> Server Logs
> Like all web services, our servers may log:
> IP addresses of visitors
> Request timestamps
> User agent strings
> These logs are used for security and debugging purposes and are not linked to your account.
Shouldn't you have spent some time to think through basic things like this before trying to write an opinion piece on anonymity? Certainly it shows a lack of depth of understanding.
Not that I use it, but one of the best privacy features of Mullvad is that you can post them cash with your account number and they will credit it. That makes the transaction virtually, and for all practical purposes, untraceable.
It seems like you have the means to do exactly that too.
I initially liked the sentiment but the offering doesn’t appear to add up. Unfortunately the real private cloud, if it exists, is bare metal and can’t really be sold as a subscription.
I’m not sure if this is just an “on mobile” thing, but I can’t find any reference to ISO 27001 or SOC2 at that datacentres URL. Taking your word for it being there previously, this seems like a major red flag! Faking these certs is no joke, and silently removing references to that after being called out would be even more of a bad look.
@ybceo you seemed to represent this org based on your previous comments, is the parent commenter missing something here?
You're right, we shouldn't have had those certifications listed. They've been removed. We're a new company, made a mistake, and we're fixing it. Appreciate you calling it out.
Sorry for continuing on this thread, but now I got more questions:
How do you monitor and enforce your uptime SLA? You state 99.9%, which is less than 9 hours downtime per year; what happens if you breach this guarantee?
Any other types of SLA's? What happens if you get breached/ your networks gets breached, or hardware failure, and my "anonymous" data is lost.
Besides that you make some claims, but are they real, or are they vaporwave?
like:
"All our datacenters maintain the highest security standards with 24/7 on-site security, biometric access controls, and CCTV surveillance.
Each facility features N+1 power redundancy with UPS systems and diesel generators, ensuring your services remain online even during extended power outages."
Speaking of mullvad. I recently learned about mullvad browser, which is basically tor browser minus connecting via the your network. This is interesting because the tor project has put the most effort into fingerprinting resistance. If you care about privacy and you have a customized browser, you're likely uniquely finger printable [1]. If you don't want to connect via tor, there's no excuse not to use the mullvad browser. (Doesn't require you to use mullvad VPN; comes with the mullvad plugin, disabled by default, to optionally use mullvad encrypted DNS. Last point, I wrote to the tor project and asked "is it possible to use tor browser minus tor network", and they responded "that's the mullvad browser", so this isn't just my recommendation)
Unlinking one's identity from one's activity is only getting harder as surveillance gets more and more pervasive. Effective OPSEC essentially turns one's life into a living hell and it's only getting hotter with time.
Any business that isn’t willing to be as anonymous as Mullvad, I assume has a compromised business model that I don’t really like. Assuming there aren’t obvious reasons for needing the data, like tax filing, or various regulatory requirements.
I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so. It also means they can avoid all the lawyers writing complicated and confusing privacy policies, or cookie approval pop-ups.
What I'd really like to see is more honesty: "we store X because feature Y needs it, here's the risk we're accepting," instead of pretending every service needs emails, analytics, and cookies by default
> I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so.
They're OK with the liability exactly because of this very sentence. As you said, there's so many data breaches... so where are the company-ending fines and managers/execs going to prison?
Here in Japan the government cracks down on it hard. There are fines for every n users exposed and in extreme cases a company can be forced to stop trading for a period of days or weeks. Companies are so scared of this happening to them that a significant portion of orientation for new employees is spent on it. I don't have stats on how effective it is, but I do know that the public is less willing to accept it as they tend to elsewhere.
Up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements such as controller and processor obligations, security of processing, record-keeping, and breach notification duties.
Up to EUR 20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements of basic principles for processing, data subjects’ rights, and unlawful transfers of personal data to third countries or international organisations.
Infra engineer here. The obvious reasons for needing the data is debugging. I collect logs, metrics, traces, and errors from everywhere, including clients. All of these come with identifying information including the associated user. From the perspective of this thread this is a huge amount of data although it's pretty modest compared to the wider industry.
This data is the tool we have to identify and fix bugs. It is considered a failing on our end if a user has to report an issue to us. Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless.
It's not my department but I think we would get laughed out of the room if we told our users that we couldn't do password resets or support SSO let alone the whole forgetting your 'credential' means losing all your data thing.
> Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless.
A lot of companies could be in similar situations, but choose not to be.
All of retail, for example. Target does significant amounts of data collection to track their customers. This is a choice. They could let users simply buy things, pay for them, and store nothing. This used to be the business model. For online orders, they could purge everything after the return window passed. The order data shouldn’t be needed after that. For brick and mortar, it should be a very straightforward business. However, I’m routinely asked for my zip code or phone number when I check out at stores. Loyalty cards are also a way to incentivize customers to give up this data (https://xkcd.com/2006/).
TVs are another big one. They are all “smart” now, and collect significant amounts of data. I don’t know anyone who would be upset with a simple screen that just let you change inputs and brightness settings, and let people plug stuff into it. Nothing needs to be collected or phone home.
A lot of the logs that are collected in the name of troubleshooting and bug fixing exist because the products are over-complicated or not thoroughly tested before release. The ability to update things later lowers the bar for release and gives a pass for adding all this complexity that users don’t really want. There is a lot of complexity in the smart TV that they might want logs for, but none of it improves the user experience, it’s all in support of the real business model that’s hidden from the user.
I wish I had a list, as you said, they are in short supply. If there is a site out there that catalogs simple straightforward business that don’t compromise a customers ability to be anonymous, I’d like it very much.
A HN user posted about a site they made for faxing documents the other day. It’s a good example of how I think most things should be setup in many cases. You pay a fee and it sends a fax, that is very simple to understand. There are no accounts and the documents are only stored long enough to fulfill the service.
You can imagine how most “modern” sites would handle faxing. Make an account, link a credit card, provide your address to validate the credit card. Then store all the faxes that were sent, claiming it’s for easy reference. Meanwhile it’s running OCR on them in the background to build a profile with a wealth of personal data. After all, people don’t tend to fax trivial things. In addition to the profits from the user, they are making a killing on selling data to advertisers… but those details are hidden away in legalese of the fine print in a policy no one actually reads.
In many ways, we're past the point of no return. So-called ubiquitous technical surveillance is largely the norm, often encroaching by design beyond the boundaries of expected decency.
Informational terrorism, a dysphemism that describes the manner by which certain data is abused to "re-rank content" for a "personalized experience," is encoded into the DNA of certain large tech companies.
The ideal would have been a security-first (privacy-first) industry and supply chain. The ideal never was going to happen, anymore than the early educational ideals of the television industry.
Ergo we are not past the point of no return. That point never existed. We are right where we should expect to be, with most people victimised by the industry and the supply chain, and with a small percentage of people working in security/privacy education to mitigate unsafe practices.
Seatbelts and airbags exist. Smoking is banned in many public settings. It took a senseless amount of carnage to achieve these measures.
We just haven't achieved the requisite amount of privacy carnage. Yet.
Yes. The only question left is when does the terror begin? And it will--it will be our own governments clamping down on all of us. The digital norm globally will be China under the CCP. That is the future for all of us unless we turn it off, but we won't because humans are stupid.
This is largely the attitude that led to this in the first place. This is about failures of messaging, campaigning, and organising. It is a lack of democratic engagement that directly stems from the idea of individual choice being supreme over everything.
I know it’s a different context, but with this catchy title, I can’t resist pointing out that anonymity also doesn’t mean anything.
You can have cryptocurrencies in your wallet, (on most chains) you are anonymous but have no privacy, your transaction history can be accessed by anyone.
It’s all fine and dandy, you can enjoy your anonymity, about as long as you make your first transaction.
You might be anonymous, but basically you hand over your full transaction history and balance anytime you pay for a coffee or tshirt.
The term pseudonymous should be more popular. A crypto id is a pseudonym, right? In the sense that it is a consistent identity you have, just, not one that is initially tied to the identity you were born with.
Social media handles are usually pseudonymous at most.
I wonder where the figure of anonymity is. With writing style analysis, correlating pseudonyms is probably pretty easy these days. Maybe we’ll all start writing our ideas into LLMs and have them do the talking…
That's why Bitcoin isn't anonymous. Use Monero XMR instead. Much more private. Transactions can't be tracked. (Some very advanced techniques might, but they are in the process of fixing it. Unlike BTC, they do care)
And if you simply have multiple wallets and try and maintain the appearance of being disconnected, can you move funds between them without establishing a connection that unmasks you?
Let’s say you need three transactions a week, that’s 150 a year. How do you get the right amount of funds into these wallets? How will you get your money out? How will they not be able to track you anyway? As far as I know, you just make the identifiable wallets one hop away.
Again, I’m assuming traditional “old school” non-privacy cryptocurrencies.
What scares me is that the more privacy oriented you are, the easier you are to fingerprint. At what point does privacy mean blending in with the crowd and not sticking out?
You're thinking about browser fingerprinting (client-side), but my post is about service-level anonymity (server-side).
Browser fingerprinting: "Your unique combination of extensions/settings makes you identifiable among other users."
Service anonymity: "There are no other users to compare you against because we don't collect identifying data."
When you sign up with just a random 32-char string, there's nothing to fingerprint. No email to correlate. No IP logs to analyze. No usage patterns to build a profile from.
Fingerprinting matters when services collect behavioral data. We architected our way out of having that data to begin with.
>When you sign up with just a random 32-char string...
There's STILL a browser fingerprint, IP logs to analyze, usage patterns to build a profile from. You may claim you don't collect it, but users need to take your word for it. This is just pseudonymity, which (as many BTC users found out) only gets you halfway there. Real anonymity is way harder, often impossible.
Don't get me wrong, it's good to see organisations that care about privacy and in fact this blog post encouraged me to consider your services in the future. We have some use cases for that at work.
Though by using cloudflare you're NOT putting your money where your mouth is.
> At what point does privacy mean blending in with the crowd and not sticking out?
It's basically rule number one. Tor is all about making all users look like the same user. The so called anonymity set. They all look the same, so you can't tell them apart from each other.
I read here that most of the Tor exit nodes are operated by governments and governments are using parallel construction to keep that information out of legal documents.
There were 4 people, but he confessed when questioned.
I guess the lesson there is that if you don't want to be convicted of a crime, don't confess to a crime? They won't give you a lighter sentence for confessing.
"...the only person on the whole campus connecting to Tor."
Talk about doubly stupid, first sending the threat, second using Tor on campus. I often wonder what goes (or doesn't go) through the mind of such people.
Blending in with the crowd doesn't work. If you use Chrome on Windows you're part of a very large group and "don't stick out". But it's also very easy to fingerprint so you're also part of the "theturtletalks" group with the size of one.
Thank you, op, for bringing sanity to this whole thing.
Relatedly, this is why I think every "new" social media service that isn't Mastodon is barking up the most wrong tree with "take everything with you," you're essentially helping to build an even harder to erase social history.
Mastodon's individual server model, like email's, is better PRECISELY because each node is a point of "failure." That makes erasure easier. Which is good.
Yep. And you still de-anonymise yourself with Mastodon when you buy hosting and a domain. If you use an existing provider, then you're back at square one and living in hope that the provider doesn't keep logs etc, or just decide they don't like you.
Nostr fixes both of these. So whilst you're at the mercy of relays storing your data, you can at least be anonymous.
This seems like the wrong end of the system to fix the problem. Someone saying "we don't log your IP address" isn't something you can easily verify, so the promise doesn't mean much because if they suck they're just going to lie about it.
What you need instead is to make it easy and common for people to use browsers that resist fingerprinting, VPNs/Tor, custom email addresses per-account, etc. Because then instead of claiming to not log your information, they simply do not have it.
The biggest thing we need is a better way to pay someone over the internet without them knowing who you are.
"The biggest thing we need is a better way to pay someone over the internet without them knowing who you are."
I've been saying that for years. Buy a prepaid card for cash at say the supermarket with xyz value on it and a unique email address included (an anonymous debit card with email). That is every new card you buy would have a different disposable email address that would expire when the card is empty.
Such a scheme could also be used to donate micro payments to opensource projects, ad-free Youtubers, etc. and do so anonymously. Moreover, it would make payments easier thus overcome the "requires effort to do" resistance when it comes to donating. Making donating super easy would I reckon greatly increase the income for all those on the receiving end.
However I can't see it happening, governments would outlaw it claiming it'd be used to transfer money for nefarious purposes, money laundering etc.
The major reason I don't donate to good/charitable causes is that I cannot do so anonymously.
> However I can't see it happening, governments would outlaw it claiming it'd be used to transfer money for nefarious purposes, money laundering etc.
I feel like it's too common for people to say "we can't have nice things because the government is run by a clutter of lummoxes" when they should be saying "we should improve society somewhat".
"Please unblock challenges.cloudflare.com to proceed."
talk about anonymity but uses cloudflare. you threw away your tls and allow cloudflare to sit in the middle of the user and your web page. you're a hypocrite.
@ybceo As long as you use Cloudflare to verify users [fingerprints] and traffic between users and your service is decrypted at Cloudflare side, I am afraid it difficult to take these anonymity claims seriously.
Please do not to rely on fingerprinters or CDNs that does TLS-termination for you.
There is no such thing as anonymity. With the number of bits required to ID a person and the fact that you are leaking such bits all the time you can simply forget about anonymity.
Many people online seem to think that they are anonymous and so were emboldened to do stuff that they might not have done if they had realized this. They continued to feel extremely good at this right up until the knock on the door.
Most UK and Australian writers would spell it "realised" so there's a bit right there.
Even if you include no personal information, there is information in writing style.
Stylometry is the study of this. Yes, there's also adversarial stylometry - distorting your writing style to fool an analysis. It's probably effective now, but that could change overnight and every archived post that every OSINT organisation has collected is deanomynised.
Yeah you can say "I change my style". But there's some bits that don't have false positives. If I EVER say "praise the omminsiah" I'm definetly au fait in 40k memes. If I ever say au fait I'm a person who has at least a rough idea of what it means. There's no false positive here, so if you can just find about 29 undeniable uncorrelated bits that are known to not have false positives ... a more advanced analysis could exploit this in a more continuous way (e.g. the likelihood of it being a false positive). I should shut up now.
It's as old as history. In the days super-abbreviated telegrams (words were costly) you could even get two for the price of one--the author and the Morse code operator who actually sent the telegram. He could be recognized by his Morse fist, other Morse operators on the network would recognize him by the style of his sending even though they were only listening to dots and dashes,
Stop with that doom and gloom. You can absolutely be anonymous online if you want to and have some basic technical knowledge (every HN reader does).
I could try to prove it to you, but the only proof you need is that cybercrime exists and millions (or tens of millions) of dollars are stolen every day. If anonymity didn't exist it would be easy to stop this, wouldn't it?
Well there's anonymity from authorities, and there's anonymity from garden variety lunatics.
There exists a grey area between not getting away with nefarious activities, and not having your life ruined by a lynch mob because you didn't approve their preferred CoC on a hobby project or some other perceived injustice.
Sadly, everybody using a browser from a massive ad company and an idp (not to mention a company with an interest in crawling the entire web for AI at the same time site owners are dealing with better scrapers) means the entire web will be login-only over time.
We're quite a few years into this period of technology. At a certain point, these "AI is going to kill the web!" predictions either need to come true or just be dismissed as false.
I don't see how those points bolster your conclusion. These pressures predate AI by over a decade and haven't forced a significant tidal change in the way the internet is used.
According to article, the whole authorization system is flawed. But we haven’t invent a new one and the one we’ve got never meant to be private, it is just a way to separate users from each other. We need something unique, a "primary key" for our DB, and that’s email or phone or username that has to be stored somewhere. A server, someone else’s computer, call it what you want. It has good privacy between users, but the admin can see everything, because otherwise management of the service would be impossible.
There is no anonymity, there is always someone you have to trust in the chain of WAN networking (DNS,ISP,VPN). If you want anonymity and privacy, you selfhost (examining the code is also a prerequisite). There is no other way to do it.
> but the admin can see everything, because otherwise management of the service would be impossible.
It depends on what service you’re offering. There are many cases where you can have end-to-end encryption so that you can know who your users are, host their data but cannot do anything with it.
Like security, the Internet doesn't tolerate half measures. You either have perfect privacy or none.
A lot of our intuitions about both are based on obscurity: nobody is interested enough to devote their lives to you. That's not the case any more. You are exposed to every person on the planet, and they have the tools to automate attacks on every single person.
That's not to say "give up", but we need to find a new understanding of how our lives work. It's like we're all hunter-gatherers who find ourselves instantly in the largest and fastest city, with nobody to teach us the ropes.
Isn't the actual difference between privacy and anonimity that one indicates that the company knows who you are, but ensures this stays "private", and the other is about not knowing who you are?
The biggest risk to this business model isn't the government, but the payment processor. Anonymity makes it easy for unsavory characters to use stolen credit cards to buy your compute. The inevitable barrage of chargebacks will then cause Stripe to cut you off. Hell, if you're particularly unlucky, your payment processor might even cut you off proactively, if they decide that your lack of KYC makes you a risk.
Using digital money (fiat or non anonymoized crypto) exposes you. you can not be part of a legal business without doing that except accepting real coins, and even then you have fingerprints on it, or maybe they can scan the banknote id and trace that to an ATM, and so on.
The only way to be absolute anonymous is stealing some hardware and trying to get it anonymously into some kind of infrastructure you dont own.
This is nowadays easier and cheaper then years ago because there are so many fuckdarts out there exposing their routers and dont give a shit about security.
And, also not very funny, those corps never tell in advance which data they "require". They grab my mail on "the first page" of the registration form. Then, on "the second page", they ask for my phone and my address. Should I decide to agree to this, they will finally tell me on "the third page", that they only support credit card, no PayPal, no direct payment via Bank ...
The PSF is the most recent org which did not get my donation due to this. https://donate.python.org/ X pages, I will not know in advance which of my data is required and which payment option is supported. All this could be on one page, I guess.
> Stripe customer ID and payment method ID
Wouldnt this information allow for the authorities to just go to Stripe and ask the relevant information there? Sure, you don't store exact personally identifying info, but you store a breadcrumb that can lead whoever has the power to request that information to trace back to the end user
> And for those who need traditional payments? We support Stripe. Because pragmatism matters. But we don't pretend that credit card payments are anonymous. We're honest about the trade-offs.
I think this paragraph is clear enough about that?
>Here's how the average "privacy-focused" service actually works:
> ...
>5. Confirm identity for "fraud prevention" (now we have your ID)
I can't tell whether OP is being hyperbolic but it's certainly not representative of the average "privacy-focused" service I've came across. The typical service only asks for an email and maybe billing information (can be prepaid card or crypto). The only exception is protonmail, which might require SMS verification[1], but given the problem of email spam I'm sympathetic, and it's bypassble by paying. It's certainly not the "average" service, and no service asked to "Confirm identity".
Yeah, so many places ask for phone number that don't really need it that I assume the phone number is a unique identifier used to combine individual's data across websites.
Most of the time I use a made-up 555 number or if it needs to send an SMS to verify, I'll use a free SMS numbers.
The problem with this in our current society is that staying anonymous becomes your whole identity. I have a friend who for the longest time didn’t use Venmo, Uber, etc. because of privacy reasons, but the lifestyle was just not sustainable. Ultimately convenience killed privacy.
So my understanding is, what Mullvad is to VPNs, and what Tarsnap is to S3 (kinda), Servury is to entire VMs. It's a prepaid model, you get an account identifier, and that's basically it.
This is very cool. I have wondered for a very long time why such a site does not exist. What pops to mind is that you could get better unit economics reselling really small VMs to the privacy obsessed. I know some netizens who would pay a dollar a month for, say, a tiny NetBSD VM and 64 MB of RAM to serve their tiny static demoscene website of yore. There are some real wizards of there.
Not sure if that's in your roadmap but definitely something to consider in this space.
"privacy" or not sharing your space with a creepy room mate, and reading the internet without adds ar3 parallel
running three flavors of the same off brand browser, each optimised for different segments of online content is what seems to be the minimum.
they are so desperate to sell me something,
(a truck) that it's wild, as it is one of the few monitisable things I consistently look for (parts, service procedures), the ,
pause, when I do certain searches gives me time to predict that yes, the machinery is grinding hard, and will ,shortly, triumphantly, produce, a ,truck.
One difference with Mullvad is VPN traffic is ephemeral. Here, a VPS has a persistent disk attached, that could contain identifying information (if it is necessary to do useful work).
Even if you don't want to live entirely on the anonymous web, it's useful to see how many products claim privacy while being structurally incapable of delivering it
> If you use our servers for illegal activity, law enforcement can still investigate. They just can't start with "who owns this account" because we can't answer that question.
You're going to have a tussle with law enforcement, and you're going to lose. Your service will last < 2 years because you will not be able to afford the lawyers you need to defend against even one muscle move by the government.
Why? That's kind of the whole point of this: they can cooperate entirely and give them everything they have. You think they'll get into legal trouble because they aren't gathering data?
I've been beating this drum for years. The problem with signal and most other privacy ware is that they require you to effectively deanonymize yourself, typically by making you use a phone number to use their service. Knowing who someone is talking to is, in many circumstances, far worse than knowing what they're saying
I can't stand the style as much as the excessive use of hyphens. The "It's not just ..., it's ...." every 5 sentences is too much once you notice it. However, every LLM seems to converge on this style. It wouldn't wouldn't write like that if it didn't work to some degree, so maybe it knows something we don't.
The blog post and homepage do a terrible job describing the product?
Wasn't Crypto recently revealed to be used by FBI (or similar) to track major criminals? They don't broadcast it, since they want people to continue thinking it's anonymous.
How do you accept crypto payments? Is there a Stripe style service that provides an API and/or payment portal? Id like to implement something for my SaaS but generally can't be bothered with crypto.
Is that legal?
I was under the impression that in europe hosting servers had KYC rules.
I'm regularly getting emails by OVH asking me to confirm my name a d home adress.
A company talking big about privacy generally comes across as dishonest, and you'd have to get all the details right to avoid unleashing the Internet's wrath. It looks like you screwed up between the server logs and Cloudflare. Unfortunate, but it seems to me that it reflects a lack of experience more than ill intent (I do not have such experience myself either.)
Honest question, but did you add the Cloudflare proxy to solve an actual problem, or did you deploy it a priori without an actual justification?
I would much rather have privacy with e2e encryption than have anonymity. The way that works is a direct connection between two parties without use of a central server, like webRTC.
What I was wondering after reading the article: How does Mulvad actually decouple banking data from the account ID? Or is it as simple as verify transaction once but never log?
So there's no subscription thing going on, you just manually pay invoices?
I once spent an entire year issuing chargebacks on AWS charges coming from god knows what AWS account. Most likely some client project I forgot about and didn't have the login to anymore, who knows. Makes me think about that - for a service where you can't login if you lose the credentials, how do you cancel a subscription? In my case I had to eventually just cancel the credit card and get a new number.
No subscription. It’s pay as you go. You top up $X and you get X months. That’s it. If your month expires, it expires. Just top off and you’re good to go.
It's a bit ironic the page is protected by Cloudflare. So, all of our traffic is going through some other company to log and track before it gets to you, eh?
I’m fine with no account recovery but they would definitely need a major warning about that at sign up time so users can take extra care to save their info.
tl;dr
“Privacy” = the data is private i.e. only on your devices. Or if the raw data is public but encrypted and the key is private, I think that qualifies.
“Anonymity” = the data is public but not linked to its owner’s identity.
If you’re sharing your data with a website (e.g. storing it unencrypted), but they promise not to leak it, the data is only “private” between you and them…which doesn’t mean much, because they may not (and sometimes cannot) keep that promise. But if the website doesn’t attribute the data except to a randomly-generated identifier (or e.g. RSA public key), the data is anonymous. That’s the article.
Although a server does provide real privacy if it stores user data encrypted and doesn’t store the key, and you can verify this if you have the client’s unobfuscated source.
Also note that anonymity is less secure than privacy because the information provides clues to the owner. e.g. if it’s a detailed report on a niche topic with a specific bias and one person is known to be super interested in that topic with that bias, or if it contains parts of the owner’s PII. But it’s much better than nothing.
Europe is currently being tormented by this exact contradiction: on one hand, it has the GDPR—the world's strictest privacy law, supposedly protecting personal data; on the other, a flood of new regulations under the banners of "child safety," "counter-terrorism," and "anti-money laundering" are systematically strangling real anonymity.
I agree, privacy still means a lot. It's a term that's been co-opted by the large tech companies which operate with impunity. It will has meaning that cannot change.
The post also misunderstands privacy
> Privacy is when they promise to protect your data.
Privacy is about you controlling your data. Promises are simply social contracts.
I don’t know what’s wrong with these comments. This is the kind of smart design we want to see and everyone is doing nitpicking.
Can we have just better things or are we going to reject everything that’s not perfect and by doing so concede the whole point and just give up?
Well done OP for the right approach and your business. This has always been my design (when possible) to approach data security. When you don’t have data you don’t have to worry about its security.
it's 2025. chances are you had peeps in class/uni who are now in the Stasi networks of informants and/or in some more or less obscure agency or more or less related private company so your anonymity only works from birth and even then only if you are lucky or your family "gets it" and has resources and brains beyond.
some people believe supply chain attacks are rare and hard to pull off and expensive and only valuable in extreme cases but if you ever worked at a local delivery service or pharmacy or something other where people and the necessary machines are being aggregated in some basements or even backrooms for all use cases from all times for wholesale forgery and fiddling with people, you know that the situation is ugly, not bad. throw in the many coders, network engineers and hardware specialists with ties to above entities and bombaclat, Jahmunkey, we fucked!
Exactly. I run sans JS by default. At least this warns me to either avoid the site or to take the risk (browser button--red for JS block, green unblock).
anonymity in your product could be a sensible design choice that your customers could value. fine. go nuts.
but in general? hard disagree. anonymity is fragile and can't be guaranteed, privacy is a legal obligation which can actually be enforced if push comes to shove.
also that page reads like slop : it's not X, it's Y. blah blah blah. this is a marketing piece trying to go viral.
How tf are you supposed to provide working authentication without storing the email somewhere? Should i just disable password resets and tell the users to fuck off if they forget theirs? Cant even use passkeys as they make users identifiable too.
How do passkeys make users identifiable beyond being a random token? I recall FIDO shared hardware key serial numbers with websites, but at least on Firefox, it prompts you to deny it.
A passkey is always one per site. Emails tend to be naturally reused, unless the visitor uses a paid aliasing service (plus trick is trivial to canonize, having a dozen mailboxes on a self-hosted email still associates them with each other, because there's no anonymity set to speak of, and major email providers like Gmail won't let you register an account today without a phone number, credit card, or passport).
Users need to have hard memorization or record of a paraphrase, same as a crypto wallet. Or just use web3 for auth, that can work well if users have decent opsec.
The battle on privacy/anonymity/whatever is lost. Get over it. What we need is a new social paradigm where everyone is happy despite the lack of privacy.
Please provide your full legal name (include any other names you go by), occupation and place of employment, phone number[s], email address[es], usernames on other social media accounts, eye color, height, weight, list of any health conditions. That's just to start, then we can start going over more info.
At first I thought it was a blog. No, this is a company. So, their privacy page (https://servury.com/privacy/):
> Server Logs > Like all web services, our servers may log: > IP addresses of visitors > Request timestamps > User agent strings > These logs are used for security and debugging purposes and are not linked to your account.
That's already a huge breach in comparison to mullvad privacy page. (https://mullvad.net/en/help/no-logging-data-policy)
I agree 100%. I went ahead and disabled all logging in Apache just now. Will update the privacy page to reflect this within the hour.
Shouldn't you have spent some time to think through basic things like this before trying to write an opinion piece on anonymity? Certainly it shows a lack of depth of understanding.
The whole thing is behind cloudflare!
Does it matter, when CF is collecting all that already before people even reach your site?
Are you allowed to do that in US? I see the company is located in the USA, can companies disable logging just like that?
(Asking because I really don't know)
Just curious, why not accept cash?
Not that I use it, but one of the best privacy features of Mullvad is that you can post them cash with your account number and they will credit it. That makes the transaction virtually, and for all practical purposes, untraceable.
It seems like you have the means to do exactly that too.
> That's already a huge breach in comparison to mullvad privacy page.
And the "3 data points, that's it" of the blog post
Those data points refer to what is stored in the database and is tied to your 32 character credential.
Web server logs were not tied to user credentials in any way.
I initially liked the sentiment but the offering doesn’t appear to add up. Unfortunately the real private cloud, if it exists, is bare metal and can’t really be sold as a subscription.
I mean technically yes but I find THAT kind of logging utterly benign.
They're good enough for fingerprinting and matching against other logs.
Also:
> // What we DON'T collect:
> - IP addresses (not logged, not stored, not tracked)
> - Usage patterns (no analytics, no telemetry, nothing)
> - Device fingerprints (your browser, your business)
so, I've read one blog from this company, and already they're lying or incompetent
Do as I say, not as I do! /s
You are liying. here: https://servury.com/datacenters/
Here on datacenters you say your are ISO27001 and SOC2 certified.
"We're ISO 27001 certified and maintain SOC 2 Type II compliance."
You do not have any certificate that I can find: https://www.iafcertsearch.org/search/certified-entities?sear...
https://www.iafcertsearch.org/search/certified-entities?sear...
Who is the company who certified you? What is the certification number?
I’m not sure if this is just an “on mobile” thing, but I can’t find any reference to ISO 27001 or SOC2 at that datacentres URL. Taking your word for it being there previously, this seems like a major red flag! Faking these certs is no joke, and silently removing references to that after being called out would be even more of a bad look.
@ybceo you seemed to represent this org based on your previous comments, is the parent commenter missing something here?
Yes, the page mentioned ISO27001 which is still visible in the indexed duckduckgo result.
https://duckduckgo.com/?q=https%3A%2F%2Fservury.com%2Fdatace...
It is not visible in the live webpage.
You're right, we shouldn't have had those certifications listed. They've been removed. We're a new company, made a mistake, and we're fixing it. Appreciate you calling it out.
Sorry for continuing on this thread, but now I got more questions:
How do you monitor and enforce your uptime SLA? You state 99.9%, which is less than 9 hours downtime per year; what happens if you breach this guarantee?
Any other types of SLA's? What happens if you get breached/ your networks gets breached, or hardware failure, and my "anonymous" data is lost.
Besides that you make some claims, but are they real, or are they vaporwave?
like: "All our datacenters maintain the highest security standards with 24/7 on-site security, biometric access controls, and CCTV surveillance.
Each facility features N+1 power redundancy with UPS systems and diesel generators, ensuring your services remain online even during extended power outages."
Are you sure the above is true, because I am not.
In this instance, what mistake did you make here exactly? Are you in process for those certifications? Is there any plan to achieve them?
Or was the mistake saying you held a certification that you thought wasn't important to most people?
Are you even a new company?
The only one I could find in Delaware with YBC Holdings, INC is registered in 1994 and is a brewing company
https://b.assets.dandb.com/businessdirectory/ybcholdingsinc....
Speaking of mullvad. I recently learned about mullvad browser, which is basically tor browser minus connecting via the your network. This is interesting because the tor project has put the most effort into fingerprinting resistance. If you care about privacy and you have a customized browser, you're likely uniquely finger printable [1]. If you don't want to connect via tor, there's no excuse not to use the mullvad browser. (Doesn't require you to use mullvad VPN; comes with the mullvad plugin, disabled by default, to optionally use mullvad encrypted DNS. Last point, I wrote to the tor project and asked "is it possible to use tor browser minus tor network", and they responded "that's the mullvad browser", so this isn't just my recommendation)
[1] https://coveryourtracks.eff.org
Most people fixate on network-level anonymity and completely underestimate how badly a "tuned" browser leaks identity
People also tend to have very poor OPSEC which undermines their efforts in spite of the tools they used.
https://grugq.github.io/blog/2013/11/06/required-reading/
Unlinking one's identity from one's activity is only getting harder as surveillance gets more and more pervasive. Effective OPSEC essentially turns one's life into a living hell and it's only getting hotter with time.
Fun fact, mullvad browser is created by Tor in collaboration with them.
What is Mullvad Browser? - Frequently Asked Questions (FAQs) - Mullvad Browser — Tor https://share.google/1w4rilivJ4qMBwbIb
Any business that isn’t willing to be as anonymous as Mullvad, I assume has a compromised business model that I don’t really like. Assuming there aren’t obvious reasons for needing the data, like tax filing, or various regulatory requirements.
I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so. It also means they can avoid all the lawyers writing complicated and confusing privacy policies, or cookie approval pop-ups.
What I'd really like to see is more honesty: "we store X because feature Y needs it, here's the risk we're accepting," instead of pretending every service needs emails, analytics, and cookies by default
This is what the GDPR requires.
> I don’t understand why any company would want the liability of holding on to any personal data if it wasn’t vital to the operations of the business, considering all the data breaches we’ve seen over the past decade or so.
They're OK with the liability exactly because of this very sentence. As you said, there's so many data breaches... so where are the company-ending fines and managers/execs going to prison?
Here in Japan the government cracks down on it hard. There are fines for every n users exposed and in extreme cases a company can be forced to stop trading for a period of days or weeks. Companies are so scared of this happening to them that a significant portion of orientation for new employees is spent on it. I don't have stats on how effective it is, but I do know that the public is less willing to accept it as they tend to elsewhere.
GDPR has fines:
Up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements such as controller and processor obligations, security of processing, record-keeping, and breach notification duties.
Up to EUR 20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements of basic principles for processing, data subjects’ rights, and unlawful transfers of personal data to third countries or international organisations.
Infra engineer here. The obvious reasons for needing the data is debugging. I collect logs, metrics, traces, and errors from everywhere, including clients. All of these come with identifying information including the associated user. From the perspective of this thread this is a huge amount of data although it's pretty modest compared to the wider industry.
This data is the tool we have to identify and fix bugs. It is considered a failing on our end if a user has to report an issue to us. Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless.
It's not my department but I think we would get laughed out of the room if we told our users that we couldn't do password resets or support SSO let alone the whole forgetting your 'credential' means losing all your data thing.
> Mullvad is in an ideal situation to not need this data because their customers are technical, identical, and stateless.
A lot of companies could be in similar situations, but choose not to be.
All of retail, for example. Target does significant amounts of data collection to track their customers. This is a choice. They could let users simply buy things, pay for them, and store nothing. This used to be the business model. For online orders, they could purge everything after the return window passed. The order data shouldn’t be needed after that. For brick and mortar, it should be a very straightforward business. However, I’m routinely asked for my zip code or phone number when I check out at stores. Loyalty cards are also a way to incentivize customers to give up this data (https://xkcd.com/2006/).
TVs are another big one. They are all “smart” now, and collect significant amounts of data. I don’t know anyone who would be upset with a simple screen that just let you change inputs and brightness settings, and let people plug stuff into it. Nothing needs to be collected or phone home.
A lot of the logs that are collected in the name of troubleshooting and bug fixing exist because the products are over-complicated or not thoroughly tested before release. The ability to update things later lowers the bar for release and gives a pass for adding all this complexity that users don’t really want. There is a lot of complexity in the smart TV that they might want logs for, but none of it improves the user experience, it’s all in support of the real business model that’s hidden from the user.
>Any business that isn’t willing to be as anonymous as Mullvad, I assume has a compromised business model that I don’t really like
Well, that's like 99% of the businesses out there. Mind listing of some of the businesses you like aside from obvious mullvad?
I wish I had a list, as you said, they are in short supply. If there is a site out there that catalogs simple straightforward business that don’t compromise a customers ability to be anonymous, I’d like it very much.
A HN user posted about a site they made for faxing documents the other day. It’s a good example of how I think most things should be setup in many cases. You pay a fee and it sends a fax, that is very simple to understand. There are no accounts and the documents are only stored long enough to fulfill the service.
https://news.ycombinator.com/item?id=46310161
You can imagine how most “modern” sites would handle faxing. Make an account, link a credit card, provide your address to validate the credit card. Then store all the faxes that were sent, claiming it’s for easy reference. Meanwhile it’s running OCR on them in the background to build a profile with a wealth of personal data. After all, people don’t tend to fax trivial things. In addition to the profits from the user, they are making a killing on selling data to advertisers… but those details are hidden away in legalese of the fine print in a policy no one actually reads.
In many ways, we're past the point of no return. So-called ubiquitous technical surveillance is largely the norm, often encroaching by design beyond the boundaries of expected decency.
Informational terrorism, a dysphemism that describes the manner by which certain data is abused to "re-rank content" for a "personalized experience," is encoded into the DNA of certain large tech companies.
> we're past the point of no return
The ideal would have been a security-first (privacy-first) industry and supply chain. The ideal never was going to happen, anymore than the early educational ideals of the television industry.
Ergo we are not past the point of no return. That point never existed. We are right where we should expect to be, with most people victimised by the industry and the supply chain, and with a small percentage of people working in security/privacy education to mitigate unsafe practices.
Seatbelts and airbags exist. Smoking is banned in many public settings. It took a senseless amount of carnage to achieve these measures.
We just haven't achieved the requisite amount of privacy carnage. Yet.
Yes. The only question left is when does the terror begin? And it will--it will be our own governments clamping down on all of us. The digital norm globally will be China under the CCP. That is the future for all of us unless we turn it off, but we won't because humans are stupid.
The terrorism is already occurring, it's merely exported to other people
[flagged]
Eh, defeatist attitude. It isn't that hard to anonymize and obfuscate your data.
The issue is everyone is willing to trade convenience for security.
The point of no return is an individual choice.
> The point of no return is an individual choice.
This is largely the attitude that led to this in the first place. This is about failures of messaging, campaigning, and organising. It is a lack of democratic engagement that directly stems from the idea of individual choice being supreme over everything.
This doesn't reflect the current reality. Tech companies acquire questionable third-party data without consent and exploit it however they see fit.
I know it’s a different context, but with this catchy title, I can’t resist pointing out that anonymity also doesn’t mean anything.
You can have cryptocurrencies in your wallet, (on most chains) you are anonymous but have no privacy, your transaction history can be accessed by anyone.
It’s all fine and dandy, you can enjoy your anonymity, about as long as you make your first transaction.
You might be anonymous, but basically you hand over your full transaction history and balance anytime you pay for a coffee or tshirt.
The term pseudonymous should be more popular. A crypto id is a pseudonym, right? In the sense that it is a consistent identity you have, just, not one that is initially tied to the identity you were born with.
Social media handles are usually pseudonymous at most.
I wonder where the figure of anonymity is. With writing style analysis, correlating pseudonyms is probably pretty easy these days. Maybe we’ll all start writing our ideas into LLMs and have them do the talking…
That's why Bitcoin isn't anonymous. Use Monero XMR instead. Much more private. Transactions can't be tracked. (Some very advanced techniques might, but they are in the process of fixing it. Unlike BTC, they do care)
you typically don't have one wallet and you (should at least attempt to) never reuse them either.
Do you mean a wallet per transaction?
And if you simply have multiple wallets and try and maintain the appearance of being disconnected, can you move funds between them without establishing a connection that unmasks you?
Let’s say you need three transactions a week, that’s 150 a year. How do you get the right amount of funds into these wallets? How will you get your money out? How will they not be able to track you anyway? As far as I know, you just make the identifiable wallets one hop away.
Again, I’m assuming traditional “old school” non-privacy cryptocurrencies.
not if you use Zcash with shielded addresses. zcash is based on zeroknowledge proofs ground up so anonymous by default not with some mixer addon.
What scares me is that the more privacy oriented you are, the easier you are to fingerprint. At what point does privacy mean blending in with the crowd and not sticking out?
You're thinking about browser fingerprinting (client-side), but my post is about service-level anonymity (server-side).
Browser fingerprinting: "Your unique combination of extensions/settings makes you identifiable among other users."
Service anonymity: "There are no other users to compare you against because we don't collect identifying data."
When you sign up with just a random 32-char string, there's nothing to fingerprint. No email to correlate. No IP logs to analyze. No usage patterns to build a profile from.
Fingerprinting matters when services collect behavioral data. We architected our way out of having that data to begin with.
>When you sign up with just a random 32-char string...
There's STILL a browser fingerprint, IP logs to analyze, usage patterns to build a profile from. You may claim you don't collect it, but users need to take your word for it. This is just pseudonymity, which (as many BTC users found out) only gets you halfway there. Real anonymity is way harder, often impossible.
Don't get me wrong, it's good to see organisations that care about privacy and in fact this blog post encouraged me to consider your services in the future. We have some use cases for that at work.
Though by using cloudflare you're NOT putting your money where your mouth is.
> At what point does privacy mean blending in with the crowd and not sticking out?
It's basically rule number one. Tor is all about making all users look like the same user. The so called anonymity set. They all look the same, so you can't tell them apart from each other.
It's also part of the rules of proper OPSEC.
https://en.wikipedia.org/wiki/The_Moscow_rules
> Do not look back; you are never completely alone.
> Go with the flow, blend in.
> Vary your pattern and stay within your cover.
I read here that most of the Tor exit nodes are operated by governments and governments are using parallel construction to keep that information out of legal documents.
Reminds me of this guy who used Tor to send a fake bomb threat to his school but he was the only person on the whole campus connecting to Tor.
There were 4 people, but he confessed when questioned.
I guess the lesson there is that if you don't want to be convicted of a crime, don't confess to a crime? They won't give you a lighter sentence for confessing.
"...the only person on the whole campus connecting to Tor."
Talk about doubly stupid, first sending the threat, second using Tor on campus. I often wonder what goes (or doesn't go) through the mind of such people.
Blending in with the crowd doesn't work. If you use Chrome on Windows you're part of a very large group and "don't stick out". But it's also very easy to fingerprint so you're also part of the "theturtletalks" group with the size of one.
Not necessarily
https://news.ycombinator.com/item?id=46334951
There's a point where "privacy" flips into distinctiveness
Thank you, op, for bringing sanity to this whole thing.
Relatedly, this is why I think every "new" social media service that isn't Mastodon is barking up the most wrong tree with "take everything with you," you're essentially helping to build an even harder to erase social history.
Mastodon's individual server model, like email's, is better PRECISELY because each node is a point of "failure." That makes erasure easier. Which is good.
That's not true. Mastodon replicates all your posts to a bunch of other servers you don't control by design, which makes them harder to erase.
It's no worse than normal internet publishing, but it doesn't magically solve the erasure question.
Yep. And you still de-anonymise yourself with Mastodon when you buy hosting and a domain. If you use an existing provider, then you're back at square one and living in hope that the provider doesn't keep logs etc, or just decide they don't like you.
Nostr fixes both of these. So whilst you're at the mercy of relays storing your data, you can at least be anonymous.
No one owning your data isn't any better than everyone owning your data.
This seems like the wrong end of the system to fix the problem. Someone saying "we don't log your IP address" isn't something you can easily verify, so the promise doesn't mean much because if they suck they're just going to lie about it.
What you need instead is to make it easy and common for people to use browsers that resist fingerprinting, VPNs/Tor, custom email addresses per-account, etc. Because then instead of claiming to not log your information, they simply do not have it.
The biggest thing we need is a better way to pay someone over the internet without them knowing who you are.
"The biggest thing we need is a better way to pay someone over the internet without them knowing who you are."
I've been saying that for years. Buy a prepaid card for cash at say the supermarket with xyz value on it and a unique email address included (an anonymous debit card with email). That is every new card you buy would have a different disposable email address that would expire when the card is empty.
Such a scheme could also be used to donate micro payments to opensource projects, ad-free Youtubers, etc. and do so anonymously. Moreover, it would make payments easier thus overcome the "requires effort to do" resistance when it comes to donating. Making donating super easy would I reckon greatly increase the income for all those on the receiving end.
However I can't see it happening, governments would outlaw it claiming it'd be used to transfer money for nefarious purposes, money laundering etc.
The major reason I don't donate to good/charitable causes is that I cannot do so anonymously.
Shame really.
> However I can't see it happening, governments would outlaw it claiming it'd be used to transfer money for nefarious purposes, money laundering etc.
I feel like it's too common for people to say "we can't have nice things because the government is run by a clutter of lummoxes" when they should be saying "we should improve society somewhat".
why not stuff wads of hundreds into collection boxes?
check if they accept zcash
> The biggest thing we need is a better way to pay someone over the internet without them knowing who you are.
What's the reason you don't want sellers to know who you are?
That would be like buying things in real life while wearing a ski mask and paying with cash.
What's the reason for the seller to know who I am?
Any normal pre-total-surveillance store would've had zero issues selling me something for cash if I walked in wearing a ski mask.
> The biggest thing we need is a better way to pay someone over the internet without them knowing who you are.
Cryptocurrency?
That's what I thought. I think an open source crypto payment gateway that "just works" could probably make it more prevalent. (Is there any?)
If it was made easy and common for ordinary people to use.
"Please unblock challenges.cloudflare.com to proceed."
talk about anonymity but uses cloudflare. you threw away your tls and allow cloudflare to sit in the middle of the user and your web page. you're a hypocrite.
Hypocrisy is a moral failing but also a somewhat pedantic one -- has this person condemned these activities or merely lamented them?
@ybceo As long as you use Cloudflare to verify users [fingerprints] and traffic between users and your service is decrypted at Cloudflare side, I am afraid it difficult to take these anonymity claims seriously.
Please do not to rely on fingerprinters or CDNs that does TLS-termination for you.
There is no such thing as anonymity. With the number of bits required to ID a person and the fact that you are leaking such bits all the time you can simply forget about anonymity.
Many people online seem to think that they are anonymous and so were emboldened to do stuff that they might not have done if they had realized this. They continued to feel extremely good at this right up until the knock on the door.
> realized
Most UK and Australian writers would spell it "realised" so there's a bit right there.
Even if you include no personal information, there is information in writing style.
Stylometry is the study of this. Yes, there's also adversarial stylometry - distorting your writing style to fool an analysis. It's probably effective now, but that could change overnight and every archived post that every OSINT organisation has collected is deanomynised.
Yeah you can say "I change my style". But there's some bits that don't have false positives. If I EVER say "praise the omminsiah" I'm definetly au fait in 40k memes. If I ever say au fait I'm a person who has at least a rough idea of what it means. There's no false positive here, so if you can just find about 29 undeniable uncorrelated bits that are known to not have false positives ... a more advanced analysis could exploit this in a more continuous way (e.g. the likelihood of it being a false positive). I should shut up now.
"Stylometry is the study of this."
It's as old as history. In the days super-abbreviated telegrams (words were costly) you could even get two for the price of one--the author and the Morse code operator who actually sent the telegram. He could be recognized by his Morse fist, other Morse operators on the network would recognize him by the style of his sending even though they were only listening to dots and dashes,
Stop with that doom and gloom. You can absolutely be anonymous online if you want to and have some basic technical knowledge (every HN reader does).
I could try to prove it to you, but the only proof you need is that cybercrime exists and millions (or tens of millions) of dollars are stolen every day. If anonymity didn't exist it would be easy to stop this, wouldn't it?
They're not anonymous. They are just in places where the local authorities encourage their behavior.
Well there's anonymity from authorities, and there's anonymity from garden variety lunatics.
There exists a grey area between not getting away with nefarious activities, and not having your life ruined by a lynch mob because you didn't approve their preferred CoC on a hobby project or some other perceived injustice.
Is there? The government apparatus that's meant to investigate these crimes is the same one elected by the mob.
If you find yourself a member of any group a campaign can mobilize the mob against, that entire investigatory apparatus can be turned against you.
Without privacy, we are doomed to endless purity purges.
Maybe ironically - just going on the title because I can't read the rest as a result - it's behind a cloudflare gate.
Sadly, everybody using a browser from a massive ad company and an idp (not to mention a company with an interest in crawling the entire web for AI at the same time site owners are dealing with better scrapers) means the entire web will be login-only over time.
We're quite a few years into this period of technology. At a certain point, these "AI is going to kill the web!" predictions either need to come true or just be dismissed as false.
I don't see how those points bolster your conclusion. These pressures predate AI by over a decade and haven't forced a significant tidal change in the way the internet is used.
The irony is that the same companies pushing us toward login-only everything are also the ones best positioned to survive it
According to article, the whole authorization system is flawed. But we haven’t invent a new one and the one we’ve got never meant to be private, it is just a way to separate users from each other. We need something unique, a "primary key" for our DB, and that’s email or phone or username that has to be stored somewhere. A server, someone else’s computer, call it what you want. It has good privacy between users, but the admin can see everything, because otherwise management of the service would be impossible.
There is no anonymity, there is always someone you have to trust in the chain of WAN networking (DNS,ISP,VPN). If you want anonymity and privacy, you selfhost (examining the code is also a prerequisite). There is no other way to do it.
> but the admin can see everything, because otherwise management of the service would be impossible.
It depends on what service you’re offering. There are many cases where you can have end-to-end encryption so that you can know who your users are, host their data but cannot do anything with it.
Like security, the Internet doesn't tolerate half measures. You either have perfect privacy or none.
A lot of our intuitions about both are based on obscurity: nobody is interested enough to devote their lives to you. That's not the case any more. You are exposed to every person on the planet, and they have the tools to automate attacks on every single person.
That's not to say "give up", but we need to find a new understanding of how our lives work. It's like we're all hunter-gatherers who find ourselves instantly in the largest and fastest city, with nobody to teach us the ropes.
Which is kinda interesting because the only people I know without any internet presence are very old or, working for intelligence services.
Isn't the actual difference between privacy and anonimity that one indicates that the company knows who you are, but ensures this stays "private", and the other is about not knowing who you are?
Yes. Privacy and anonymity are both useful in different contexts. This article is just an ad for a service.
100%! Privacy and anonymity isn't the same thing.
The biggest risk to this business model isn't the government, but the payment processor. Anonymity makes it easy for unsavory characters to use stolen credit cards to buy your compute. The inevitable barrage of chargebacks will then cause Stripe to cut you off. Hell, if you're particularly unlucky, your payment processor might even cut you off proactively, if they decide that your lack of KYC makes you a risk.
This is where crypto comes in. Payment processors have excessive power over users. Even Valve was recently targeted.
Using digital money (fiat or non anonymoized crypto) exposes you. you can not be part of a legal business without doing that except accepting real coins, and even then you have fingerprints on it, or maybe they can scan the banknote id and trace that to an ATM, and so on. The only way to be absolute anonymous is stealing some hardware and trying to get it anonymously into some kind of infrastructure you dont own.
This is nowadays easier and cheaper then years ago because there are so many fuckdarts out there exposing their routers and dont give a shit about security.
And, also not very funny, those corps never tell in advance which data they "require". They grab my mail on "the first page" of the registration form. Then, on "the second page", they ask for my phone and my address. Should I decide to agree to this, they will finally tell me on "the third page", that they only support credit card, no PayPal, no direct payment via Bank ...
The PSF is the most recent org which did not get my donation due to this. https://donate.python.org/ X pages, I will not know in advance which of my data is required and which payment option is supported. All this could be on one page, I guess.
> Stripe customer ID and payment method ID Wouldnt this information allow for the authorities to just go to Stripe and ask the relevant information there? Sure, you don't store exact personally identifying info, but you store a breadcrumb that can lead whoever has the power to request that information to trace back to the end user
> And for those who need traditional payments? We support Stripe. Because pragmatism matters. But we don't pretend that credit card payments are anonymous. We're honest about the trade-offs.
I think this paragraph is clear enough about that?
>Here's how the average "privacy-focused" service actually works:
> ...
>5. Confirm identity for "fraud prevention" (now we have your ID)
I can't tell whether OP is being hyperbolic but it's certainly not representative of the average "privacy-focused" service I've came across. The typical service only asks for an email and maybe billing information (can be prepaid card or crypto). The only exception is protonmail, which might require SMS verification[1], but given the problem of email spam I'm sympathetic, and it's bypassble by paying. It's certainly not the "average" service, and no service asked to "Confirm identity".
[1] https://proton.me/support/human-verification
A phone number IS identity these days.
Yeah, so many places ask for phone number that don't really need it that I assume the phone number is a unique identifier used to combine individual's data across websites.
Most of the time I use a made-up 555 number or if it needs to send an SMS to verify, I'll use a free SMS numbers.
Not if you buy a SIM or eSIM anonymously. This is easy in the U.S. with cash in a store, or online (silent.link).
the only way is “anonymity by design”. history showed us that “don’t be evil” does not work if the entity can change its mind unilaterally.
be confident that the service is not keeping logs? JÁ!
The problem with this in our current society is that staying anonymous becomes your whole identity. I have a friend who for the longest time didn’t use Venmo, Uber, etc. because of privacy reasons, but the lifestyle was just not sustainable. Ultimately convenience killed privacy.
I guess those are just examples and there are much more significant things, because Venmo and Uber seem far from indispensable.
>Ultimately convenience killed privacy.
By design, unfortunately.
We have to choose where anonymity is worth the tradeoffs, but it's still quite possible to live without Venmo, Uber, etc.
So my understanding is, what Mullvad is to VPNs, and what Tarsnap is to S3 (kinda), Servury is to entire VMs. It's a prepaid model, you get an account identifier, and that's basically it.
This is very cool. I have wondered for a very long time why such a site does not exist. What pops to mind is that you could get better unit economics reselling really small VMs to the privacy obsessed. I know some netizens who would pay a dollar a month for, say, a tiny NetBSD VM and 64 MB of RAM to serve their tiny static demoscene website of yore. There are some real wizards of there.
Not sure if that's in your roadmap but definitely something to consider in this space.
"privacy" or not sharing your space with a creepy room mate, and reading the internet without adds ar3 parallel
running three flavors of the same off brand browser, each optimised for different segments of online content is what seems to be the minimum.
they are so desperate to sell me something, (a truck) that it's wild, as it is one of the few monitisable things I consistently look for (parts, service procedures), the , pause, when I do certain searches gives me time to predict that yes, the machinery is grinding hard, and will ,shortly, triumphantly, produce, a ,truck.
One difference with Mullvad is VPN traffic is ephemeral. Here, a VPS has a persistent disk attached, that could contain identifying information (if it is necessary to do useful work).
Even if you don't want to live entirely on the anonymous web, it's useful to see how many products claim privacy while being structurally incapable of delivering it
Glad I had to do a Cloudflare turnstile captcha to see this page
> If you use our servers for illegal activity, law enforcement can still investigate. They just can't start with "who owns this account" because we can't answer that question.
You're going to have a tussle with law enforcement, and you're going to lose. Your service will last < 2 years because you will not be able to afford the lawyers you need to defend against even one muscle move by the government.
Good luck!
Why? That's kind of the whole point of this: they can cooperate entirely and give them everything they have. You think they'll get into legal trouble because they aren't gathering data?
You ever heard of the phrase “show me the man and I’ll show you the crime”? These guys are gonna discover what that means really quickly.
No, this is a brilliantly original way to prevent legal action that has never been previously conceived of in the history of the internet.
Good old "we can't decrypt your laptop but we can repeatedly smash your head into the table until you start cooperating"
I've been beating this drum for years. The problem with signal and most other privacy ware is that they require you to effectively deanonymize yourself, typically by making you use a phone number to use their service. Knowing who someone is talking to is, in many circumstances, far worse than knowing what they're saying
> Knowing who someone is talking to is, in many circumstances, far worse than knowing what they're saying
How?
I go to court for knowing a drug dealer. That case goes nowhere.
I go to court for buying from a drug dealer. That's open and shut.
I'm not a CEO of a trillion dollar corporation or the president of anything. My privacy needs are far different from theirs.
It's why I'm so excited about Nostr, and apps built on top of it, like 0xchat: https://www.0xchat.com/
> "privacy" has become the most abused word in tech
Ideally, an argument about privacy would start with its notion of privacy.
https://en.wikipedia.org/wiki/Privacy#Conceptions_of_privacy
This was authored using an LLM, wasn't it. The style is unmistakable. Stop wasting our time with this slop.
I can't stand the style as much as the excessive use of hyphens. The "It's not just ..., it's ...." every 5 sentences is too much once you notice it. However, every LLM seems to converge on this style. It wouldn't wouldn't write like that if it didn't work to some degree, so maybe it knows something we don't.
Here's the thing. It's not just x, it's hyperbole y. Hyperbole. Y.
Yeeeep. I'm very disappointed because the subject matter is important.
thank you. absurd no other comments noticed
The blog post and homepage do a terrible job describing the product?
Wasn't Crypto recently revealed to be used by FBI (or similar) to track major criminals? They don't broadcast it, since they want people to continue thinking it's anonymous.
How do you accept crypto payments? Is there a Stripe style service that provides an API and/or payment portal? Id like to implement something for my SaaS but generally can't be bothered with crypto.
I like the idea of this but I'm a certain this article is AI generated.
Is that legal? I was under the impression that in europe hosting servers had KYC rules. I'm regularly getting emails by OVH asking me to confirm my name a d home adress.
Do you have a domain name registered with them? It may be just RDRP mandated by ICANN, not KYD.
A company talking big about privacy generally comes across as dishonest, and you'd have to get all the details right to avoid unleashing the Internet's wrath. It looks like you screwed up between the server logs and Cloudflare. Unfortunate, but it seems to me that it reflects a lack of experience more than ill intent (I do not have such experience myself either.)
Honest question, but did you add the Cloudflare proxy to solve an actual problem, or did you deploy it a priori without an actual justification?
I would much rather have privacy with e2e encryption than have anonymity. The way that works is a direct connection between two parties without use of a central server, like webRTC.
What I was wondering after reading the article: How does Mulvad actually decouple banking data from the account ID? Or is it as simple as verify transaction once but never log?
I think they remove the invoice after a month. You can also, send them cash in an envelope
So there's no subscription thing going on, you just manually pay invoices?
I once spent an entire year issuing chargebacks on AWS charges coming from god knows what AWS account. Most likely some client project I forgot about and didn't have the login to anymore, who knows. Makes me think about that - for a service where you can't login if you lose the credentials, how do you cancel a subscription? In my case I had to eventually just cancel the credit card and get a new number.
No subscription. It’s pay as you go. You top up $X and you get X months. That’s it. If your month expires, it expires. Just top off and you’re good to go.
You can pay with an envelope of cash, so they don't need your banking data to begin with.
Perhaps so, but that's damn difficult or very risky for all but a very select few.
Because you can't mail cash? Or it won't be delivered without a return address
It's a bit ironic the page is protected by Cloudflare. So, all of our traffic is going through some other company to log and track before it gets to you, eh?
I’m fine with no account recovery but they would definitely need a major warning about that at sign up time so users can take extra care to save their info.
tl;dr “Privacy” = the data is private i.e. only on your devices. Or if the raw data is public but encrypted and the key is private, I think that qualifies.
“Anonymity” = the data is public but not linked to its owner’s identity.
If you’re sharing your data with a website (e.g. storing it unencrypted), but they promise not to leak it, the data is only “private” between you and them…which doesn’t mean much, because they may not (and sometimes cannot) keep that promise. But if the website doesn’t attribute the data except to a randomly-generated identifier (or e.g. RSA public key), the data is anonymous. That’s the article.
Although a server does provide real privacy if it stores user data encrypted and doesn’t store the key, and you can verify this if you have the client’s unobfuscated source.
Also note that anonymity is less secure than privacy because the information provides clues to the owner. e.g. if it’s a detailed report on a niche topic with a specific bias and one person is known to be super interested in that topic with that bias, or if it contains parts of the owner’s PII. But it’s much better than nothing.
Europe is currently being tormented by this exact contradiction: on one hand, it has the GDPR—the world's strictest privacy law, supposedly protecting personal data; on the other, a flood of new regulations under the banners of "child safety," "counter-terrorism," and "anti-money laundering" are systematically strangling real anonymity.
The onion link for the site appears to be broken.
The very premise is false, privacy does mean something, and anonymity doesn't really exists. This is an advertisement.
I agree, privacy still means a lot. It's a term that's been co-opted by the large tech companies which operate with impunity. It will has meaning that cannot change.
The post also misunderstands privacy
> Privacy is when they promise to protect your data.
Privacy is about you controlling your data. Promises are simply social contracts.
I don’t know what’s wrong with these comments. This is the kind of smart design we want to see and everyone is doing nitpicking.
Can we have just better things or are we going to reject everything that’s not perfect and by doing so concede the whole point and just give up?
Well done OP for the right approach and your business. This has always been my design (when possible) to approach data security. When you don’t have data you don’t have to worry about its security.
Best of luck, ignore the naysayers.
it's 2025. chances are you had peeps in class/uni who are now in the Stasi networks of informants and/or in some more or less obscure agency or more or less related private company so your anonymity only works from birth and even then only if you are lucky or your family "gets it" and has resources and brains beyond.
some people believe supply chain attacks are rare and hard to pull off and expensive and only valuable in extreme cases but if you ever worked at a local delivery service or pharmacy or something other where people and the necessary machines are being aggregated in some basements or even backrooms for all use cases from all times for wholesale forgery and fiddling with people, you know that the situation is ugly, not bad. throw in the many coders, network engineers and hardware specialists with ties to above entities and bombaclat, Jahmunkey, we fucked!
#TheEconomicsOfPunchedDrugs #Automation #DataAnalysis #SituationalAssessment #HeyIsThatATurdNuggetAtTheTopOfThatPyramid
> Privacy is Marketing. Anonymity is Architecture.
But in order to read the article you need to enable JS. What a joke.
Exactly. I run sans JS by default. At least this warns me to either avoid the site or to take the risk (browser button--red for JS block, green unblock).
> That's not privacy. That's performance art.
Smells like it was written by an LLM so I stopped reading.
Good luck guys, you will surely attract the attention of Feds very quickly.
hyperbolic.
anonymity in your product could be a sensible design choice that your customers could value. fine. go nuts.
but in general? hard disagree. anonymity is fragile and can't be guaranteed, privacy is a legal obligation which can actually be enforced if push comes to shove.
also that page reads like slop : it's not X, it's Y. blah blah blah. this is a marketing piece trying to go viral.
LLM slop, Cloudflare, potentially lying about certifications, privacy hypocrisy...a pretty bad look.
Dude, disclose the AI writing; it has AI smells all over it, such as contrastive sentences.
AI generated article. What a slop.
How tf are you supposed to provide working authentication without storing the email somewhere? Should i just disable password resets and tell the users to fuck off if they forget theirs? Cant even use passkeys as they make users identifiable too.
How do passkeys make users identifiable beyond being a random token? I recall FIDO shared hardware key serial numbers with websites, but at least on Firefox, it prompts you to deny it.
In that case one could argue emails dont make users identifiable either, if the addresses dont contain any meaningful names
A passkey is always one per site. Emails tend to be naturally reused, unless the visitor uses a paid aliasing service (plus trick is trivial to canonize, having a dozen mailboxes on a self-hosted email still associates them with each other, because there's no anonymity set to speak of, and major email providers like Gmail won't let you register an account today without a phone number, credit card, or passport).
And yet your passkey and therefore app access is tied to a singular key connecting that with all the user info.
Users need to have hard memorization or record of a paraphrase, same as a crypto wallet. Or just use web3 for auth, that can work well if users have decent opsec.
That’s a trade off if you don’t want the service to know who you are
Is this a joke?
Nice ad you bought! Oh wait
Yet another promotional post of Mullvad team. Nice story, but I don't buy it.
Email is fine when it is an option. Mullvad have even option to pay with a credit card & PayPal. That's more sensitive data than Email.
[dead]
[dead]
Apparently neither does spelling. "anymore" -> "any more"
I didn't think anyone [not any one] could be more pedantic than I am. Damn it.
https://www.merriam-webster.com/dictionary/anymore
Anymore is a word though.
The battle on privacy/anonymity/whatever is lost. Get over it. What we need is a new social paradigm where everyone is happy despite the lack of privacy.
Please provide your full legal name (include any other names you go by), occupation and place of employment, phone number[s], email address[es], usernames on other social media accounts, eye color, height, weight, list of any health conditions. That's just to start, then we can start going over more info.
> The battle on X is lost. Get over it. What we need is a new social paradigm where everyone is happy despite the lack of X.
Where have I heard this before?
What's your definition of privacy?
Everybody says I should be ok having no privacy and yet frown upon me posting photos of the poop I take on Instagram.