3 ms·

> It does significantly lower the bars for identifying you though, but the requirements are still high If you squint a bit, it looks a lot like a "Nobody But

> It does significantly lower the bars for identifying you though, but the requirements are still high If you squint a bit, it looks a lot like a "Nobody But US" (NOBUS[1]) scheme. A few more identifying bits could tip the scale for party that has a whole host of other bits on a list of suspects, without being useful to most other people. 1. https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS

illiac786 5mo ago
You definitely need glasses then. Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.
- UqWBcuFx6NV4r 5mo ago
  it really isn’t.
  - illiac786 5mo ago
    Examples?
    - overfeed 5mo ago
      IP addresses are metadata - and don't require search warrants, meaning they are fair game for dragnet surveillance. Tapping into a backbone, a la Room 641A, can be used to cross-reference timestamped public posts on an anonymous message board to other data sources (e.g. subpoena Netflix for payer based of Netflix's access logs from VPN exit IPs)
      - illiac786 5mo ago
        please read the thread again. The parent said “it is not a high bar to own a website where a user is entering personal data”. I strongly disagree, although “high” is obviously not measurable. Maybe I should again be more specific, again. high bar for me is, you need to be a state sponsored hacker basically, or a large criminal organisation. Or a single, very skilled and high motivated person maybe.
- overfeed 5mo ago
  The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses. Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowing the exact times the target got home, or interacted with their phone after getting a DM alert.
  - illiac786 5mo ago
    What’s the difference if Mullvad did not have the vulnerability described above?
    - overfeed 5mo ago
      The vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone. Clustering, in turn, allows time-based deanonymization[1], against the users assumptions of being sufficiently anonymized. Adversaries who do not enjoy a backbone-traffic MitM vantage point cannot exploit this vulnerability, which makes it appear NOBUS-y. 1. Any *aaS, forum, or board, when given a (Mullvad!) IP address and series of request timestamps, and a subpoena, can yield PII on the real identity (email, phone, billing address)
      - illiac786 5mo ago
        but, to cluster this traffic, wouldn’t you need equipment between each and every mullvad exit node and each and every server the user access? Or at least a large proportion of it? Are you talking about a surveillance state?
linkregister 5mo ago
Then why complicate it by being publicly insecure? If Mullvad were wanting to defeat anonymity, they could simply log the traffic metadata while falsely advertising they aren't. Their ads on San Francisco's public transit are good.
- raverbashing 5mo ago
  "public insecure" JFC Security is always a balance. Always AI is showing that everything has a weak spot (wondering where are the "I don't make mistakes with C" now people are - but that's for another discussion) There's another commenter mentioning this makes sense because exactly it avoids them keeping information on which customer is matched to which server. You know, one of the things you don't want to log Could it be done better? Probably. Here's a better idea, logging off is 100% safe Meanwhile 99% of the normies will go for NordVPN
- hackinthebochs 5mo ago
  Good VPNs tout the fact that they had nothing to give in response to a subpoena, or that there was nothing a law enforcement agency to find when they seized a server. For mullvad to be effective as a honey pot it needs to survive these events with its reputation in tact.
  - MuteXR 5mo ago
    If it were a true honeypot by a state agency, they'd be able to just lie about having nothing too.
    - hackinthebochs 5mo ago
      Not when people get arrested and the investigative techniques, sources, etc are made public. They would have to intervene in the legal process to make sure mullvad's role was kept secret. Presumably this isn't always feasible across jurisdictions.
      - duskdozer 5mo ago

illiac786 5mo ago

You definitely need glasses then. Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.

UqWBcuFx6NV4r 5mo ago
it really isn’t.
- illiac786 5mo ago
  Examples?
  - overfeed 5mo ago
    IP addresses are metadata - and don't require search warrants, meaning they are fair game for dragnet surveillance. Tapping into a backbone, a la Room 641A, can be used to cross-reference timestamped public posts on an anonymous message board to other data sources (e.g. subpoena Netflix for payer based of Netflix's access logs from VPN exit IPs)
    - illiac786 5mo ago
      please read the thread again. The parent said “it is not a high bar to own a website where a user is entering personal data”. I strongly disagree, although “high” is obviously not measurable. Maybe I should again be more specific, again. high bar for me is, you need to be a state sponsored hacker basically, or a large criminal organisation. Or a single, very skilled and high motivated person maybe.
overfeed 5mo ago
The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses. Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowing the exact times the target got home, or interacted with their phone after getting a DM alert.
- illiac786 5mo ago
  What’s the difference if Mullvad did not have the vulnerability described above?
  - overfeed 5mo ago
    The vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone. Clustering, in turn, allows time-based deanonymization[1], against the users assumptions of being sufficiently anonymized. Adversaries who do not enjoy a backbone-traffic MitM vantage point cannot exploit this vulnerability, which makes it appear NOBUS-y. 1. Any *aaS, forum, or board, when given a (Mullvad!) IP address and series of request timestamps, and a subpoena, can yield PII on the real identity (email, phone, billing address)
    - illiac786 5mo ago
      but, to cluster this traffic, wouldn’t you need equipment between each and every mullvad exit node and each and every server the user access? Or at least a large proportion of it? Are you talking about a surveillance state?

linkregister 5mo ago

Then why complicate it by being publicly insecure? If Mullvad were wanting to defeat anonymity, they could simply log the traffic metadata while falsely advertising they aren't. Their ads on San Francisco's public transit are good.

raverbashing 5mo ago
"public insecure" JFC Security is always a balance. Always AI is showing that everything has a weak spot (wondering where are the "I don't make mistakes with C" now people are - but that's for another discussion) There's another commenter mentioning this makes sense because exactly it avoids them keeping information on which customer is matched to which server. You know, one of the things you don't want to log Could it be done better? Probably. Here's a better idea, logging off is 100% safe Meanwhile 99% of the normies will go for NordVPN
hackinthebochs 5mo ago
Good VPNs tout the fact that they had nothing to give in response to a subpoena, or that there was nothing a law enforcement agency to find when they seized a server. For mullvad to be effective as a honey pot it needs to survive these events with its reputation in tact.
- MuteXR 5mo ago
  If it were a true honeypot by a state agency, they'd be able to just lie about having nothing too.
  - hackinthebochs 5mo ago
    Not when people get arrested and the investigative techniques, sources, etc are made public. They would have to intervene in the legal process to make sure mullvad's role was kept secret. Presumably this isn't always feasible across jurisdictions.
    - duskdozer 5mo ago