Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

261–270 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#261

Post by xp84 »

rvnx wrote: post #90
callahad wrote: post #80

Earlier quoted context omitted.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it. So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope, the stamp (and it has to be a british one), investigate who bought the stamp, get the assistance of the shopkeeper in UK (without raising suspicions), successfully reviews tons of security cameras footage to find who bought, etc. And still d…

Wow, looks like you lost that bet! They indeed shred that envelope.

"Put the money in an envelope together with the payment token and send it to us. We will open the envelope, add time to the account (corresponding to the amount of cash sent), and then use a shredder to destroy the envelope and its non-money contents."

Source: https://mullvad.net/en/help/no-logging-data-policy/#payments

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#262

Post by [deleted] »

kkielhofner wrote: post #259
semanticist wrote: post #240

Earlier quoted context omitted.

This feels like a very American-centric perspective, this happened in Sweden. For a bunch of reasons policing outside the US is very different to policing in the US.

I realize this happened in Sweden. My dad was a professor at the Karolinska Institutet in Stockholm; I practically grew up there. My first name is spelled "Kristian" for this reason. Yes Sweden is very different from the US. In fact, seven years ago some Swedish cops on vacation in NYC became somewhat famous and drew significant attention (at the time) to policing issues in the US[0]. People in the US were literally…

[deleted]

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#263

Post by nisegami »

hnarn wrote: post #184
kkielhofner wrote: post #174

Earlier quoted context omitted.

I'm an American (keep that in mind) but I have been to Sweden many many times throughout my entire life (my dad worked there). It's a great place and somewhat famously the "Swedish Subway Cops"[0] highlighted the difference between US and Swedish policing seven years ago. All of that said I find it highly, highly implausible that law enforcement anywhere in the world would show up with a warrant and just walk out wit…

The people that attend when these warrants are executed are highly technically skilled, and obviously Swedish surveillance agencies know Mullvad very well, probably intimately (ie it wouldn’t surprise me if they even have an understanding of their infrastructure). It’s not at all “highly implausible” that they showed up for a technical discussion to see if the data they wanted but were almost certain did not exist co…

>If they are confident that this data does not exist, why would they start seizing hardware?

As retaliation or as a punitive measure. Basically, just to spite them.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#264

Post by Root_Denied »

nextaccountic wrote: post #206
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

> What good is a VPN when multiple apps on your computer are phoning home? The point of a VPN is that whenever an app phone home, they will do so through the VPN. Standard VPN configuration (which I supose the Mullvad client performs?) is to entirely disallow any traffic that doesn't go through the VPN

You're missing the reason this is important - the companies that run those apps (spotify, facebook, steam, discord, etc.) will be able to correlate your VPN connection with your non-VPN connection, and tie those both to an app account that identifies you.

It means unless you've got a dedicated download/seed box running your torrent downloads, one that doesn't have anything else on it and never connects to anything without a VPN connect, it's possible to track you down way more easily than you would think.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#265

Post by dathinab »

password4321 wrote: post #127
input_sh wrote: post #119

Earlier quoted context omitted.

They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.

HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/

yes but requires the Police to have the right warrants and tools

and the server to not detect it due to e.g. network disconnect, or you not giving it the latest versions of rooling keys etc.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#266

Post by Izkata »

gerbilly wrote: post #56
rasengan wrote: post #47

Earlier quoted context omitted.

> service provider may claim to not store any user data, but they could be lying. As someone who ran a VPN in the past, this blog post is extremely strange as well as the purported described sequence of events. Police in any jurisdiction aren’t jokes - especially not Sweden where they can absolutely walk in and take your stuff according to mullvads website [1]. It’s 2023 - if a VPN is how you’re doing your privacy yo…

> It’s 2023 - if a VPN is how you’re doing your privacy you’re probably doing it wrong. I'm honestly interested, how could one 'do privacy' the right way then?

I'm guessing they're thinking of VPN as OpenVPN, and are referring to WireGuard...? Mullvad also provides configurations for that.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#268

Post by jdmoreira »

tsukikage wrote: post #115
asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

This is in Sweden

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#269

Post by jerry1979 »

tsukikage wrote: post #115
asoneth wrote: post #97

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

Perhaps a business would structure their physical infrastructure in anticipation of the language of search warrants. They could use documentation, the principle of separation of concern, and well-labeled physical devices.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#270

Post by u320 »

zaphirplane wrote: post #248
troad wrote: post #200

Earlier quoted context omitted.

This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly d…

Items removed outside the scope of a warrant have similar standing to items seized without a warrant.

Yes, in the sense that they are both admissible in court. This is Sweden, not USA.
Post reply on HN