0

Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) claims (accessed here 2021-05-16)

Exceptional Privacy ... our no-log policy independently audited.

and then (at least honestly) admit (accessed here 2021-05-16)

...only collects a minimal amount of information when you connect over our VPN product (VyprVPN), and only retains it for a period of 30 days. We retain:

  • Customer’s source IP address (generally the IP address assigned by the customer’s ISP)
  • VyprVPN IP address used by the user
  • Connection start and stop time
  • Total number of bytes used

Wouldn't keeping time, source and target IP address make the user's online activity quite transparent (aka "log files" in their genuine meaning), and in clear contradiction (at least for 30 days) to a "no log" policy?

0

2 Answers 2

2

There are many different things that could possibly be logged. They are certainly able to define things how they want for advertising purposes; it sounds like while they log the who and when, they don't actually log what sites you are visiting (which is probably the privacy concern for most users). However, "no-log" would probably imply to most that absolutely zero logs for anything are kept, which is clearly not the correct interpretation here.

1
  • ... i.e. the VPN provider cannot tell sites visited by a user, but in case being asked "(VPN-provider based IP) visited this site - what real user IP was it?", within 30 d the user is not protected by inability of the VPN provider to answer (as "no log policy" implies), but only by hopefully not willing to answer, and possibly a high(?) number of users with the same(?) VPN-provider based IP address in parallel. This would be well acceptable for me, but I am concerned that information being unclear does not stop here.
    – Martin
    May 16, 2021 at 14:49
2

There is no "definition" of what logging in terms of a VPN covers or not covers. There might only be an expectation based on whatever information (like marketing), but expectation is not definition. VyPrVPN itself offers a more detailed explanation itself what they mean. From Our Commitment to Our Users:

... we don't track or retain any user activity while connected to our service

So, this is about user activity. And it is about the activity while connected. This can be read as the information of when a user connects and disconnects are not covered by this, since this is not while being connected.

The linked audit provides another perspective right at the very beginning in their Executive Summary:

... no Personally-Identifiable Information (PII) about customers with respect to their use of the service are logged by Golden Frog except as required for business operations. ... Connections are logged during authentication, but logs that could identify users are kept only for a short time

Accounting the use of the service at this level might be considered as required for business operations, i.e. tracking the use and potential abuse at a very broad level.

But I agree that their marketing of "We don’t log data" might lead to the wrong expectations. And this might even be intended. But, data (traffic) is not the same as meta data (login, logout, ...).

In other words: when in doubt what some phrase actual means, just consider that it does not mean much by itself and that one should use additional information to find out the details. While not always true at least in this case these detailed information are also easy to find and access. And also: don't believe marketing too much. They might not lie but they likely don't give comprehensive information either and might even hide relevant details in order to look better.

1
  • Yes... "No log" is not the same as "only some logs", and the policy is obviously NOT to not "track or retain any user activity". I believe security starts with a precise language.
    – Martin
    May 16, 2021 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .