31–40 of 195 posts
One thing that I always wondered from VPNs. Let's say a pedophile uses Mullvad to get forbidden images, isn't the VPN liable? I mean, the law enforcement will see that the IP was from Mullvad's office, so I assume they are the ones doing it? How do they avoid this? It is a real doubt. Maybe stupid, but real.
One thing that I always wondered from VPNs. Let's say a pedophile uses Mullvad to get forbidden images, isn't the VPN liable? I mean, the law enforcement will see that the IP was from Mullvad's office, so I assume they are the ones doing it? How do they avoid this? It is a real doubt. Maybe stupid, but real.
and then suppose you login to that VPN and are looking up children's sweaters for your kids and keep the session on .. while law enforcement is looking up the ip address associated with the earlier activity which is now assigned to you . Good luck explaining to the the cops about VPNs and IP addresses. This is my fear.
The more significant concern is if you are the other side: if you deliberately run some sort of VPN or other proxy that others can use, or less deliberately do so. Many hacked or otherwise suspicious browser add-ons, and other malware, will make HTTP(S) requests & other connections on behalf of their C&C hosts and to your ISP or anyone else those requests will be largely indistinguishable from those that are the result of your activity.
One thing that I always wondered from VPNs. Let's say a pedophile uses Mullvad to get forbidden images, isn't the VPN liable? I mean, the law enforcement will see that the IP was from Mullvad's office, so I assume they are the ones doing it? How do they avoid this? It is a real doubt. Maybe stupid, but real.
I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".
Honestly I don’t think audits are worth anything. But it’d be a huge conspiracy to mess with so many parties.
I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".
Sweden absolutely has LI requirements for all telecom gear but vpns I have no idea.
I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".
https://www.assured.se/publications/Assured_Mullvad_relay_se... Honestly I don’t think audits are worth anything. But it’d be a huge conspiracy to mess with so many parties.
One thing that I always wondered from VPNs. Let's say a pedophile uses Mullvad to get forbidden images, isn't the VPN liable? I mean, the law enforcement will see that the IP was from Mullvad's office, so I assume they are the ones doing it? How do they avoid this? It is a real doubt. Maybe stupid, but real.
IANAL but my understanding of current case law is that it IP address does not automatically mean a particular person.
Earlier quoted context omitted.
Technically, researchers have proven that you can shutdown a machine, hit the RAM with a cold spray (like liquid nitrogen) and keep the bits "alive" long enough to dump them for analysis. But, obviously, that's pretty insane. Agree with everything that this is a big leap in the step of better protection for users.
Even if that attacks has close to 100% success rate, I'd imagine it being nigh physically impossible to execute a targeted attack, as you don't know which machine to hit for a specific user. And that seems to be the main threat model we would be concerned about for this.
Earlier quoted context omitted.
You don't have to explain anything to cops. You explain it to lawyers and judges.
And the court of public opinion. By the time lawyers and judges are involved, unless you are very lucky, your name and photo is all over the tabloids. Any retractions published when you are later found completely innocent will be the equivalent of a column inch or two on page 17.
Earlier quoted context omitted.
You can still mount a remote networked file system to a dikless node. Lack of disks does not guarantee inability to persist data.
If only the system were open source so you wouldn't have to wonder about that... But we do still have to trust that they are actually running the code they posted. Unless that code somehow contains some way to verify itself? I wonder if there is some way to do that? Have the code include a hash of itself and some way to query the running service that guarantees that the running service must be running the code you ar…
- Multi-party computation. Too much overhead for something like this.
- Remote attestation, as seen in e.g. Intel SGX. Usually provided by the CPU vendor. Not a cryptographic guarantee, more of a "it'd be very hard to defeat this if you're not Intel". Probably not that warrant-resistant.