Comment by lxgr | Hacker News Reader

Comment by lxgr | Hacker News Reader

Parent Full thread

At that point, you can probably just pay by credit card: If your aim is to frustrate invasive ad trackers and profilers on the web (and you assume that Mullvad isn't outright colluding with these), that should be good enough to break any links.

On the other hand, if you don't trust Mullvad's assertion that they delete the link between accounts and credit card payment records after 40 days [1], what makes you think you can trust them to not keep a record of individual scratch cards sold on Amazon, which Amazon can then correlate to an order ID and by extension account and shipping address?

At a higher level, if somebody can convince Mullvad to collude in that manner, they can likely also just ask them to outright hand over your traffic flows and connection data.

How would they do that? Those are shipped directly from Amazon, and don't have any external markings that could be used to link specific card to amazon account. Unless the idea is that vouchers arrive at amazon in some additional packaging and then are repackaged after linking voucher to the account.

By the end of the day I agree, if you have any "real" reason for using VPN you pretty much have to implicitly trust your provider to not keep any traffic flows and connections that could correlate traffic to your IP, but not even sending money in envelope saves your from that.

I think it goes something like this:

If your worried about anything in a 40 day window the credit card <-> account_id is a liability

Amazon doesn’t know the redemption code on the gift card. So Amazon knows that you purchased a Mullvad gift card, but can’t associate the transaction with a Mullvad account. Likewise Mullvad knows service was paid for with a gift card (possibly that the gift card is from a lot sold on Amazon). But they do not know which Amazon transaction the card is associated with.

Unless your behavior and the behavior of others deanonymizes the Amazon purchase <-> redemption your account should be indistinguishable from any other that purchased a Mullvad gift card from Amazon in that window of time.

Reply on news.ycombinator.com