Comment by giobox | Hacker News Reader

Comment by giobox | Hacker News Reader

Parent Full thread

Serious question: how can we trust that any of these are "credible" as you put it? I'm reminded of the recent disclosure that a "private" Swiss software firm providing encryption software was owned by the CIA and had backdoors, and operated this way for nearly 50 years:

> https://en.wikipedia.org/wiki/Crypto_AG

> https://www.washingtonpost.com/graphics/2020/world/national-...

Personally, I just don't see how you can possibly trust any assurance offered in the current world? You are implicitly handing your private traffic to a third party black box and hoping it is as "private" as they claim. For 99 percent of customers I'm sure this is fine, but I would not be surprised in the slightest if we find out in the future one of these was run by an intelligence agency. We've already seen them take advantage of fake/compromised encrypted messaging apps.

For some threat models, that would almost be a good thing because if Mulled is a CryptoAG-style front, they aren't going to blow there cover on something trivial like a copyright lawsuit.

And an intelligence agency is not as willing to share their data as an ISP would be, so you pretty much still win over the status quo. Indeed, several ISPs were found to be sharing with intelligence agencies anyway, so by putting your traffic directly through them, you at least remove the ISP from the picture and the 50 other companies they would've also shared with.

>several ISPs were found to be sharing with intelligence agencies

In the US, I would suspect all of them. They ply you with multimillion dollar contracts. If you try to resist, they weaponize whatever they can against you. Consider the case of Qwest. After the CEO refused to work with the NSA, he was brought in on unrelated criminal charges: https://www.foxbusiness.com/features/former-qwest-ceo-joe-na...

You will be surprised. They don't only share data. They also modify it.

I don't think this should convince anyone but I just so happened to go to school with people who are now working there. That, but moreso the absence of bullshit, the experience so far, and the availability of reasonable payment methods makes me a happy customer.

As with anything relying on trust with a third party, one should definitely actively assess their individual threat models and risk profiles. It might be useful for parts of your traffic, not necessarily all

For outgoing, I also heard that proxychaining is a thing (which might not help you if collaborating actors compromised all obv)

Reply on news.ycombinator.com