[charcircuit]

I think you are misreading his comment. He is saying that on a VPN it is standard behavior that if you visit site A and site B they will both see you connecting from the same IP and can infer you are potentially the same person.

[fragmede]

Site A and B have to collude in order to make that inference. Outside of Cloudflare, no one is colluding at that level.

[camgunz]

Plenty of people own more than one website. You're also forgetting about random site assets like web fonts, CSS, JavaScript CDNs, etc. etc.

[antonvs]

That would only be true if there were no ad networks.

But today’s internet is essentially a giant ad network.

[jorvi]

Then he is using the wrong terminology.

Privacy = hide what I am doing

Anonimity = hide who I am

If site A and site B share some backchannel, then they can share what I was doing on their site, but aside from "this person is on Mullvad endpoint A1", they can't infer who I am[0]. To those sites, I am anonymous but not private.

On the other hand, to my ISP, I am private but not anonymous. They can see a tunnel originating from my home IP to Mullvad, so they know exactly who is connecting to Mullvad. But they don't know what I am doing inside that tunnel or where it leads beyond Mullvad.

That is the whole crux of a public VPN. The ISP doesn't know who to tell who I am, and the sites (and other terminating IPs) don't know who to tell what I'm doing, because the VPN breaks the chain in both directions.

So, if you torrent a movie illegally, the movie studio can only send an angry letter to Mullvad about someone on endpoint A1 torrenting their movie at 22:34. If it were possible for them to tell your ISP that you downloaded something illegally (privacy, the what), your ISP would have to give your address to the movie studio for a settlement fine (anonimity, the who).

It is kind of hilarious I am at -3 when parent is still in the positive, when he is so utterly wrong. But that's modern HN for ya.

[0]Fingerprinting obviously can throw a spanner into that, but that has nothing to do with the VPN. And it can be mitigated.