Does anyone here know how to corroborate Mullvad's account of this event? Perhaps we can find the Swedish entity that wrote the warrant and any public information reported by the officers executing said warrant?
If such information is publicly accessible, and it corroborates Mullvad's story here, I'd feel like that's pretty compelling evidence that we can trust that Mullvad isn't simply committing fraud by promising not to log customer data while actually logging it.
When the prosecutor brings forth the charges to a court, this information will be public. Until then it is probably covered by “förundersökningssekretess”, which just means that ongoing investigations are not public.[0]
You can contact the “Åklagarmyndigheten” (the Swedish prosecutor authority) and ask them and they’ll help you out. Generally speaking it is pretty easy to get information from government agencies in Sweden due to our constitution. Everything is public by default, with some exceptions like military secrets. I think it shouldn’t be a problem for the prosecutor to confirm they had a warrant at Mullvads office, and maybe even to confirm they didn’t seize anything, unless they think it could harm the ongoing investigation somehow.
That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
Read a page of text, then read it again to see if it changed. This test never seems to fail, at least in the sort of dreams I can remember having after waking up. Usually I can't read at all in dreams, and when I can, the text is different every time I read it.
I thought this was just me! There have been times when I've "read" in dreams (signs, usually), but I don't actually visualize the words. I just "know" what they say.
We're assuming in this scenario that your memory is still basically functional, so the math on a sheet of paper won't be replaced suddenly without you noticing.
If you can't even remember things in the medium term that's a level beyond "trapped in a dream" that's much more hopeless.
So, with that assumption, you make a computer solve a problem that's impossible for a human to work through in a practical amount of time. And then you verify it got the right answer. This proves the math wasn't done by your dreaming brain. (At least it proves it to a pretty good certainty, and you can repeat the test.)
Many NP-complete problems are good candidates here for slow solutions and fast verifications.
Yeah I kept thinking about simulation stuff too but GP's method is a good one for being trapped in one's own mind situation.
Also for situations that have the standard dream level of fidelity, you can try basic reality checks like putting your finger through your hand or more conspicuously spinning along your own axis.
I would even say "highly unlikely". I revisited how I understand "unlikely" after reading this:
> Radioactive capsule that fell off truck found in Australia... Radiation Services WA general manager Lauren Steen describing it as a "highly unlikely" scenario.
What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data.
Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.
Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws.
When you try to argue something is law, please have the decency to link to the actual law, you have linked a proposal and not the law as accepted by parliament.
> it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
“Entirely” possible? Sure, I guess it’s “entirely” possible that the NSA is actually controlled by a reptilian, illuminati cabal of extraterrestrials, while we’re just making stuff up without any factual basis whatsoever.
Bad faith responses like this lashing out at people like bragr make me even more suspicious. You know damn well, or should know, that companies secretly being owned by intelligence agencies is something that has happened before and could happen again. Meanwhile there is no evidence at all for reptilian ETs ever existing.
And furthermore, I am sure you know that when dealing with matters of security, it pays to exercise precaution and be wary of scenarios you cannot prove to be happening at the moment. E.g., you don't know your new friend you met at the bus stop is secret police, an informant for the Vichy government, but until you're damn sure he isn't then you don't let him know the location of your resistance safehouse. You don't need to have proof that your new friend has done anything wrong to be cautious of that possibility.
mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest.
also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.
> there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.
Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best.
Of course we shouldn’t trust them 100%. Trust isn’t required them competent OpSec is implemented within a workflow. Trust is a vulnerability.
pretending you don't need trust when you actually do is a vulnerability. of course you need to trust that mullvad is doing what they actually say they are doing. there is literally no way for you to verify everything they claim.
I don't myself. If it isn't on my own infra, I won't trust it.
The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.
Alright, I'll bite. Not all password managers are the same. In particular, the good ones have no direct access to your data. It's encrypted before reaching them, so even if they get hacked, the attacker can't access your passwords without your master password as well, which hopefully you're not giving out.
You don't have to trust password managers if you don't want to, but if you want others to accept your reasoning as to why, you'll have to convince them using an argument that actually applies.
While GP didn't spell this out, they have, in my opinion, a point. If you use a cloud portal, usually web based (be it browser, electron or similar), that asks for your master password, you need to trust the provider that the master password is not send to their servers. Even if you trust the provider to adhere to this principle, if their infrastructure is compromised an attacker can serve you a different webapp that sends your master password to the server. Same goes for auto-updating native apps.
This does not render the model of keeping the master password client side only moot, it is more secure no matter what. You successfully mitigate the read-only attack of dumping the storage of the cloud provider. However, if you assume a full, on-going compromise of the infrastructure, your password is not secure anymore.
I get that this is moving the goal posts a bit but I wanted to post this anyway. I think if you have highly valuable credentials and want the maximum security for them, you should play out as many possible attack vectors as possible.
i never said you shouldn't ever trust anything. I personally do trust mullvad. I've been using it for over a decade. I'm just not in denial over the fact that there is trust required. Second of all, aside from signal which I have superficially played around with, I don't and have never used any of those services you mentioned and they have absolutely nothing to do with the topic at hand so maybe you can tell me why you brought them into this conversation?
Because I don’t think it’s wise to trust ANY company with major secrets, just because they claim to not view them. Thus I agree with your sentiment and recommend it be applied far more widely
> mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest.
There are parallels to the now-defunct Crypto AG. Impeccable reputation, but no way of independently verifying it it did what it said on the can. It took decades for the truth about its links to the CIA to come out.
My theory is that if you need an iron-clad guarantee of privacy, you're not going to get it from a VPN.
If you're interested in hiding from civil snoops (RIAA, MPAA), by all means, use one. If you're interested in hiding from a government, then by all means, keep rolling the honeypot dice.
Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.
> I'm a paying customer, yet I have never given them any PII.
By nature, every VPN gets at least the IP you are connecting from and the IPs (and almost always also hostnames) you are connecting to. I'd consider that PII.
As long as you only connect from one IP and only ever access one host, sure! That's not trivial to achieve with most VPN clients and devices/operating systems, though.
> You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD.
> Which payment methods do you accept?
> We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24.
> Can I really pay with cash?
> You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD.
Anonymity is not binary. It's a spectrum. Phyical cash mailed to a company with only an account number is significantly more anonymous than a check or credit card they bill.
Perfect anonymity is probably impossible because information theory is impossible to escape. Which means you are trying to determine how far along the spectrum you can reasonably get for your particular risk profile.
Comments that pretend like perfect anonymity is the goal or act like it's binary are singularly unhelpful.
Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it.
So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope, the stamp (and it has to be a british one), investigate who bought the stamp, get the assistance of the shopkeeper in UK (without raising suspicions), successfully reviews tons of security cameras footage to find who bought, etc.
And still don't know which activity to link it to.
A perfect waste of public resources if the NSA really does that, when all they needed to do is to purchase a VPN provider or fund Tor and claim to be no-logs VPN ;)
> So, yes, there is a theory that someone may go in the trash in Sweden, finds the envelope[...]
Presumably the theory is more like [1] - that the postal service, when they scan the envelope to read the address, save the scanned image and give it to the cops.
I agree that the NSA would be better off just running their own VPN services - or indeed intercepting everything on major backbones and just seeing what source IPs connect to Mullvad's servers.
> Can bet 99.99% that Mullvad throws the envelope in the trash and just forgets about it.
Storage is cheap - really cheap. I bet automatically capturing images of all mail during sorting and archiving that for years is not only viable, but a vital investigation/intelligence tool. One would ask Mullvad for the cash payment dates[1], and cross-reference with all mail sent to a Mullvad postal address. One city-level datapoint on where user was, cross-checked with the latest IP address, where stamps were bought[2], and you've massively trimmed the list of suspects, especially if they are behind a NAT and sharing the IP.
1. They have to keep track of payment dates, which is a side channel.
2. Where and when stamps were bought. I'm certain GCHQ can keep track of individual stamp IDs, the batches they belonged to, when they were procured by the retailer and have a reasonable guess when that specific stamp was bought by mail-sender.
Wow, looks like you lost that bet! They indeed shred that envelope.
"Put the money in an envelope together with the payment token and send it to us. We will open the envelope, add time to the account (corresponding to the amount of cash sent), and then use a shredder to destroy the envelope and its non-money contents."
The UK will know with certainty that a specific stamp was used to send a specific envelope to Mullvad. (e.g., America has been logging images of every envelope that passes through its postal service for over two decades).
It would also be trivial for the UK to know:
- When and where that stamp was initially sold (and to whom, if buying online!)
- When and where an envelope bearing that stamp entered the postal system
- When and where envelopes with other stamps from the same booklet entered the postal system
> Not really very realistic is it though? I can only imagine this sort of thing is only done if the suspect is someone like Bin Laden, not the average Joe using a VPN for pirating Photoshop.
This is a misconception caused by the scale of surveillance today. In the old days you were right. To do this kind of tracing they'd have to assign someone to do it which takes human resources and is not infinitely scalable. So they'd only do it to people deemed interesting enough, so average Joe was safe.
Today the scope has changed completely. Everything can be correlated all the time, so it is. No suspicion or probable cause needed.
And all of this is null and void if you buy your stamps from aliexpress and for the low low effort of simply driving to a different city to throw the envelope into the postbox.
Not really very realistic is it though? I can only imagine this sort of thing is only done if the suspect is someone like Bin Laden, not the average Joe using a VPN for pirating Photoshop.
To make this happen each stamp would during product have to know where it would will be sold. Is that actually how it works? Can you show me the evidence for that.
If they scan the stamp's code at time of purchase, and associate it with your debit card, that'd be an obvious way of tracking you.
If they don't do that, if they meet the stamp along the letter's journey, they can scan the code and check which batch it's from, and there could be a database of which post office got which batch, and then it's a matter of checking that post office's purchases/security cameras.
If all stamps are indistinguishable from each other, then you could've bought the stamp months ago on the Isle of Skye and used it in London, they wouldn't be able to tell the difference.
You can pay a Lightning invoice to get a voucher which is redeemable on the website. You get an extra layer of privacy, and also don't need to wait for an on chain transaction.
At that point, you can probably just pay by credit card: If your aim is to frustrate invasive ad trackers and profilers on the web (and you assume that Mullvad isn't outright colluding with these), that should be good enough to break any links.
On the other hand, if you don't trust Mullvad's assertion that they delete the link between accounts and credit card payment records after 40 days [1], what makes you think you can trust them to not keep a record of individual scratch cards sold on Amazon, which Amazon can then correlate to an order ID and by extension account and shipping address?
At a higher level, if somebody can convince Mullvad to collude in that manner, they can likely also just ask them to outright hand over your traffic flows and connection data.
How would they do that? Those are shipped directly from Amazon, and don't have any external markings that could be used to link specific card to amazon account. Unless the idea is that vouchers arrive at amazon in some additional packaging and then are repackaged after linking voucher to the account.
By the end of the day I agree, if you have any "real" reason for using VPN you pretty much have to implicitly trust your provider to not keep any traffic flows and connections that could correlate traffic to your IP, but not even sending money in envelope saves your from that.
If your worried about anything in a 40 day window the credit card <-> account_id is a liability
Amazon doesn’t know the redemption code on the gift card. So Amazon knows that you purchased a Mullvad gift card, but can’t associate the transaction with a Mullvad account. Likewise Mullvad knows service was paid for with a gift card (possibly that the gift card is from a lot sold on Amazon). But they do not know which Amazon transaction the card is associated with.
Unless your behavior and the behavior of others deanonymizes the Amazon purchase <-> redemption your account should be indistinguishable from any other that purchased a Mullvad gift card from Amazon in that window of time.
If you care about privacy, then Amazon is the last company I would buy from. From personal experience, I would be far more concerned about what Amazon does with your data than Mullvad.
As a customer, I have no doubt about the "customer data not compromised". I'm a paying customer, yet I have never given them any PII. Great service.