Honest question: Short of root-level access to the entirety of their infrastructure, how would you verify it?
I work for an ISP and have toyed with the idea of offering a "private, no logs" VPN service. As someone running such a service, what would it take to convince you that I wasn't logging information that could be used to identify you?
(Obviously, there would be logs of some stuff -- just not the kind of things that would allow you to be individually or personally identified.)
Get a reputable auditor to vouch for you, by giving them access to your infrastructure for a while. Of course it’s not foolproof (you could change everything the minute he leaves) but it’s the best you can do. Bonus points for making it a yearly event.
How exactly would an entity that makes such a claim, as in this case of "we don't log access", be able to allow external parties to verify this without handing over access to their infrastructure for manual inspection?
I've read a little about zero knowledge proofs, but don't really know much about the subject to know if it could be used to verify these sorts of claims.
Well these were kind of my points I guess. It's a service differentiator probably the biggest one and yet it can never be verified.
I don’t know about PIA, but I believe Malaysian vpn provider Hide.me brought in an independent auditor to validate their claims. I expect you could do that in any country.
Interesting I had not heard this. It actually says as much on this page:
https://hide.me/en/features/logs
Maybe PIA should do the same since that's their biggest differentiating claim.
Has this ever been verified in any way?