That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

There is no such laws in Sweden.

That does not appear to be factual: https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-f...

What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data.

Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.

Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws.

[1] https://lagen.nu/prop/2006/07:63

Mullvad is not an operator, and you’re moving the goal posts.

When you try to argue something is law, please have the decency to link to the actual law, you have linked a proposal and not the law as accepted by parliament.

> being forced to shutdown under some kind of Swedish NSL

Given Mullvad I think they'd rather shut down.

> it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.

“Entirely” possible? Sure, I guess it’s “entirely” possible that the NSA is actually controlled by a reptilian, illuminati cabal of extraterrestrials, while we’re just making stuff up without any factual basis whatsoever.

Bad faith responses like this lashing out at people like bragr make me even more suspicious. You know damn well, or should know, that companies secretly being owned by intelligence agencies is something that has happened before and could happen again. Meanwhile there is no evidence at all for reptilian ETs ever existing.

And furthermore, I am sure you know that when dealing with matters of security, it pays to exercise precaution and be wary of scenarios you cannot prove to be happening at the moment. E.g., you don't know your new friend you met at the bus stop is secret police, an informant for the Vichy government, but until you're damn sure he isn't then you don't let him know the location of your resistance safehouse. You don't need to have proof that your new friend has done anything wrong to be cautious of that possibility.

https://en.wikipedia.org/wiki/Crypto_AG

See Crypto AG (https://en.wikipedia.org/wiki/Crypto_AG) for a company in the cryptography / privacy industry that was owned by intelligence services.

It's possible you're in a coma and everything you're experiencing is a terribly detailed dream.

It's not very likely though.

That one's pretty easy to disprove though. Just have a computer solve a random NP-complete problem and then verify it by hand.

Can you, please, explain?

We're assuming in this scenario that your memory is still basically functional, so the math on a sheet of paper won't be replaced suddenly without you noticing.

If you can't even remember things in the medium term that's a level beyond "trapped in a dream" that's much more hopeless.

So, with that assumption, you make a computer solve a problem that's impossible for a human to work through in a practical amount of time. And then you verify it got the right answer. This proves the math wasn't done by your dreaming brain. (At least it proves it to a pretty good certainty, and you can repeat the test.)

Many NP-complete problems are good candidates here for slow solutions and fast verifications.

This assumes the dreamer is a human brain.

Yeah I kept thinking about simulation stuff too but GP's method is a good one for being trapped in one's own mind situation.

Also for situations that have the standard dream level of fidelity, you can try basic reality checks like putting your finger through your hand or more conspicuously spinning along your own axis.

At least in my dreams, nonsensical things happen all the time, but within the dream seem completely reasonable.

It's not so bad to miss a hundred signs if you have a reliable test to try.

Thanks, I will try to understand it, but I need to read some stuff beforehand, I guess.

How would this work?

Read a page of text, then read it again to see if it changed. This test never seems to fail, at least in the sort of dreams I can remember having after waking up. Usually I can't read at all in dreams, and when I can, the text is different every time I read it.

> Usually I can't read at all in dreams

I thought this was just me! There have been times when I've "read" in dreams (signs, usually), but I don't actually visualize the words. I just "know" what they say.

> not very likely

I would even say "highly unlikely". I revisited how I understand "unlikely" after reading this:

> Radioactive capsule that fell off truck found in Australia... Radiation Services WA general manager Lauren Steen describing it as a "highly unlikely" scenario.

Law enforcements could force Mullvad to start logging some specific account if they manage to indentify the account.

Service might not collect data but they could be forced with warrant to start doing so for specific entities.

This has happened in Finland, for example.

mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest.

also their business definitely doesn't depend on being honest or standing for their values. there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.

> there are plenty of vpn's who run on fake marketing that give the impression that they have certain values and do certain things while actually not doing it and they are way more successful than mullvad.

Yes, but Mullvad also doesn’t whore themselves out to any YouTuber that will accept a sponsorship agreement. I’ve never seen an ad for them. I’ve only heard of them from people who tell me they’re the best.

Of course we shouldn’t trust them 100%. Trust isn’t required them competent OpSec is implemented within a workflow. Trust is a vulnerability.

pretending you don't need trust when you actually do is a vulnerability. of course you need to trust that mullvad is doing what they actually say they are doing. there is literally no way for you to verify everything they claim.

And yet you trust WhatsApp and Facebook and Signal with their claims of end-to-end encryption. Why?

I don't myself. If it isn't on my own infra, I won't trust it.

The idea that folk are keeping passwords in some cloud management portal owned by some company boggles my mind. But this is a very controversial opinion and offends many.

Alright, I'll bite. Not all password managers are the same. In particular, the good ones have no direct access to your data. It's encrypted before reaching them, so even if they get hacked, the attacker can't access your passwords without your master password as well, which hopefully you're not giving out.

You don't have to trust password managers if you don't want to, but if you want others to accept your reasoning as to why, you'll have to convince them using an argument that actually applies.

While GP didn't spell this out, they have, in my opinion, a point. If you use a cloud portal, usually web based (be it browser, electron or similar), that asks for your master password, you need to trust the provider that the master password is not send to their servers. Even if you trust the provider to adhere to this principle, if their infrastructure is compromised an attacker can serve you a different webapp that sends your master password to the server. Same goes for auto-updating native apps.

This does not render the model of keeping the master password client side only moot, it is more secure no matter what. You successfully mitigate the read-only attack of dumping the storage of the cloud provider. However, if you assume a full, on-going compromise of the infrastructure, your password is not secure anymore.

I get that this is moving the goal posts a bit but I wanted to post this anyway. I think if you have highly valuable credentials and want the maximum security for them, you should play out as many possible attack vectors as possible.

i never said you shouldn't ever trust anything. I personally do trust mullvad. I've been using it for over a decade. I'm just not in denial over the fact that there is trust required. Second of all, aside from signal which I have superficially played around with, I don't and have never used any of those services you mentioned and they have absolutely nothing to do with the topic at hand so maybe you can tell me why you brought them into this conversation?

Because I don’t think it’s wise to trust ANY company with major secrets, just because they claim to not view them. Thus I agree with your sentiment and recommend it be applied far more widely

mullvad is working on a fireware attestation system that can allow clients to verify the exact version of the software running on the server.

But I think this is not fully deployed.

https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...

This is also one of the very few uses of remote attestation that I support as a consumer.

Some places passed laws during the pandemic allowing for the execution of a will using witnesses connected via video link. How does that sit with you

> mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest.

There are parallels to the now-defunct Crypto AG. Impeccable reputation, but no way of independently verifying it it did what it said on the can. It took decades for the truth about its links to the CIA to come out.

Their entire business depends on them not telling you they are doing it.

> their entire business depends on them not doing it...

... in a way that you, as a customer, can detect.

1. You can't have any hard guarantees about what information is retained by third parties about you.

2. As other comments here have pointed out, something smells a bit weird with this.

How profound. So what is your alternate theory of what is happening here?

My theory is that if you need an iron-clad guarantee of privacy, you're not going to get it from a VPN.

If you're interested in hiding from civil snoops (RIAA, MPAA), by all means, use one. If you're interested in hiding from a government, then by all means, keep rolling the honeypot dice.