7 ms·
> As an example, imagine that you are a moderator on a forum and you suspect that a new face is actually a sockpuppet of a user you banned the day prior. You c
by solenoid0937 6mo ago
> As an example, imagine that you are a moderator on a forum and you suspect that a new face is actually a sockpuppet of a user you banned the day prior. You check the IP logs, and despite using different Mullvad servers, both accounts resolve to the overlapping float ranges 0.4334 - 0.4428 and 0.4358 - 0.4423. This gives you a >99% chance that they are the same person.
This sounds like how I'd design a VPN if I were an intelligence agency.
- asdff 6mo agoMakes you wonder...
- BLKNSLVR 6mo agoEvery now and then there are articles like this one about something that Mullvad may or may not be able to do better, and there are always comments about whether they're an intelligence front. I don't know the answer, but there are two ways to take it: 1. Submarining to destroy confidence in an actually trustworthy, decent VPN company 2. They're an intelligence front. For me, Mullvad have the appearance of the greatest likelihood of being legit since they're not aggressively pushing their product with lies and fear mongering. That gels with my vibe. If they're an intelligence front, well, most VPNs probably are as well, so I'm no worse off. Luckily I'm not doing anything that would get me in the kind of trouble for which multi-jurisdictional cooperation is worthwhile.
- 8cvor6j844qw_d6 6mo ago[dead]
- deleted 6mo ago[deleted]
- linkregister 6mo agoYou'll find comments accusing anything of being an intelligence front on internet message boards. I agree with you that public evidence is overwhelmingly in favor that Mullvad is earnestly trying to protect privacy.
- tommica 6mo ago> This sounds like how I'd design a VPN if I were an intelligence agency. So does your comment...
- tanh 6mo agoYeah I'm sure one day it will transpire Cloudflare is affliated with intelligence agencies too. The solution to a "sudden DDoS" is to put their website behind Cloudflare. Wonder who can do those sudden attacks?
- hammock 6mo agoI don’t see how they couldn’t be. Either on purpose, secretly my coercion, or secretly without their own knowledge. It’s so valuable
- dewey 6mo ago> Wonder who can do those sudden attacks? Anyone with a few crypto currencies in their wallet that can click a button on any of the booter services with botnets for hire.
- overfeed 6mo agoYou are right, they don't have to do it themselves, but guess who's protecting the booters from other booters?
- l23k4 6mo agoPrimarily specialist bulletproof ddos protection services like ddos-guard.ru, not "Cloudflare" as is the popular meme among clueless commenters.
- linkregister 6mo agoMost modern booters are not maintaining public websites that could be the object of DDoS attacks. They're renting residential IP addresses from free VPN users.
- sph 6mo agoThat’s been my pet theory from day 1, and not because of DDoS. Simply because they are the SSL terminator for most of the internet and can see anything going on in cleartext (and I’ve seen them protecting some shady stuff) I recall a PRISM slide showing the diagram of Google and the public internet, with a big arrow on GFE saying, quote, “SSL added and removed here! :-)” If NSA aren’t installed at Cloudflare, I wonder what they are even doing.
- illiac786 6mo agoWell there is still the small detail of them not storing any logs. This is a massive issue in my view, it allows correlation across multiple VPNs exit nodes, but that’s it. It doesn’t allow to identify you automatically. It does significantly lower the bars for identifying you though, but the requirements are still high. Hopefully they fix this soon. I can’t believe this type of “let’s make it a hash or something sensitive” still happen, and at mullvad, of all places. Why not randomise it simply?
- overfeed 6mo ago> It does significantly lower the bars for identifying you though, but the requirements are still high If you squint a bit, it looks a lot like a "Nobody But US" (NOBUS[1]) scheme. A few more identifying bits could tip the scale for party that has a whole host of other bits on a list of suspects, without being useful to most other people. 1. https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
- illiac786 6mo agoYou definitely need glasses then. Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.
- UqWBcuFx6NV4r 6mo agoit really isn’t.
- illiac786 6mo agoExamples?
- overfeed 6mo agoIP addresses are metadata - and don't require search warrants, meaning they are fair game for dragnet surveillance. Tapping into a backbone, a la Room 641A, can be used to cross-reference timestamped public posts on an anonymous message board to other data sources (e.g. subpoena Netflix for payer based of Netflix's access logs from VPN exit IPs)
- cycomanic 6mo agoWhy? If I was an intelligence agency and designing a VPN I would simply log all the IPs connecting to my VPN and not rely on statistics on exit nodes to identify the users, even more so because they rely on the users to pick different servers.
- faangguyindia 6mo agoHow would you claim it's a no log VPN?
- cjblomqvist 6mo agoIn this particular case I'm quite sure it's not the case. Good arguments in the other comments (why not just log more if that's the case), but I also happen to know a little bit about the workings of Mullvad (I live in Gothenburg where they're from...)
- arcfour 6mo agoMullvad predates the Snowden leaks by several years and was not mentioned anywhere in them. Sure, there are other intelligence agencies, but that's the one I'd be the most worried about. Since either they run it, or they would know of it and want to emulate the idea, or know of it and have access to it from the partner agency running it. Or they are not a threat to me. There's also the issue of no publicly known cases where someone that used Mullvad being deanonymized through the VPN but instead being discovered through some other opsec failure. If an intelligence agency has this capability they have been sitting on it for almost 2 decades without making use of the data. Hard to believe.
- codethief 6mo ago> Mullvad predates the Snowden leaks by several years and was not mentioned anywhere in them. Wow, I didn't realize Mullvad was this old! Then again, maybe they weren't popular enough back then for intelligence agencies to target them? For instance, Mullvad kinda rode WireGuard's popularity wave by being the first(?) VPN provider to implement the protocol. Big ads on billboards came even later. So maybe they only became a target in recent years?
- omcnoe 6mo agoIntelligence agencies use parallel construction to disguise their real methods. Further, more sophisticated methods are reserved for bigger targets. Intelligence agencies aren't running around discussing their methods publicly, most intelligence agency work doesn't result in public criminal charges.
- arcfour 6mo agoSo they gave away all their other extremely valuable methods in the leaks except for Mullvad?
- adampunk 6mo agoI'm not saying I believe the underlying accusation but absence in the Snowden files is absolutely not proof of absence in USFG toolkit.
- traceroute66 6mo ago> how I'd design a VPN if I were an intelligence agency I think its safe to assume that intelligence agencies have other options available to them, such as country-wide timing attacks.
- connorboyle 6mo agoI don't understand your logic. If you are an intelligence agency who controls a VPN, you can just directly monitor the traffic yourself. You have no incentive to make it easier for external observers to guess which users are coming out of which exit IP addresses.