Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

241–250 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#241

Post by tiahura »

kkielhofner wrote: post #186
Marsymars wrote: post #150

Earlier quoted context omitted.

I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

How about the possibility that this is Sweden with a different set of priorities, an underlying crime that's relatively petty, and a prosecutor that is mostly disinterested in the case but had to at least pretend to make an effort?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#242

Post by yellowapple »

hammock wrote: post #234
troad wrote: post #200

Earlier quoted context omitted.

This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly d…

Many cases the police don’t let you watch, they make you wait outside. Reason to have cameras in your place (pros and cons)

Pros: excellent material for a music video mocking the cops doing the search.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#243

Post by raverbashing »

zamnos wrote: post #223
raverbashing wrote: post #43

Earlier quoted context omitted.

True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.

Dns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/

I know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had

(of course, it all depends on the DNS provider you choose)

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#244

Post by therein »

tadfisher wrote: post #218
Dylan16807 wrote: post #210

Earlier quoted context omitted.

We're assuming in this scenario that your memory is still basically functional, so the math on a sheet of paper won't be replaced suddenly without you noticing. If you can't even remember things in the medium term that's a level beyond "trapped in a dream" that's much more hopeless. So, with that assumption, you make a computer solve a problem that's impossible for a human to work through in a practical amount of tim…

This assumes the dreamer is a human brain.

Yeah I kept thinking about simulation stuff too but GP's method is a good one for being trapped in one's own mind situation.

Also for situations that have the standard dream level of fidelity, you can try basic reality checks like putting your finger through your hand or more conspicuously spinning along your own axis.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#245

Post by mike_hock »

tsukikage wrote: post #115
asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

You mean, sufficiently convincing that they leave empty-handed for now, knowing they'll have to come back with bigger guns.

I'll be watching the news feed for updates on this.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#246

Post by RoyGBivCap »

hammock wrote: post #234
troad wrote: post #200

Earlier quoted context omitted.

This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly d…

Many cases the police don’t let you watch, they make you wait outside. Reason to have cameras in your place (pros and cons)

In America maybe. This was in Sweden.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#247

Post by unixgoddess »

actionfromafar wrote: post #42
unixgoddess wrote: post #23

Earlier quoted context omitted.

the problem is, if this starts to become common, countries will move to make it illegal not to store data...

At least that forces legislators to be overt.

unfortunately that's useless if you can't do anything about it... just think about the recent unfruitful millions-strong street protests in france, how powerless we are even in self-proclaimed democracies.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#248

Post by zaphirplane »

troad wrote: post #200
kkielhofner wrote: post #186

Earlier quoted context omitted.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly d…

Items removed outside the scope of a warrant have similar standing to items seized without a warrant.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#249

Post by rft »

zamnos wrote: post #222
doublerabbit wrote: post #169

Earlier quoted context omitted.

I don't myself. If it isn't on my own infra, I won't trust it. The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.

Alright, I'll bite. Not all password managers are the same. In particular, the good ones have no direct access to your data. It's encrypted before reaching them, so even if they get hacked, the attacker can't access your passwords without your master password as well, which hopefully you're not giving out. You don't have to trust password managers if you don't want to, but if you want others to accept your reasoning…

While GP didn't spell this out, they have, in my opinion, a point. If you use a cloud portal, usually web based (be it browser, electron or similar), that asks for your master password, you need to trust the provider that the master password is not send to their servers. Even if you trust the provider to adhere to this principle, if their infrastructure is compromised an attacker can serve you a different webapp that sends your master password to the server. Same goes for auto-updating native apps.

This does not render the model of keeping the master password client side only moot, it is more secure no matter what. You successfully mitigate the read-only attack of dumping the storage of the cloud provider. However, if you assume a full, on-going compromise of the infrastructure, your password is not secure anymore.

I get that this is moving the goal posts a bit but I wanted to post this anyway. I think if you have highly valuable credentials and want the maximum security for them, you should play out as many possible attack vectors as possible.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#250

Post by swapfile »

wing-_-nuts wrote: post #227
KronisLV wrote: post #133

Earlier quoted context omitted.

> To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to hide? Even then fingerprinting would still present an issue, even without explicitly logging in, with most browsers. For example: https://coveryourtracks.eff.org/ Also have a look at this: https://www.amiunique.org/ So you might need to have a browser that lies and presents configura…

And if you do go out of your way to avoid fingerprinting, get ready for endless captcha prompts, automatic shadowbanning, etc as punishment

>automatic shadowbanning

Yes that seems to be the case here on Hacker News as well as it seems like my submissions and comments don't show up unless I'm logged in. Let's see about this one.

Post reply on HN