Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

221–230 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#221

Post by tadfisher »

pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

The point of a VPN-as-a-service is that many thousands of connections originate from that same IP, making it difficult to correlate individual connections to an identity.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#222

Post by zamnos »

doublerabbit wrote: post #169
EGreg wrote: post #163

Earlier quoted context omitted.

And yet you trust WhatsApp and Facebook and Signal with their claims of end-to-end encryption. Why?

I don't myself. If it isn't on my own infra, I won't trust it. The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.

Alright, I'll bite. Not all password managers are the same. In particular, the good ones have no direct access to your data. It's encrypted before reaching them, so even if they get hacked, the attacker can't access your passwords without your master password as well, which hopefully you're not giving out.

You don't have to trust password managers if you don't want to, but if you want others to accept your reasoning as to why, you'll have to convince them using an argument that actually applies.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#223

Post by zamnos »

raverbashing wrote: post #43
john_the_writer wrote: post #28

Earlier quoted context omitted.

Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.

True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.

Dns-over-HTTPS (DoH) ftw

https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#224

Post by Dylan16807 »

jonas21 wrote: post #220
Dylan16807 wrote: post #210

Earlier quoted context omitted.

We're assuming in this scenario that your memory is still basically functional, so the math on a sheet of paper won't be replaced suddenly without you noticing. If you can't even remember things in the medium term that's a level beyond "trapped in a dream" that's much more hopeless. So, with that assumption, you make a computer solve a problem that's impossible for a human to work through in a practical amount of tim…

At least in my dreams, nonsensical things happen all the time, but within the dream seem completely reasonable.

It's not so bad to miss a hundred signs if you have a reliable test to try.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#225

Post by kevin_thibedeau »

password4321 wrote: post #127
input_sh wrote: post #119

Earlier quoted context omitted.

They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.

HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/

Implement a deadman switch over X10.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#226

Post by RomanPushkin »

vorpalhex wrote: post #190
bragr wrote: post #95

Earlier quoted context omitted.

That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

It's possible you're in a coma and everything you're experiencing is a terribly detailed dream. It's not very likely though.

> not very likely

I would even say "highly unlikely". I revisited how I understand "unlikely" after reading this:

> Radioactive capsule that fell off truck found in Australia... Radiation Services WA general manager Lauren Steen describing it as a "highly unlikely" scenario.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#227

Post by wing-_-nuts »

KronisLV wrote: post #133
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

> To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to hide? Even then fingerprinting would still present an issue, even without explicitly logging in, with most browsers. For example: https://coveryourtracks.eff.org/ Also have a look at this: https://www.amiunique.org/ So you might need to have a browser that lies and presents configura…

And if you do go out of your way to avoid fingerprinting, get ready for endless captcha prompts, automatic shadowbanning, etc as punishment

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#228

Post by saberience »

callahad wrote: post #148
panick21_ wrote: post #109

Earlier quoted context omitted.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

It's all metadata correlation. The UK will know with certainty that a specific stamp was used to send a specific envelope to Mullvad. (e.g., America has been logging images of every envelope that passes through its postal service for over two decades). It would also be trivial for the UK to know: - When and where that stamp was initially sold (and to whom, if buying online!) - When and where an envelope bearing that…

Not really very realistic is it though? I can only imagine this sort of thing is only done if the suspect is someone like Bin Laden, not the average Joe using a VPN for pirating Photoshop.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#229

Post by michaelmrose »

tsukikage wrote: post #115
asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

It was Swedish cops. We all know I US cops would both be unlikely to comprehend the situation and would take everything that wasn't nailed down out of spite even if they did and would experience no consequences however other folks in better countries actually have rights.

They had warrants to seize servers containing data relevant to a case. None such exists. They didn't have the right to just steal like US cops.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#230

Post by therein »

slekker wrote: post #196
slowmotiony wrote: post #139

Earlier quoted context omitted.

After getting a call from the CIA to leave their honeypot alone, they left without taking anything ;-)

Bold claim. Any more info on this?

Absolutely none but they are getting into the too good to be true territory.

Given they are legit, they should take this as a compliment I guess.

Post reply on HN