Does paying anonymously really keep you anonymous?

VPN
1

Granted that, I have no illegal activity in mind or certainly not one that the police would take the effort to really get to my house, just for the sake of curiosity and understanding.

I see many people (if not almost everyone), that suggest you to:

  1. Set up Tor and access their website via Tor and redirect to the .onion site

  2. Buy it either with Monero or cash/cards.

And until now, I can see that yes, Mullvad has really no data about me. But, doesn’t it change immediately as basically “normal action” will be taken.

Examples:

  • It I use the VPN without Tor, they can see my real IP, hence my provider and can know who I am.

Perfect, let just use it always with Tor. Not practical, but let’s assume it.

  • As soon as I will log in to any personal related, they can identify me.

  • Or if used with a mobile phone, it automatically connect to lots of stuff you can’t (or it is hard) control, like email, social, chat, etc…there would be certainly something that will trace back to your real identity.

So, what’s the point? I mean, if you are a normal person that just care about his privacy but won’t do anything illegal (maybe torrenting aside?), for accessing blocked content, protecting public WiFi, etc… does it make sense the initial registration effort ?

It would be “that bad” paying simply with a Card ore something? What’s the drawback (long term, where my data would still be exposed, probably)?

Thanks.

2

So let’s give you this scenario.

You are a political dissident who needs to use a VPN due to risk of persecution. You sign in to whatever you need to access using your VPN. That service is located your country and stores your IP and data. What can alert a government that you’re using a VPN? Of course, connections to the VPN. But obviously your traffic and DNS requests are encrypted between you and mullvad. This obfuscates what exactly you’re up to, but as you correctly stated, anybody can see you’re using a VPN.

Where the secure payment comes into it is that if connection logs are ever requested, this doesn’t matter as much as it would with credit cards. Also, if VPN’s could make you a target in your country, it’s much easier to prove you intended to use a VPN if you have a credit card tied to your purchase, which directly associates you with it.

Let’s say I use express VPN, I have to pay using card and personally identifying info. Your government subpoenas them for all info. They know that you use the service, they know your email, your credit card details (real address) and they know your phone number. Plus, the whole reason you were on the radar in the first place was because the government monitored your bank account (which is perfectly legal in most places, sometimes without a warrant etc) and saw monthly payments to express VPN.

What happens if mullvad gets subpoenaed? They have 0 personal data that can be handed over because it doesn’t even exist. There’s also no trace you even owned the VPN (aside from having the mullvad app on your PC). It’s basically a way for you to plausibly deny you ever purchased a VPN, and it stops it being tied to you through financial transactions. Furthermore let’s say you live in a building with lots of people on the same IP. There’s no way to tell who’s using mullvad, unless they monitor the WiFi itself. Most of the limitations you discuss are limitations of VPN’s as a whole, not mullvad.

Most people make the mistake that public WiFi is insecure. This was true around 10 years ago but now 90% of the web uses TLS and DNS over HTTPS. The days of hackers being able to sniff your passwords are virtually gone, as most websites are encrypted. All a VPN does is create a slightly more secure tunnel that shifts the burden of trust onto the VPN.

VPN’s hide your location and DNS request, and some other things. There is little use for a VPN if you are just looking for encryption, this is standard across most of the web.

Tl,dr: anonymous payment methods mean that mullvad has nothing but your IP to hand over. This is much better than most other VPN’s that can associate it to you.

3

A VPN is only a more private way of accessing the internet if the VPN provider is more trustworthy than your internet service provider.

Mullvad does seem more trustworthy than most VPN providers and ISPs and, through policy, has much less information about you to begin with. However, it does all come down to trust for the reasons you describe.

I think part of the reason we see such a divergence of opinion is that ISPs in the US are legally allowed to collect and re-sell your data where as those in Europe are generally not.

4

Thank you very much for your thoroughful example.

But, isn’t your IP enough if your state want/try to persecute you? If I am not mistaken, VPN are somewhat known servers. If my ISP see all my traffic it is direct towards a certain server that it is used/owned by Mullvad, and so the State enforce Mullvad to give credential and gives my IP, isn’t that enough to prove I used that VPN and create me trouble, in you hypothetical scenario. If I payed with a Credit Card, sure, they would have owned also my personal info, but I don’t find it necessary, once my ISP identify that I am using a certain VPN, and the VPN can connect my IP to them, all my personal information could be easily asked to my ISP instead of the VPN.

Or am I getting something wrong?

5

So what happens when you pay with a credit card like my dumbass did?

6

While I thank you regardless, I don’t really understand how this answer my question.

I am already convinced that I would like to use a VPN, my question was about the payment options. Is it worth the trouble for paying anonymously if Mullvad can see my real IP, stuff where I log into and such, VS just pay normally with a Credit Card, Apple Pay or whatever’s?

7

They learn about privacy

That is something else I’d argue. Some people just don’t want to give their info to other parties.

You don’t need to have a threat model to want to have privacy or control over your data.

8

Thanks for the clarification. Your question seemed more general and not specifically about payment options. At step 2 you seemed to suggest that you would pay with Monero, cash or card. I took this to mean credit/debit card. Did you mean gift card?

To answer your question, the only advantage of credit/debit cards is that they are instant. It is quite convenient to pay by cash or gift card. Posting within Europe, cash takes less than a week to be credited to your account. Mullvad gift cards are available online and arrive in 1-2 days.

9

Oh no, fortunately I am not. I was just trying to understand different behaviors.

The all point of pain Monero, let’s say, it that I cannot be tracked. But…if my ISP know that I use Mullvad VPN, and my ISP has all of my data, I don’t really see much difference, if the State want to know me, it just have to ask my ISP my information. Because paying with a card doesn’t to anything harmful other than stating that I use that VPN, just like my ISP seeing traffic directed through it, right?

10

So basically, I can just easily pay it with whatever I want, unless I will have the will to really pay attention on everything I do and dedicate to it.

11

My bad if I made confusion with words, I wrote the post with the smartphone, I may have misspelled something :sweat_smile:

But is it worth it to use an anonymous payment method? That’s my question. Let’s say I will pay cash or with a gift card purchased somewhere. What are the benefit? I mean, as soon as I will connect to the VPN they will see my real IP, doesn’t it deny the fact that I payed anonymous?

I am just asking if using an anonymous pay option is it worth the trouble and (sometimes) the extra cost.

12

So, basically yes. You are confirming my initial idea. Unless I will not do some extra and constant procedure to keep me anonymous (like adding Tor, not log in/buy stuff with it, etc…) it basically makes no differenze if I pay with a card or cash?

As for theft I am fine, I generally use one time cards so they can’t charge more money onto it.

13

As you say, it is difficult to be truly anonymous when a service provider sees your IP address and every website you visit. However, I like that Mullvad don’t have my name, postal address or payment information.

14

Yep. I am.

I live with my partner so…yeah…there’s my name on the bill, and I pay it monthly with ma bank account automatically, so…