Hacker News Reader

Comment by eimrine | Hacker News Reader

Imagine using Mullvad VPN for entering Tor and realizing that your activity is transparent for Mullvad.

It's not transparent (or at least any more than any other means of accessing TOR). If you at all access the internet through somewhat normal means (without running your own ISP and connecting to an IXP physically) you are placing some level of trust in a service provider.

What these sort of VPNs do is allowing you to move that point of trust to another party than the one that maintains your intrastructure (your normal ISP). You do not give them any more trust than your normal ISP, but since your normal ISP is usually more regulated it is a good idea to scrutinize the VPN provider more.

I trust mullvad more than my normal ISP on privacy. mullvad is also one of the few VPN providers that has not sold its product as a end-all-be-all privacy solution while a lot of others have been spreading FUD (things like saying that your ISP can see in cleartext all your traffic even though 99% is over https, saying their products protect against hackers when there is no evidence for that, etc.).

It's a question if you'd rather your ISP see you using a VPN and Mullvad seeing you use Tor or your ISP knowing you're using Tor.

Tor bridges mask Tor use to your network and ISP

Bridges including "private" ones are trivially enumerated: https://github.com/scriptzteam/Tor-Bridges-Collector

I would not rely on bridges if you ever need to deny that you used Tor at a certain point in time though they may be useful for bypassing some censorship systems. A VPN could hide Tor use from your ISP but that obviously comes with a different set of risks (the VPN provider will know you are using Tor).

I run multiple private bridges and they aren't in this list.

What do you mean by transparent? If you mean that a VPN can see you are using Tor and when, sure, but I'm not aware of circumstances where that would matter.

Isn’t that just how VPNs work / a typical risk with VPNs?

Indeed. Different tools for different use cases.

You gotta trust someone, somewhere.

Mullvad at least only requires that you use a PIN number instead of an ID.

Almost any proxy configuration could be useful in a specific scenario. It's almost always a tradeoff.

For example, you could trade off your ISP knowing that you connected to Tor for your ISP knowing that you connected to mullvad and mullvad knowing that you connected to Tor.

Who do you trust with that metadata more?

Given that they have literally switched their nodes to be diskless and released lots of their work to strongly disable logging in systems, that may be acceptable for most users.

The risk model determines your behavior.

Yeah I’m not trying to hide from the law, I’m trying to get the airline to stop giving me weird price quotes and bbc to let me stream their shows.

Well I am. I have a right to. If you want to have plausible deniability when you inevitably must do something legally wrong but morally right, then you must always be hiding.

You don't.

"Why did you suddenly download and install tor at 2am?"

"I wanted to watch a weird porn and didn't want anyone else to know"

Don't inconvenience your entire life for strictly theoretical situations.

No? Also I do struggle to think of a situation, for me, that would require TOR access in order to do something morally right but illegal.

The most obvious example: whistleblowing.

Fair enough, but I have no idea how that would require me to always use TOR, lest the insanely unlikely scenario arise that I need to expose some hidden information.

Also wait, whistleblowing on the government? I’m not privy to anything like that.

Maybe not now. But you don't know what your life will look like in 10 years, or even 20. People end up in politics more than they ever imagined, out of necessity. It's the OpSec equivalent of holding something behind your back and saying "no, there's nothing there." Makes you look even more guilty. You look a lot less guilty if you hold non-suspicious things behind your back often. Then people are more likely to think you're odd, rather than guilty. Kind of a bad example, but you get the point in the abstract.

Suddenly starting to join the Tor network often around the time some major information is leaked would be a strong correlator pointing to your guilt. I'm just using one example, but there are many scenarios where this matters.

Heh no, starting to access TOR is not suspicious or a correlator to anything, that’s the paranoia I’m talking about.

Also I wouldn’t use TOR for this anyway.

Alright man. It's not paranoia when it becomes reality, but you do you.

It’s paranoia when it’s not reality, which it isn’t based on your use of the future tense.

So by your logic, preparation for anything is paranoia?

> I’m trying to get the airline to stop giving me weird price quotes

Seems understandable.

> and bbc to let me stream their shows.

Have you paid your license fee?

I honestly have no idea how it works, I just know I can watch taskmaster when my vpn says I’m in London.

So when you say

> Yeah I’m not trying to hide from the law

what you really mean is more like "I'm cool piracy and breaking British laws, but other than that I'm not hiding from the law"?

Yea, I am cool breaking a British law nobody in my country has ever been prosecuted for breaking, but my point is I’m not hiding about that, it’s a tech problem I’m avoiding, not a legal one.

Given that they have SAID they are diskless, etc.

I feel like there is no scenario where it should be allowed to forget that all the claims are always falsifiable. Not saying they are lying, just that no one ever truly knows. It's important to not be complacent with that.

It's true we can't know for 100% certain, but things like third party audits can give one sufficient confidence (depending on your risk tolerance, of course)

https://www.assured.se/publications/Assured_Mullvad_relay_se...

Reply on news.ycombinator.com