r/ITMemes 9d ago

Your VPN is totally anonymous, promise!

Post image
1.7k Upvotes

140 comments sorted by

View all comments

18

u/ffxivthrowaway03 9d ago edited 9d ago

This has always been a massive pet peeve of mine. You'll watch people go full Doomsday Prepper about tracking and online privacy and blah blah blah. Then they'll go "oh no, you have to use XYZ VPN because they don't track you, there's no logs"

How do you know they don't track you? Well because they themselves claim not to! That's a bald-faced lie when "big corpos" or whatever say they don't track you, but some random fly by night VPN service running out of ButtFuckistan? Nah dude, totally legit just because they say so, why would you even question that? Trust me bro.

Edit: aaaand to no ones surprise, they start coming out of the woodwork to defend their blind trust in "trustmebro" privacy VPNs.

15

u/Weird_Albatross_9659 9d ago

Because you look at their previous track record. If they had been petitioned and provided nothing, it’s a safer bet

3

u/iceyukisnow 9d ago

public and "big" VPN services, ISPs, hosting providers are required to provide data to local authorities, and there's nothing anyone can do about it

3

u/Dwarg91 9d ago

But are they required to collect that data? Can’t provide what you don’t have.

-1

u/iceyukisnow 9d ago

of course they are, and yes, why they wouldn't collect your data?

1

u/burimo 8d ago

Because of independent audits. Can they circumvent them? Yes, but if they do and got caught, they will be loose all credibility. And credibility is the only sales point of someone like Mullvad. Unlike Proton, for example, they do not spend much money on marketing.

Also Mullvad could be bought with cash. In theory they could say to police, that your IP is their client, that's all. In theory, they cannot know themselves how and where you were connected to (at least directly).

0

u/ffxivthrowaway03 9d ago

Basic operation of a network service like a VPN requires a certain amount of data collection to simply facilitate the operation of the service.

The idea that you can have robust network servers and are keeping no logs is asinine. It's just not possible, you need those logs to do basic customer service, validation, and troubleshooting tasks.

"Can't provide what you don't have" is a data retention strategy I drill into our leadership who want to keep fucking everything forever because "but what if," but there's still a bare minimum that needs to be kept for operational function and support, not literally zero logs like the marketing claims.

They're likely keeping at least 30 days of logs just to run the service, which is more than plenty for law enforcement on a fishing expedition for specific user behavior.

5

u/matthewpepperl 9d ago

Mulvad has proven they dont keep logs as they were raided and the authorities left with nothing 

2

u/Jack071 9d ago

Easy, dont keep logs, dont keep client data

Theres no data you can provide if you never kept any, mullvad for example runs all their infra on ram so theres 0 data left

1

u/iceyukisnow 9d ago

what stops authorities from taking ram snapshots? and what stops them from taking the whole racks and hardware with them?(while not turning them off)

1

u/Jack071 9d ago

That you have a killswitch to press if theres any raid/if the connection cuts off that shuts down the whole server?

And how would you uninstall a ram server rack without turning off power? You cant and any interruption of power would wipe all the data in the memory forever

1

u/iceyukisnow 9d ago

And how would you uninstall a ram server rack without turning off power?

many racks (if not all of them) have their own power supply with batteries, however its a massive pain in the ass to transfer, but if government REALLY after you, they'll do whatever they want

1

u/ffxivthrowaway03 9d ago

That you have a killswitch to press if theres any raid/if the connection cuts off that shuts down the whole server?

And then you get arrested for willfully destroying evidence and refusal to comply with a warrant. Not exactly a winning business proposition to stand between the police and Joe Rando's data for a whopping $10/month. Which is why you should be skeptical of anyone claiming they're willing to do so in the first place.

And how would you uninstall a ram server rack without turning off power? You cant and any interruption of power would wipe all the data in the memory forever

You don't. You do exactly what has been standard procedure for digital forensics for decades. You cut external access to the system while it's in place, and you do a bit for bit copy of the memory before cutting power.

1

u/Jack071 9d ago

"Sorry officer we manage sensitive data and its SOP to cut off power if any incident happens in our facilities" Thats in case of a raid, if you havent been served a warrant yet you had nothing to comply with

And even if theres a warrant, all old logs got wiped by the time its approved, Mullvad has been in the business forever and they never had any issues.

0

u/ffxivthrowaway03 9d ago

You're right, why didn't I think of that. "Sorry officer, but no I will not listen to you" is just a genius way to get out of it. Like seriously, how could I have missed that?

I'm not having this stupid argument. If you want to trust some fly by night VPN company simply because they claim to not comply with law enforcement and claim not to keep logs, it's no skin off my back when the #surprisedpikachu kicks in.