14 ms·

Privacy doesn't mean anything anymore, anonymity does

• derelicta 10mo ago
  Good luck guys, you will surely attract the attention of Feds very quickly.
• al_borland 10mo ago
  Any business that isn’t willing to be as anonymous as Mullvad, I assume has a compromised business model that I don’t really like. Assuming there aren’t obvious reasons for needing the data, like tax filing, or various regulatory requirements. I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so. It also means they can avoid all the lawyers writing complicated and confusing privacy policies, or cookie approval pop-ups.
  • martin-t 10mo ago
    > I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so. They're OK with the liability exactly because of this very sentence. As you said, there's so many data breaches... so where are the company-ending fines and managers/execs going to prison?
    • tjpnz 10mo ago
      Here in Japan the government cracks down on it hard. There are fines for every n users exposed and in extreme cases a company can be forced to stop trading for a period of days or weeks. Companies are so scared of this happening to them that a significant portion of orientation for new employees is spent on it. I don't have stats on how effective it is, but I do know that the public is less willing to accept it as they tend to elsewhere.
      • PacificSpecific 10mo ago
        Wow good for them. I wish we took it that seriously in North America.
      • Hakkin 10mo ago
        Is this true? KADOKAWA had a massive hack last year that leaked a large amount of sensitive user data and as far as I know has faced no legal repercussions. Obviously they took a decent financial and reputational hit, but that was just an effect of the hack itself, not any government intervention.
    • sixtyj 10mo ago
      GDPR has fines: Up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements such as controller and processor obligations, security of processing, record-keeping, and breach notification duties. Up to EUR 20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements of basic principles for processing, data subjects’ rights, and unlawful transfers of personal data to third countries or international organisations.
      • tsimionescu 10mo ago
        Sure, in principle. Have you heard of any company that suffered any significant hardship (say, stock price plummeting, personnel reductions, bankruptcy) because of one of these fines?
        • jamiecurle 10mo ago
          Specific to the UK, there's a list of enforcement actions that the Information Commissioners Office (ICO) have taken: https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/ Some went to prison, some were fined £14M and it's a mixture of small fry and big fry.
        • zrn900 10mo ago
          Big companies arent suffering any of those. But small businesses and individuals are. Just see the enforcement lists. They are fining small flower shops that sent emails to 20-30 people, some of whom subscribed to it decades ago, then forgot. Or small internet startups for missing one subscription record and whatnot. Like all other corporate moat-building efforts, GDPR has been successful in destroying small businesses in favor of big ones.
      • dangus 10mo ago
        These fines aren’t something you’re responsible for paying by merely being breached. These are imposed for misconduct in data handling. It’s not very hard to handle customer data in a legally compliant way, that’s why you don’t see companies deciding against retaining data. You can do everything right and still have a data breach, and in that case nobody is fining you.
  • Spivak 10mo ago
    Infra engineer here. The obvious reasons for needing the data is debugging. I collect logs, metrics, traces, and errors from everywhere, including clients. All of these come with identifying information including the associated user. From the perspective of this thread this is a huge amount of data although it's pretty modest compared to the wider industry. This data is the tool we have to identify and fix bugs. It is considered a failing on our end if a user has to report an issue to us. Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless. It's not my department but I think we would get laughed out of the room if we told our users that we couldn't do password resets or support SSO let alone the whole forgetting your 'credential' means losing all your data thing.
    • al_borland 10mo ago
      > Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless. A lot of companies could be in similar situations, but choose not to be. All of retail, for example. Target does significant amounts of data collection to track their customers. This is a choice. They could let users simply buy things, pay for them, and store nothing. This used to be the business model. For online orders, they could purge everything after the return window passed. The order data shouldn’t be needed after that. For brick and mortar, it should be a very straightforward business. However, I’m routinely asked for my zip code or phone number when I check out at stores. Loyalty cards are also a way to incentivize customers to give up this data (https://xkcd.com/2006/ https://xkcd.com/2006/). TVs are another big one. They are all “smart” now, and collect significant amounts of data. I don’t know anyone who would be upset with a simple screen that just let you change inputs and brightness settings, and let people plug stuff into it. Nothing needs to be collected or phone home. A lot of the logs that are collected in the name of troubleshooting and bug fixing exist because the products are over-complicated or not thoroughly tested before release. The ability to update things later lowers the bar for release and gives a pass for adding all this complexity that users don’t really want. There is a lot of complexity in the smart TV that they might want logs for, but none of it improves the user experience, it’s all in support of the real business model that’s hidden from the user.
  • eleveriven 10mo ago
    What I'd really like to see is more honesty: "we store X because feature Y needs it, here's the risk we're accepting," instead of pretending every service needs emails, analytics, and cookies by default
    • teekert 10mo ago
      This is what the GDPR requires.
  • bossyTeacher 10mo ago
    >Any business that isn’t willing to be as anonymous as Mullvad, I assume has a compromised business model that I don’t really like Well, that's like 99% of the businesses out there. Mind listing of some of the businesses you like aside from obvious mullvad?
    • al_borland 10mo ago
      I wish I had a list, as you said, they are in short supply. If there is a site out there that catalogs simple straightforward business that don’t compromise a customers ability to be anonymous, I’d like it very much. A HN user posted about a site they made for faxing documents the other day. It’s a good example of how I think most things should be setup in many cases. You pay a fee and it sends a fax, that is very simple to understand. There are no accounts and the documents are only stored long enough to fulfill the service. https://news.ycombinator.com/item?id=46310161 https://news.ycombinator.com/item?id=46310161 You can imagine how most “modern” sites would handle faxing. Make an account, link a credit card, provide your address to validate the credit card. Then store all the faxes that were sent, claiming it’s for easy reference. Meanwhile it’s running OCR on them in the background to build a profile with a wealth of personal data. After all, people don’t tend to fax trivial things. In addition to the profits from the user, they are making a killing on selling data to advertisers… but those details are hidden away in legalese of the fine print in a policy no one actually reads.
• theturtletalks 10mo ago
  What scares me is that the more privacy oriented you are, the easier you are to fingerprint. At what point does privacy mean blending in with the crowd and not sticking out?
  • ybceo 10mo ago
    You're thinking about browser fingerprinting (client-side), but my post is about service-level anonymity (server-side). Browser fingerprinting: "Your unique combination of extensions/settings makes you identifiable among other users." Service anonymity: "There are no other users to compare you against because we don't collect identifying data." When you sign up with just a random 32-char string, there's nothing to fingerprint. No email to correlate. No IP logs to analyze. No usage patterns to build a profile from. Fingerprinting matters when services collect behavioral data. We architected our way out of having that data to begin with.
    • integralid 10mo ago
      >When you sign up with just a random 32-char string... There's STILL a browser fingerprint, IP logs to analyze, usage patterns to build a profile from. You may claim you don't collect it, but users need to take your word for it. This is just pseudonymity, which (as many BTC users found out) only gets you halfway there. Real anonymity is way harder, often impossible. Don't get me wrong, it's good to see organisations that care about privacy and in fact this blog post encouraged me to consider your services in the future. We have some use cases for that at work. Though by using cloudflare you're NOT putting your money where your mouth is.
      • ybceo 10mo ago
        I was going to say making the platform open source might solve this problem, but then users would have to trust that we are actually running the open source version and not some fork with logging and tracking. This would be an interesting problem / paradox to try to crack. But you are 100% right, I will look into alternatives for Cloudflare, which we are using because it seems like the cloud hosting industry LOVES to DDoS new players.
• duskdozer 10mo ago
  Maybe ironically - just going on the title because I can't read the rest as a result - it's behind a cloudflare gate.
• austin-cheney 10mo ago
  I would much rather have privacy with e2e encryption than have anonymity. The way that works is a direct connection between two parties without use of a central server, like webRTC.
• CalRobert 10mo ago
  Sadly, everybody using a browser from a massive ad company and an idp (not to mention a company with an interest in crawling the entire web for AI at the same time site owners are dealing with better scrapers) means the entire web will be login-only over time.
  • bigyabai 10mo ago
    I don't see how those points bolster your conclusion. These pressures predate AI by over a decade and haven't forced a significant tidal change in the way the internet is used.
  • squigz 10mo ago
    We're quite a few years into this period of technology. At a certain point, these "AI is going to kill the web!" predictions either need to come true or just be dismissed as false.
  • eleveriven 10mo ago
    The irony is that the same companies pushing us toward login-only everything are also the ones best positioned to survive it
• udev4096 10mo ago
  [dead]
• sloppppp 10mo ago
  This was authored using an LLM, wasn't it. The style is unmistakable. Stop wasting our time with this slop.
  • politelemon 10mo ago
    Here's the thing. It's not just x, it's hyperbole y. Hyperbole. Y.
    • abnercoimbre 10mo ago
      Yeeeep. I'm very disappointed because the subject matter is important.
  • 152334H 10mo ago
    thank you. absurd no other comments noticed
  • karanSF 10mo ago
    I can't stand the style as much as the excessive use of hyphens. The "It's not just ..., it's ...." every 5 sentences is too much once you notice it. However, every LLM seems to converge on this style. It wouldn't wouldn't write like that if it didn't work to some degree, so maybe it knows something we don't.
• armchairhacker 10mo ago
  tl;dr “Privacy” = the data is private i.e. only on your devices. Or if the raw data is public but encrypted and the key is private, I think that qualifies. “Anonymity” = the data is public but not linked to its owner’s identity. If you’re sharing your data with a website (e.g. storing it unencrypted), but they promise not to leak it, the data is only “private” between you and them…which doesn’t mean much, because they may not (and sometimes cannot) keep that promise. But if the website doesn’t attribute the data except to a randomly-generated identifier (or e.g. RSA public key), the data is anonymous. That’s the article. Although a server does provide real privacy if it stores user data encrypted and doesn’t store the key, and you can verify this if you have the client’s unobfuscated source. Also note that anonymity is less secure than privacy because the information provides clues to the owner. e.g. if it’s a detailed report on a niche topic with a specific bias and one person is known to be super interested in that topic with that bias, or if it contains parts of the owner’s PII. But it’s much better than nothing.
• jacquesm 10mo ago
  There is no such thing as anonymity. With the number of bits required to ID a person and the fact that you are leaking such bits all the time you can simply forget about anonymity. Many people online seem to think that they are anonymous and so were emboldened to do stuff that they might not have done if they had realized this. They continued to feel extremely good at this right up until the knock on the door.
  • schmuckonwheels 10mo ago
    Well there's anonymity from authorities, and there's anonymity from garden variety lunatics. There exists a grey area between not getting away with nefarious activities, and not having your life ruined by a lynch mob because you didn't approve their preferred CoC on a hobby project or some other perceived injustice.
    • pona-a 10mo ago
      Is there? The government apparatus that's meant to investigate these crimes is the same one elected by the mob. If you find yourself a member of any group a campaign can mobilize the mob against, that entire investigatory apparatus can be turned against you. Without privacy, we are doomed to endless purity purges.
  • wisty 10mo ago
    > realized Most UK and Australian writers would spell it "realised" so there's a bit right there. Even if you include no personal information, there is information in writing style. Stylometry is the study of this. Yes, there's also adversarial stylometry - distorting your writing style to fool an analysis. It's probably effective now, but that could change overnight and every archived post that every OSINT organisation has collected is deanomynised. Yeah you can say "I change my style". But there's some bits that don't have false positives. If I EVER say "praise the omminsiah" I'm definetly au fait in 40k memes. If I ever say au fait I'm a person who has at least a rough idea of what it means. There's no false positive here, so if you can just find about 29 undeniable uncorrelated bits that are known to not have false positives ... a more advanced analysis could exploit this in a more continuous way (e.g. the likelihood of it being a false positive). I should shut up now.
• Prunkton 10mo ago
  What I was wondering after reading the article: How does Mulvad actually decouple banking data from the account ID? Or is it as simple as verify transaction once but never log?
  • stanislavb 10mo ago
    I think they remove the invoice after a month. You can also, send them cash in an envelope
    • komali2 10mo ago
      So there's no subscription thing going on, you just manually pay invoices? I once spent an entire year issuing chargebacks on AWS charges coming from god knows what AWS account. Most likely some client project I forgot about and didn't have the login to anymore, who knows. Makes me think about that - for a service where you can't login if you lose the credentials, how do you cancel a subscription? In my case I had to eventually just cancel the credit card and get a new number.
      • deafpolygon 10mo ago
        No subscription. It’s pay as you go. You top up $X and you get X months. That’s it. If your month expires, it expires. Just top off and you’re good to go.
  • pxc 10mo ago
    You can pay with an envelope of cash, so they don't need your banking data to begin with.
    • hilbert42 10mo ago
      Perhaps so, but that's damn difficult or very risky for all but a very select few.
      • pxc 10mo ago
• guuger 10mo ago
  Europe is currently being tormented by this exact contradiction: on one hand, it has the GDPR—the world's strictest privacy law, supposedly protecting personal data; on the other, a flood of new regulations under the banners of "child safety," "counter-terrorism," and "anti-money laundering" are systematically strangling real anonymity.
• mk89 10mo ago
  At first I thought it was a blog. No, this is a company. So, their privacy page (https://servury.com/privacy/ https://servury.com/privacy/): > Server Logs > Like all web services, our servers may log: > IP addresses of visitors > Request timestamps > User agent strings > These logs are used for security and debugging purposes and are not linked to your account. That's already a huge breach in comparison to mullvad privacy page. (https://mullvad.net/en/help/no-logging-data-policy https://mullvad.net/en/help/no-logging-data-policy)
  • afro88 10mo ago
    > That's already a huge breach in comparison to mullvad privacy page. And the "3 data points, that's it" of the blog post
    • ybceo 10mo ago
      Those data points refer to what is stored in the database and is tied to your 32 character credential. Web server logs were not tied to user credentials in any way.
      • kevin_thibedeau 10mo ago
        IPs are PII. They can be tied to an identity.
        • organsnyder 10mo ago
          Even user agents are often specific enough to be considered PII.
  • IlikeKitties 10mo ago
    I mean technically yes but I find THAT kind of logging utterly benign.
    • procaryote 10mo ago
• zwnow 10mo ago
  How tf are you supposed to provide working authentication without storing the email somewhere? Should i just disable password resets and tell the users to fuck off if they forget theirs? Cant even use passkeys as they make users identifiable too.
  • K0balt 10mo ago
    Users need to have hard memorization or record of a paraphrase, same as a crypto wallet. Or just use web3 for auth, that can work well if users have decent opsec.
  • wrxd 10mo ago
    That’s a trade off if you don’t want the service to know who you are
  • pona-a 10mo ago
    How do passkeys make users identifiable beyond being a random token? I recall FIDO shared hardware key serial numbers with websites, but at least on Firefox, it prompts you to deny it.
    • zwnow 10mo ago
      In that case one could argue emails dont make users identifiable either, if the addresses dont contain any meaningful names
      • pona-a 10mo ago
        A passkey is always one per site. Emails tend to be naturally reused, unless the visitor uses a paid aliasing service (plus trick is trivial to canonize, having a dozen mailboxes on a self-hosted email still associates them with each other, because there's no anonymity set to speak of, and major email providers like Gmail won't let you register an account today without a phone number, credit card, or passport).
        • zwnow 10mo ago
• DerSaidin 10mo ago
  One difference with Mullvad is VPN traffic is ephemeral. Here, a VPS has a persistent disk attached, that could contain identifying information (if it is necessary to do useful work).
• p4bl0 10mo ago
  The very premise is false, privacy does mean something, and anonymity doesn't really exists. This is an advertisement.
  • politelemon 10mo ago
    I agree, privacy still means a lot. It's a term that's been co-opted by the large tech companies which operate with impunity. It will has meaning that cannot change. The post also misunderstands privacy > Privacy is when they promise to protect your data. Privacy is about you controlling your data. Promises are simply social contracts.
• pogue 10mo ago
  Glad I had to do a Cloudflare turnstile captcha to see this page
• mnw21cam 10mo ago
  Apparently neither does spelling. "anymore" -> "any more"
  • kleiba 10mo ago
    https://www.merriam-webster.com/dictionary/anymore https://www.merriam-webster.com/dictionary/anymore
  • IanCal 10mo ago
    Anymore is a word though.
    • timbit42 10mo ago
      It isn't used the same as "any more" though.
  • hilbert42 10mo ago
    I didn't think anyone [not any one] could be more pedantic than I am. Damn it.
    • jaclaz 10mo ago
      D@mn, I believed you were thinking that no one (not noone) could be more pedantic than you.
• metalman 10mo ago
  "privacy" or not sharing your space with a creepy room mate, and reading the internet without adds ar3 parallel running three flavors of the same off brand browser, each optimised for different segments of online content is what seems to be the minimum. they are so desperate to sell me something, (a truck) that it's wild, as it is one of the few monitisable things I consistently look for (parts, service procedures), the , pause, when I do certain searches gives me time to predict that yes, the machinery is grinding hard, and will ,shortly, triumphantly, produce, a ,truck.
• mnls 10mo ago
  According to article, the whole authorization system is flawed. But we haven’t invent a new one and the one we’ve got never meant to be private, it is just a way to separate users from each other. We need something unique, a "primary key" for our DB, and that’s email or phone or username that has to be stored somewhere. A server, someone else’s computer, call it what you want. It has good privacy between users, but the admin can see everything, because otherwise management of the service would be impossible. There is no anonymity, there is always someone you have to trust in the chain of WAN networking (DNS,ISP,VPN). If you want anonymity and privacy, you selfhost (examining the code is also a prerequisite). There is no other way to do it.
  • wrxd 10mo ago
    > but the admin can see everything, because otherwise management of the service would be impossible. It depends on what service you’re offering. There are many cases where you can have end-to-end encryption so that you can know who your users are, host their data but cannot do anything with it.
• qwertyuiop12 10mo ago
  the only way is “anonymity by design”. history showed us that “don’t be evil” does not work if the entity can change its mind unilaterally. be confident that the service is not keeping logs? JÁ!
• anal_reactor 10mo ago
  The battle on privacy/anonymity/whatever is lost. Get over it. What we need is a new social paradigm where everyone is happy despite the lack of privacy.
  • pooper 10mo ago
    Everybody says I should be ok having no privacy and yet frown upon me posting photos of the poop I take on Instagram.
    • anal_reactor 10mo ago
      Yes, exactly, that's what I'm talking about. Imagine a world where it's completely acceptable to post poop on Instagram, and people who don't want to look at it simply tick "don't display poop". The thing is, the "if you have nothing to hide then you have nothing to fear" argument IS true, under assumption that others would be understanding and compassionate to your intentions. Which is exactly the opposite of the legal/societal system we currently have. What I'm trying to say is that the core issue is "people aren't trustworthy" and "we need privacy" is a bandaid on the former problem. If we manage to create a society where people are trustworthy, the need of privacy will disappear.
      • iamnothere 10mo ago
        The core problem is that people have (and will always have) divergent goals, and a large subset of people see no problem in using coercive and even violent means to ensure that their own “team” wins. This is human nature and cannot be remedied.
        • anal_reactor 10mo ago
          The thing is, same logic applies to other entities that form groups, like cells in an organism, or ants in a colony.
      • WesolyKubeczek 10mo ago
        Then the government is overturned by a totalitarian clique that declares displaying poop punishable by death, and this includes any past display of poop. Suddenly you find yourself here unsafe { anal_reactor }
• nilslindemann 10mo ago
  And, also not very funny, those corps never tell in advance which data they "require". They grab my mail on "the first page" of the registration form. Then, on "the second page", they ask for my phone and my address. Should I decide to agree to this, they will finally tell me on "the third page", that they only support credit card, no PayPal, no direct payment via Bank ...
  • nilslindemann 10mo ago
    The PSF is the most recent org which did not get my donation due to this. https://donate.python.org/ https://donate.python.org/ X pages, I will not know in advance which of my data is required and which payment option is supported. All this could be on one page, I guess.
• AnthonyMouse 10mo ago
  This seems like the wrong end of the system to fix the problem. Someone saying "we don't log your IP address" isn't something you can easily verify, so the promise doesn't mean much because if they suck they're just going to lie about it. What you need instead is to make it easy and common for people to use browsers that resist fingerprinting, VPNs/Tor, custom email addresses per-account, etc. Because then instead of claiming to not log your information, they simply do not have it. The biggest thing we need is a better way to pay someone over the internet without them knowing who you are.
  • HelloUsername 10mo ago
    > The biggest thing we need is a better way to pay someone over the internet without them knowing who you are. Cryptocurrency?
    • AnthonyMouse 10mo ago
      If it was made easy and common for ordinary people to use.
      • abc123abc123 10mo ago
        True. For 99% of the people mining it yourself of demanding getting paid in crypto is not viable. That means you go to an exchange, and all you do is then logged at this government regulated exchange. I suppose you could engage in some cloak and dagger exchange at night, but again, the 99% won't do that. The ones who do, are most likely capable of setting up their own services, anonymously, so they don't need to have a commercial, for-profit as their middleman.
    • wseqyrku 10mo ago
      That's what I thought. I think an open source crypto payment gateway that "just works" could probably make it more prevalent. (Is there any?)
      • __MatrixMan__ 10mo ago
• hiAndrewQuinn 10mo ago
  So my understanding is, what Mullvad is to VPNs, and what Tarsnap is to S3 (kinda), Servury is to entire VMs. It's a prepaid model, you get an account identifier, and that's basically it. This is very cool. I have wondered for a very long time why such a site does not exist. What pops to mind is that you could get better unit economics reselling really small VMs to the privacy obsessed. I know some netizens who would pay a dollar a month for, say, a tiny NetBSD VM and 64 MB of RAM to serve their tiny static demoscene website of yore. There are some real wizards of there. Not sure if that's in your roadmap but definitely something to consider in this space.
• fithisux 10mo ago
  Is this a joke?
• bfkwlfkjf 10mo ago
  Speaking of mullvad. I recently learned about mullvad browser, which is basically tor browser minus connecting via the your network. This is interesting because the tor project has put the most effort into fingerprinting resistance. If you care about privacy and you have a customized browser, you're likely uniquely finger printable [1]. If you don't want to connect via tor, there's no excuse not to use the mullvad browser. (Doesn't require you to use mullvad VPN; comes with the mullvad plugin, disabled by default, to optionally use mullvad encrypted DNS. Last point, I wrote to the tor project and asked "is it possible to use tor browser minus tor network", and they responded "that's the mullvad browser", so this isn't just my recommendation) [1] https://coveryourtracks.eff.org https://coveryourtracks.eff.org
  • eleveriven 10mo ago
    Most people fixate on network-level anonymity and completely underestimate how badly a "tuned" browser leaks identity
    • matheusmoreira 10mo ago
      People also tend to have very poor OPSEC which undermines their efforts in spite of the tools they used. https://grugq.github.io/blog/2013/11/06/required-reading/ https://grugq.github.io/blog/2013/11/06/required-reading/ Unlinking one's identity from one's activity is only getting harder as surveillance gets more and more pervasive. Effective OPSEC essentially turns one's life into a living hell and it's only getting hotter with time.
  • basedrum 10mo ago
    Fun fact, mullvad browser is created by Tor in collaboration with them.
    • seb1204 10mo ago
      What is Mullvad Browser? - Frequently Asked Questions (FAQs) - Mullvad Browser — Tor https://share.google/1w4rilivJ4qMBwbIb https://share.google/1w4rilivJ4qMBwbIb
• _4ud2 10mo ago
  > Privacy is Marketing. Anonymity is Architecture. But in order to read the article you need to enable JS. What a joke.
  • hilbert42 10mo ago
    Exactly. I run sans JS by default. At least this warns me to either avoid the site or to take the risk (browser button--red for JS block, green unblock).
• bobbyschmidd 10mo ago
  it's 2025. chances are you had peeps in class/uni who are now in the Stasi networks of informants and/or in some more or less obscure agency or more or less related private company so your anonymity only works from birth and even then only if you are lucky or your family "gets it" and has resources and brains beyond. some people believe supply chain attacks are rare and hard to pull off and expensive and only valuable in extreme cases but if you ever worked at a local delivery service or pharmacy or something other where people and the necessary machines are being aggregated in some basements or even backrooms for all use cases from all times for wholesale forgery and fiddling with people, you know that the situation is ugly, not bad. throw in the many coders, network engineers and hardware specialists with ties to above entities and bombaclat, Jahmunkey, we fucked! #TheEconomicsOfPunchedDrugs #Automation #DataAnalysis #SituationalAssessment #HeyIsThatATurdNuggetAtTheTopOfThatPyramid
• eleveriven 10mo ago
  Even if you don't want to live entirely on the anonymous web, it's useful to see how many products claim privacy while being structurally incapable of delivering it
• bitbasher 10mo ago
  It's a bit ironic the page is protected by Cloudflare. So, all of our traffic is going through some other company to log and track before it gets to you, eh?
• jrm4 10mo ago
  Thank you, op, for bringing sanity to this whole thing. Relatedly, this is why I think every "new" social media service that isn't Mastodon is barking up the most wrong tree with "take everything with you," you're essentially helping to build an even harder to erase social history. Mastodon's individual server model, like email's, is better PRECISELY because each node is a point of "failure." That makes erasure easier. Which is good.
  • immibis 10mo ago
    That's not true. Mastodon replicates all your posts to a bunch of other servers you don't control by design, which makes them harder to erase. It's no worse than normal internet publishing, but it doesn't magically solve the erasure question.
    • shark_laser 10mo ago
      Yep. And you still de-anonymise yourself with Mastodon when you buy hosting and a domain. If you use an existing provider, then you're back at square one and living in hope that the provider doesn't keep logs etc, or just decide they don't like you. Nostr fixes both of these. So whilst you're at the mercy of relays storing your data, you can at least be anonymous.
  • chneu 10mo ago
    No one owning your data isn't any better than everyone owning your data.
• basket_horse 10mo ago
  The problem with this in our current society is that staying anonymous becomes your whole identity. I have a friend who for the longest time didn’t use Venmo, Uber, etc. because of privacy reasons, but the lifestyle was just not sustainable. Ultimately convenience killed privacy.
  • stvltvs 10mo ago
    We have to choose where anonymity is worth the tradeoffs, but it's still quite possible to live without Venmo, Uber, etc.
  • duskdozer 10mo ago
    I guess those are just examples and there are much more significant things, because Venmo and Uber seem far from indispensable. >Ultimately convenience killed privacy. By design, unfortunately.
• gruez 10mo ago
  >Here's how the average "privacy-focused" service actually works: > ... >5. Confirm identity for "fraud prevention" (now we have your ID) I can't tell whether OP is being hyperbolic but it's certainly not representative of the average "privacy-focused" service I've came across. The typical service only asks for an email and maybe billing information (can be prepaid card or crypto). The only exception is protonmail, which might require SMS verification[1], but given the problem of email spam I'm sympathetic, and it's bypassble by paying. It's certainly not the "average" service, and no service asked to "Confirm identity". [1] https://proton.me/support/human-verification https://proton.me/support/human-verification
  • zie 10mo ago
    A phone number IS identity these days.
    • Johnny555 10mo ago
      Yeah, so many places ask for phone number that don't really need it that I assume the phone number is a unique identifier used to combine individual's data across websites. Most of the time I use a made-up 555 number or if it needs to send an SMS to verify, I'll use a free SMS numbers.
    • drnick1 10mo ago
      Not if you buy a SIM or eSIM anonymously. This is easy in the U.S. with cash in a store, or online (silent.link).
• ____mr____ 10mo ago
  > Stripe customer ID and payment method ID Wouldnt this information allow for the authorities to just go to Stripe and ask the relevant information there? Sure, you don't store exact personally identifying info, but you store a breadcrumb that can lead whoever has the power to request that information to trace back to the end user
  • g947o 10mo ago
    > And for those who need traditional payments? We support Stripe. Because pragmatism matters. But we don't pretend that credit card payments are anonymous. We're honest about the trade-offs. I think this paragraph is clear enough about that?
• titzer 10mo ago
  > If you use our servers for illegal activity, law enforcement can still investigate. They just can't start with "who owns this account" because we can't answer that question. You're going to have a tussle with law enforcement, and you're going to lose. Your service will last < 2 years because you will not be able to afford the lawyers you need to defend against even one muscle move by the government. Good luck!
  • stodor89 10mo ago
    Good old "we can't decrypt your laptop but we can repeatedly smash your head into the table until you start cooperating"
  • kyrofa 10mo ago
    Why? That's kind of the whole point of this: they can cooperate entirely and give them everything they have. You think they'll get into legal trouble because they aren't gathering data?
    • ls612 10mo ago
      You ever heard of the phrase “show me the man and I’ll show you the crime”? These guys are gonna discover what that means really quickly.
      • kyrofa 10mo ago
        There are a number of companies/products that operate under this principle (mullvad and signal come to mind). Are you saying all of those are futile and misleading? Or are you saying that you expect they all have significant money and legal teams to defend against a crooked cop's thirst for vengeance for not responding the way they wanted during an investigation?
        • ls612 10mo ago
          I’m saying it’s only a matter of time before they get Pavel Durov’ed.
• specialist 10mo ago
  > "privacy" has become the most abused word in tech Ideally, an argument about privacy would start with its notion of privacy. https://en.wikipedia.org/wiki/Privacy#Conceptions_of_privacy https://en.wikipedia.org/wiki/Privacy#Conceptions_of_privacy
• bilsbie 10mo ago
  I’m fine with no account recovery but they would definitely need a major warning about that at sign up time so users can take extra care to save their info.
• joemazerino 10mo ago
  I like the idea of this but I'm a certain this article is AI generated.
• serial_dev 10mo ago
  I know it’s a different context, but with this catchy title, I can’t resist pointing out that anonymity also doesn’t mean anything. You can have cryptocurrencies in your wallet, (on most chains) you are anonymous but have no privacy, your transaction history can be accessed by anyone. It’s all fine and dandy, you can enjoy your anonymity, about as long as you make your first transaction. You might be anonymous, but basically you hand over your full transaction history and balance anytime you pay for a coffee or tshirt.
  • kachapopopow 10mo ago
    you typically don't have one wallet and you (should at least attempt to) never reuse them either.
    • wood_spirit 10mo ago
      Do you mean a wallet per transaction? And if you simply have multiple wallets and try and maintain the appearance of being disconnected, can you move funds between them without establishing a connection that unmasks you?
      • kachapopopow 10mo ago
        well the idea is to obscure it to someone looking from the outside, give enough information it can still be traced - but that's usually only possible by infosec agencies which is typically what they have access to already with normal banks. to clarify: it can be hard to prove that two crypto addresses are the same people
        • kube-system 10mo ago
          There's a whole industry of commercially available products that analyze blockchains transactions for the purpose of tracing them. Anyone can simply buy these services. It is functionally accurate enough to find and prosecute criminals.
• photon_garden 10mo ago
  > That's not privacy. That's performance art. Smells like it was written by an LLM so I stopped reading.
• undeniablemess 10mo ago
  AI generated article. What a slop.
• BloondAndDoom 10mo ago
  I don’t know what’s wrong with these comments. This is the kind of smart design we want to see and everyone is doing nitpicking. Can we have just better things or are we going to reject everything that’s not perfect and by doing so concede the whole point and just give up? Well done OP for the right approach and your business. This has always been my design (when possible) to approach data security. When you don’t have data you don’t have to worry about its security. Best of luck, ignore the naysayers.
• 123sereusername 10mo ago
  [dead]
• o999 10mo ago
  @ybceo As long as you use Cloudflare to verify users [fingerprints] and traffic between users and your service is decrypted at Cloudflare side, I am afraid it difficult to take these anonymity claims seriously. Please do not to rely on fingerprinters or CDNs that does TLS-termination for you.
• snakepit 10mo ago
  In many ways, we're past the point of no return. So-called ubiquitous technical surveillance is largely the norm, often encroaching by design beyond the boundaries of expected decency. Informational terrorism, a dysphemism that describes the manner by which certain data is abused to "re-rank content" for a "personalized experience," is encoded into the DNA of certain large tech companies.
  • lisbbb 10mo ago
    Yes. The only question left is when does the terror begin? And it will--it will be our own governments clamping down on all of us. The digital norm globally will be China under the CCP. That is the future for all of us unless we turn it off, but we won't because humans are stupid.
    • hearsathought 10mo ago
      [flagged]
    • pcthrowaway 10mo ago
      The terrorism is already occurring, it's merely exported to other people
  • heresie-dabord 10mo ago
    > we're past the point of no return The ideal would have been a security-first (privacy-first) industry and supply chain. The ideal never was going to happen, anymore than the early educational ideals of the television industry. Ergo we are not past the point of no return. That point never existed. We are right where we should expect to be, with most people victimised by the industry and the supply chain, and with a small percentage of people working in security/privacy education to mitigate unsafe practices. Seatbelts and airbags exist. Smoking is banned in many public settings. It took a senseless amount of carnage to achieve these measures. We just haven't achieved the requisite amount of privacy carnage. Yet.
  • chneu 10mo ago
    Eh, defeatist attitude. It isn't that hard to anonymize and obfuscate your data. The issue is everyone is willing to trade convenience for security. The point of no return is an individual choice.
• made3 10mo ago
  "Please unblock challenges.cloudflare.com to proceed." talk about anonymity but uses cloudflare. you threw away your tls and allow cloudflare to sit in the middle of the user and your web page. you're a hypocrite.
  • uoaei 10mo ago
    Hypocrisy is a moral failing but also a somewhat pedantic one -- has this person condemned these activities or merely lamented them?
• vpribish 10mo ago
  hyperbolic. anonymity in your product could be a sensible design choice that your customers could value. fine. go nuts. but in general? hard disagree. anonymity is fragile and can't be guaranteed, privacy is a legal obligation which can actually be enforced if push comes to shove. also that page reads like slop : it's not X, it's Y. blah blah blah. this is a marketing piece trying to go viral.
• dtj1123 10mo ago
  The onion link for the site appears to be broken.
• heliumtera 10mo ago
  Nice ad you bought! Oh wait
• vitonsky 10mo ago
  Yet another promotional post of Mullvad team. Nice story, but I don't buy it. Email is fine when it is an option. Mullvad have even option to pay with a credit card & PayPal. That's more sensitive data than Email.
• jfengel 10mo ago
  Like security, the Internet doesn't tolerate half measures. You either have perfect privacy or none. A lot of our intuitions about both are based on obscurity: nobody is interested enough to devote their lives to you. That's not the case any more. You are exposed to every person on the planet, and they have the tools to automate attacks on every single person. That's not to say "give up", but we need to find a new understanding of how our lives work. It's like we're all hunter-gatherers who find ourselves instantly in the largest and fastest city, with nobody to teach us the ropes.
  • whynotmaybe 10mo ago
    Which is kinda interesting because the only people I know without any internet presence are very old or, working for intelligence services.
• necovek 10mo ago
  Isn't the actual difference between privacy and anonimity that one indicates that the company knows who you are, but ensures this stays "private", and the other is about not knowing who you are?
  • WolfeReader 10mo ago
    Yes. Privacy and anonymity are both useful in different contexts. This article is just an ad for a service.
  • adipid 10mo ago
    100%! Privacy and anonymity isn't the same thing.
• coldstartops 10mo ago
  You are liying. here: https://servury.com/datacenters/ https://servury.com/datacenters/ Here on datacenters you say your are ISO27001 and SOC2 certified. "We're ISO 27001 certified and maintain SOC 2 Type II compliance." You do not have any certificate that I can find: https://www.iafcertsearch.org/search/certified-entities?search=YBC%20Holdings%20Inc https://www.iafcertsearch.org/search/certified-entities?sear... https://www.iafcertsearch.org/search/certified-entities?search=servury https://www.iafcertsearch.org/search/certified-entities?sear... Who is the company who certified you? What is the certification number?
  • foundry27 10mo ago
    I’m not sure if this is just an “on mobile” thing, but I can’t find any reference to ISO 27001 or SOC2 at that datacentres URL. Taking your word for it being there previously, this seems like a major red flag! Faking these certs is no joke, and silently removing references to that after being called out would be even more of a bad look. @ybceo you seemed to represent this org based on your previous comments, is the parent commenter missing something here?
    • russianGuy83829 10mo ago
      Yes, the page mentioned ISO27001 which is still visible in the indexed duckduckgo result. https://duckduckgo.com/?q=https%3A%2F%2Fservury.com%2Fdatacenters%2F+ISO27001&t=fpas&ia=web https://duckduckgo.com/?q=https%3A%2F%2Fservury.com%2Fdatace... It is not visible in the live webpage.
      • russianGuy83829 10mo ago
        bing (use desktop mode) has both claims https://www.bing.com/search?q=https%3A%2F%2Fservury.com%2Fdatacenters%2F%20SOC&lq=0&pq https://www.bing.com/search?q=https%3A%2F%2Fservury.com%2Fda... archived versions here: http://archive.today/8LX8s http://archive.today/8LX8s http://archive.today/00mIw http://archive.today/00mIw
  • ybceo 10mo ago
• combyn8tor 10mo ago
  How do you accept crypto payments? Is there a Stripe style service that provides an API and/or payment portal? Id like to implement something for my SaaS but generally can't be bothered with crypto.
• canyp 10mo ago
  A company talking big about privacy generally comes across as dishonest, and you'd have to get all the details right to avoid unleashing the Internet's wrath. It looks like you screwed up between the server logs and Cloudflare. Unfortunate, but it seems to me that it reflects a lack of experience more than ill intent (I do not have such experience myself either.) Honest question, but did you add the Cloudflare proxy to solve an actual problem, or did you deploy it a priori without an actual justification?
• paradox460 10mo ago
  I've been beating this drum for years. The problem with signal and most other privacy ware is that they require you to effectively deanonymize yourself, typically by making you use a phone number to use their service. Knowing who someone is talking to is, in many circumstances, far worse than knowing what they're saying
  • themafia 10mo ago
    > Knowing who someone is talking to is, in many circumstances, far worse than knowing what they're saying How? I go to court for knowing a drug dealer. That case goes nowhere. I go to court for buying from a drug dealer. That's open and shut. I'm not a CEO of a trillion dollar corporation or the president of anything. My privacy needs are far different from theirs.
  • shark_laser 10mo ago
    It's why I'm so excited about Nostr, and apps built on top of it, like 0xchat: https://www.0xchat.com/ https://www.0xchat.com/
• hexbin010 10mo ago
  LLM slop, Cloudflare, potentially lying about certifications, privacy hypocrisy...a pretty bad look.
• mac-mc 10mo ago
  Dude, disclose the AI writing; it has AI smells all over it, such as contrastive sentences.
• deleted 10mo ago
  [deleted]
• 10000truths 10mo ago
  The biggest risk to this business model isn't the government, but the payment processor. Anonymity makes it easy for unsavory characters to use stolen credit cards to buy your compute. The inevitable barrage of chargebacks will then cause Stripe to cut you off. Hell, if you're particularly unlucky, your payment processor might even cut you off proactively, if they decide that your lack of KYC makes you a risk.
  • drnick1 10mo ago
    This is where crypto comes in. Payment processors have excessive power over users. Even Valve was recently targeted.
• rumpelstiel 10mo ago
  Using digital money (fiat or non anonymoized crypto) exposes you. you can not be part of a legal business without doing that except accepting real coins, and even then you have fingerprints on it, or maybe they can scan the banknote id and trace that to an ATM, and so on. The only way to be absolute anonymous is stealing some hardware and trying to get it anonymously into some kind of infrastructure you dont own.
  • rumpelstiel 10mo ago
    This is nowadays easier and cheaper then years ago because there are so many fuckdarts out there exposing their routers and dont give a shit about security.
• Ey7NFZ3P0nzAe 10mo ago
  Is that legal? I was under the impression that in europe hosting servers had KYC rules. I'm regularly getting emails by OVH asking me to confirm my name a d home adress.
  • gobblegobble2 10mo ago
    Do you have a domain name registered with them? It may be just RDRP mandated by ICANN, not KYD.
• slimebot80 10mo ago
  The blog post and homepage do a terrible job describing the product? Wasn't Crypto recently revealed to be used by FBI (or similar) to track major criminals? They don't broadcast it, since they want people to continue thinking it's anonymous.