Hacker News Reader

Comment by juanbyrge | Hacker News Reader

Sure, nothing has changed yet. That's how it goes with acquisitions. But people (including myself) are more concerned about the future. At some point in the future there will pressure from within Kape to increase revenues. And at that point I don't want my browsing data to be sold to advertisers and marketing agencies.

View on HN

The merger agreement includes a written guarantee to never log. I don't think there is any other VPN that has that, and I _know_ that many other VPNs will not sign that with us.

The idea of suing a shell corp of an intelligence agency for breach of contract seems laughable.

Maybe they aren't that, but why should anybody without personal knowledge of the situation trust that they aren't? This is the sort of scenario where 'better safe than sorry' overrules giving the benifit of the doubt.

That is a great question - all of our information is public whereas most other VPN companies go out of their way to hide where they are located and who they are.

Verification and transparency are more important than trust.

How can users verify that PIA doesn't log?

You can only infer that as the result of court case demanding logs. And even then, it would have to be born out of the discovery process that PIA was truthful, in my opinion. Yet that only gives you comfort that they hadn't maintained logs up to that point. You have no guarantees from that point forward, which is what we're all concerned about. We aren't concerned about PIA's past operations, but rather what this new partnership means for their future behavior.

I realize your question is most likely rhetorical, but I felt the need to articulate my concerns.

Or they claim no logs in court cases while making them anyways. Thereby creating cover.

"You can only infer that as the result of court case demanding logs. "

You can't be sure. In the Lavabit case, Lavabit argued giving up the key protecting all their users... compromising them to the FBI... would cost them customers due to damaged reputation and privacy. The FBI argued they could do it without telling them. Then, Lavabit would still look private with no financial harm. The judge agreed.

That proposal and the judge agreeing changed how I looked at a lot of companies' claims about law enforcement. I already assumed this would happen with Patriot Act requests by FBI/NSA partnership given they'd be hit with secrecy orders. I didn't see a judge straight up telling a privacy company to defraud all of its customers. I figured the order would be more narrow than that. Now, I have a blanket recommendation to avoid U.S. for privacy tech over both secret government (Patriot Act stuff) and regular, court system.

While I agree with you, I think there's some nuance. In the Lavabit case, the FBI was investigating a national security threat whereas the PIA case involved the hacking of local social media sites. I can see a judge not wanting to rule against the FBI in a case of national security whereas I think a judge would be hesitant to do the same in the case of a misdemeanor offense. Then again, I'm continually surprised by the U.S. government in the "war against terror" era.

Snowden was not a national security threat, he was a government embarrassment threat. It’s not okay to conflate the two

I'm not conflating anything nor am I making a judgement on the FBI's motives. The FBI issued a national security letter that Lavabit fought in court, which I feel Lavabit should have won. The point you missed is the FBI and the judge put a bit more weight towards forcing Lavabit's hand than it did in PIA's case because of the scope and severity of the offenses, perceived or otherwise.

The FBI did not issue a national security letter in the Lavabit case. A national security letter cannot require the placement of a device to intercept communications or compel turning over encryption keys to accomplish the same. The FBI presented Lavabit with a subpoena issued by a judge.

Er, why isn't this prominently mentioned in the blog post?

https://www.privateinternetaccess.com/blog/2019/11/bellum-om...

I didn't lose trust in PIA because of Kape, I lost it because your blog post was poorly written and inadequately communicated some very important news. You bury mentions of a merger in the 7th paragraph, wtf?

I can't trust PIA if you can't be trusted to clearly communicate such important information.

I'm getting a "This Connection is Not Private" page when I try to access the website. Andrew please look into this if you see my comment.

Did you ask AirVPN and IVPN?

https://airvpn.org/faq/logs/

https://airvpn.org/forums/topic/891-important-notice-about-s...

https://www.ivpn.net/privacy

Don't forget Mullvad.

https://mullvad.net/en/help/no-logging-data-policy/

Thanks, sorry.

Serious question: what happens if they decide to start logging anyway?

For context: Facebook told the EU Commission they wouldn't link Facebook and WhatsApp accounts. Then they did it anyway. Sure, they got fined for it, but it's hard to believe that the fine was not factored in from the beginning.

So if they break that part of the agreement with PIA, then what? Is the merger canceled?

Yet the only seeming relevant principle of the 'Kape principles' is:

> 3. Zero Data – sanctity of personal data – we believe each individual owns his own data therefore we will never store or attempt to sell what does not belong to us.

Which is vague in the extreme. It does not clarify what 'personal data' means. Is my internet activity when using PIA/Kape's network still my own? Or does Kape now make a claim on this data?

If there is really a 'never log' guarantee, why is this not prominently displayed in the discussion of the merger?

Reply on news.ycombinator.com