Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have successfully completed our migration to RAM-only VPN infrastructure

mullvad.net

Post reply on HN
Print view View original

51–60 of 195 posts

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#51

Post by eddythompson80 »

lopkeny12ko wrote: post #43
HPsquared wrote: post #28

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

This has never made any sense to me. I'm surprised this isn't a massive red flag from anyone on HN. Running a production-grade service with zero metrics and logs? If there's an outage, or even something as mundane as a VM failing to provision, you're telling me that Mullvad developers just shrug and say "well, we can't do anything, because there's no logs!" I don't use a third party VPN, but if I wanted to, "we delib…

Yes, because it’s a simple service (VPN) that hasn’t added a billion nonesense features over time. You can log VM provisioning and health logs but as long as you don’t log any wireguard logs or user provisioning logs you’re good.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#52

Post by hiatus »

foobiekr wrote: post #38
NhanH wrote: post #9

Earlier quoted context omitted.

Even if that attacks has close to 100% success rate, I'd imagine it being nigh physically impossible to execute a targeted attack, as you don't know which machine to hit for a specific user. And that seems to be the main threat model we would be concerned about for this.

Of course they know which machine to hit. How do you do customer service without such a basic function?

Mullvad gives you the option to connect to multiple servers. They offer wireguard configs for every endpoint. How does law enforcement know which server the client plans to connect to? There is no metering either, just a flat monthly rate so nothing to track there either.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#53

Post by CydeWeys »

lopkeny12ko wrote: post #43
HPsquared wrote: post #28

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

This has never made any sense to me. I'm surprised this isn't a massive red flag from anyone on HN. Running a production-grade service with zero metrics and logs? If there's an outage, or even something as mundane as a VM failing to provision, you're telling me that Mullvad developers just shrug and say "well, we can't do anything, because there's no logs!" I don't use a third party VPN, but if I wanted to, "we delib…

Who said they don't have metrics? The VPN servers don't have any storage, but they can still send metrics to an off-machine API, or a different server that does have storage can send requests to the VPN servers and do metrics that way.

Ditto for logging. They claim to not log activity over the VPN itself, but I don't see any claims about not logging more mundane infra stuff like "a VM failed to provision". I think you're arguing here against claims they aren't making.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#54

Post by CydeWeys »

lopkeny12ko wrote: post #45
klysm wrote: post #44

Earlier quoted context omitted.

you can send logs and metrics over the network. the important part to users is not logging the traffic info

Sending them over the network to where? "We don't store logs" means they certainly aren't being ingested into any persistent storage. I'm highly interested in how one can run time-series queries over /dev/null.

They never said "We don't store logs". What they said is they don't keep logs of user activity. You're arguing against a strawman.

https://mullvad.net/en/help/no-logging-data-policy/

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#55

Post by NoMoreNicksLeft »

HPsquared wrote: post #28

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

I don't think that the Houston Police Department (or whichever city you're in) is sophisticated enough to set up an NSA-fiber-optic-backbone-data-siphoning operation. Yes, the NYPD is known to buy illegal million dollar cell phone interceptor machines, but that's about it the maximum level that sort of thing ever goes, for the largest municipal law enforcement agency in the United States.

Like, how would that even work? Without a court gag order, gossip would make its way out of the building in weeks. The cell phone shit only was only quasi-secret because only police department employees were involved, something that's impossible for these VPN outfits. They don't get any of the (unjustified) privilege that the CIA or NSA (or even the FBI, sometimes) receive.

Anything I might do that could pique the curiosity of law enforcement is definitely below the level of federal intelligence agency interest. Maybe your life is more exciting though.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#56

Post by mplewis »

HPsquared wrote: post #28

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

What evidence makes you believe this is happening?

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#57

Post by hamburglar »

jjice wrote: post #42
INTPenis wrote: post #2

This is really cool, you'd expect any VPN provider that cares about security and transparency to act like Mullvad. Some pour thousands of dollars into forcing influencers to say they care about security, while others focus on actually improving security. And it's all open source btw. https://github.com/system-transparency/stboot

> Some pour thousands of dollars into forcing influencers to say they care about security, Tangential to this, it always irks me how they talk about how they all act as if the majority of the websites their users are going to aren't HTTPS and they act like their main benefits are filling in the gaps that HTTPS actually fills in. HTTPS isn't a cure all by any means but most of the scare tactics that the big VPN compan…

I’d agree with you about HTTPS providing most of the benefit that VPN advertising focuses on if I hadn’t seen repeated direct evidence that even most technical users will blithely click through HTTPS errors’ “accept the risk” bypass. It’s as if knowledgeable users think “sure, this could be a man in the middle attack, but it’s most likely just a benign cert problem, because certs are hard.” Sigh.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#58

Post by eviks »

HPsquared wrote: post #28

I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".

If you're that compromised, wouldn't it be much easier to just log and lie about it?

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#59

Post by ThePowerOfFuet »

WendyTheWillow wrote: post #39
dspillett wrote: post #29

Earlier quoted context omitted.

And the court of public opinion. By the time lawyers and judges are involved, unless you are very lucky, your name and photo is all over the tabloids. Any retractions published when you are later found completely innocent will be the equivalent of a column inch or two on page 17.

Simply not an issue for nearly everyone.

Until it happens to you.

Re: We have successfully completed our migration to RAM-only VPN infrastructure

#60

Post by johnklos »

dangus wrote: post #11
Daviey wrote: post #6

Earlier quoted context omitted.

It's essentially a PXE-boot diskless environment, what makes you think it is unusual and possibility of being unreliable?

I should say, unsuitable for certain use cases.

I have servers which have literally been running non-stop for multiple years. Unless / until the kernel itself needs to be upgraded for security issues, and so long as backup power is good, they can run indefinitely.
Post reply on HN