"They" will just spray the machines with liquid nitrogen, pull them out of the rack, put the DRAM in a thermos w/ LN2 and read the data at their leisure.
We have successfully completed our migration to RAM-only VPN infrastructure
71–80 of 195 posts
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#72Earlier quoted context omitted.
IANAL but my understanding of current case law is that it IP address does not automatically mean a particular person.
Pretty sure if they live by themself and nobody else comes into their dwelling and there is no other name attachef to their subscriber info it does
Definitely not. I still am logged into my ex girlfriend wifi so if I wanted to harm her I could easily go stand outside her home at night and download malicious files. That would not make her guilty. They may investigate but that is not proof she did something unlawful.
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#73I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".
> I wonder about those VPNs that say "we don't log or store anything". That may be the case, but...
There may inevitably be some bad actors.
But then there are other companies like OVPN who proved in court that when they say no logging they mean it[1].
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#74Earlier quoted context omitted.
or liquid nitrogen. https://en.wikipedia.org/wiki/Cold_boot_attack
They're going to freeze the whole data center? It's rack after rack of machines that the traffic could have passed through, right? And if they're not logging IPs to RAM then they only have a fraction of a second to get the right one before the register is overwritten with the next user's info.
You do need to know where to send the user's return traffic, so you'll need a table ultimately comprising mappings of network flows to end-user addresses. Of course, once the flows close you don't need to retain this information. In practice, you'll also need information about all currently-open VPN sessions.
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#75"They" will just spray the machines with liquid nitrogen, pull them out of the rack, put the DRAM in a thermos w/ LN2 and read the data at their leisure. https://ieeexplore.ieee.org/document/8388826
With modern encryption protocols, this yields you nothing.
The feature is called Perfect Forward Secrecy, and protects past flows from later key compromise.
Wireguard supports this, which is what Mullvad uses. (For some reason, speculation about which is an exercise left to the reader, WPA in Wi-Fi still does not.)
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#76Earlier quoted context omitted.
I’d agree with you about HTTPS providing most of the benefit that VPN advertising focuses on if I hadn’t seen repeated direct evidence that even most technical users will blithely click through HTTPS errors’ “accept the risk” bypass. It’s as if knowledgeable users think “sure, this could be a man in the middle attack, but it’s most likely just a benign cert problem, because certs are hard.” Sigh.
The problems with clicking past those errors are typically not due to network sniffing but with whatever crazy shit is on the page they are going to. The only two valid usecases of big VPNs like these are 1. Very mild security increase over public wifi 2. Shifting your risk from the ISP spying to mullvad or the VPN provider spying or slightly anonymizing if mullvad rotates IPs. (2) is a real benefit because ISPs are…
3. You live in a country where your ISP is legally mandated to record all of your browsing history and make it available to the government.
4. You live in a country where certain websites are blocked because the government doesn’t agree with them, or because those websites don’t want to deal with your country.
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#77"They" will just spray the machines with liquid nitrogen, pull them out of the rack, put the DRAM in a thermos w/ LN2 and read the data at their leisure. https://ieeexplore.ieee.org/document/8388826
That seems like significantly more work, and significantly more error prone than pulling an SSD out of a machine and reading from a log file
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#78Earlier quoted context omitted.
I’d agree with you about HTTPS providing most of the benefit that VPN advertising focuses on if I hadn’t seen repeated direct evidence that even most technical users will blithely click through HTTPS errors’ “accept the risk” bypass. It’s as if knowledgeable users think “sure, this could be a man in the middle attack, but it’s most likely just a benign cert problem, because certs are hard.” Sigh.
To be frank that's also because the cause for an HTTPS certificate error ranges from "malicious hijack" to "misconfigured server setup" to "I lapsed the expiry date" to "I am using a self-signed certificate". The degree of which these should be scares is not equivalent, yet browsers will treat all of these as equivalent even though they can distinguish between them in the error page. It just results in clickthrough f…
The reason the browser doesn't differentiate between them is because the end result is the same - the cett doesn't match the browsers trusted store. The battle has beenosr on self signed certs at this point (unless you're an enterprise, at which point bundle them with your image).
The difference between a misconfiguration and a compromise is intention, both should be treated as equally suspicious.
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#79Earlier quoted context omitted.
IANAL but my understanding of current case law is that it IP address does not automatically mean a particular person.
Pretty sure if they live by themself and nobody else comes into their dwelling and there is no other name attachef to their subscriber info it does
What if they are on cellular and that hasn't been upgraded to IPv6?
Years ago I handled fraud cases for an e-commerce site with local police, at some point they started asking for IP and port numbers for the offenders, rather than just the IP. Turns out that one of the cellular phone providers had basically run out of IPv4 addresses for their 4G network and did some NAT solution. If you didn't have the port number the client had connected from then they could only tell you which cell tower had been used, not who the customer was.
Re: We have successfully completed our migration to RAM-only VPN infrastructure
#80I wonder about those VPNs that say "we don't log or store anything". That may be the case, but they probably just send a continuous stream of data to the law enforcement / intelligence services or whoever instead of storing it themselves. They can then correctly say "WE don't log".
If you're that compromised, wouldn't it be much easier to just log and lie about it?
Lying about it opens you up to potential litigation and being exposed through discovery. It makes less sense to outwardly lie to paying customers rather than simply lie by omission.