The Trust Problem with VPNs

With National Data Privacy Day approaching, I've been thinking about a fundamental contradiction in VPN privacy: every VPN asks you to trust them. But trust is antithetical to privacy. If you have to trust someone not to observe you, you don't have privacy—you have their promise. Here's a thought experiment: You've used a VPN for years because they promised not to keep logs. But how would you know if they were telling the truth?

The Promise Problem:

Every major VPN makes some version of "we don't log your activity." But these promises are, by design, unverifiable. You're trusting a company's word about what happens inside systems you can't see. Sometimes that trust is misplaced. In 2016, a VPN with a "zero-logs" policy provided detailed logs to law enforcement. In 2019, another disclosed a breach they weren't forthcoming about. In 2021, a provider was acquired by a company with adware history. The point isn't that these companies are villains. It's simpler: when privacy depends on trusting internal practices, you're accepting uncertainty most users don't appreciate. Policies can be violated. Companies get acquired. Jurisdictions issue subpoenas.

Policy vs. Architecture:

Imagine two hotels. At the first, management promises staff will never enter your room without permission. At the second, your room physically cannot be opened without your specific key—not by housekeeping, not by management, not by anyone.

Both offer privacy. But fundamentally different kinds. One is a policy. The other is a physical constraint.

Most VPNs operate like the first hotel. They promise not to look at your data, but their systems are technically capable of doing so. They're just promising not to.

What if the system itself made certain violations impossible—not because of policy, but because of how it was built?

What's Changing:

Two shifts matter. First, quantum computing's impact on encryption. Today's standards are secure against conventional computers, but quantum will eventually break many. NIST published post-quantum standards in 2024 for this reason. Sophisticated adversaries may be collecting encrypted data today intending to decrypt it later.

Second, passwordless authentication. Technologies like FIDO2 and passkeys are finally making passwords obsolete. Within years, typing passwords will feel as dated as carrying a Rolodex. Both shifts point the same direction: security moving from trust-based systems toward cryptographic guarantees. Privacy should follow.

Verifiable Privacy:

Privacy claims should be auditable and provable. They shouldn't require taking a company's word.

This is what we're building at Culper Systems. We call it "Verifiable Lattice Privacy Architecture" (VLPA). It's designed so that user identity and network traffic are cryptographically separated at the architectural level. Even with full access to the infrastructure—even if you were an engineer working inside our company—you couldn't correlate who a user is with what they're doing online. It's not a policy decision. It's a mathematical constraint engineered into the foundation.

The question shouldn't be "does this company promise not to log my data?" It should be "is this system designed in a way that makes logging impossible?"

When you rent a room with keys only you control, you don't need to trust management's intentions. You verify privacy by understanding how the system works. Digital privacy should offer the same possibility. The cryptography exists. The question is whether we'll demand systems that prove their privacy claims rather than just assert them.

Godot 4.6 Release

Complete Claude Code configuration collection

Computing with projected light: the folk computer

Java, the Domain Driven Cult

FlowLogix base-pom has more than 100 releases published

California Post brings brash New York-style tabloid news to the West Coast

JuiceSSH – Give me my pro features back

We Asked 300 People About Health Care Costs. The Numbers Are Shocking

Decompiling Xbox games using PDB debug info

Show HN: a Rust-based multimodal inference server

The Model T Comes to Silicon Valley

20M Rows Exposed: Security Audit of 107 YC Startups Using Supabase

Ask HN: Hosted LLMs to process personal data?

Certificate Transparency as Communication Channel

Robert Marchand (Cyclist)

How do you reconstruct what a financial system observed at time T, years later?

Tragic blimps, cooking mice, and epic penguins

WhatsApp falls under EU's strictest online rules

Data center power outage took out TikTok first weekend under US ownership

Exploring the Myers Diff Algorithm in ColdFusion

Show HN: Donkey Support –> Reply to Support Chats from Slack/Discord/Telegram

A Linux app that darkens your screen when you slouch

Silencing the Kinesis Advantage 2 (2022)

A Complete Guide to Neural Network Optimizers

Categories of Inference-Time Scaling for Improved LLM Reasoning

What Your VPN Knows About You (and Why It Matters)

The Devastating Decline of a Brilliant Young Coder (2020)

IIFE for Complex Initialization

The Rise and Fall of the American Monoculture

Reetcode: Extension to add LeetCode style features to Rosalind

Introducing AgentKit – a production-ready starter for building real AI agents