Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

81–90 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#81

Earlier quoted context omitted.

To a legal inquiry via search warrant? Probably not unless it's operated in a country that doesn't have search warrants, but that sounds more like a lawless wasteland.

Still waiting for someone to convert an international waters oil rig to a lawless data center. Or like that submarine base that Microsoft did.

You might enjoy the book Cryptomnicon which is remarkably truthalized.

https://arstechnica.com/tech-policy/2012/03/sealand-and-have...

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#82

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

When tunneling through a VPN ideally thousands of users will share the same exit IP. So even if all your apps "phone home" identifiable information there is no way to prove that whatever traffic "the law" is trying to pin you on actually originates from your machine.

Unless of course if the VPN keeps detailed traffic logs which is why that’s generally frowned upon.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#84

Its funny, how the VPN providers basically become the avatars of the old anarchic web and the constant buisness and government overreach makes them ever stronger. Its basically a old "freedom" tax.

That’s incredibly generous.

The VPN industry is deserving of its bad reputation. Collecting user data in clear contravention of their TOS. Using hacked boxes as VPN endpoints to get people onto residential IP ranges. And whatever else.

I’m very confident in my completely baseless assertion that most people that use a “public” VPN are either bypassing geographical restrictions on a streaming service, or doing something outright shady.

There’s a reason that it’s common for VPN providers to take cash and cryptocurrency, as this one does. It does precisely zilch to thwart the sort of tracking that affects the vast vast vast majority of Internet users.

The VPN industry isn’t being propped up by nerds indulging their crypto libertarian / anarchism fetish but are just spending their time reading Hacker News (with JS off, obviously). There just aren’t enough of them.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#85
post #5

Full title: Mullvad VPN was subject to a search warrant. Customer data not compromised As a customer, I have no doubt about the "customer data not compromised". I'm a paying customer, yet I have never given them any PII. Great service.

How did you pay?

I use https://vpn.sovereign.engineering to pay with Bitcoin.

You can pay a Lightning invoice to get a voucher which is redeemable on the website. You get an extra layer of privacy, and also don't need to wait for an on chain transaction.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#86

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

Briefly, law requires establishing probable cause, that _one_ specific person has done specific things, to underwrite search warrant. VPN IPs are shared between users, meaning any one of the ~X00 users sharing a single ip could be doing any number of things at the same time.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#87

I’m confused. You’re saying cops came to your office 6 deep and just left with nothing even though your privacy policy says you have data [1]? There was no court case or investigation of any kind? This blog post concerns me deeply for a number of reasons especially given a VPNs only actual differentiating value/proposition is trust. [1] https://mullvad.net/en/help/privacy-policy

I don't have a dog in this matter, but I read through their privacy policy. The data they might have or have access to is if you pay with anything other than cash. That data they are saying lies with the payment processor. They link their no logging user activity policy which cover that further. But, at the end of the day it's like you said, it comes down to trust if we are not able to / not going to verify.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#88

Earlier quoted context omitted.

How did you pay?

They also have vouchers you can buy from Amazon, which I find a nice alternative to sending cash in an envelope.

At that point, you can probably just pay by credit card: If your aim is to frustrate invasive ad trackers and profilers on the web (and you assume that Mullvad isn't outright colluding with these), that should be good enough to break any links.

On the other hand, if you don't trust Mullvad's assertion that they delete the link between accounts and credit card payment records after 40 days [1], what makes you think you can trust them to not keep a record of individual scratch cards sold on Amazon, which Amazon can then correlate to an order ID and by extension account and shipping address?

At a higher level, if somebody can convince Mullvad to collude in that manner, they can likely also just ask them to outright hand over your traffic flows and connection data.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#89

Earlier quoted context omitted.

Maybe not in the US. > We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. If this line is to be believed then the police would have been committing a crime by proceeding.

This is not how police work anywhere. There would be an entire legal process for this.

What legal process? The officers were pursuing some kind of case and got a warrant for a possible lead, the lead turned out to be cold, the officers moved on to other evidence. What's so complicated about that?

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#90

Earlier quoted context omitted.

I mean, just don't put a return address on it, and drop it off in a random post office box.

All standard British stamps now have unique Data Matrix codes on them, which means you also have to source your stamps anonymously.

Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it.

So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope, the stamp (and it has to be a british one), investigate who bought the stamp, get the assistance of the shopkeeper in UK (without raising suspicions), successfully reviews tons of security cameras footage to find who bought, etc.

And still don't know which activity to link it to.

A perfect waste of public resources if the NSA really does that, when all they needed to do is to purchase a VPN provider or fund Tor and claim to be no-logs VPN ;)

Post reply on HN