Hacker News Reader

Comment by prophesi | Hacker News Reader

Kind of surprised this hasn't been mentioned yet, but it's pretty commonplace to buy gift cards with cryptocurrencies. So there's yet another layer of anonymity if you buy an Amazon gift card from a stranger/service then use it for a physical Mullvad activation code.

View on HN

This seems like a silly extra step to add when you can just purchase Mullvad service directly with monero for a 10% discount.

It might even be more likely to deanonymize you since you're forced to interact with a physical thing. It's an extra step in the obfuscation chain that adds personal information (mailing address at least) that wouldn't be added otherwise.

I suppose if you were forced to use a non anonymous crypto like bitcoin that can be easily tracked, there might be some value to this extra step.

Yeah I would say mailing in cash without a return address or using Monero are the best options. Shipping would be the most difficult to preserve privacy; even a P.O. box will at least indicate your locality. I'd definitely like to hear how the voucher cards work and if that leaves a trail on a Mullvad account.

You can have them shipped to an Amazon locker presumably. Mailing cash has the downside of having your postmark on the envelope.

Or any virtual mailbox, except Amazon lockers can only be used for Amazon packages (unless your place happens to have Amazon Hub). And I do admit postage stamps will add some bits of entropy in terms of datetime and country (couldn't find a list of countries Amazon lockers are located), though much less accurate than a monero or amazon transaction.

It's also kind of silly when you're not anonymous to Mullvad or to the data centers Mullvad pays to run its services out of. They have your IP address, and it's not that hard to go from an IP address to an ISP to an identity.

Don't get me wrong. I think Mullvad is a great VPN service. But if people think it's a bullet-proof solution to the problem of anonymity, they're fooling themselves.

The point is that typically privacy-first VPN providers promise not to store your IP but have to store your payment details for practical reasons.

The VPN provider does not, but the owner of the data center still can store whatever she likes or some entity asks her to store.

They actually removed subscriptions just because of that: they were required to keep some info to process payments, but this was incompatible with their vision for privacy.

With single payments they don't need to keep it for so long.

Here's the threat model that justifies uses a public VPN:

1. The VPN provider and its infrastructure is trusted.

2. Attackers (private or government) can access data the VPN stores some period of time after you use it, but not while you are using the VPN.

3. Given assumptions (1) and (2) are true, attackers should not be able to determine which websites you visited.

A VPN does nothing if you don't trust the VPN provider (since they can always be lying about keeping logs) or if the government can access the VPN's servers/data while you're using it. But it does protect against one of the most common ways a government/private party could gain access to your browsing history: the government/private party subpoenas the websites you visited or your ISP for all pages visited by a given IP.

In this case, providing an alternate way to pay protects against storing data that an attacker can use to connect your account to your identity.

Is there a good way to receive the physical good without providing your address, though?

You can deliver the package to a amazon approved distribution center ( I dont know what they call them. Basically a shop where they hold your stuff until you come around and pick it up ). If you want to anonymize it, you can deliver it to some other state's distribution center and drive there to pick it up. Even better is to give a stranger your phone, to go and fetch it from the store, so that your face isnt visible in a CCTV cameras near the store, and while they come back to deliver it to you, you can fake a mugging and "steal" your own phone and the gift card while wearing a PPE kit or something, so that they dont know your dimensions.

Do you, by chance, write cheap adventure stories for a living?

Cause this sounds like something I read a few months ago. A pretty silly plan.

Wasn't it clear enough that I meant for it to be silly ?

Poe's law strikes again :P

"Officers, I just saw a mugging. Can you please send someone?"

The old trick is to find a house where the owner is on a long vacation or not around and mail it there. Of course you could lose your package, so adjust risk appropriately.

You can create an Amazon account with a burner, fund it with a giftcard, and have the item shipped to an Amazon locker.

Use a reshipping services or just find a drop site you have mail access to and know that no one will be home when its likely to be delivered. In my carding days in the late 90s - early 00s, I would use houses being built that were not occupied yet or still under construction. Carded many Rolexes, Oakleys, and video games like Starcraft Brood War and The Sims this way lol.

Who really needs this kind of anonymity?

Someone who lives in country, where their freedom of speech might compromise their safety a physical freedom.

How many countries like that are there? What are some examples? Then how many people in those countries?

That can’t be Mullvad’s target market? New to VPNs, forgive the ignorance.

One that comes to mind is one where I live - the UK.

Police these days prefers to scout the internet for thought crime and to have an excuse why they don't go after burglars etc.

Something is very rotten if we came to the point where one can not express speech freely in countries like UK. If that is the case VPNs are going to be a giant market.

UK explicitly does not have free speech.

https://nypost.com/2022/03/31/twitter-user-sentenced-to-comm...

>Other Brits who have been convicted under the same law as Kelly include a law student who was sentenced to community service for sending racist messages to a soccer player and a woman who posted songs about Holocaust denial on YouTube.

For more disturbing details of what is to come for UK, read this page:

https://www.gov.uk/government/publications/online-safety-bil...

Seems like you are new to the world, not only new to VPNs.

You might start investigating the state of planet earth by reading e.g. https://rsf.org/en and will find many other hints for more sources.

ideally: nobody

practically: everybody

Reply on news.ycombinator.com