Yeah, Mullvad was searched and they shrugged and said "well, go ahead" and could then proudly publish that the Swedish authorities could take zero info from there: https://mullvad.net/en/blog/update-the-swedish-authorities-answered-our-protocol-request

Wondering how these magicians measure quality of service then, since they collect no juicy data. I find this hard to believe.

I would put Mullvad and IVPN up there as the two VPNs I'd trust most to do things right, but I still agree with everything you've said.

As others have said, Mullvad is pretty close to (if not at) 100% guarantee... No personal info whatsoever is required to be given when you sign up (including email address or payment information; you can use Monero if you want), so there isn't really anything that they could give to authorities even if they wanted.

Even if they did keep logs (which im 99.9% sure they don't), all that would show is an IP address, and from what I understand based on past precedent, that is not enough to identify a person on its own. But IANAL.

The purpose of these corporate white papers is to inform (impress) potential customers of actual issues. It demonstrates knowledge and implies that the company has the ability to leverage their product or service to meet whatever the challenge is.

I wouldn't say boulder-sized because the meat of the article is true, but yes a bit of skepticism is always useful.

Sounds like the intro paragraph to someone's term paper at uni.

GPT loves alliteration, so at least there’s something to support your suspicion.

I love Mullvad and recommend them for everything other than torrenting. Once they disabled port forwarding I moved to AirVPN who seem to be pretty legit.

I'm not trying to keep my ratios up but I have a few torrents of media that are not available anywhere for sale and have less than 10 seeds, so I feel like I am helping keep the shows and movies of my childhood alive.

I mean, if you set up your os on an encrypted ram disk, then set it to restart when the server rack door was unlocked/opened and didn't leave a backdoor for yourself to remote in, you could have a situation where you entirely lack the capability to give them access to anything before that moment. A skilled hacker might be able to get in through an exploit or do something crazy with cryogenics to read the memory at the time of shutdown, but a quick restart would overwrite most of what's in memory and scrub that

Legally, there's not much better defense than "I'm sorry your honor, I can't provide access to the running system in the same way I can't un-shatter a smashed mug". If someone shows up with a warrant, you could explain that it'll wipe itself if they open or unplug it, and it might've done so already. Then you guide them to it, hand over the key to the server cabinet, and let them decide to open the cabinet and destroy evidence so they can take it with them. Or they can take you at your word, and give up.

Court orders can't break physics, and as a VPN your reasoning for setting up the system like this is to make your service more appealing to customers - the purpose is not to aid in a crime or destroy evidence, it's just the normal course of business.

The same way that most companies wipe their emails after 30 days - yes, it potentially destroys incriminating paper trails, but that's just a side effect of the security policy you've had all along

Granted, there's probably some sketchy sealed laws they could use to force you to backdoor your own system moving forward, but you can fight that as it's undue hardship. It requires a non-negligible amount of work and would make your product less competitive

They might win in the end if they keep pushing, and even might be able to order you to "keep up the canary paper" (meaning keep claiming not even you have access to the running system), but more likely they'd get a warrant for your customer financial records and try to find an easier path to find what they want elsewhere

They no longer offer this, right?

You're about 15% of the way to re-inventing Tor.

check out Nym, they are doing this kind of network

Sounds very similar to Safing Privacy Network. They route different applications across nodes (Tor-esque).

IVPN servers are all well-known and catalogued. ExpressVPN partly buys hacked machines to user as proxies for their paid tier user VPNs, so they are much less likely to be blocked. They have a lot more.. troubling history, that would make me never visit their download site.

https://www.zdnet.com/article/trust-but-verify-an-in-depth-analysis-of-expressvpns-terrible-horrible-no-good-very-bad-week/

Kape Technologies has announced plans to acquire ExpressVPN for $986 million. I do have concerns about this because Kape was once considered a malware provider.

Reuters indicating that ExpressVPN CIO Daniel Gericke is among three men fined $1.6 million by the US Department of Justice for hacking and spying on US citizens on behalf of the government of the UAE (United Arab Emirates).

Kape Technologies has had quite a convoluted history. According to a report in Forbes, a company called Crossrider was formed in 2011 by "billionaire Teddy Sagi, a serial entrepreneur and ex-con who was jailed for insider trading in the 1990s. His biggest money maker to date is gambling software developer Playtech," and Koby Menachemi.

Menachemi was a developer for Unit 8200, an Israeli signals intelligence unit responsible for hacking and collecting data (think of it as part CIA, part NSA, and part high school, because the unit hires and trains teenagers in hacking and coding skills).

the newly renamed Kape Technologies set out on an acquisition binge. The company started buying in 2017, acquiring CyberGhost VPN for about $9 million. Next, in 2018, came Mac antivirus company Intego for $16 million. A few months later, Kape gobbled up another VPN provider, ZenMate, for about $5 million. A year later, in 2019, Kape spent $95 million for Private Internet Access, one of the best known VPN providers at the time.

There's more to the story as well, but you can be sure that all your data is ~~belong~~ either being proxied by a botnet, or being used to spy on you. 'I have nothing to hide!' you may say, but I'm sure you have an app or two that still uses insecure HTTP update checks, which can be intercepted to trigger a malware installation.