Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infrastructure audit completed by Radically Open Security

mullvad.net

Post reply on HN
Print view View original

251–260 of 290 posts

Re: Infrastructure audit completed by Radically Open Security

#251

Post by jonfw »

brapachin wrote: post #8

It appears in this audit. They only reviewed test production servers. Playing devils advocate, what would be stopping Mullvad from providing the Open Security team with a version of Mullvad stripped of logging features? I hate to be this skeptical, but shouldn’t an actual audit review customer facing servers (within bounds to prevent the auditors from logging info). Maybe I’m wrong someone pls lmk. But I’m not convin…

Audits can't account for a company acting in bad faith to mislead an auditor. It accomplishes two things-

1. ensure that the company isn't misconfiguring things and accidentally breaking their own policies

2. provide a paper trail that would directly implicate people in the event of fraud, removing plausible deniability for the folks involved.

Re: Infrastructure audit completed by Radically Open Security

#252

Post by pelasaco »

protonmail wrote: post #181
procone wrote: post #90

Earlier quoted context omitted.

Source? They've always been logless. I think you have this completely backwards considering Proton maliciously logged and handed out customer IPs to police [0]. [0]: https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

As any other company operating legally, we have to respect the local legislation, which is what happened in this case. The case also shows that our encryption works as intended - we were not able to share any of the user's data stored encrypted on our servers (email content, attachments, etc.), because we don't have access to it ourselves. Note also, that the case pertains to Proton Mail, and not Proton VPN. Proton M…

thank you Protonmail. I was downvoted as expected, but you still the only viable option <3.

Re: Infrastructure audit completed by Radically Open Security

#253

Post by allarm »

GoToRO wrote: post #143
leesalminen wrote: post #112

Earlier quoted context omitted.

> Anyway, and sadly, the sanctions affect "regular" people like me the most. The ruling elite? Not at all. This confirms my secondhand knowledge of financial sanctions. It seems to universally be this way and makes me wonder why we still tout them as if they were effective. They sure don’t seem to be.

The idea is that "the many", the poor, will overthrown the elite.

Because they have limited access to the Internet? That’s just silly.

Re: Infrastructure audit completed by Radically Open Security

#254

Post by hvis »

nabakin wrote: post #200
mynameishere wrote: post #170

Earlier quoted context omitted.

Russian passport, your official documents would be from the Russian state; your police would be Russian And, most likely, your personal allegiance would be Russian.

While this is a provocative response and there is no excuse for the Russian invasion of Ukraine, the 2001 Ukrainian census[1] states 60.4% of the Crimean population considered themselves Russian and 24% of the Crimean population considered themselves Ukrainian. [1] https://en.wikipedia.org/wiki/Demographics_of_Crimea#Ethnici...

Whether the people considered themselves to be "Russian" or not, in 1991 54% of voters in Crimea came out in favor of independence: https://en.wikipedia.org/wiki/1991_Ukrainian_independence_re...

Even though you have the results of "demographics" survey of 1989 that put "Russian" populace at 67%.

Re: Infrastructure audit completed by Radically Open Security

#255

Post by concordDance »

varispeed wrote: post #82
euazOn wrote: post #61

Earlier quoted context omitted.

Sidenote: I know a bunch of people from Crimea and many things we take for granted are surprisingly complex for them. People from Cuba or Iran at least have the certainty of which country they are in.

Crimea is in Ukraine.

Country borders are made up. While this is most obvious when looking at Africa it is also true everywhere else.

Re: Infrastructure audit completed by Radically Open Security

#256

Post by nabakin »

iudqnolq wrote: post #216
nabakin wrote: post #200

Earlier quoted context omitted.

While this is a provocative response and there is no excuse for the Russian invasion of Ukraine, the 2001 Ukrainian census[1] states 60.4% of the Crimean population considered themselves Russian and 24% of the Crimean population considered themselves Ukrainian. [1] https://en.wikipedia.org/wiki/Demographics_of_Crimea#Ethnici...

Obviously it's impossible to do a reasonably unskewed poll in Crimea right now. However in other parts of Ukraine the number of people who consider themselves Russian drastically decreased when Russia started shelling their homes. So it's not clear how informative 2001 polls would be. Russia has also deliberately encouraged Russians to move to Crimea recently which would also skew that statistic.

You make some good points. I agree, any census done after Russia took Ukraine in 2014 can't be used and I don't doubt people who once considered themselves Russian started to consider themselves Ukrainian after Russia attacked Ukraine, but this was before all that so I don't think that's a problem.

And I'm not saying considering yourself Russian means you have allegiance to Russia, but I think there is a strong correlation between the two. Even if there's less of a correlation than I think, the percentage which considers themselves Russian is over twice that of the percentage which considers themselves Ukrainian. Maybe the Tatars align more with Ukraine than Russia, improving the balance, but idk.

Re: Infrastructure audit completed by Radically Open Security

#257

Post by concordDance »

varispeed wrote: post #108
dijit wrote: post #86

Earlier quoted context omitted.

Yet, if you lived there you would be issued a Russian passport, your official documents would be from the Russian state; your police would be Russian. And; if you lived in Laos, Cuba, Cambodia or Afganistan: you would currently be taking the opposite stance. We owe it to ourselves to not permit the affectations of propaganda to convince us that we are consistently right, the truth on the ground is much more complicat…

[flagged]

> These documents are illegal and have no meaning.

"No meaning"? That seems like a meaningless statement.

> And then you are trying to legitimise the Russian invasion.

Not everyone is a soldier in your ideological (and literal in this case) war. People can have nuanced views for nuanced reasons.

Re: Infrastructure audit completed by Radically Open Security

#258

Post by allarm »

protonmail wrote: post #186
sotix wrote: post #154

Earlier quoted context omitted.

Both are fine for vpn performance. However, Mullvad has won me over with their business practices. Mullvad accepts my payment for a month of use at a time, and I manually renew it (after I receive a reminder) each month. If I don’t need a vpn the following month, I don’t pay for another month. I also find Mullvad works a bit better on Linux too. I just got hit with a 2 year auto renewal charge from proton for my old…

Please note that Proton subscriptions are automatically renewed, as well as that if you are using multiple services under the same Proton account, the access to all of them will be suspended if an invoice has not been cleared for longer than 14 days: https://proton.me/support/delinquency . We cannot downgrade a subscription for you automatically, as only you can choose what data should be removed from your Proton acc…

Please note that this response and the whole reasoning is absolutely ridiculous. But thank you for it anyway, I’ll make sure to keep away from your services in the future.

Re: Infrastructure audit completed by Radically Open Security

#259

Post by samcat116 »

hunter2_ wrote: post #121
BoppreH wrote: post #59

I really respect how Mullvad is willing to sacrifice business to give extra security and reliability to the (remaining) customers. I first saw it when they disabled auto-renewal with PayPal, because it'd force them to store PII along with your account. Unfortunately for me, they made one too many sacrifices, and disabled port forwarding[1]. They don't store any contact information that could be used to warn customers…

> They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day This situation seems avoidable: what if the payment/signup flow had a big loud warning that you need to configure your own polling of an RSS endpoint using a client capable of pinging you?

This might be the most HN comment I’ve seen in a while

Re: Infrastructure audit completed by Radically Open Security

#260

Post by nabakin »

hvis wrote: post #254
nabakin wrote: post #200

Earlier quoted context omitted.

While this is a provocative response and there is no excuse for the Russian invasion of Ukraine, the 2001 Ukrainian census[1] states 60.4% of the Crimean population considered themselves Russian and 24% of the Crimean population considered themselves Ukrainian. [1] https://en.wikipedia.org/wiki/Demographics_of_Crimea#Ethnici...

Whether the people considered themselves to be "Russian" or not, in 1991 54% of voters in Crimea came out in favor of independence: https://en.wikipedia.org/wiki/1991_Ukrainian_independence_re... Even though you have the results of "demographics" survey of 1989 that put "Russian" populace at 67%.

Thanks for this. I'm glad people have good, evidence-based responses to my comment.

This gives us a great idea of how likely a Crimean who considers themselves Russian would actually vote between the two and that while the correlation is strong, it might not be strong enough to suggest Crimeans would favor Russia and while Crimea is still clearly, the most Russian-friendly Ukrainian state, the decision between the two is much closer than I previously thought.

Edit: to add, I have talked with a Crimean who supports Ukraine, but they say the outcome of a vote would very likely be pro-Russia, even before they started shipping Russians in and pre-occupation.

Post reply on HN