Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

141–150 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#141

Post by metadaemon »

terhechte wrote: post #100
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

Use the VPN from a VM. You can also configure Mullvad to use socks so that it can only be accessed from Firefox (which has OS independent socks settings)

I was under the impression the socks feature no longer works, are you currently using it?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#142

Post by LeonM »

InCityDreams wrote: post #121
lxgr wrote: post #55

Earlier quoted context omitted.

> I'm a paying customer, yet I have never given them any PII. By nature, every VPN gets at least the IP you are connecting from and the IPs (and almost always also hostnames) you are connecting to. I'd consider that PII.

If you pay cash, and use the service the pii is 2 IP numbers?

How would you pay cash for an online service?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#143

Post by fareesh »

robjan wrote: post #113
fareesh wrote: post #102

Earlier quoted context omitted.

If an app phones home at 11:00 AM and the illegal act is at 11:01 AM wouldn't it narrow down the list of suspects considerably?

No, because at the same time x number of users have their apps phoning home with what appears to be the same IP

Are you sure x is sufficiently large?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#144

Post by daveoc64 »

panick21_ wrote: post #109
callahad wrote: post #80

Earlier quoted context omitted.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

There's no evidence they're actually doing that, it's just possible that they could.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#145

Post by rekoil »

password4321 wrote: post #127
input_sh wrote: post #119

Earlier quoted context omitted.

They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.

HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/

I guess their OS could defend itself from something like this by actively deleting any potentially compromising customer data as soon as it loses it's connection to the internet. No idea if it does though.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#146

Post by HDThoreaun »

LeonM wrote: post #142
InCityDreams wrote: post #121

Earlier quoted context omitted.

If you pay cash, and use the service the pii is 2 IP numbers?

How would you pay cash for an online service?

you can mail them cash with your account number.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#148

Post by callahad »

panick21_ wrote: post #109
callahad wrote: post #80

Earlier quoted context omitted.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

It's all metadata correlation.

The UK will know with certainty that a specific stamp was used to send a specific envelope to Mullvad. (e.g., America has been logging images of every envelope that passes through its postal service for over two decades).

It would also be trivial for the UK to know:

- When and where that stamp was initially sold (and to whom, if buying online!)

- When and where an envelope bearing that stamp entered the postal system

- When and where envelopes with other stamps from the same booklet entered the postal system

Add up enough bits and you can pierce anonymity.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#149

Post by msdrigg »

LeonM wrote: post #142
InCityDreams wrote: post #121

Earlier quoted context omitted.

If you pay cash, and use the service the pii is 2 IP numbers?

How would you pay cash for an online service?

One quick google away:

> Can I really pay with cash?

> You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD.

https://mullvad.net/en/pricing/

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#150

Post by Marsymars »

tsukikage wrote: post #115
asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.
Post reply on HN