Hacker News Reader

Comment by delbel | Hacker News Reader

Well then why is it if you actually try and sue a VPN provider for the logs, you won't be able to get them. this is the case for one scenario I know of where a subject got hacked and it was traced to a VPN service. Article is just FUD -- which this conversation could be warranted in some cases, but realistically I've found that it isn't the case. This doesn't mean that their outbound service isn't being logged by a third or unknown party like a government entity (which we know all traffic is logged), but hey it is what it is.

View on HN

They have logs, they just don't keep them very long. (Allegedly.) So in theory, while they might not have logs for a past incident if it's been long enough, they most certainly have logs in very short term and/or can tell who's connected to what at the present time. So while many copyright actors will be too slow to get a hold of said logs, a government actor with significant interest will.

The biggest issue for me is that VPN providers have given me no particular reason to trust them. If I already have reasons to distrust large international corporations that say they care about my privacy, why would I go trust one I've never heard of on the Internet that says it cares about my privacy?

Under EU privacy regulations you could probably demand that your VPN provider gives you a copy of all information they have on you, including logs.

In the EU I've seen this successfully done with ISPs, ie. customers request logs and get a CD by mail. You'll have to insist and it might involve a small service fee.

I did this and the fee was 200 DKK, and that is around 33 USD.

So what exactly was in the logs?

Probably what is required under Danish "law", which would be every 20th TCP session or so...

Note: I write "law" because afaik the current logging directives have been found in violation of the European Human Rights declaration, I hear a legal battle is pending:

https://ulovliglogning.dk/en/

To be fair - I'd never rely on a VPN provider to protect me from government actors with significant interest.

"YOU’RE STILL GONNA BE MOSSAD’ED UPON" (from https://www.usenix.org/system/files/1401_08-12_mickens.pdf )

Whether or not your VPN provider gives you any particular reason to trust them - for some of us, the government has passed laws to require our ISPs to be "untrustworthy".

Can you give us some known examples of VPN Providers that were sued and didn't give logs?

I'd imagine a list of those ones would be considered more credible

A quick google shows a few.

I know PIA had an actual FBI subpoena.[1] (literally the first link I find) Of course there are collision based identification methods, but knowing that you use a VPN and were using something on the East Coast isn't much to go off of. Worst case I can see here is "User was the only one connected on the East coast at this time", but with PIA's userbase, that seems like an unlikely scenario.

There's also a list [2] (little old)

I remember looking a little closer back when the ISP stuff was happening and it wasn't too hard to find cases where specific VPNs were "tested in the field". But I remember coming across a few, I think Norad was also one of them.

[1] https://torrentfreak.com/vpn-providers-no-logging-claims-tes...

[2] https://torrentfreak.com/vpn-services-that-take-your-anonymi...

Yeah, except when PIA gave copies of the subpoena to the media, they only blacked out the content by adding a layer in the PDF.

So you can open it up in Acrobat, and see everything below.

Are you going to trust a VPN provider that can’t even black out text in a PDF?

For reference, here the content with the blacked out info un-blacked-out: https://i.imgur.com/u1hYerD.png and https://i.imgur.com/1a9YD0f.png

I haven't seen the PDF myself, but is it possible that PIA intentionally redacted the information in a reversible way?

Is anything that is blacked out dangerous or a violation?

Could it have been done on purpose? To fulfill legal requirements and prove they aren't hiding anything.

Or could it be an accident? If the latter, then there are certainty questions to ask. I'd expect the legal department to have different tech skills than the IT department though. But still questions.

I don't know the answer, and really would like an answer if someone does know the correct one.

There's nothing confidential in those images. It is a matter of public record that Detective Andrew Perley #660 wanted to know who was routed through 184.75.214.66 on 2013-2-19, and that his interest was communicated to the VPN provider on 2013-4-22.

I'm not sure why they went through the rigmarole of pretending to black something out. Maybe they were just fucking with him?

They sent the blacked out version to the media, and Ars and others published them like that.

So why did they black it out? As a childish joke? Also not inspiring trust in them.

And if they just blacked it out, without need of doing so, and fucked that up, then the question is if they're trustworthy if their security team doesn't double check their blacked out PDFs.

The problem isn't with the content, but with the process.

You assume the PDF was created by someone very tech-literate.

It's far more likely it was created by some middle-level communications staffer.

Yes, this is more likely than intentional leak of the info and I don't know why you're getting downvoted. Someone who works at your company doesn't understand how PDF works -- that's OK, most people don't need to. It's unlikely that the guys who are busy running the servers are going to be spending their time dragging boxes over documents before they get posted online.

The whole point of a VPN is that you trust it more than your government or ISP.

If your VPN allows any intern to simply post PDFs online that contain such info, without the legal or security department looking over it, you're not trustworthy.

What's next? Next time they actually deliver someone's info, and it ends up in a PDF everywhere online, too?

Trust is a fragile thing.

Well, uh, that's definitely not the point of VPNs when I use them. It's very unlikely that a private VPN provider is more trustworthy than either a decently-sized ISP or a government.

VPNs are useful to avoid negative effects of traffic analysis and bad QoS, bad neighbors at a public access point, and give privacy or a different geolocation when accessing specific individual destinations on the web (e.g., an IRC server that would emit your IP into the public log). Generally, VPNs should be used as needed to serve one of these specific purposes, not 24/7.

Expecting protection from your government or ISP for $10 / mo is a tad unrealistic.

Interesting. PIAs entirely marketing argues differently, even going as far as the typical 2000s era scare tactics of telling me where my IP is geolocated, and that the government can read my data.

PIA seems to have gone through this:

https://arstechnica.com/tech-policy/2013/10/how-one-small-am...

To some extent it will be more credible, but the usual "Past Behavior is No Guarantee of Future Performance" type caveats are going to apply regardless.

I know I certainly don't have the time, inclination, or frankly the expertise, to keep abreast of the internal developments in a VPN provider's business, which will likely be private anyway, as well as the evolving legal/regulatory framework wherever they operate. Similarly, policies regarding logs or data retention can evolve over time, one of course has to trust that any retention policy disclosed in public is actually adhered to in private.

If you really are someone who has to give serious consideration to the risk of logs being pulled, I'm not sure any commercial third party provider is a "safe" option.

While not exactly what you're looking for, Torrentfreak does an annual review of VPNs. Here's last year's : https://torrentfreak.com/vpn-services-anonymous-review-2017-...

The VPN I used is based in a country where the US can't come and subpoena / sue people, which is the main protection I can think of. Worst that can happen is their servers being shutdown in countries that can, and it happens on a daily basis. Using a US-based VPN seems like a bad idea either way.

Additionally, why would a VPN keep logs at all? With no traces, they have "plausible deniability" that some of their users are doing horrible, horrible things online. This is the main reason I trust my VPN provider to not have logs. IIRC, the only thing they look for is email spam (which is fairly easy to detect with very minimal / time restricted logging), as it spoils their IP addresses too quickly.

Debugging and assessing abusive behaviour is far easier with some level of history.

That might be a few minutes, hours, or days. Weeks, months, years, not so much.

The way I see it (guessing, not knowing anything specific), the better commercial VPN services -- at least in or ensared into U.S. law -- may not keep logs, in general. But when a three letter agency with relevant authority (being more generous WRT some VPN services, maybe only unavoidable authority), asks for logging for specific users or perhaps some other narrow logging profile, then such logging starts and is made available.

That's hardly the only concern. What if they have an arrangement to sell your traffic data to ad networks? Inject ads via dns poisoning? Inject Bitcoin mining JavaScript into http? Throttle traffic unless e.g. Netflix pays for bandwidth?

VPN just substitutes an unregulated ISP for a somewhat regulated ISP.

Someone would notice a VPN firm fucking with their only service in those ways (well, maybe not the first way), and then they wouldn't have any more customers. That's the difference between these firms and ISPs: they face actual competition!

Someone technical enough to notice would notice, I think that’s a small portion of people who are being preyed on by Big Privacy.

There is a point to be made in there somewhere, that your VPN needs to be an entity you trust (at least more than the alternatives), if you pay for its services, expecting privacy for the price.

A more helpful rant than the OP provided, would be one that informs you of ways to evaluate the trustworthiness of various VPN providers.

Reply on news.ycombinator.com