Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

171–180 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#171

Post by echoer_lyrist »

justsomehnguy wrote: post #70
jrootabega wrote: post #21

Earlier quoted context omitted.

There's also usually another disconnect: between tech industry publicity and tech industry reality. Mullvad could have been, and maybe even still is, lying about how they operate, because it's good for business.

> Mullvad could have been, and maybe even still is, lying about how they operate Could they? Sure. Do they have anything on me? * One BTC transfer * IPs where I'm connecting from (if they are lying and storing them) * My traffic (if they are lying and storing it) * My unencrypted traffic (if they are lying and storing it) Do they have ... on me? * Email? - nope * Phone number? - nope * Credit card? - nope * My first…

Did you obtain the BTC that you used for the purchase from an exchange that requires PII?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#172

Post by ementally »

woofcat wrote: post #140
ementally wrote: post #126

Earlier quoted context omitted.

If your ISP suspects your IP address (can see your are connected to specific VPN server) they can just contact top websites, example: twitter, facebook or google and ask them if there are any users connected with the same IP at given specific time.

This is a confusing take to me. So my ISP which has my billing information is trying to find out who I am by calling Google? They know who I am. The inverse is what you're trying to prevent. Service ABC has malicious activity and calls Google to ask which accounts are accessing from that IP address. However this has two main problems. a) Why would Google give this info over willingly. b) Most VPN's assign the same ou…

a) If they are unable to identify the user by any means then this is their only resort and google is going to happily hand it over.

b) Depends on the country you are in. You might be the only one connected to a specific VPN server at specified time, this also answers point c.

c) Would be surprised. Have a read of this recent Affidavit https://s3.documentcloud.org/documents/23723268/pompourin-af...

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#173

Post by sangnoir »

rvnx wrote: post #90
callahad wrote: post #80

Earlier quoted context omitted.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it. So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope, the stamp (and it has to be a british one), investigate who bought the stamp, get the assistance of the shopkeeper in UK (without raising suspicions), successfully reviews tons of security cameras footage to find who bought, etc. And still d…

> Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it.

Storage is cheap - really cheap. I bet automatically capturing images of all mail during sorting and archiving that for years is not only viable, but a vital investigation/intelligence tool. One would ask Mullvad for the cash payment dates[1], and cross-reference with all mail sent to a Mullvad postal address. One city-level datapoint on where user was, cross-checked with the latest IP address, where stamps were bought[2], and you've massively trimmed the list of suspects, especially if they are behind a NAT and sharing the IP.

1. They have to keep track of payment dates, which is a side channel.

2. Where and when stamps were bought. I'm certain GCHQ can keep track of individual stamp IDs, the batches they belonged to, when they were procured by the retailer and have a reasonable guess when that specific stamp was bought by mail-sender.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#174

Post by kkielhofner »

benmmurphy wrote: post #166

Is this a warrant canary? Maybe the police seized machines but they were blocked from commenting so they published this implausible claim the police went away empty handed.

I'm an American (keep that in mind) but I have been to Sweden many many times throughout my entire life (my dad worked there). It's a great place and somewhat famously the "Swedish Subway Cops"[0] highlighted the difference between US and Swedish policing seven years ago.

All of that said I find it highly, highly implausible that law enforcement anywhere in the world would show up with a warrant and just walk out with nothing saying "Oh ok, sorry for the confusion!" because a subject of the warrant told them "Oh we don't have that. Here's my logging configuration file - see line 45 where logs go /dev/null?" (or whatever).

Sweden is not the US and maybe I can't picture this because of our issues here but still - this narrative and explanation really strains credibility to me.

[0] - https://www.youtube.com/watch?v=izdfnHBMwSs

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#175

Post by miohtama »

pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

You want to use VPN in places like United Arab Emirates and China where there are issues with Internet traffic

- WhatsApp calls and such are blocked, you force to use the local crappy app by the local ruler’s cousin otherwise

- They will outright send a re-educator to visit you if you browser the web about the sensitive topics

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#176

Post by grvgr »

rasengan wrote: post #47
dannyw wrote: post #18

Earlier quoted context omitted.

A service provider may claim to not store any user data, but they could be lying. From the article: "After demonstrating that this is indeed how our service works" Presumably, Mullvad employees showed this data does not exist live.

> service provider may claim to not store any user data, but they could be lying. As someone who ran a VPN in the past, this blog post is extremely strange as well as the purported described sequence of events. Police in any jurisdiction aren’t jokes - especially not Sweden where they can absolutely walk in and take your stuff according to mullvads website [1]. It’s 2023 - if a VPN is how you’re doing your privacy yo…

[dead]

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#177

Post by teaearlgraycold »

bragr wrote: post #95
hnarn wrote: post #75

Earlier quoted context omitted.

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

> being forced to shutdown under some kind of Swedish NSL

Given Mullvad I think they'd rather shut down.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#178

Post by hnarn »

bragr wrote: post #164
SiempreViernes wrote: post #152

Earlier quoted context omitted.

What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data. Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days ( https://lagen.nu/1942:740#K27P16S1 ). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to ke…

Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws. [1] https://lagen.nu/prop/2006/07:63

Mullvad is not an operator, and you’re moving the goal posts.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#179

Post by hnarn »

bragr wrote: post #95
hnarn wrote: post #75

Earlier quoted context omitted.

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

> it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

“Entirely” possible? Sure, I guess it’s “entirely” possible that the NSA is actually controlled by a reptilian, illuminati cabal of extraterrestrials, while we’re just making stuff up without any factual basis whatsoever.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#180

Post by hnarn »

InTheArena wrote: post #24

This makes me highly suspicious that they’re setting up a sting on mullvlad. There doesn’t seem to be much other reasons to serve a physical warrant other then to establish non-compliance with some law they may interpret differently.

You don’t have a very rich imagination. It’s entirely possible this warrant was executed for no other reason than compliance, if requests come from foreign agencies for example obviously they have to be acted upon even if you are almost certain you will find nothing.
Post reply on HN