping up year after year, even if they've already been previously fixed in other parts of the code? Again, a good red flag to use there. Audits do not and often cannot cover things like "is the company reselling connection/user metadata to other companies," though, and in most cases consumers will care that there is an audit rather than caring what's in the audit.
  - patrakov 3y ago
    Well... using PureVPN as an example. They claim that they have been audited twice. First audit, from 2019: https://my.purevpn.com/pdf/Privacy_No_Log_Audit_Report.pdf https://my.purevpn.com/pdf/Privacy_No_Log_Audit_Report.pdf I tried to contact the auditor, Altius IT, in order to confirm whether exfiltrating connection data to a third party would result in the audit failure. They replied, but in a very vague way (refused to answer any questions regarding Altius IT's audit of PureVPN's environment). Well, at least they confirmed indirectly that the audit did exist. Second audit, from 2023: https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_PureVPN_TPA_Letter_2023-04-FINAL-2.pdf https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_Pure... I tried to contact KPMG to verify the authenticity of that report, and also asked the same question - "whether deliberate real-time exfiltration of origin IP addresses, assigned VPN IP addresses, connection timestamps, or connected user activities to a third party by PureVPN, without PureVPN (as opposed to that hypothetical third party) storing anything locally in any form of logs, would have constituted a failure of the privacy assessment." Result: no reply from KPMG at all, so I cannot be sure even that the report indeed comes from KPMG and is not a fake.
    - verandaguy 3y ago
      There are bad auditors, of course. Having had the displeasure of working with KPMG (not in a code-security-audit setting, mercifully), I genuinely don't understand how their staff can be allowed within a ten mile radius of source code. The ideal way to authenticate audits IMO would be for the audited entity to link back to a PDF or other report hosted on the auditor's site.
  - aaomidi 3y ago
    Honestly, this audit from Mullvad is showing some really rookie mistakes.
foobiekr 3y ago
This is how lawful intercept systems have worked since the nineties. You’d have to go look at their jurisdiction to see whether there are laws mandating LI that impact vpn providers. Or Mulvad could clear it up, I guess. Sweden absolutely has LI requirements for all telecom gear but vpns I have no idea.
lopkeny12ko 3y ago
This has never made any sense to me. I'm surprised this isn't a massive red flag from anyone on HN. Running a production-grade service with zero metrics and logs? If there's an outage, or even something as mundane as a VM failing to provision, you're telling me that Mullvad developers just shrug and say "well, we can't do anything, because there's no logs!" I don't use a third party VPN, but if I wanted to, "we deliberately eschew all observability" is not a positive selling point.
- klysm 3y ago
  you can send logs and metrics over the network. the important part to users is not logging the traffic info
  - lopkeny12ko 3y ago
    Sending them over the network to where? "We don't store logs" means they certainly aren't being ingested into any persistent storage. I'm highly interested in how one can run time-series queries over /dev/null.
    - CydeWeys 3y ago
      They never said "We don't store logs". What they said is they don't keep logs of user activity. You're arguing against a strawman. https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
    - klysm 3y ago
      you are conflating logs & metrics with user activity logs.
- eddythompson80 3y ago
  Yes, because it’s a simple service (VPN) that hasn’t added a billion nonesense features over time. You can log VM provisioning and health logs but as long as you don’t log any wireguard logs or user provisioning logs you’re good.
- 3y ago
2OEH8eoCRo0 3y ago
To claim such a thing you should put up some evidence. I think they are actually streaming all data to the Martians.
eddythompson80 3y ago
Given the ridiculous number of VPN providers that say that, how are they keeping the secret exactly?
NoMoreNicksLeft 3y ago
I don't think that the Houston Police Department (or whichever city you're in) is sophisticated enough to set up an NSA-fiber-optic-backbone-data-siphoning operation. Yes, the NYPD is known to buy illegal million dollar cell phone interceptor machines, but that's about it the maximum level that sort of thing ever goes, for the largest municipal law enforcement agency in the United States. Like, how would that even work? Without a court gag order, gossip would make its way out of the building in weeks. The cell phone shit only was only quasi-secret because only police department employees were involved, something that's impossible for these VPN outfits. They don't get any of the (unjustified) privilege that the CIA or NSA (or even the FBI, sometimes) receive. Anything I might do that could pique the curiosity of law enforcement is definitely below the level of federal intelligence agency interest. Maybe your life is more exciting though.
mplewis 3y ago
What evidence makes you believe this is happening?
- rsaxvc 3y ago
  Historical: Room 641A at AT&T in the US.
- deleted 3y ago
  [deleted]
- karaterobot 3y ago
  I inferred that they were speculating, not that they had a smoking gun piece of evidence. The word "probably" is what tipped me off, ymmv.
- mrsalt 3y ago
  Everyone said this about global surveillance before Snowden and yet. I don't see the value in questioning if this is true or not, rather I think we should assume it's true and act as such, isn't that what modern security is about? (see: HTTPS/DNSSEC/DoH etc) I frankly wouldn't be surprised if it's actually happening.
eviks 3y ago
If you're that compromised, wouldn't it be much easier to just log and lie about it?
- smith7018 3y ago
  Lying about it opens you up to potential litigation and being exposed through discovery. It makes less sense to outwardly lie to paying customers rather than simply lie by omission.
  - hinkley 3y ago
    I can just imagine EFF drooling over such a prospect.
    - TheRealPomax 3y ago
      The EFF wants a world where this kind of BS, and consequent litigation, is a thing of the past. If there's water running down their face, it's tears, not drool. We deserve a better world.
      - hinkley 3y ago
        You get there by either getting congress to pass laws or by setting legal precedent in the court. That’s the goal of the legal arm. Not to fight every bullshit civil liberties case, but to fight the last one that doesn’t get thrown out in court. If you don’t think they look forward to those cases, I think you’re the one who has read them wrong, not me.
- CrazyPyroLinux 3y ago
  this is what "warrant canaries" are for. dont use anyone who doesnt have one
  - NegativeK 3y ago
    There should probably be case law before anyone actually believes in warrant canaries. 'If it's illegal to advertise that you've received a court order of some kind, it's illegal to intentionally and knowingly take any action that has the effect of advertising the receipt of that order. A judge can't force you to do anything, but every lawyer I've spoken to has indicated that having a "canary" you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something. If any lawyers have a different legal interpretation, I'd love to hear it.' --Moxie Marlinspike
verandaguy 3y ago
I formerly worked for a somewhat-older mainstream consumer VPN provider for a few years, to the extent that you can take my word for it, this is not industry-standard practice at least as far as the provider is able to control it. Commercial VPNs typically run on rental servers -- usually a mix of the major cloud providers and smaller hosting providers -- and in my former company's case, using dedicated hosting (bare metal where available). Steps were taken to restrict access for physical actors, but ultimately, the mantra's always that physical access basically guarantees data access on a long enough timeline if you assume there's a bad actor in the mix. That said, to the best of my memory, there were no indications of this kind of data siphoning happening without our knowledge, and we absolutely didn't take part in it ourselves knowingly. Occasional requests would come in from various international law enforcement orgs, and every time they'd be replied to with a message about how we don't store user records (which was a truthful reply AFAIK). The biggest challenge for us was competing with some of the newer actors in the space, taking advantage of deceptive marketing and engaging in (IMO) unethical business practices for the sector: - Claims of "no logging," even backed up by audits, are only ever point-in-time measurements, and may not reflect reality if the VPN provider approaches the auditors in bad faith (say, with a sanitized code base); a good auditor in my experience will refuse to make this claim in the report - Claims about having the corporate HQ in one country making it immune from the laws of countries they operate servers in (this is deceptive marketing; failure to comply with laws will get you shut down, and at my old employer we'd make calls about whether to just drop our server presence in a country entirely in response to local laws and political happenings) - Commercial resale of user data is (allegedly) rampant among many of the newer providers you see constantly plugged on Youtube. This isn't helped by the massive consolidation of the VPN market under just 2 or 3 holding companies. I won't name names for the companies I mentioned above, but my recommendation is to adjust your threat model from "nation-state level surveillance" to "commercial data resale just like every other web service." As far as data collection went for my old company: we collected system metrics like resource usage over time, and kept minimal sanitized logs to help diagnose any production issues that'd come up -- basically the absolute minimum amount of data we needed to keep the service operating smoothly. I have every reason to believe this is an industry norm, since otherwise development and troubleshooting would be nearly impossible. Anyway, there's also the looming "threat" (lol) of HTTPS and encrypted DNS proliferation and improvement making the core use case for commercial VPNs obsolete. I think anyone who's spent a bit of time in that industry realizes that the business model isn't long for this earth as a result, so I suspect many are trying to milk the industry for all it's worth. Personally, I'm all for HTTPS and encrypted DNS proliferation, and I'm also hoping more and more commercial public networks start using virtual private subnets and other device isolation features to make it even harder to abuse coffee shop Wi-Fi.
traceroute66 3y ago
> I wonder about those VPNs that say "we don't log or store anything". That may be the case, but... There may inevitably be some bad actors. But then there are other companies like OVPN who proved in court that when they say no logging they mean it[1]. [1] https://www.ovpn.com/en/blog/ovpn-wins-court-order https://www.ovpn.com/en/blog/ovpn-wins-court-order
vinay_ys 3y ago
Even with an honest company, the pressures on them are twofold – security and legal. Their systems can be compromised through security vulnerabilities and social engineering (including coercion – money, ideology, compromise, ego – classic psyops playbook). Or they can get legal government orders - which pretty much every government in the world have laws on books and operational practices to force any actor to hand-over data in the name of fighting money laundering and terrorism (AML/CFT). It is very expensive to put up strong defenses against these. I don't see a viable business model charging $5/month that covers regular operational expenses and covers these types of events. Edit: Forgot to mention backdoors built into basic technologies they may already be using – like the Cavium HSM thing that came to light earlier this week.
- ehhthing 3y ago
  You know at that point why not just hack Level3, Cogent, Telia, Zayo or some other T1 provider? Frankly VPNs don't protect you from anything other than the most monitoring systems and the occasional public wifi connection. They're really just glorified Netflix region proxies and nothing more to most people
NegativeK 3y ago
That's an... interesting? interpretation of what logging is. What you've described, to me, is the VPN logging customer activity and then sending it elsewhere to be stored.
KomoD 3y ago
> but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log" No they can't, because THEY are still logging.
deleted 3y ago
[deleted]

aaomidi 3y ago

https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf https://www.assured.se/publications/Assured_Mullvad_relay_se... Honestly I don’t think audits are worth anything. But it’d be a huge conspiracy to mess with so many parties.

foobiekr 3y ago
This is a sec eval. It doesn’t eval what the service can do.
- Ajedi32 3y ago
  Sections 2.1.1 and 3.1.18
verandaguy 3y ago
Audits are IMO worthwhile, but end users should be aware of the scope of an audit. In the context of commercial VPN providers, it's usually just a code security audit -- are there any memory leaks? Is sensitive data being passed around a little bit too loosely? Is there some way for unprivileged users to gain privilege escalation by crafting a malicious request against one of your services? In this sense, they're valuable. As someone working in software, I can figure out if the bugs were subtle or blatant, which is often a good proxy metric for the competence of the team behind the product. Are the same bugs cropping up year after year, even if they've already been previously fixed in other parts of the code? Again, a good red flag to use there. Audits do not and often cannot cover things like "is the company reselling connection/user metadata to other companies," though, and in most cases consumers will care that there is an audit rather than caring what's in the audit.
- patrakov 3y ago
  Well... using PureVPN as an example. They claim that they have been audited twice. First audit, from 2019: https://my.purevpn.com/pdf/Privacy_No_Log_Audit_Report.pdf https://my.purevpn.com/pdf/Privacy_No_Log_Audit_Report.pdf I tried to contact the auditor, Altius IT, in order to confirm whether exfiltrating connection data to a third party would result in the audit failure. They replied, but in a very vague way (refused to answer any questions regarding Altius IT's audit of PureVPN's environment). Well, at least they confirmed indirectly that the audit did exist. Second audit, from 2023: https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_PureVPN_TPA_Letter_2023-04-FINAL-2.pdf https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_Pure... I tried to contact KPMG to verify the authenticity of that report, and also asked the same question - "whether deliberate real-time exfiltration of origin IP addresses, assigned VPN IP addresses, connection timestamps, or connected user activities to a third party by PureVPN, without PureVPN (as opposed to that hypothetical third party) storing anything locally in any form of logs, would have constituted a failure of the privacy assessment." Result: no reply from KPMG at all, so I cannot be sure even that the report indeed comes from KPMG and is not a fake.
  - verandaguy 3y ago
    There are bad auditors, of course. Having had the displeasure of working with KPMG (not in a code-security-audit setting, mercifully), I genuinely don't understand how their staff can be allowed within a ten mile radius of source code. The ideal way to authenticate audits IMO would be for the audited entity to link back to a PDF or other report hosted on the auditor's site.
- aaomidi 3y ago
  Honestly, this audit from Mullvad is showing some really rookie mistakes.

foobiekr 3y ago

This is how lawful intercept systems have worked since the nineties. You’d have to go look at their jurisdiction to see whether there are laws mandating LI that impact vpn providers. Or Mulvad could clear it up, I guess. Sweden absolutely has LI requirements for all telecom gear but vpns I have no idea.

lopkeny12ko 3y ago

This has never made any sense to me. I'm surprised this isn't a massive red flag from anyone on HN. Running a production-grade service with zero metrics and logs? If there's an outage, or even something as mundane as a VM failing to provision, you're telling me that Mullvad developers just shrug and say "well, we can't do anything, because there's no logs!" I don't use a third party VPN, but if I wanted to, "we deliberately eschew all observability" is not a positive selling point.

klysm 3y ago
you can send logs and metrics over the network. the important part to users is not logging the traffic info
- lopkeny12ko 3y ago
  Sending them over the network to where? "We don't store logs" means they certainly aren't being ingested into any persistent storage. I'm highly interested in how one can run time-series queries over /dev/null.
  - CydeWeys 3y ago
    They never said "We don't store logs". What they said is they don't keep logs of user activity. You're arguing against a strawman. https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
  - klysm 3y ago
    you are conflating logs & metrics with user activity logs.
eddythompson80 3y ago
Yes, because it’s a simple service (VPN) that hasn’t added a billion nonesense features over time. You can log VM provisioning and health logs but as long as you don’t log any wireguard logs or user provisioning logs you’re good.
3y ago

2OEH8eoCRo0 3y ago

To claim such a thing you should put up some evidence. I think they are actually streaming all data to the Martians.

eddythompson80 3y ago

Given the ridiculous number of VPN providers that say that, how are they keeping the secret exactly?

NoMoreNicksLeft 3y ago

I don't think that the Houston Police Department (or whichever city you're in) is sophisticated enough to set up an NSA-fiber-optic-backbone-data-siphoning operation. Yes, the NYPD is known to buy illegal million dollar cell phone interceptor machines, but that's about it the maximum level that sort of thing ever goes, for the largest municipal law enforcement agency in the United States. Like, how would that even work? Without a court gag order, gossip would make its way out of the building in weeks. The cell phone shit only was only quasi-secret because only police department employees were involved, something that's impossible for these VPN outfits. They don't get any of the (unjustified) privilege that the CIA or NSA (or even the FBI, sometimes) receive. Anything I might do that could pique the curiosity of law enforcement is definitely below the level of federal intelligence agency interest. Maybe your life is more exciting though.

mplewis 3y ago

What evidence makes you believe this is happening?

rsaxvc 3y ago
Historical: Room 641A at AT&T in the US.
deleted 3y ago
[deleted]
karaterobot 3y ago
I inferred that they were speculating, not that they had a smoking gun piece of evidence. The word "probably" is what tipped me off, ymmv.
mrsalt 3y ago
Everyone said this about global surveillance before Snowden and yet. I don't see the value in questioning if this is true or not, rather I think we should assume it's true and act as such, isn't that what modern security is about? (see: HTTPS/DNSSEC/DoH etc) I frankly wouldn't be surprised if it's actually happening.

eviks 3y ago

If you're that compromised, wouldn't it be much easier to just log and lie about it?

smith7018 3y ago
Lying about it opens you up to potential litigation and being exposed through discovery. It makes less sense to outwardly lie to paying customers rather than simply lie by omission.
- hinkley 3y ago
  I can just imagine EFF drooling over such a prospect.
  - TheRealPomax 3y ago
    The EFF wants a world where this kind of BS, and consequent litigation, is a thing of the past. If there's water running down their face, it's tears, not drool. We deserve a better world.
    - hinkley 3y ago
      You get there by either getting congress to pass laws or by setting legal precedent in the court. That’s the goal of the legal arm. Not to fight every bullshit civil liberties case, but to fight the last one that doesn’t get thrown out in court. If you don’t think they look forward to those cases, I think you’re the one who has read them wrong, not me.
CrazyPyroLinux 3y ago
this is what "warrant canaries" are for. dont use anyone who doesnt have one
- NegativeK 3y ago
  There should probably be case law before anyone actually believes in warrant canaries. 'If it's illegal to advertise that you've received a court order of some kind, it's illegal to intentionally and knowingly take any action that has the effect of advertising the receipt of that order. A judge can't force you to do anything, but every lawyer I've spoken to has indicated that having a "canary" you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something. If any lawyers have a different legal interpretation, I'd love to hear it.' --Moxie Marlinspike

verandaguy 3y ago

I formerly worked for a somewhat-older mainstream consumer VPN provider for a few years, to the extent that you can take my word for it, this is not industry-standard practice at least as far as the provider is able to control it. Commercial VPNs typically run on rental servers -- usually a mix of the major cloud providers and smaller hosting providers -- and in my former company's case, using dedicated hosting (bare metal where available). Steps were taken to restrict access for physical actors, but ultimately, the mantra's always that physical access basically guarantees data access on a long enough timeline if you assume there's a bad actor in the mix. That said, to the best of my memory, there were no indications of this kind of data siphoning happening without our knowledge, and we absolutely didn't take part in it ourselves knowingly. Occasional requests would come in from various international law enforcement orgs, and every time they'd be replied to with a message about how we don't store user records (which was a truthful reply AFAIK). The biggest challenge for us was competing with some of the newer actors in the space, taking advantage of deceptive marketing and engaging in (IMO) unethical business practices for the sector: - Claims of "no logging," even backed up by audits, are only ever point-in-time measurements, and may not reflect reality if the VPN provider approaches the auditors in bad faith (say, with a sanitized code base); a good auditor in my experience will refuse to make this claim in the report - Claims about having the corporate HQ in one country making it immune from the laws of countries they operate servers in (this is deceptive marketing; failure to comply with laws will get you shut down, and at my old employer we'd make calls about whether to just drop our server presence in a country entirely in response to local laws and political happenings) - Commercial resale of user data is (allegedly) rampant among many of the newer providers you see constantly plugged on Youtube. This isn't helped by the massive consolidation of the VPN market under just 2 or 3 holding companies. I won't name names for the companies I mentioned above, but my recommendation is to adjust your threat model from "nation-state level surveillance" to "commercial data resale just like every other web service." As far as data collection went for my old company: we collected system metrics like resource usage over time, and kept minimal sanitized logs to help diagnose any production issues that'd come up -- basically the absolute minimum amount of data we needed to keep the service operating smoothly. I have every reason to believe this is an industry norm, since otherwise development and troubleshooting would be nearly impossible. Anyway, there's also the looming "threat" (lol) of HTTPS and encrypted DNS proliferation and improvement making the core use case for commercial VPNs obsolete. I think anyone who's spent a bit of time in that industry realizes that the business model isn't long for this earth as a result, so I suspect many are trying to milk the industry for all it's worth. Personally, I'm all for HTTPS and encrypted DNS proliferation, and I'm also hoping more and more commercial public networks start using virtual private subnets and other device isolation features to make it even harder to abuse coffee shop Wi-Fi.

traceroute66 3y ago

> I wonder about those VPNs that say "we don't log or store anything". That may be the case, but... There may inevitably be some bad actors. But then there are other companies like OVPN who proved in court that when they say no logging they mean it[1]. [1] https://www.ovpn.com/en/blog/ovpn-wins-court-order https://www.ovpn.com/en/blog/ovpn-wins-court-order

vinay_ys 3y ago

Even with an honest company, the pressures on them are twofold – security and legal. Their systems can be compromised through security vulnerabilities and social engineering (including coercion – money, ideology, compromise, ego – classic psyops playbook). Or they can get legal government orders - which pretty much every government in the world have laws on books and operational practices to force any actor to hand-over data in the name of fighting money laundering and terrorism (AML/CFT). It is very expensive to put up strong defenses against these. I don't see a viable business model charging $5/month that covers regular operational expenses and covers these types of events. Edit: Forgot to mention backdoors built into basic technologies they may already be using – like the Cavium HSM thing that came to light earlier this week.

ehhthing 3y ago
You know at that point why not just hack Level3, Cogent, Telia, Zayo or some other T1 provider? Frankly VPNs don't protect you from anything other than the most monitoring systems and the occasional public wifi connection. They're really just glorified Netflix region proxies and nothing more to most people

NegativeK 3y ago

That's an... interesting? interpretation of what logging is. What you've described, to me, is the VPN logging customer activity and then sending it elsewhere to be stored.

KomoD 3y ago

> but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log" No they can't, because THEY are still logging.

deleted 3y ago

[deleted]