Hacker News Reader

Comment by GekkePrutser | Hacker News Reader

It's just one of the many layers of good opsec of you care about privacy. You shouldn't rely on this alone.

And breaking the internet? I think centralisation by parties like Amazon, Google, CloudFlare does that a lot more.

And if you want you can even send them cash in an envelope. Or monero or whatever.

I don't disagree that centralized services are also bad for the internet, but that's not a rebuttal to my point (also, what is a VPN service if not a "centralized ISP with different egress options"). A VPN does not add a layer of privacy. That's a misunderstanding of the concept and unfortunately a popular one even among security folks and even more-so among security marketing folks. A VPN allows you to effectively choose a different ISP. You are not private from Mullvad. You just have their promise that they're better and more transparent than your alternatives and that they won't sell your DNS queries and connection logs to advertisers. It's not bad to align with an ISP that shares your values, but it's not privacy outright.

> And if you want you can even send them cash in an envelope. Or monero or whatever.

So why not only allow payments in privacy perfect currency if they're so concerned about privacy?

> So why not only allow payments in privacy perfect currency if they're so concerned about privacy?

Because perfect is the enemy of good. Mulvad would lose customers and that is not good for Mulvad, nor for the customer.

Yet, here we are praising Mullvad for removing recurring subscriptions which will certainly mean they lose some predictable revenue and customers...

It’s pretty simple. A VPN adds a layer of privacy between you and the server you’re accessing. You go from user A with X home IP address originating from precise Y location, to user A with generic shared IP originating from a vague location likely nowhere near your real location.

Beyond location, did you know there are services that can sometimes accurately provide a users place of work based on home IP? Their likely income level, and more. That becomes impossible with a VPN.

In short a VPN removes a key personal identifier that can be used to ID you online. Your IP address.

But traditional ISPs reuse IP addresses too. You rarely get a static IP from your ISP. Some even run carrier grade NAT and you're literally sharing an IP with your whole building or something. VPNs are not really different in any regard. They do obfuscate location, I'll give you that, and that's seems like the crux of the issue with traditional ISPs: they are small and distributed so people have created location maps. By using a big centralized service you can obfuscate your zip code. I'm all for people having that option, don't get me wrong. Personally I'd rather see us pass strong legislation that takes things a step further and prohibits zip-code based profiling if that's considered dangerous to society, or ya know solve the social problem and create diverse zip codes in the first place so you can't predict income based on it, rather than be fooled into thinking that we can solve this problem by giving everyone a VPN. It doesn't scale.

Most residential ISPs reassign the same IP to the same account for months at a time. It's not technically static but is certainly used as a "mostly static" piece of data by profiling technologies.

I've been assigned the same Comcast IP for years now. I believe the IP allocation is linked to the modem's MAC address.

I agree that it's but a single tool in a complex mesh of procedures to provide some privacy.

But the reality is that it does work for a variety of usecases. Try to torrent in Germany (of all places) and you'll get blackmail letters from random lawyers. Do this with a VPN and no problem.

For this scenario it's the tool for the job. If you're an insurgent trying to liberate Iran it's not.

For general surfing privacy it doesn't add much value at all because most of the identifying information is in the session itself, not the IP. This is where the layered approach comes in.

But I definitely see a value in these services.

And they do offer many anonymous payment options, but some are heavily frowned upon in some regions (eg anonymous crypto in India) and mailing bills is inconvenient and risky. And I guess for some people it's worth the tradeoff.

Yeah I definitely see value, don't get me wrong. I think, slightly, that marketing privacy is the cheap shot at best and kinda irresponsibly inaccurate at worst because it glazes over so much of the actual problem. In other words, if I start using Mullvad today I don't incredibly become anonymous and private on the internet... there's a lot more work to do to achieve that posture. The way VPNs are touted though might lead you to believe they keep you safe and private.

Otherwise sounds like we mostly agree.

Almost all VPN providers do such confusing advertisement, but Mullvad doesn't.

Reply on news.ycombinator.com