8 ms·

Review of Mullvad VPN

476 points by ylk 2y ago

klysm 2y ago
I'm convinced signal handlers are nearly impossible to write without introducing terribly gnarly race conditions.
- BoingBoomTschak 2y ago
  The presence of signals in UNIX made me reach the following conclusion: event loop should be mandatory (or at least opt-out), something setup in the CRT before main(). Of course, we're not living in such a well-made C world.
- ComputerGuru 2y ago
  If you’re lucky enough to structure your entire app in advance to keep in mind how sync signals are delivered, you can ususllly get away with only setting an atomic Boolean, incrementing an atomic int, or setting a binary semaphore.
LeoPanthera 2y ago
The Mullvad VPN app. Not the service.
- Always42 2y ago
  Thanks for helping me not waste my time
- promano 2y ago
  There was an audit of the VPN servers earlier this year: https://mullvad.net/en/blog/fourth-infrastructure-audit-completed-by-cure53 https://mullvad.net/en/blog/fourth-infrastructure-audit-comp...
- mplewis 2y ago
  This is relevant to folks evaluating VPN providers as the app is most users' entrypoint to the service.
  - gpvos 2y ago
    Of course, but that doesn't make the title less misleading.
ylk 2y ago
Link to Mullvad's blog post: https://mullvad.net/en/blog/the-report-for-the-2024-security-audit-of-the-app-is-now-available https://mullvad.net/en/blog/the-report-for-the-2024-security...
aftbit 2y ago
Direct link to the PDF report: https://x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf https://x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-... Titles of issues they found: 4.1.1 MLLVD-CR-24-01: Signal Handler’s Alternate Stack Too Small 4.1.2 MLLVD-CR-24-02: Signal Handler Uses Non-Async-Safe Functions 4.1.3 MLLVD-CR-24-03: Virtual IP Address of Tunnel Device Leaks to Net- work Adjacent Participant 4.1.4 MLLVD-CR-24-04: Deanonymization Through NAT 4.1.5 MLLVD-CR-24-05: Deanonymization Through MTU 4.1.6 MLLVD-CR-24-06: Sideloading Into Setup Process All pretty straightforward IMO. They lean on "DAITA" aka Defence against AI Traffic Analysis pretty heavily, which I don't fully understand yet, but is probably worth some further reading. https://mullvad.net/en/vpn/daita https://mullvad.net/en/vpn/daita
- daghamm 2y ago
  I think the paper is easier to follow https://dl.acm.org/doi/pdf/10.1145/3603216.3624953 https://dl.acm.org/doi/pdf/10.1145/3603216.3624953
- ratorx 2y ago
  Safe signal handling has so many footguns that it seems worth re-considering the entire API. Even OpenSSH has had issues with it [1]. It seems very difficult to build good abstractions for it in any programming language, without introducing some function colouring mechanism explicitly for this. Maybe a pure language like Haskell could do it. [1]: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server https://blog.qualys.com/vulnerabilities-threat-research/2024...
  - jandrese 2y ago
    Or it's nearly impossible for a pure functional language if the result of the async signal means you need to mutate some state elsewhere in the program to deal with the issue.
    - ratorx 2y ago
      I think that’s slightly orthogonal. It would still be safe, because you’d design around this restriction from the start, rather than accidentally call or mutate something you were not supposed to. The problem with safe signal handling is that you need to verify that your entire signal handler call stack is async safe. Assuming purity is a stronger property, signal handling is a safe API without any more work. The inflexibility due to the purity might cause other issues but that’s more a language level concern. If the signal handling API is safe and inflexible, it still seems better for a lot of use cases than an unsafe by default one.
runjake 2y ago
dang "X41 audited the Mullvad VPN app" might be a clearer title.
- deleted 2y ago
  [deleted]
rfoo 2y ago
> Virtual IP Address of Tunnel Device Leaks to Network Adjacent Participant > X41 recommends to mitigate the issue by setting the kernel parameter arp_ignore to 1 on Linux. > It is also recommended to randomize the virtual IP address for each user on each connection if possible. ... isn't randomizing the virtual IP address makes the situation worse? sounds like the best solution would be just give every user the same boring static IP address like 169.254.199.1/30.
- Aachen 2y ago
  Worse how?
- kdmtctl 2y ago
  For each session. Keys are rotated frequently, so a lot of noise could be produced. The only and one address is a good strategy for anti fingerprint though, but it is not easy to achieve for WG tunnels and pure L3 routing. Personally I don't really get their multi hop when you connect on a predefined port on an ingress server to get redirected to egress in a different region. Easy guessable for a powerful observer. Anyway any VPN is only an encryption tool, not an anonymizer.
  - rfoo 2y ago
    A key selling point of WireGuard is it can roam between networks very well, without interruption to the connections within tunnel. Rotating IP address once you roam to another network (or just flaky wifi) ruins this.
ziddoap 2y ago
This is a nice audit report. The dedicated threat model section is something that a lot of auditing outfits skip over in their reports. While I'm positive Cure53, Assured, and Atredis (the previous auditors) established an appropriate threat model with Mullvad prior to engagement, it's not explicitly written out for the reader, which opens up room for misinterpretation of the findings.
- wutwutwat 2y ago
  > established an appropriate threat model with Mullvad prior to engagement Doesn't this make it kinda pointless? If the target has a say in how they should perform their audit/attack, how does that not produce results biased to the targets favor? Wouldn't the most unbiased way to do such a thing would be for the target to have zero idea what the auditor would be doing? > which opens up room for misinterpretation of the findings If Mullvad dictated how to do things or imposed limits on the reach of the testing, the results are worthless anyway
  - palata 2y ago
    Say I manufacture door locks, and I ask you to audit the security of my system. Wouldn't it make sense to agree with you that stuff like lockpicking is fine, but going around the building, breaking a window and entering the room doesn't count as "breaking the lock security"? That's the whole point of a threat model: Mullvad has a threat model, and they build a product resistant to that. When someone audits the product, they should audit it against the threat model.
  - ziddoap 2y ago
    >Doesn't this make it kinda pointless? To do an audit you have to audit against some sort of pre-established criteria. That is how audits work. In security, that will typically be a standard (or set of standards) alongside a threat model. In finances, you audit against what is legal in the areas you operate. >[...] zero idea what the auditor would be doing? That's a practical impossibility. From the client side you want to be able to evaluate quotes, stay within a budget, etc. You don't want to pay good money (audits are really expensive!) for areas that you are works-in-progress, or non-applicable threat models (e.g. lots of security software explicitly does not protect against nation-state actors, so they don't do audits from the perspective of a nation-state actor). From the auditor side, you want to know what staff to assign (according to their expertise), how to schedule your staff, etc. >If Mullvad dictated how to do things or imposed limits on the reach of the testing, the results are worthless anyway Not at all. The company says "This is the set of standards we are auditing against and our threat model. This is how we performed". The results are useful for everything covered by those standards and threat model. By explicitly stating the threat model, you as a consumer can compare your threat model to the one that was audited and make an informed decision.
puffybuf 2y ago
I use mullvad VPN with wireguard on OpenBSD (man wg). Works great. You can buy months with bitcoin for anonymity.
- chucknthem 2y ago
  Became a fan of Mullvad when I visited China. It was the most reliable VPN app I tested and you can have up to 5 devices per account.
  - whoistraitor 2y ago
    It is probably the most reliable yeh, tho spending time here I’ve grown increasingly aware that the great firewall is more than aware of this vpn traffic, even if it’s wrapped up to look like normal traffic. They periodically will seem to ‘dial down’ the internet, especially at politically sensitive times. They are fully aware great swathes of the populace and visitors use VPNs, and they choose to allow it. They’d rather control and monitor than inspire even more opaque channels.
- antihero 2y ago
  Even if you buy it with BTC surely you're still connecting with your real IP?
  - nexoft 2y ago
    not if he is using his neighors maybe he is using tor on top of it who knows
    - btmiller 2y ago
      I’ve never understood the neighbor approach. What’s the logic for that? Instead of your skin, it’s a person one door down from you, that was generous enough to share their connection with you? That’s not anonymity, that’s just outsourcing the identity to someone that probably extended trust to you. And if other things like Tor remove that connection, then what was the point of using a neighbor in the first place?
accidbuddy 2y ago
Is there any serious website that reviews (rank list) these VPNs? I say this because it is always difficult to find information that is not sponsored on the internet. In fact, I've always heard that Mullvad is one of the best, even supporting P2P
- vigilans 2y ago
  You heard wrong. Mullvad is the best ;)
- ThatMedicIsASpy 2y ago
  Port forwarding was removed a year ago which handicapped P2P. https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
- npteljes 2y ago
  The go-to used to be the website of "that one privacy guy". Now, on who is this guy, and whether this is really his site, I have no idea. https://thatoneprivacysite.xyz/#detailed-vpn-comparison https://thatoneprivacysite.xyz/#detailed-vpn-comparison
  - crossroadsguy 2y ago
    > (Data last updated on 20/07/19)
  - rsynnott 2y ago
    I mean, if you knew who he was, he wouldn't be a very good privacy guy, now, would he?
    - npteljes 2y ago
      I get what you're getting at, but no, in hindsight, I like my privacy and security watchdogs to be transparent. Like Bruce Schneier. And for a counterexample, Satoshi. I lost my trust in anonymous randos, for authenticity, I like someone with a professional face and contact info.
mmooss 2y ago
Where does Mullvad get all this money? I've seen physical ads in different places in the world, audits, etc. I'm not suggesting a conspiracy, but is the VPN business that good? Are they funded by a privacy group?
- kdmtctl 2y ago
  They provide white label for Mozilla, Tailscale and may be some others I am not aware of. Plus they really sell a lot of subscriptions.
  - nikcub 2y ago
    and they've been accepting bitcoin since 2010. I assume they've done very well from that (I'm afraid to calculate what the present value of my mullvad subscription would be)
    - nly 2y ago
      Why would they have done well? they likely use a payment processor who dynamically price their € fees in Bitcoin and immediately liquidate all Bitcoin received.
      - Tiberium 2y ago
        They run their own full nodes for each blockchain they support, so I highly doubt they cash out crypto that often.
  - rsyring 2y ago
    Nit: they have a partnership with Tailscale to offer the VPN as a part of a tailnet that subscribes to the service. But, it's not white label. White label implies it would be Tailscale VPN (or similar) with no reference to Mullvalad in their docs or marketing. But that's not what is happening with their offering.
    - kdmtctl 2y ago
immibis 2y ago
This seems to be mostly a test of the VPN client application, not the VPN service. However, "Deanonymization Through NAT" is about the VPN service.
tptacek 2y ago
I was going to go on a little rant about public audit reports that say stuff like "this company is very secure and is doing things great and this audit confirms that" --- not at all an x41-specific complaint, virtually all assessment firms are guilty of it, some much more than x41. But: they found a triggerable heap corruption vulnerability in a Rust program, which is a nice catch. I do think giving the vulnerability that follows that one a sev:hi, despite it being both theoretical (I don't think they have a POC) and not corrupting memory, is grade inflation though.
wkat4242 2y ago
Mullvad used to be great. But their stopping port forwarding makes torrents much worse. Their deprecation of openvpn sucks for me too. I have a couple usecases that need that. So I'm going to move to another one. Too bad because they were good for a long time.
- deleted 2y ago
  [deleted]
- 2OEH8eoCRo0 2y ago
  I miss them and had to move elsewhere due to the discontinuation of port forwarding.
  - wkat4242 2y ago
    Yeah it's a really important feature for many people. Torrents just don't really work without it. Three quarters of peers are behind NAT or VPN so without port forwarding they won't connect. If you have some Torrents with only a handful of seeders it makes it really difficult.
    - deleted 2y ago
      [deleted]
    - palata 2y ago
      Doesn't BitTorrent do some NAT traversal stuff? Genuinely interested.
      - wkat4242 2y ago
        Not really no. If both peers are behind NAT they just can't connect. There's no central server to facilitate hole punching.
    - zo1 2y ago
      With the availability and ease of use of Seed boxes, this feature is kinda moot. It doesn't even cater to power users any more because they've all moved to seed boxes a really long time ago. This just leaves semi-serious individuals that want to take the risk of torrenting on their private internet connection.
scdnc 2y ago
My only problem with Mullvad is that you get a lot more captchas and blocks from websites than you get from other VPNs.
- switch007 2y ago
  It's been bad for me lately. Basically persona non grata Many captchas are just bans but they are hoping for some free training
  - zahllos 2y ago
    A lot of their endpoints are rented or hosted from ASes that are well known, e.g. M247 Ltd. If I wanted to vastly reduce annoying VPN traffic, I'd simply block these ASes as well. That's likely the cause of these. There isn't a lot Mullvad can do about it. Not all providers of hosting are willing to tolerate VPN endpoints in the same way they don't like hosting tor exit nodes.
    - switch007 2y ago
      Yeah I made sure to avoid those
  - immibis 2y ago
    hCaptcha seems to be increasing in popularity, have tasks that actually stump current bots, and not discriminate by IP address. reCAPTCHA is the GoDaddy of CAPTCHA services. It doesn't achieve its purpose and the CAPTCHA task is often just a time waster. It's already decided whether you're a bot or not - which is not based on your mouse movements, but rather your IP address reputation and whether you're signed into Google. It only still exists because of brand inertia. I'd like to see a Google executive put before Congress and forced to complete a reCAPTCHA over Tor.
- jijijijij 2y ago
  Youtube and Reddit are the worst. I am pretty convinced the aggressive blocking is not because of abuse, but because VPNs actually have become a problem for tracking and data mining. I have the suspicion the IP blocking is somewhat coordinated between Youtube and Reddit, to maximize annoyance and discourage VPN usage, since I frequently find exit server working for either one of them, but not both. Disrupting the ping pong of social media for VPN users, seems like an effective strategy to influence their behavior. And since they are natural monopolies respectively, they hardly risk alienating anyone doing so. Similar to how cookie banners are abused to modify people's sentiment on privacy regulations in favor of data mining. Even many tech people believe annoying cookie banners are the EU's fault, when common practice is either malicious compliance, unwarranted or straight illegal. That said, it is actually fucking annoying. Then again, just a nuance in the greater enshittification and rapidly growing dissatisfaction with the web overall for me.
simonebrunozzi 2y ago
VPNs are a great business these days, but I don't feel that they treat their customers properly, or that they're transparent about what they provide. My sense is that there's a lot of BS going on. Including the fact that "cool" VPNs are supposed to be coming from Scandinavian countries (but most of them aren't).
- bjoli 2y ago
  I am a happy mullvad customer since about 5 years. I find it somewhat reassuring that they are not spending a gazillion dollars advertising on YouTube or affiliate websites. And of course prefer that they are in a jurisdiction that isn't a haven for shady companies. In short: I like them because there is little bullshit and they seem to be OK. I don't think I could ever trust PIA or all of those companies.
  - SwiftyBug 2y ago
    They certainly spent a gazillion dollars advertising on every billboard and subway car in Manhattan.
    - bookaway 2y ago
      Yeah, this sort of stuff seems incredibly short-sighted. It gives me queasy "methinks the lady doth protest too much" ExpressVPN vibes.
    - bjoli 2y ago
      I didn't know about that, but they have this to say about it: https://mullvad.net/en/blog/advertising-that-targets-everyone https://mullvad.net/en/blog/advertising-that-targets-everyon... I never said I was against their AFK advertising. The EU chat control advertisement was great. The NYC stuff is pretty meh. Advertisement is was on my brain. I mostly treat it like that. I just find it weird that there seems to be so many companies spending a seemi gly infinite amount on affiliate advertisement (through bought reviews) and on influencer ads.
- evantbyrne 2y ago
Beijinger 2y ago
I have never use Mullvad VPN but I can give two recommendations: If money is no concern, use Astrill. Easy of software, number of countries, GFC, circumvent geoblocking, it is one of the best, if not the best, but it comes with a big price tag attached. I think 300 USD/2 years if I remember correctly. If you don't need the best, AirVPN has often deals for 50USD/2 years. But the servers are very "spammy" (tons of captchas for you to solve).
- phartenfeller 2y ago
  Why do you think Astrill is one of the best? And why do you think it is better than Mullvad? I trust Mullvad because it does security audits like this. And it stores no data and has a history of police showing up without any data compromised [1]. [1] https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...
  - Beijinger 2y ago
    Astill works on most OS, software is extremely slick, has many servers, at my time even Mainland china IPs were possible. Works reliable in China, is often NOT detected as a VPN (geo-blocking, Banks, captchas). They even offer fixed IP addresses, if desired. If you ask why would you have a fixed ip address and if this does not contradict the idea of a VPN you may have little international experience and don't understand the different applications of a VPN. Hey, there may be people that give a f... about the privacy it offers because they have totally different applications. If you want a Mercedes of VPNs, likely Astrill is the choice. If privacy is your main concern, there are many options. Dont mistake privacy for anonymity. If in doubt, pay with Bitcoin and use TOR to connect to your VPN. For my current application, AirVPN is more than enough. Two years: are 79 €, if they have a special, it is 49 euro. If you are cost sensitive, Mullvad is double the price already, but at least only less than half of the Astrill price.
    - akimbostrawman 2y ago
      >If privacy is your main concern, there are many options. Dont mistake privacy for anonymity. There main slogan is "Fast, Secure & Anonymous VPN" meanwhile they require name and email unlike Mullvad which pioneered the concept of random account IDs for login years ago. >If in doubt, pay with Bitcoin and use TOR to connect to your VPN. Bitcoin is not and never will be private or anonymous. Use monero or cash.
seanw444 2y ago
It's nice to see confirmation that Mullvad isn't smoke and mirrors. It's the only VPN I use. It's pretty much guaranteed that if you go looking, you're going to find vulnerabilities. They took it seriously and fixed it immediately, which is reassuring. I'll continue using Mullvad.
Kurtcheng 2y ago
[dead]

476 points by ylk 2y ago

klysm 2y ago

I'm convinced signal handlers are nearly impossible to write without introducing terribly gnarly race conditions.

BoingBoomTschak 2y ago
The presence of signals in UNIX made me reach the following conclusion: event loop should be mandatory (or at least opt-out), something setup in the CRT before main(). Of course, we're not living in such a well-made C world.
ComputerGuru 2y ago
If you’re lucky enough to structure your entire app in advance to keep in mind how sync signals are delivered, you can ususllly get away with only setting an atomic Boolean, incrementing an atomic int, or setting a binary semaphore.

LeoPanthera 2y ago

The Mullvad VPN app. Not the service.

Always42 2y ago
Thanks for helping me not waste my time
promano 2y ago
There was an audit of the VPN servers earlier this year: https://mullvad.net/en/blog/fourth-infrastructure-audit-completed-by-cure53 https://mullvad.net/en/blog/fourth-infrastructure-audit-comp...
mplewis 2y ago
This is relevant to folks evaluating VPN providers as the app is most users' entrypoint to the service.
- gpvos 2y ago
  Of course, but that doesn't make the title less misleading.

ylk 2y ago

Link to Mullvad's blog post: https://mullvad.net/en/blog/the-report-for-the-2024-security-audit-of-the-app-is-now-available https://mullvad.net/en/blog/the-report-for-the-2024-security...

aftbit 2y ago

Direct link to the PDF report: https://x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf https://x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-... Titles of issues they found: 4.1.1 MLLVD-CR-24-01: Signal Handler’s Alternate Stack Too Small 4.1.2 MLLVD-CR-24-02: Signal Handler Uses Non-Async-Safe Functions 4.1.3 MLLVD-CR-24-03: Virtual IP Address of Tunnel Device Leaks to Net- work Adjacent Participant 4.1.4 MLLVD-CR-24-04: Deanonymization Through NAT 4.1.5 MLLVD-CR-24-05: Deanonymization Through MTU 4.1.6 MLLVD-CR-24-06: Sideloading Into Setup Process All pretty straightforward IMO. They lean on "DAITA" aka Defence against AI Traffic Analysis pretty heavily, which I don't fully understand yet, but is probably worth some further reading. https://mullvad.net/en/vpn/daita https://mullvad.net/en/vpn/daita

daghamm 2y ago
I think the paper is easier to follow https://dl.acm.org/doi/pdf/10.1145/3603216.3624953 https://dl.acm.org/doi/pdf/10.1145/3603216.3624953
ratorx 2y ago
Safe signal handling has so many footguns that it seems worth re-considering the entire API. Even OpenSSH has had issues with it [1]. It seems very difficult to build good abstractions for it in any programming language, without introducing some function colouring mechanism explicitly for this. Maybe a pure language like Haskell could do it. [1]: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server https://blog.qualys.com/vulnerabilities-threat-research/2024...
- jandrese 2y ago
  Or it's nearly impossible for a pure functional language if the result of the async signal means you need to mutate some state elsewhere in the program to deal with the issue.
  - ratorx 2y ago
    I think that’s slightly orthogonal. It would still be safe, because you’d design around this restriction from the start, rather than accidentally call or mutate something you were not supposed to. The problem with safe signal handling is that you need to verify that your entire signal handler call stack is async safe. Assuming purity is a stronger property, signal handling is a safe API without any more work. The inflexibility due to the purity might cause other issues but that’s more a language level concern. If the signal handling API is safe and inflexible, it still seems better for a lot of use cases than an unsafe by default one.

runjake 2y ago

dang "X41 audited the Mullvad VPN app" might be a clearer title.

deleted 2y ago
[deleted]

rfoo 2y ago

> Virtual IP Address of Tunnel Device Leaks to Network Adjacent Participant > X41 recommends to mitigate the issue by setting the kernel parameter arp_ignore to 1 on Linux. > It is also recommended to randomize the virtual IP address for each user on each connection if possible. ... isn't randomizing the virtual IP address makes the situation worse? sounds like the best solution would be just give every user the same boring static IP address like 169.254.199.1/30.

Aachen 2y ago
Worse how?
kdmtctl 2y ago
For each session. Keys are rotated frequently, so a lot of noise could be produced. The only and one address is a good strategy for anti fingerprint though, but it is not easy to achieve for WG tunnels and pure L3 routing. Personally I don't really get their multi hop when you connect on a predefined port on an ingress server to get redirected to egress in a different region. Easy guessable for a powerful observer. Anyway any VPN is only an encryption tool, not an anonymizer.
- rfoo 2y ago
  A key selling point of WireGuard is it can roam between networks very well, without interruption to the connections within tunnel. Rotating IP address once you roam to another network (or just flaky wifi) ruins this.

ziddoap 2y ago

This is a nice audit report. The dedicated threat model section is something that a lot of auditing outfits skip over in their reports. While I'm positive Cure53, Assured, and Atredis (the previous auditors) established an appropriate threat model with Mullvad prior to engagement, it's not explicitly written out for the reader, which opens up room for misinterpretation of the findings.

wutwutwat 2y ago
> established an appropriate threat model with Mullvad prior to engagement Doesn't this make it kinda pointless? If the target has a say in how they should perform their audit/attack, how does that not produce results biased to the targets favor? Wouldn't the most unbiased way to do such a thing would be for the target to have zero idea what the auditor would be doing? > which opens up room for misinterpretation of the findings If Mullvad dictated how to do things or imposed limits on the reach of the testing, the results are worthless anyway
- palata 2y ago
  Say I manufacture door locks, and I ask you to audit the security of my system. Wouldn't it make sense to agree with you that stuff like lockpicking is fine, but going around the building, breaking a window and entering the room doesn't count as "breaking the lock security"? That's the whole point of a threat model: Mullvad has a threat model, and they build a product resistant to that. When someone audits the product, they should audit it against the threat model.
- ziddoap 2y ago
  >Doesn't this make it kinda pointless? To do an audit you have to audit against some sort of pre-established criteria. That is how audits work. In security, that will typically be a standard (or set of standards) alongside a threat model. In finances, you audit against what is legal in the areas you operate. >[...] zero idea what the auditor would be doing? That's a practical impossibility. From the client side you want to be able to evaluate quotes, stay within a budget, etc. You don't want to pay good money (audits are really expensive!) for areas that you are works-in-progress, or non-applicable threat models (e.g. lots of security software explicitly does not protect against nation-state actors, so they don't do audits from the perspective of a nation-state actor). From the auditor side, you want to know what staff to assign (according to their expertise), how to schedule your staff, etc. >If Mullvad dictated how to do things or imposed limits on the reach of the testing, the results are worthless anyway Not at all. The company says "This is the set of standards we are auditing against and our threat model. This is how we performed". The results are useful for everything covered by those standards and threat model. By explicitly stating the threat model, you as a consumer can compare your threat model to the one that was audited and make an informed decision.

puffybuf 2y ago

I use mullvad VPN with wireguard on OpenBSD (man wg). Works great. You can buy months with bitcoin for anonymity.

chucknthem 2y ago
Became a fan of Mullvad when I visited China. It was the most reliable VPN app I tested and you can have up to 5 devices per account.
- whoistraitor 2y ago
  It is probably the most reliable yeh, tho spending time here I’ve grown increasingly aware that the great firewall is more than aware of this vpn traffic, even if it’s wrapped up to look like normal traffic. They periodically will seem to ‘dial down’ the internet, especially at politically sensitive times. They are fully aware great swathes of the populace and visitors use VPNs, and they choose to allow it. They’d rather control and monitor than inspire even more opaque channels.
antihero 2y ago
Even if you buy it with BTC surely you're still connecting with your real IP?
- nexoft 2y ago
  not if he is using his neighors maybe he is using tor on top of it who knows
  - btmiller 2y ago
    I’ve never understood the neighbor approach. What’s the logic for that? Instead of your skin, it’s a person one door down from you, that was generous enough to share their connection with you? That’s not anonymity, that’s just outsourcing the identity to someone that probably extended trust to you. And if other things like Tor remove that connection, then what was the point of using a neighbor in the first place?

accidbuddy 2y ago

Is there any serious website that reviews (rank list) these VPNs? I say this because it is always difficult to find information that is not sponsored on the internet. In fact, I've always heard that Mullvad is one of the best, even supporting P2P

vigilans 2y ago
You heard wrong. Mullvad is the best ;)
ThatMedicIsASpy 2y ago
Port forwarding was removed a year ago which handicapped P2P. https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
npteljes 2y ago
The go-to used to be the website of "that one privacy guy". Now, on who is this guy, and whether this is really his site, I have no idea. https://thatoneprivacysite.xyz/#detailed-vpn-comparison https://thatoneprivacysite.xyz/#detailed-vpn-comparison
- crossroadsguy 2y ago
  > (Data last updated on 20/07/19)
- rsynnott 2y ago
  I mean, if you knew who he was, he wouldn't be a very good privacy guy, now, would he?
  - npteljes 2y ago
    I get what you're getting at, but no, in hindsight, I like my privacy and security watchdogs to be transparent. Like Bruce Schneier. And for a counterexample, Satoshi. I lost my trust in anonymous randos, for authenticity, I like someone with a professional face and contact info.

mmooss 2y ago

Where does Mullvad get all this money? I've seen physical ads in different places in the world, audits, etc. I'm not suggesting a conspiracy, but is the VPN business that good? Are they funded by a privacy group?

kdmtctl 2y ago
They provide white label for Mozilla, Tailscale and may be some others I am not aware of. Plus they really sell a lot of subscriptions.
- nikcub 2y ago
  and they've been accepting bitcoin since 2010. I assume they've done very well from that (I'm afraid to calculate what the present value of my mullvad subscription would be)
  - nly 2y ago
    Why would they have done well? they likely use a payment processor who dynamically price their € fees in Bitcoin and immediately liquidate all Bitcoin received.
    - Tiberium 2y ago
      They run their own full nodes for each blockchain they support, so I highly doubt they cash out crypto that often.
- rsyring 2y ago
  Nit: they have a partnership with Tailscale to offer the VPN as a part of a tailnet that subscribes to the service. But, it's not white label. White label implies it would be Tailscale VPN (or similar) with no reference to Mullvalad in their docs or marketing. But that's not what is happening with their offering.
  - kdmtctl 2y ago

immibis 2y ago

This seems to be mostly a test of the VPN client application, not the VPN service. However, "Deanonymization Through NAT" is about the VPN service.

tptacek 2y ago

I was going to go on a little rant about public audit reports that say stuff like "this company is very secure and is doing things great and this audit confirms that" --- not at all an x41-specific complaint, virtually all assessment firms are guilty of it, some much more than x41. But: they found a triggerable heap corruption vulnerability in a Rust program, which is a nice catch. I do think giving the vulnerability that follows that one a sev:hi, despite it being both theoretical (I don't think they have a POC) and not corrupting memory, is grade inflation though.

wkat4242 2y ago

Mullvad used to be great. But their stopping port forwarding makes torrents much worse. Their deprecation of openvpn sucks for me too. I have a couple usecases that need that. So I'm going to move to another one. Too bad because they were good for a long time.

deleted 2y ago
[deleted]
2OEH8eoCRo0 2y ago
I miss them and had to move elsewhere due to the discontinuation of port forwarding.
- wkat4242 2y ago
  Yeah it's a really important feature for many people. Torrents just don't really work without it. Three quarters of peers are behind NAT or VPN so without port forwarding they won't connect. If you have some Torrents with only a handful of seeders it makes it really difficult.
  - deleted 2y ago
    [deleted]
  - palata 2y ago
    Doesn't BitTorrent do some NAT traversal stuff? Genuinely interested.
    - wkat4242 2y ago
      Not really no. If both peers are behind NAT they just can't connect. There's no central server to facilitate hole punching.
  - zo1 2y ago
    With the availability and ease of use of Seed boxes, this feature is kinda moot. It doesn't even cater to power users any more because they've all moved to seed boxes a really long time ago. This just leaves semi-serious individuals that want to take the risk of torrenting on their private internet connection.

scdnc 2y ago

My only problem with Mullvad is that you get a lot more captchas and blocks from websites than you get from other VPNs.

switch007 2y ago
It's been bad for me lately. Basically persona non grata Many captchas are just bans but they are hoping for some free training
- zahllos 2y ago
  A lot of their endpoints are rented or hosted from ASes that are well known, e.g. M247 Ltd. If I wanted to vastly reduce annoying VPN traffic, I'd simply block these ASes as well. That's likely the cause of these. There isn't a lot Mullvad can do about it. Not all providers of hosting are willing to tolerate VPN endpoints in the same way they don't like hosting tor exit nodes.
  - switch007 2y ago
    Yeah I made sure to avoid those
- immibis 2y ago
  hCaptcha seems to be increasing in popularity, have tasks that actually stump current bots, and not discriminate by IP address. reCAPTCHA is the GoDaddy of CAPTCHA services. It doesn't achieve its purpose and the CAPTCHA task is often just a time waster. It's already decided whether you're a bot or not - which is not based on your mouse movements, but rather your IP address reputation and whether you're signed into Google. It only still exists because of brand inertia. I'd like to see a Google executive put before Congress and forced to complete a reCAPTCHA over Tor.
jijijijij 2y ago
Youtube and Reddit are the worst. I am pretty convinced the aggressive blocking is not because of abuse, but because VPNs actually have become a problem for tracking and data mining. I have the suspicion the IP blocking is somewhat coordinated between Youtube and Reddit, to maximize annoyance and discourage VPN usage, since I frequently find exit server working for either one of them, but not both. Disrupting the ping pong of social media for VPN users, seems like an effective strategy to influence their behavior. And since they are natural monopolies respectively, they hardly risk alienating anyone doing so. Similar to how cookie banners are abused to modify people's sentiment on privacy regulations in favor of data mining. Even many tech people believe annoying cookie banners are the EU's fault, when common practice is either malicious compliance, unwarranted or straight illegal. That said, it is actually fucking annoying. Then again, just a nuance in the greater enshittification and rapidly growing dissatisfaction with the web overall for me.

simonebrunozzi 2y ago

VPNs are a great business these days, but I don't feel that they treat their customers properly, or that they're transparent about what they provide. My sense is that there's a lot of BS going on. Including the fact that "cool" VPNs are supposed to be coming from Scandinavian countries (but most of them aren't).

bjoli 2y ago
I am a happy mullvad customer since about 5 years. I find it somewhat reassuring that they are not spending a gazillion dollars advertising on YouTube or affiliate websites. And of course prefer that they are in a jurisdiction that isn't a haven for shady companies. In short: I like them because there is little bullshit and they seem to be OK. I don't think I could ever trust PIA or all of those companies.
- SwiftyBug 2y ago
  They certainly spent a gazillion dollars advertising on every billboard and subway car in Manhattan.
  - bookaway 2y ago
    Yeah, this sort of stuff seems incredibly short-sighted. It gives me queasy "methinks the lady doth protest too much" ExpressVPN vibes.
  - bjoli 2y ago
    I didn't know about that, but they have this to say about it: https://mullvad.net/en/blog/advertising-that-targets-everyone https://mullvad.net/en/blog/advertising-that-targets-everyon... I never said I was against their AFK advertising. The EU chat control advertisement was great. The NYC stuff is pretty meh. Advertisement is was on my brain. I mostly treat it like that. I just find it weird that there seems to be so many companies spending a seemi gly infinite amount on affiliate advertisement (through bought reviews) and on influencer ads.
evantbyrne 2y ago

Beijinger 2y ago

I have never use Mullvad VPN but I can give two recommendations: If money is no concern, use Astrill. Easy of software, number of countries, GFC, circumvent geoblocking, it is one of the best, if not the best, but it comes with a big price tag attached. I think 300 USD/2 years if I remember correctly. If you don't need the best, AirVPN has often deals for 50USD/2 years. But the servers are very "spammy" (tons of captchas for you to solve).

phartenfeller 2y ago
Why do you think Astrill is one of the best? And why do you think it is better than Mullvad? I trust Mullvad because it does security audits like this. And it stores no data and has a history of police showing up without any data compromised [1]. [1] https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...
- Beijinger 2y ago
  Astill works on most OS, software is extremely slick, has many servers, at my time even Mainland china IPs were possible. Works reliable in China, is often NOT detected as a VPN (geo-blocking, Banks, captchas). They even offer fixed IP addresses, if desired. If you ask why would you have a fixed ip address and if this does not contradict the idea of a VPN you may have little international experience and don't understand the different applications of a VPN. Hey, there may be people that give a f... about the privacy it offers because they have totally different applications. If you want a Mercedes of VPNs, likely Astrill is the choice. If privacy is your main concern, there are many options. Dont mistake privacy for anonymity. If in doubt, pay with Bitcoin and use TOR to connect to your VPN. For my current application, AirVPN is more than enough. Two years: are 79 €, if they have a special, it is 49 euro. If you are cost sensitive, Mullvad is double the price already, but at least only less than half of the Astrill price.
  - akimbostrawman 2y ago
    >If privacy is your main concern, there are many options. Dont mistake privacy for anonymity. There main slogan is "Fast, Secure & Anonymous VPN" meanwhile they require name and email unlike Mullvad which pioneered the concept of random account IDs for login years ago. >If in doubt, pay with Bitcoin and use TOR to connect to your VPN. Bitcoin is not and never will be private or anonymous. Use monero or cash.

seanw444 2y ago

It's nice to see confirmation that Mullvad isn't smoke and mirrors. It's the only VPN I use. It's pretty much guaranteed that if you go looking, you're going to find vulnerabilities. They took it seriously and fixed it immediately, which is reassuring. I'll continue using Mullvad.

Kurtcheng 2y ago

[dead]