Hacker News Reader

Comment by yieldcrv | Hacker News Reader

You’re still trusting that

Mullvad never changes

Mullvad never is compelled to change by coercion

The data center Mullvad uses - a separate company - never compromises them out of curiosity, preference, coercion

That governments skip the private sector coercion entirely and just add their own devices and logging in the middle, which came out of the Snowden leaks as normal 10 years ago.

All VPNs have this limitation. They’re just internet resellers that amusingly try to differentiate an audience based on privacy.

View on HN

Bro, you’re too simple.

Are you even printing your own chip wafers?

Do you ever key your passwords outside places where you have total physical control?

On that note, do you let your love person stay over for the night (have physical access to your flat)?

Your incompetent and flabby security posture makes me want to puke. At the very least, admit that your security posture is „typical educated HN reader“ and you’re not serious, so the rest of us can continue on our business without your mind numbing puerile distractions.

[okay that rant was really just a „holier than thou“ parody about how if you’re going to maintain a security posture that’s more tense than 90% of your peers, at least acknowledge what threat model you espouse and acknowledge that others may have a different one. If you had been like: „is this your threat model? Then why don’t you care about this…“, you would have my upvote not my snark. Even if that weren’t my threat model I would have found that exposition commendable.]

Yes, realizing that you can't trust the ownership of a company to stay consistent for eternity is basically like thinking your mate is working for the government to steal your passwords.

What investment do you have in people trusting VPN providers that would cause you to make an argument like that? I bet none, it's just a bad instinct.

i2p, tor. whonix distribution of linux, tails… but ok

I didnt expect the sarcastic tone of responses but I also dont understand why people act like sports team fans of VPN providers. there are other solution, easily accessible, that do more than VPNs can do, depending on your threat model

a VPN user that supposedly just wants to avoid adtech tracking doesnt need annual audits about how little data one VPN stores over the other

You can't trust anything you have not built, incl. your laptop, keyboard, mouse, phone, car, even your teabag (what happens if they're randomly drugging your tea to test some pathogens, with a request from your government).

Even if you have built that thing, you can't trust any semi-capable chip to not log, change, or exfiltrate data in any way possible.

So, the hole has no bottom.

if you want privacy on the internet you have options. VPNs give you privacy from your local network and ISP and a little bit from the destination service, and that's it.

there are options to have privacy from additional kinds of parties. i2p, tor. whonix distribution of linux, tails…

> there are options to have privacy from additional kinds of parties.

like ones you pay to use their VPN servers...?

What if your VPN is the true adversary here?

Edit: Also, questioning trustworthiness of VPNs and them putting them forward as a solution is... a bit unorthodox.

> What if your VPN is the true adversary here?

They're not. Spectrum is my true adversary. My VPN may also be an adversary but that's a possibility, whereas Spectrum is a certainty.

This thread is reacting to someone pointing out the weaknesses in VPNs. It's the people who were triggered by that to defend VPN usage against the pointing out of this reality, and to imply everyone aware of the drawbacks are paranoiacs; it's those people who have committed themselves in advance to a solution.

To achieve true privacy, first you must create the universe.

Let me get my big-bang kit, manufactured by looks to the underside...

I don't know whether I can trust the company which made it.

For the people who don't have a kit yet, they can always take the cloud approach and use Google Online Development simulator (G.O.D. simulator) and follow their tutorial for Hello Universe[1].

[1]: https://youtu.be/tmGMd2bqh6o

Looking for Universe SDK in case you have a link

https://zombo.com/

The universe you create is inside the universe you inhabit in, which has no privacy, so the universe you create also has no privacy.

No, you create a parallel one. It executes sandbox escape after a couple femtoseconds.

Given enough time in your own head, this is doable.

You're right. We're actually wasting our time ever thinking about our security or privacy, or taking any measures to protect it. You've convinced me that some security is an illusion, and that the real answer is trust.

> That governments skip the private sector coercion entirely and just add their own devices and logging in the middle, which came out of the Snowden leaks as normal 10 years ago.

In the U.S, VPNs are not effective against targeted surveillance. But they very well may be effective against government passive surveillance programs like the President’s Surveillance Program.

The Snowden leaks revealed many things. What stood out most to me about them was that the government _tried_ to stay within the confines of the law. It was a very twisted, contortionist, interpretation of the law, but they did try very hard to stay within the bounds of the legal theory that allowed the program to exist.

Based on the leaks, if you’d have been running HTTPS over a VPN during the PSP, it’s likely a good portion of your traffic would have evaded the program.

https://everytwoyears.org/2020/07/13/tactical-privacy.html

Always critics but never providing a viable alternative. So please tell us your model, yank the cable out of the wall and pitch your phone in the lake? I'm mostly concerned about advertisers, corps, and my ISP. I know that in my country (the USA) that if they want something out of me they'll take me to a back room and beat it out of me, so generally I don't do illegal stuff.

i2p, tor. whonix distribution of linux, tails…

none of those will stop the NSA or FBI if they're really after you

I'm not worried about my government as it currently stands. I'm squicked out by the fact that every single private company I interact with seems to be falling over themselves to collect as much data about me as possible, and resell it to anyone who will pay. There are no protections against this in the US.

I am worried, at least a little bit, about an authoritarian government coming to power and basically weaponizing past data collected against it's citizens. I've seen the inferences facebook and google can make with privately collected data. I don't think it's too outlandish that governments would be able to quickly and easily create detailed dossiers on everyone that protested against x or voted for opposition candidate y.

The Nazis used the census to find Jews. A huge amount of people had no idea that they had matrilineal Jewish descent until the Nazis and IBM told them.

https://en.wikipedia.org/wiki/IBM_and_the_Holocaust

Which data center company do they use?

At least for the DC compromise, you can multihop through servers from different providers.

Hence the archive records of their yearly audit dating back to their founding year.

VPNs are for escaping private adtech firms, not governments. I don't know where you got this impression from.

perhaps the annual audits, a bit of theatre if its just for escaping private adtech firms

this attracts people that want a subpoena to yield nothing

Reply on news.ycombinator.com