Hacker News Reader

Comment by yellowarchangel | Hacker News Reader

Isn't Netherlands in the nine eyes?

EDIT: "We will never share your personal information with any third party, except when we need to respond to a legal request from Dutch authorities" - https://www.wifimask.com/terms

As a VPN service that means it is not thoughtful about privacy.

View on HN

As a counterpoint: any VPN service that claims that they will ignore the authorities legal requests is lying. No matter what, as soon as it is a business, has a registered address and a nominal director it can be put under pressure.

I think this is true. We want to be as honest and open as possible, that includes being honest about the laws we have to comply too. On the other hand, we have a strict no log policy, we have nothing to hand over to authorities accept for the registered email address, a hashed password and the last 4 numbers of a creditcard. Authorities will need to find different ways to get the information they want.

A 'no log policy' is a hard one, it may be true but you can't really prove a negative. So it is as good as your word and your reputation, which in this case may be very good but it may not be enough to reduce skepticism.

FWIW I do tech DD for a living and I've seen several places that had 'no log' policies on the outside and yet they would occasionally - or even structurally - log data in order to comply with the law.

The 'WBT' (Retenion duty for Telecommunicationsdata) has been disbanded, which should work to your advantage, but the GDPR makes explicit room for the accomodation of legal and regulatory requirements and this in turn may transcend your 'no log' policy. Please make sure you have appropriate legal advice on the subject, it is complex and getting it wrong can really bite you.

Best of luck with your company!

Your comment makes me think of a "Warrant canary" which we could set up to inform our customers that we have been served with a government subpoena: https://en.wikipedia.org/wiki/Warrant_canary

Thanks!

Is anything a VPN company says any better than their reputation? We can't see what's going on behind closed doors.

Even the authorities asking for data have an interest in keeping the VPN's reputation alive in case the VPN does cooperate.

Obviously if they are a Dutch company, then they must comply with Dutch regulations and authority demands. This is to be expected.

What is under their control (which I have not investigated) is how much logging they do. If they do the absolute minimal logging, then there's very little for the Dutch authorities to review. This of course excludes the very likely possibility that the overly performant Dutch intelligence service is monitoring everything from every angle (they have thus far proven to be very, very capable of doing so).

Yes.

Our intelligence agency (AIVD) allegedly facilitated the planting of stuxnet (they had a guy in there or something)

So it'd be reasonable to say that "we're not uncooperative"

Excellent point.

Reply on news.ycombinator.com