upvote
Why? If I was an intelligence agency and designing a VPN I would simply log all the IPs connecting to my VPN and not rely on statistics on exit nodes to identify the users, even more so because they rely on the users to pick different servers.
reply
How would you claim it's a no log VPN?
reply
I could just...lie.
reply
You really think someone would do that?
reply
What, just go on the Internet and tell lies? Who would do such a thing‽
reply
One person can tell a lie, but a company consists of many people. You must ensure that only few people know of the logging or there will be a risk of a leak.
reply
Well, there should only be a few people with the access needed to discover logging is happening. Just put the logging configuration in whatever secure configuration management tool is storing your TLS keys and suchlike.

Make it look like an accidental misconfiguration and if an insider who isn't an NSA mole does somehow discover the logging, there's a fair chance they'll turn a blind eye anyway. After all, if you work at a VPN, publicly outing your employer for logging will tank the business, then you and your colleagues will all be out of a job.

reply
An intelligence agency already consists of more people than you need to run a VPN service.
reply
Still I think it's easier to avoid the need for more people than necessary. "Just lie" sounds like the easiest solution but on closer inspection maybe it is not?
reply
Because if you lie you get infinitely more data than if you don't lie. And if you lie you can do it completely in secret whereas if you don't lie you get articles like the OP exposing the teeny amount of data you're trying to collect. It makes no sense.
reply
Lying is almost always the most cost-efficient answer to anything, if you’re not concerned about your trustworthiness, morality, ethics, etc.
reply
Intelligence agencies... are generally pretty good at that.
reply
leakers and whistleblowers are extremely rare. History is filled with examples of conspiracies involving many people that went on for long periods of time before one person eventually risked everything and said something. The Tuskegee Experiment went on for like 40 years! If keeping secrets were all that hard none of them would have been allowed to go on as long as they did.
reply
Companies can lie at large too. Enron, theranos, and many others come to mind.
reply
Their 3rd party audit didn’t catch this…

I guess we’ll see how they respond.

reply
> How would you claim it's a no log VPN?

Mullvad have been taken to court over this in relation to a copyright infringement case.

TL;DR The judge permitted people to take a fine-tooth comb to Mullvad's infrastructure and no logging was found[1].

[1] https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

reply
Yeah I'm sure one day it will transpire Cloudflare is affliated with intelligence agencies too. The solution to a "sudden DDoS" is to put their website behind Cloudflare. Wonder who can do those sudden attacks?
reply
That’s been my pet theory from day 1, and not because of DDoS. Simply because they are the SSL terminator for most of the internet and can see anything going on in cleartext (and I’ve seen them protecting some shady stuff)

I recall a PRISM slide showing the diagram of Google and the public internet, with a big arrow on GFE saying, quote, “SSL added and removed here! :-)”

If NSA aren’t installed at Cloudflare, I wonder what they are even doing.

reply
To add: apparently that PRISM slide got its own Knowyourmeme entry: https://knowyourmeme.com/memes/ssl-added-and-removed-here
reply
> I’ve seen them protecting some shady stuff

Hmm do we want them to decide what stuff is shady and what isn't?

We're already allowing payment processors to do that and it's not good.

reply
DDoS is just one of the impetuses for a service provider be MiTM'd
reply
It's within the realm of possibility that NSA is collecting data with Cloudflare's consent. It seems unlikely that Cloudflare would jeopardize their entire business model over it. Unlike other companies in the leaked NSA slides that participated in PRISM, Cloudflare would face a near-total loss of customers. Their entire value proposition is being an unobtrusive traffic intermediary.
reply
Within the realm of possibility? Let's be honest, if you are a top NSA executive and you couldn't find a way to get your hands on Cloudflare's private keys (bribing or threatening the right person), you are not getting your Christmas bonus.
reply
It is of course inconceivable that the NSA do not have the private keys for dozens of browser trusted certificate authorities

That nonetheless doesn't help them unless they are doing active MITM. In order to do that they'd have to have at least some physical presence at Cloudflare or on the path to Cloudflare.

reply
My understanding is that they tapped communication nodes before. I would be surprised if they can't tap the pipes to cloudflare.
reply
I mean, it is the CIA, but if you encrypt it before it leaves the box, and you're decent good with the key material, how are they going to get at it? Tapping the fiber then gets them encrypted flows, which isn't nothing, but, well, it would be surprising if they had access to the clear text.
reply
Is this information derived from Enemy of the State starring Will Smith and Gene Hackman? It was a great movie and the first DVD I ever bought.
reply
Do people in government get bonuses linked to performance?
reply
Government agencies get budgets linked to performance.
reply
Well - do they? In my experience they get budgets for spending their current budget.
reply
> Unlike other companies in the leaked NSA slides that participated in PRISM, Cloudflare would face a near-total loss of customers

People didn’t care when they learned about PRISM, why would they care now when it’s a known fact? The sane stance would be to assume Cloudflare is in cahoots with NSA.

reply
All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits. The NSA leaks were a forcing function that led to a massive uptake of encryption. Up until that point it was common for websites to support only HTTP.

The NSA leaks dominated news cycles for the entirety of 2013.

reply
> All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits

This is as helpful as Whatsapp's so called E2E encryption comms (that just happens to not be applicable by default in certain situations).

reply
my llm api traffic terminates tcp at cloudflare in lovely plain text :/

it does give better peering. reduces latency a bit for me.

reply
I had no idea that this was a thing. How can you figure out where SSL turns into plain text on its route to the destination?
reply
in this case it's my design to use cloudflare.

but you can also see from curl or traceroute, that the endpoint you talked to was a cloudflare ip and your ssl ended there. after that you can't see inside cloudflare.

reply
> Cloudflare would face a near-total loss of customer

I think more people than you would expect would be happy to accept that as the price for protection against malicious actors

reply
That slide was about the NSA sitting inside Google data centers without Google's knowledge.

That doesn't mean collusion

reply
That's the thing though: We can't know that.
reply
Well, we kind of can, given that "SSL added and removed here :-)" was a pretty explicit workaround to the issue of encrypted communications in Google's infrastructure, just not between sites (IIRC).

Either way, if they were directly colluding with Google, they would have had a much simpler time siphoning off that data.

reply
I don’t see how they couldn’t be. Either on purpose, secretly my coercion, or secretly without their own knowledge. It’s so valuable
reply
Yeah, their origin is a story of absolute incredible luck. Cloudflare came out of nowhere and suddenly massive sites with huge user bases around the world, including places like 4chan, were getting DDoSed. Then they immediately announce that they transitioned to Cloudflare. Hell of a lucky time to make a company that the entire internet suddenly became absolutely dependent on.

The funny thing about that era is you knew they started using Cloudflare because they went from stable with constant uptime to going down and showing a Cloudflare banner randomly all the time for a good year or so. They ran worse with Cloudflare than they did while they were allegedly getting DDoSed. The whole company glows, as the late great HN commenter Terry Davis would've said.

reply
Am i the only one that actually remembers this time period? It wasn’t that long ago. The confidence of your assertion is completely misplaced. I remember exactly where i was when I first read about CF, on launch day. DDoS attacks were CERTAINLY a big issue before Cloudflare came along. A whole lot of script kiddie energy was poured into them. LHC? Slowloris? IRC C2? This wasn’t niche stuff. That’s why I remember the CF launch, because I and everyone else knew that it was a big deal, given what the landscape had been for quite some time. Sorry if you personally didn’t have your finger on the pulse for whatever reason, but this was far from a niche issue, even for big sites / usual targets like 4chan.
reply
I was there and recalled there being occasional script kiddy DDoS attacks here and there. But the uptime when being attacked was still much, much better than the first 1-2 years of actually using Cloudflare.
reply
> as the late great HN commenter Terry Davis would've said.

Oh my god, this is how & when I realize that Terry Davis (Rest in peace) used to use Hackernews too: https://news.ycombinator.com/threads?id=TerryADavis

https://news.ycombinator.com/item?id=10061171 (From this comment written by terry):

"I wrote all the code from scratch, including a 20,000 line of code compiler that makes x86_64 machine code from HolyC or Asm and operates AOT and JIT.

My JIT mode is not interpreted. It optimizes and compiles to x86_64 machine code.

I was chosen by God because I am the best programmer on the planet and God boosted my IQ with divine intellect." -Terry A Davis.

reply
> Wonder who can do those sudden attacks?

Anyone with a few crypto currencies in their wallet that can click a button on any of the booter services with botnets for hire.

reply
You are right, they don't have to do it themselves, but guess who's protecting the booters from other booters?
reply
Primarily specialist bulletproof ddos protection services like ddos-guard.ru, not "Cloudflare" as is the popular meme among clueless commenters.
reply
Most modern booters are not maintaining public websites that could be the object of DDoS attacks. They're renting residential IP addresses from free VPN users.
reply
Well there is still the small detail of them not storing any logs.

This is a massive issue in my view, it allows correlation across multiple VPNs exit nodes, but that’s it. It doesn’t allow to identify you automatically. It does significantly lower the bars for identifying you though, but the requirements are still high.

Hopefully they fix this soon.

I can’t believe this type of “let’s make it a hash or something sensitive” still happen, and at mullvad, of all places. Why not randomise it simply?

reply
> It does significantly lower the bars for identifying you though, but the requirements are still high

If you squint a bit, it looks a lot like a "Nobody But US" (NOBUS[1]) scheme. A few more identifying bits could tip the scale for party that has a whole host of other bits on a list of suspects, without being useful to most other people.

1. https://en.wikipedia.org/wiki/NOBUS

reply
Then why complicate it by being publicly insecure? If Mullvad were wanting to defeat anonymity, they could simply log the traffic metadata while falsely advertising they aren't.

Their ads on San Francisco's public transit are good.

reply
Good VPNs tout the fact that they had nothing to give in response to a subpoena, or that there was nothing a law enforcement agency to find when they seized a server. For mullvad to be effective as a honey pot it needs to survive these events with its reputation in tact.
reply
If it were a true honeypot by a state agency, they'd be able to just lie about having nothing too.
reply
Not when people get arrested and the investigative techniques, sources, etc are made public. They would have to intervene in the legal process to make sure mullvad's role was kept secret. Presumably this isn't always feasible across jurisdictions.
reply
"public insecure" JFC

Security is always a balance. Always

AI is showing that everything has a weak spot (wondering where are the "I don't make mistakes with C" now people are - but that's for another discussion)

There's another commenter mentioning this makes sense because exactly it avoids them keeping information on which customer is matched to which server. You know, one of the things you don't want to log

Could it be done better? Probably.

Here's a better idea, logging off is 100% safe

Meanwhile 99% of the normies will go for NordVPN

reply
You definitely need glasses then.

Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.

reply
it really isn’t.
reply
Examples?
reply
IP addresses are metadata - and don't require search warrants, meaning they are fair game for dragnet surveillance. Tapping into a backbone, a la Room 641A, can be used to cross-reference timestamped public posts on an anonymous message board to other data sources (e.g. subpoena Netflix for payer based of Netflix's access logs from VPN exit IPs)
reply
Mullvad predates the Snowden leaks by several years and was not mentioned anywhere in them.

Sure, there are other intelligence agencies, but that's the one I'd be the most worried about. Since either they run it, or they would know of it and want to emulate the idea, or know of it and have access to it from the partner agency running it. Or they are not a threat to me.

There's also the issue of no publicly known cases where someone that used Mullvad being deanonymized through the VPN but instead being discovered through some other opsec failure. If an intelligence agency has this capability they have been sitting on it for almost 2 decades without making use of the data. Hard to believe.

reply
> Mullvad predates the Snowden leaks by several years and was not mentioned anywhere in them.

Wow, I didn't realize Mullvad was this old! Then again, maybe they weren't popular enough back then for intelligence agencies to target them? For instance, Mullvad kinda rode WireGuard's popularity wave by being the first(?) VPN provider to implement the protocol. Big ads on billboards came even later. So maybe they only became a target in recent years?

reply
In this particular case I'm quite sure it's not the case. Good arguments in the other comments (why not just log more if that's the case), but I also happen to know a little bit about the workings of Mullvad (I live in Gothenburg where they're from...)
reply
> This sounds like how I'd design a VPN if I were an intelligence agency.

So does your comment...

reply
> how I'd design a VPN if I were an intelligence agency

I think its safe to assume that intelligence agencies have other options available to them, such as country-wide timing attacks.

reply
Makes you wonder...
reply
Every now and then there are articles like this one about something that Mullvad may or may not be able to do better, and there are always comments about whether they're an intelligence front.

I don't know the answer, but there are two ways to take it:

1. Submarining to destroy confidence in an actually trustworthy, decent VPN company

2. They're an intelligence front.

For me, Mullvad have the appearance of the greatest likelihood of being legit since they're not aggressively pushing their product with lies and fear mongering. That gels with my vibe. If they're an intelligence front, well, most VPNs probably are as well, so I'm no worse off.

Luckily I'm not doing anything that would get me in the kind of trouble for which multi-jurisdictional cooperation is worthwhile.

reply
You'll find comments accusing anything of being an intelligence front on internet message boards. I agree with you that public evidence is overwhelmingly in favor that Mullvad is earnestly trying to protect privacy.
reply
deleted
reply