Almost every non-cash payment leaves a paper trail. How does this compromise my VPN privacy? How does this relate to their resellers?

Let's say you know that I bought a Mullvad voucher, from first-party or third-party store. What would be your next steps you would take to get to know me?

A good selection of resellers is important because it allows users to choose where to put their trust. For example:

If you buy from the Mullvad reseller proxystore.de in Germany, you can go there in person and pay with cash. It's a real place.

Without such resellers, the only other way to pay Mullvad with cash is to mail an envelope to them.

Do you believe that every VPN service paid without cash (or maybe Monero et al) is inherently compromised? That would follow from your argument, right?

▲

potato-peeler 8 hours ago | parent [-]

Upto you how much you want to disclose. If I purchase directly from mullvad, only mullvad and my bank knows. If I purchase from amazon or other online retailers, now even amazon knows. God knows what they do with it.

▲

fwn 8 hours ago | parent [-]

Hmm, no. I think your worry requires a proper, explicit threat model.

It is also not "even Amazon" knowing about the sale. When you buy from a reseller using a non-cash payment method, you shift the link to your identity from Mullvad to the reseller. You are compartmentalizing the transaction to isolate the payment flow from the account registration. To stick with your example: If you buy from Amazon, you remove that payment information from Mullvad and add it to Amazon, a generic mass market online shop.

The reseller does not know if you will activate the voucher, and if you do, they don't know if you will activate it yourself or give it to someone else. Mullvad does not know the ID that might have been used to buy the voucher.

Having niche as well as mainstream resellers is also a good thing: Many users buy from Amazon all the time. For those people, being able to use Amazon means they do not have to add payment details to another store, which might result in an unusual payment compared to their usual purchasing behavior. For users not wanting to use Amazon, there is no harm in ignoring this specific reseller on Amazon.

Having the ability to use resellers adds privacy.

▲

potato-peeler 7 hours ago | parent [-]

I go by what I see. My purchase is only known to mullvad/proton and bank. Nobody else. If you are comfortable in announcing your intention to purchase a vpn to a third party which does not have the same privacy policy as mullvad, you do you.

▲

fwn 6 hours ago | parent [-]

No worries! I did not try to convince you of anything.

In your initial comment, you wrote:

> I don’t know why mullvad has this [reseller] arrangement, considering their promise.

We have now (briefly) talked about threat modeling, compartmentalization, linkability/observability, obfuscation, as well as having user choice regarding the shop.

So now you know why Mullvad has this reseller arrangements, considering their promise.

	▲	potato-peeler 6 hours ago \| parent [-]
		No, you have only convinced yourself. You disregard privacy policy of organizations you deal with. You have no audit reports of amazon or any other retailer to know what they do with your private and purchase information. Since you don’t have that, you are only hypothesising that 3rd party platforms will keep you safe. Therefore, arrangement between mullvad and their resellers are questionable. Like I said, you do you.