3

VPN providers can end accounts which violate their terms of use. If you look at https://nordvpn.com/terms-of-service/ for example, you see that they will terminate accounts violating their ToS. The same is for other providers.

How do they know you are violating their ToS when "nothing is logged"? That's contradicting as hell. According to a well known comparison chart, some providers which are serious about privacy are Nordvpn, IVPN and BlackVPN.

I am not planning to violate their ToS, but I am very sceptical about privacy in general.

|improve this question|||||
  • 3
    You are confusing "monitoring" with "logging" – schroeder♦ Jun 20 '16 at 12:30
  • 1
    I'm afraid you are incorrect, and the difference is important. It is also important to understand what they mean when they say "logging". Of course every single VPN service has to monitor. How will they know if the service is down? How will they plan for capacity? If you read "no logging" and you interpret that to mean "no knowledge", that that's an error of interpretation. – schroeder♦ Jun 21 '16 at 9:06
  • 1
    It's important to note that DMCA safe harbors require that a service provider adopt a policy to terminate service for subscribers and account holders who are repeat infringers in order to qualify. This policy doesn't have to be effective or practically enforceable, but it does have to exist. – Reid Rankin Jul 4 '16 at 5:47
-3

You're right, if they really do not log anything, it's impossible. There could be two reasons for this:

  1. They do actually log something

  2. It's just for legal reasons.

Personally, I'd be wary of such contradictions, but ymmv.

|improve this answer|||||
  • 1
    The linked ToS mentions 'scanning'. It is very possible to terminate a connection (and flag the account) for scanning, while not logging the traffic. – schroeder♦ Jun 20 '16 at 12:40
7

I see two possible uses for this even with logging disabled:

  1. A user violates some other part of the ToS, for example by paying for their account using a stolen credit card.
  2. An operator of a website which is targeted by a user's illegal activities contacts the VPN provider, and the VPN provider sees that the connection to that website is still open so it can determine which account is responsible for it and take appropriate action.

Additionally, even if they've never intended to use the clause, they'd probably still have included it as this kind of clause seems pretty much standard across any kind of ToS.

|improve this answer|||||
7

Claim to "not log" is not the same as "not monitor connections". First is saving traces, second is analyzing activity when it happens, that does not necessary generates logs.

However, while not totally clear, I understand they claim to not monitor too:

NordVPN does not monitor, store or record logs for any VPN user.

They do not monitor logs (since this is written in their Logging Policy) or connections? Maybe depends on who is asking :)?

|improve this answer|||||
  • Not a legal, but I think that sentence literally means "we don't monitor or store logs", so they're free to monitor network traffic without using logs. – A. Darwin Jul 3 '16 at 18:42
3

I am the CEO of a real no Log VPN service. Here is how I would do it without violating a no log policy. I would create Layer 7 filters on the firewall that would pattern match abusive traffic in real time and then mark the matched packets. Once you have the abusive packets marked you could login to your router or WAF and monitor the marked traffic. From there you will have the source IP and you can use something like the OpenVPN management console to associate the source IP with a username all without a single log.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.