Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

301–310 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#301

Post by autoexec »

KronisLV wrote: post #133
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

> To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to hide? Even then fingerprinting would still present an issue, even without explicitly logging in, with most browsers. For example: https://coveryourtracks.eff.org/ Also have a look at this: https://www.amiunique.org/ So you might need to have a browser that lies and presents configura…

> So you might need to have a browser that lies and presents configuration information that is common enough not to be unique,

there are so many ways to fingerprint a user that trying to blend in with the crowd is pointless. If anything, it's better to have your browser present a unique fingerprint that regularly changes than to have to pray that you've somehow managed to avoid every single thing that could possibly flag you individually.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#302

Post by autoexec »

causi wrote: post #208
troad wrote: post #192

Earlier quoted context omitted.

> don't use a VPN correctly People have different use cases for a VPN. I use one because I travel a lot, and spend a lot of time on dodgy public Wi-Fi. Not because I’m living some Jason Bourne fantasy.

Yeah. A commercial VPN that's demonstrated its record-keeping policy under subpoena is reasonably safe if your objective is pirating media. HN commentators act like the VPN target market is Sino-Iranian freedom fighters who split their time between rescuing Uyghurs and searching for a way to cure their magical curse that makes them dissolve into dust if Google can tell they did a search for good restaurants in the ar…

> Most people are just trying not to get a scary letter from HBO.

It's safe to assume that VPN company operating in the US is compromised but I figure that three letter agencies aren't going to spoil their honeypot over some kid downloading movies and TV episodes, which just gives you an added layer of protection against raids while also preventing your ISP from selling your browsing history and avoiding DMCA letters which unfortunately can get you perma-banned from your ISP based on nothing but unproven accusations from unreliable 3rd parties.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#303

Post by quickthrower2 »

93po wrote: post #182
Etheryte wrote: post #135

Earlier quoted context omitted.

Tor exists, but realistically the overhead of using Tor is not acceptable to the general public. As long as Tor is sufficiently slow compared to everyday traffic it will remain a niche use case. A good VPN on the other hand gives you at least a little bit of privacy without much of a cost.

I've looked at Tor recently just out of curiosity for the tech and I found browsing to be plenty fast. Admittedly it was plain text sites with no images or whatever. And the installation/use of the Tor browser was easy.

One does not need to justify Tor usage :-)

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#304

Post by autoexec »

woofcat wrote: post #140
ementally wrote: post #126

Earlier quoted context omitted.

If your ISP suspects your IP address (can see your are connected to specific VPN server) they can just contact top websites, example: twitter, facebook or google and ask them if there are any users connected with the same IP at given specific time.

This is a confusing take to me. So my ISP which has my billing information is trying to find out who I am by calling Google? They know who I am. The inverse is what you're trying to prevent. Service ABC has malicious activity and calls Google to ask which accounts are accessing from that IP address. However this has two main problems. a) Why would Google give this info over willingly. b) Most VPN's assign the same ou…

It's not a 1-1 mapping but it can narrow things down to you and maybe a handful of others. If you're doing something like file sharing repeatedly over several days/weeks they can pull data for all of that time and when your IP is the only constant they'd know it was you. If they have only a handful of people it could potentially be, and they care enough they can seize and search the devices of everyone to find the person.

Also, you don't have to be logged into google for google to know who you are. If you're using windows, your OS is also phoning home constantly with identifying data. If you use steam, it's also phoning home. Run wireshark sometime and see how much your computer is sending to random servers without you doing anything or being "logged in".

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#305

Post by iio7 »

hnarn wrote: post #275

The summary of many comments so far seems to be: "I don't believe this is what actually happened when this warrant was executed in Sweden, because it doesn't sound like something that would happen when a warrant is executed in the US."

Exactly this! It's Sweden, not the US.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#306

Post by singleshot_ »

kkielhofner wrote: post #186
Marsymars wrote: post #150

Earlier quoted context omitted.

I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

This analogy breaks down at a certain resolution but imagine if the cop who pulled over Tyson brought the district attorney with him and Tyson has God in the passenger seat. I could absolutely envision a situation where God explained the facts to the DA who subsequently changed his mind about whether there was a substantial likelihood of a conviction, which is (usually) the ethical threshold for bringing prosecution.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#307

Post by autoexec »

miohtama wrote: post #175
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

You want to use VPN in places like United Arab Emirates and China where there are issues with Internet traffic - WhatsApp calls and such are blocked, you force to use the local crappy app by the local ruler’s cousin otherwise - They will outright send a re-educator to visit you if you browser the web about the sensitive topics

> They will outright send a re-educator to visit you if you browser the web about the sensitive topics

This also true if you post the wrong things to social media in Canada (https://northernontario.ctvnews.ca/sudbury-ont-police-say-yo...) and in Australia (https://www.youtube.com/watch?v=vWZ06UThHas) and in the UK if you post something offensive they'll outright arrest you. I'm sure I read an article at some point about someone in the US being questioned by police for posting a movie quote to social media, but I can't seem to find anything about it now, just finding tons of examples of police in the US getting in trouble for posting racists things.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#308

Post by panick21_ »

callahad wrote: post #148
panick21_ wrote: post #109

Earlier quoted context omitted.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

It's all metadata correlation. The UK will know with certainty that a specific stamp was used to send a specific envelope to Mullvad. (e.g., America has been logging images of every envelope that passes through its postal service for over two decades). It would also be trivial for the UK to know: - When and where that stamp was initially sold (and to whom, if buying online!) - When and where an envelope bearing that…

To make this happen each stamp would during product have to know where it would will be sold. Is that actually how it works? Can you show me the evidence for that.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#309

Post by LawTalkingGuy »

kkielhofner wrote: post #259
semanticist wrote: post #240

Earlier quoted context omitted.

This feels like a very American-centric perspective, this happened in Sweden. For a bunch of reasons policing outside the US is very different to policing in the US.

I realize this happened in Sweden. My dad was a professor at the Karolinska Institutet in Stockholm; I practically grew up there. My first name is spelled "Kristian" for this reason. Yes Sweden is very different from the US. In fact, seven years ago some Swedish cops on vacation in NYC became somewhat famous and drew significant attention (at the time) to policing issues in the US[0]. People in the US were literally…

Meh, police get the address wrong sometimes. I could totally see them either not understanding of not believing a 'no logs' policy.

So they get a warrant for 'servers with client connection logs' and when they arrive they discover that there are no servers - nothing with a HD and certainly no storage systems, and then they contact their boss and are more willing to re-examine and maybe decide to trust that the company was being honest.

Mullvad don't say they weren't searched, just that nothing was taken. They informed the police that what they wanted didn't exist and demonstrated it to the police/prosecutor's satisfaction. Cops have access to technical consultants if they need expertise to verify this.

Good code and wiring probably helped - if there's a rat's nest of cables running into the ceiling it's hard to trust, but if there's a really clean patch panel and short direct runs between equipment it's easier to demonstrate that what you see matches the device map and how it's configured.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#310

Post by jaystraw »

terhechte wrote: post #100
pedro_hab wrote: post #71

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

Use the VPN from a VM. You can also configure Mullvad to use socks so that it can only be accessed from Firefox (which has OS independent socks settings)

you can start chrome-based browsers with a flag from the commandline with os independent proxy settings
Post reply on HN