8 ms·

Mullvad always seemed too good to be true. So that's why i'd won't use it if i'd had critical stuff to do. I do love Mullvad, but so aircrack-ng

kfreds 4y ago
Thank you for the compliment! We are indeed for real, but I don't expect this comment will convince you. I'd love to know what we could do that would change your mind. The same goes for anyone else reading this. Are you worried that we are too good to be true? What could we do to become more trustworthy in your eyes? Cheers, Fredrik Stromberg (cofounder of Mullvad)
- Fritsdehacker 4y ago
  I don't know. Disclaimer: just a happy customer. What I do know is that all you know about me is the account number you gave me and the IP address I'm connecting from. I always pay cash, so that would be hard to trace back. So I know you do the absolute maximum you can do to know as little about me as possible. As far as not keeping logs and not spying on me, I suppose I'll have to trust the audit reports. Not much more you can do in my opinion. It's definitely good enough for me! Thanks for this great service!
  - kfreds 4y ago
    > Not much more you can do in my opinion. It's definitely good enough for me! Thanks for this great service! Thank you. I happen to think there's a lot more we can do. Look forward to future blog posts. :)
- __turbobrew__ 4y ago
  My only feedback is that Mullvad is based out of Sweden which is a member of Fourteen Eyes. I don’t expect you to move your location but it is the only detractor I can think of.
  - kfreds 4y ago
    Thank you.
- throwaway92394 4y ago
  This isn't meant to be criticism just curious. Why did it take so long to add monero support? For the past several years there's only ~2 other VPNs that tick all the privacy boxes, and you're the most preferable - other then lack of monero support. It always seemed weird that you went so far for privacy, but didn't support monero. Was it just on the backlog and took a bit of time to implement? I appreciate that you built your own implementation for crypto by the way. Thanks for the great service. EDIT: I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Has this happened? I think according to your swedish-legislation page says "However, the Swedish police authority may have access to information by way of coercive measures such as seizure and search of premises." which would allow for this to happen in theory? I.E. intercepting or seizing control of your router to see what IP a connection is on? EDIT: One other question - is there plans to add more IPs? Services seem to flag most mullvad IPs but I'm not sure there's much you can do about that.
  - roastedpeacock 4y ago
    > Why did it take so long to add monero support? Some third-parties did sell gift-codes using Monero before Mullvad had native support although I had no experience with them. > I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Got any details? FWIW: Correlating the origin IP with real-time traffic out of a single-hop VPN tunnel can be done using traffic-analysis by third-parties that are not the VPN provider themselves.
    - throwaway92394 4y ago
      > Got any details? I do not - it's not an accusation, I have no evidence, just a rumor I was curious if they'd care to comment on.
  - kfreds 4y ago
    > Why did it take so long to add monero support? It always seemed weird that you went so far for privacy, but didn't support monero. Was it just on the backlog and took a bit of time to implement? I don't work with payments and the surrounding systems so I don't know the details of the project itself. As an organization we've certainly been aware of the feature request, but until now we've prioritized other projects. > EDIT: I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Has this happened? To my knowledge it has never happened in the history of our service. > EDIT: One other question - is there plans to add more IPs? Services seem to flag most mullvad IPs but I'm not sure there's much you can do about that. I'm sure my colleagues in the Operations and Support teams are aware of it. You'll get a better answer from support@mullvad.net.
- 0daystock 4y ago
  Paradoxically, the most trustworthy thing you could do as a VPN provider is explain why most people don't need and won't actually benefit from a VPN. Outside of a few limited use cases (accessing location-restricted content, connecting to legacy services) and with almost-ubiquitous end-to-end TLS encryption deployed on the Internet, there's really not a lot of good reasons to use a VPN (and many good reasons not to). Reasoning about this in a transparent and objective way is something I've never seen VPN providers do, and for this reason I struggle with trusting them.
  - __turbobrew__ 4y ago
    DNS queries are still leaked (from most users) regardless of end-to-end TLS. There is of course DNSSEC and DNS over HTTPS, but those are not used by the majority. Another use case you missed is downloading/uploading pirated/copywrited content. Good VPNs receive DMCA notices and throw them in the garbage. You are right that VPNs are not useful for many use cases and they can give users a false sense of security.
    - easrng 4y ago
      DNSSEC doesn't help privacy, it helps security.
      - __turbobrew__ 4y ago
        Yes you are right. I meant DNSCRYPT.
      - tptacek 4y ago
        You mean it helps record integrity. The "security" story with DNSSEC is much more of a mixed bag than that; there's a reason it's very rarely deployed in the industry. You're definitely right to point out that DoH helps with the VPN DNS privacy problem and DNSSEC doesn't.
  - kfreds 4y ago
    Thank you. I disagree with your assessment of the use cases for a VPN. Just one example: Your IP address is often a great identifier, making a VPN or Tor a useful starting point for online privacy. This is more or less what we say on our website as well. Based on your comment however I think you might find the follwing links to IVPN refreshing: https://www.ivpn.net/blog/why-you-dont-need-a-vpn/ https://www.ivpn.net/blog/why-you-dont-need-a-vpn/ https://www.doineedavpn.com/ https://www.doineedavpn.com/ https://github.com/ivpn/doineedavpn.com https://github.com/ivpn/doineedavpn.com

kfreds 4y ago

Thank you for the compliment! We are indeed for real, but I don't expect this comment will convince you. I'd love to know what we could do that would change your mind. The same goes for anyone else reading this. Are you worried that we are too good to be true? What could we do to become more trustworthy in your eyes? Cheers, Fredrik Stromberg (cofounder of Mullvad)

Fritsdehacker 4y ago
I don't know. Disclaimer: just a happy customer. What I do know is that all you know about me is the account number you gave me and the IP address I'm connecting from. I always pay cash, so that would be hard to trace back. So I know you do the absolute maximum you can do to know as little about me as possible. As far as not keeping logs and not spying on me, I suppose I'll have to trust the audit reports. Not much more you can do in my opinion. It's definitely good enough for me! Thanks for this great service!
- kfreds 4y ago
  > Not much more you can do in my opinion. It's definitely good enough for me! Thanks for this great service! Thank you. I happen to think there's a lot more we can do. Look forward to future blog posts. :)
__turbobrew__ 4y ago
My only feedback is that Mullvad is based out of Sweden which is a member of Fourteen Eyes. I don’t expect you to move your location but it is the only detractor I can think of.
- kfreds 4y ago
  Thank you.
throwaway92394 4y ago
This isn't meant to be criticism just curious. Why did it take so long to add monero support? For the past several years there's only ~2 other VPNs that tick all the privacy boxes, and you're the most preferable - other then lack of monero support. It always seemed weird that you went so far for privacy, but didn't support monero. Was it just on the backlog and took a bit of time to implement? I appreciate that you built your own implementation for crypto by the way. Thanks for the great service. EDIT: I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Has this happened? I think according to your swedish-legislation page says "However, the Swedish police authority may have access to information by way of coercive measures such as seizure and search of premises." which would allow for this to happen in theory? I.E. intercepting or seizing control of your router to see what IP a connection is on? EDIT: One other question - is there plans to add more IPs? Services seem to flag most mullvad IPs but I'm not sure there's much you can do about that.
- roastedpeacock 4y ago
  > Why did it take so long to add monero support? Some third-parties did sell gift-codes using Monero before Mullvad had native support although I had no experience with them. > I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Got any details? FWIW: Correlating the origin IP with real-time traffic out of a single-hop VPN tunnel can be done using traffic-analysis by third-parties that are not the VPN provider themselves.
  - throwaway92394 4y ago
    > Got any details? I do not - it's not an accusation, I have no evidence, just a rumor I was curious if they'd care to comment on.
- kfreds 4y ago
  > Why did it take so long to add monero support? It always seemed weird that you went so far for privacy, but didn't support monero. Was it just on the backlog and took a bit of time to implement? I don't work with payments and the surrounding systems so I don't know the details of the project itself. As an organization we've certainly been aware of the feature request, but until now we've prioritized other projects. > EDIT: I've heard a rumor that you've shared a user IP because of a government subpoena (live during a connection, so it wasn't logged). Has this happened? To my knowledge it has never happened in the history of our service. > EDIT: One other question - is there plans to add more IPs? Services seem to flag most mullvad IPs but I'm not sure there's much you can do about that. I'm sure my colleagues in the Operations and Support teams are aware of it. You'll get a better answer from support@mullvad.net.
0daystock 4y ago
Paradoxically, the most trustworthy thing you could do as a VPN provider is explain why most people don't need and won't actually benefit from a VPN. Outside of a few limited use cases (accessing location-restricted content, connecting to legacy services) and with almost-ubiquitous end-to-end TLS encryption deployed on the Internet, there's really not a lot of good reasons to use a VPN (and many good reasons not to). Reasoning about this in a transparent and objective way is something I've never seen VPN providers do, and for this reason I struggle with trusting them.
- __turbobrew__ 4y ago
  DNS queries are still leaked (from most users) regardless of end-to-end TLS. There is of course DNSSEC and DNS over HTTPS, but those are not used by the majority. Another use case you missed is downloading/uploading pirated/copywrited content. Good VPNs receive DMCA notices and throw them in the garbage. You are right that VPNs are not useful for many use cases and they can give users a false sense of security.
  - easrng 4y ago
    DNSSEC doesn't help privacy, it helps security.
    - __turbobrew__ 4y ago
      Yes you are right. I meant DNSCRYPT.
    - tptacek 4y ago
      You mean it helps record integrity. The "security" story with DNSSEC is much more of a mixed bag than that; there's a reason it's very rarely deployed in the industry. You're definitely right to point out that DoH helps with the VPN DNS privacy problem and DNSSEC doesn't.
- kfreds 4y ago
  Thank you. I disagree with your assessment of the use cases for a VPN. Just one example: Your IP address is often a great identifier, making a VPN or Tor a useful starting point for online privacy. This is more or less what we say on our website as well. Based on your comment however I think you might find the follwing links to IVPN refreshing: https://www.ivpn.net/blog/why-you-dont-need-a-vpn/ https://www.ivpn.net/blog/why-you-dont-need-a-vpn/ https://www.doineedavpn.com/ https://www.doineedavpn.com/ https://github.com/ivpn/doineedavpn.com https://github.com/ivpn/doineedavpn.com