Hacker News Reader

Comment by r3bl | Hacker News Reader

As far as donations are concerned, there's not a company I'm more proud of being a paid user of than I am of being a PIA customer.

Out of a sea of "private, no logs" VPN services, PIA donations to the projects that you might also be interested in makes them really stand out. That (together with Ubuntu support) made all the difference when I was pursing a VPN provider.

View on HN

On the note of Ubuntu, PIA also sponsors Linux Mint (an Ubuntu derivative) and even has a tool in the distro's repository to generate OpenVPN config files easily.

And Krita, and Inkscape and Blender...

>"Out of a sea of "private, no logs" VPN services, ..."

Has this ever been verified in any way?

Honest question: Short of root-level access to the entirety of their infrastructure, how would you verify it?

I work for an ISP and have toyed with the idea of offering a "private, no logs" VPN service. As someone running such a service, what would it take to convince you that I wasn't logging information that could be used to identify you?

(Obviously, there would be logs of some stuff -- just not the kind of things that would allow you to be individually or personally identified.)

Get a reputable auditor to vouch for you, by giving them access to your infrastructure for a while. Of course it’s not foolproof (you could change everything the minute he leaves) but it’s the best you can do. Bonus points for making it a yearly event.

How exactly would an entity that makes such a claim, as in this case of "we don't log access", be able to allow external parties to verify this without handing over access to their infrastructure for manual inspection?

I've read a little about zero knowledge proofs, but don't really know much about the subject to know if it could be used to verify these sorts of claims.

Well these were kind of my points I guess. It's a service differentiator probably the biggest one and yet it can never be verified.

I don’t know about PIA, but I believe Malaysian vpn provider Hide.me brought in an independent auditor to validate their claims. I expect you could do that in any country.

Interesting I had not heard this. It actually says as much on this page:

https://hide.me/en/features/logs

Maybe PIA should do the same since that's their biggest differentiating claim.

One issue, is they have an App for every platform, and thus is distributed through .. less than auditable .. means.

As long as you can ignore all of the tracking cookies set on their web page.

Reply on news.ycombinator.com