Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

101–110 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#101

Post by pc86 »

Ensorceled wrote: post #91
pc86 wrote: post #52

Earlier quoted context omitted.

> Huh? Why all the downvotes all of a sudden? Because the whole point of the article is that there was no data to be compromised. If anything this should make you more likely to go with Mullvad if you're looking for VPN services. Reading no more than the title, making up the article content in your mind, and writing a comment based on that made up content is a pretty good recipe for downvotes.

> Because the whole point of the article is that there was no data to be compromised. AND they were able to convince the police and prosecutor of that!

I have to wonder what would have happened had the same thing occurred in the US. I'm really struggling to think of a scenario where the police have a warrant that says "$THING is on computers at this company, go get them" and you have literally any chance of convincing them that $THING is not anywhere.

I could see them taking all the computers then six months later saying "here you can have them back now, come pick them up at the precinct and here's the storage bill."

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#102

Post by fareesh »

sdrinf wrote: post #86
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

Briefly, law requires establishing probable cause, that _one_ specific person has done specific things, to underwrite search warrant. VPN IPs are shared between users, meaning any one of the ~X00 users sharing a single ip could be doing any number of things at the same time.

If an app phones home at 11:00 AM and the illegal act is at 11:01 AM wouldn't it narrow down the list of suspects considerably?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#103

Post by qzx_pierri »

coconut08 wrote: post #98
hnarn wrote: post #75

Earlier quoted context omitted.

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest. also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it an…

> there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.

Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best.

Of course we shouldn’t trust them 100%. Trust isn’t required them competent OpSec is implemented within a workflow. Trust is a vulnerability.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#105

Post by blint_carton »

"After demonstrating that this is indeed how our service works..."

I'm curious how they demonstrated that. Did they just review their policies with them or did they some how technically demonstrate this? Latter seems not really possible to do, even if you had a technically-savvy member of the department there.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#106

Post by noirscape »

rvnx wrote: post #90
callahad wrote: post #80

Earlier quoted context omitted.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it. So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope, the stamp (and it has to be a british one), investigate who bought the stamp, get the assistance of the shopkeeper in UK (without raising suspicions), successfully reviews tons of security cameras footage to find who bought, etc. And still d…

Their official policy is to iirc put the envelope and the letter into a paper shredder after it's been processed fwiw.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#107

Post by panick21_ »

coconut08 wrote: post #98
hnarn wrote: post #75

Earlier quoted context omitted.

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest. also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it an…

mullvad is working on a fireware attestation system that can allow clients to verify the exact version of the software running on the server.

But I think this is not fully deployed.

https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#108

Post by coconut08 »

qzx_pierri wrote: post #103
coconut08 wrote: post #98

Earlier quoted context omitted.

mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest. also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it an…

> there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad. Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best. Of cour…

pretending you don't need trust when you actually do is a vulnerability. of course you need to trust that mullvad is doing what they actually say they are doing. there is literally no way for you to verify everything they claim.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#109

Post by panick21_ »

callahad wrote: post #80
generalizations wrote: post #66

Earlier quoted context omitted.

I mean, just don't put a return address on it, and drop it off in a random post office box.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#110

Post by WaitWaitWha »

asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

"Once is happenstance. Twice is coincidence. Three times is enemy action."

- Ian Fleming, Goldfinger

I find this to be a reasonable subjective measure.

Post reply on HN