Mullvad should be viewed with skepticism

elbert

Asonderu
As Mullvad themselves write in a follow up blog post:

In all the years up until now it has been clear to them [the police] that they are not able to seize non-existing data.

As you said yourself, the police knew that they would not be able to get any data, and that is why they did not carry out a search in the 14 years before. This time, however, the search was authorized because it was part of an international judicial cooperation from Germany and did not originate from the Swedish authorities themselves. The blog post goes into a bit more detail about this.

Octofine

Asonderu

If you are convinced that your ISP spies on you, and believe it to be a mere possibility that Mullvad doesn't, then I would get a subscription ASAP to mitigate risk.

Mullvad is also not based in the country your from (unless youre from Sweden) so even if your country wanted to, they couldn't force Mullvad to hand over data.

The police (before the raid) know about as much about Mullvads data as the average privacy aware person. Under international pressure, Swedish authorities will absolutely give Mullvaf a visit, even if mullvad claims to have a no log policy. This has happened to multiple VPNs that got exposed in that way for a fake no log policy.

Lastly, Sweden is a democratic state , and while they may spy on people, it would raise concerns if they fake the result of a police finding

dhhdjbd

Asonderu Or did you, without thinking, blindly believe that “Mullvad is the best!”? I believe that perhaps many privacy enthusiasts have trusted everything uncritically and with blind faith.

I mean, atleast as far as i am aware, one can not find any evidence that mullvad did ever hand over data, or has data to hand over in the first place.

I feel like, if mullvad would do this, then there should be any evidence.
(Like court documents or anyone even saying that mullvad did like leak their data)

grayway2

Asonderu if you don't trust Mullvad, buy credit by sending cash or monero and always connect from public WiFi but honestly there is very few other candidate to trust (like airVPN)

You need to trust your VPN and let me tell you why it's possible with Mullvad

They donate every year a lot of money to privacy fighter organisations
Mozilla VPN use VPN servers from Mullvad to operate
They created a fork of firetox with the tor browser organisation called mullvad browser free from tracking
no data for Swedish police during the raid. Do you think that when police visit a place they are 100℅ confident to not find something ? That's nonsense

I mean yes, you can't be 100℅ confident that mullvad is not secretly recording your browsing history. You can't be 100℅ confident that GrapheneOS does not collect our IP address to give them to the NSA or that veracrypt has no secret backdoor/weakness but at this point let's just stop using technology and live in a mountain

DeletedUser203

If Police or any agency took the word of a VPN provider, "we have no data to hand over" and accepetd this, they would be failing in their respective duties.
Now they have visited, any Mulvad employees failing to hand over data, if it existed, are now personally on the hook, as it were, should Mulvad have deceived said agencies. Police and Agencies abide by ABC,
Accept nothing, Believe nobody, Check everything.

Asonderu

I see.
I have come to understand that the vast majority of people take official announcements at face value.
I extend my respect to everyone who replied.

matchboxbananasynergy

Asonderu My thing is, I don't see what the alternative is. You can say "I don't believe them". Okay, then what? Who do you believe? Do you believe anybody?

elbert

Asonderu My point is not to blindly trust any official statements. Rather that there is a logical explanation for the supposedly suspicious fact that there was a house search after 14 years without a single one. For me, what they said makes sense and especially since they also published official police documents, my brief research at the time also revealed that the Swedish laws mentioned exist and contain the alleged passages. Since I have not found any solid evidence to contradict their statements, I personally trust them no less than I did before this incident.
But as the others have pointed out, fundamentally you have to trust a VPN provider (as well as many other things on the internet and in life in general).

mmmm

matchboxbananasynergy exactly this. One has to place trust somewhere when dealing with the internet and the issues it brings.

DeletedUser203

matchboxbananasynergy Do you believe anybody?

Where the internet is concerned, on face value no, not even GrapheneOS, which is why my phone is essentially empty, save a few contact's listed by D.O.B, no names and one messaging app.
16 digit pin, no fingerprint, 30 minute reboot to BFU.
And just for good measure I factory reset it on average once a week and every OS update. You may say paranoid, I say carefull. The internet is a mess and best kept at arms length.

Asonderu

All intelligence agencies of various countries engage in acts that transcend the law.
History has proven this over time.

If you were an intelligence operative eager to uncover people’s online activities, you can easily imagine the steps you’d take. When choosing a VPN, you’d do well to think carefully. The VPNs that are overhyped as being the ultimate in privacy are exactly the ones they’re likely keeping a close eye on and proactively setting traps for.

elbert

Asonderu Especially Mullvad has in general been very honest on what they can provide and what not. For example they never claim to make you anonymous like many other VPNs do. They also require zero information about you to create an account and you can pay privately with cash or Monero.
But if a major intelligence service is part of your threat model, just using a VPN won't be enough, no matter which service you choose.

EnragedBoot

I think it's important to keep in mind that like most things, trust is a spectrum, not black and white. Just because I trust one person less than another, doesn't mean I outright distrust them, just that they haven't earned that higher level of trust the other person has.

It is bad to either outright trust or distrust anyone or anything. Skepticism is healthy, paranoia is not.

DeletedUser270

Asonderu You are correct, Basicly, trust but verifies. The problem, we can not prove any VPN operator doesn't log or do anything, except we accept they promise or it can be other third party will record our log activity.

What we can do is dual control, segregation of duties. Using 2 hop vpn operator.

VPN 1, they only know your source IP
VPN 2, they only know your destination IP

DeletedUser270

DeletedUser270 or if you still don't trust centralize network, you can add TOR network as a decentralize network

Setup connection as below :

TOR over VPN1 over VPN2
TOR over VPN over TOR (slowest connection)

DeletedUser270

DeletedUser270 and please don't get me wrong, you should not use this setup every day.

My point is centralization network is a key of surveillance capitalism. So if you want to defeat them, yo should do digital compartmentalization on your GOS with using user profile feature:

For Public user profile is for real identity for banking, shopping, etc (no need to use VPN)
For Private user profile is for daily browsing, private comm, etc (use dual hop VPN1 over VPN2)
For Anonymity user profile (use TOR over VPN1 over VPN2)
For Sensitive user profile (user TOR over VPN over TOR)

dhhdjbd

@JPN_Tales

I've been using Mullvad and IVPN for a long time, but their use of many very dangerous M247 and Datapacket servers is a major concern from a privacy perspective, and I couldn't help but be skeptical of the company's attitude.

Can someone explain this please?

DeletedUser270

dhhdjbd Actually, many VPN provider not only Mullvad, iVPN but also Proton and other also using M247 and DataPacket service. It mean they are become Global Player (Global ISP) that control VPN internet traffic all around the world and He may be assume that M247 and DataPacket could do fingerprinting all VPN user all around the world just like our local ISP or Cloudflare that has global internet infrastructure. it is call centralize network, please cmiiw

fph

matchboxbananasynergy Do you trust your ISP more than your VPN provider? If the answer is yes, the using a VPN makes sense.

Is this sentence missing a "not"?

matchboxbananasynergy

fph Fixed it, meant to say "if the answer is no".