3 ms·

Mullvad, because it has a good interface for port forwarding, and I kinda like the fact that it supports wireguard. It's also fast and reliable (but so are man

Mullvad, because it has a good interface for port forwarding, and I kinda like the fact that it supports wireguard. It's also fast and reliable (but so are many of the others), and apparently has good privacy. I've previously used AirVPN, which was great except for not having any servers near me, and ExpressVPN, which was great except for not having such a good interface for port forwarding (and also it's the most expensive of the ones I like). PIA failed to answer a question that I sent in using their web support form (they didn't even say that they'd received it but couldn't answer it).

spindle 8y ago
P.S. Also, Mullvad's staff have been doing some work to try to improve wireguard.
rb666 8y ago
Read this on Wireguard: https://restoreprivacy.com/wireguard/ https://restoreprivacy.com/wireguard/ Be aware.
- throwawaymath 8y ago
  The claim that Wireguard has not had a security audit is false[1][2]. It's based on the extremely robust Noise protocol framework, it has a formally verified Tamarin security model and two of the most well-known cryptographers in the world have personally reviewed it with no significant findings. Wireguard also does not do any of the logging claimed by that article by default. I know this because I maintain Wireguard VPN instances on baremetal and public cloud. This strikes me as a misunderstanding of what Jason wrote on the mailing list about Blind Operator Mode[3]. I stopped reading that article after I saw these two (glaring) inaccuracies. Either someone has a vendetta against Wireguard or they seriously misunderstand the protocol's security and default behavior. ________________ 1. https://www.wireguard.com/formal-verification/ https://www.wireguard.com/formal-verification/ 2. https://eprint.iacr.org/2018/080.pdf https://eprint.iacr.org/2018/080.pdf 3. https://lists.zx2c4.com/pipermail/wireguard/2017-November/001969.html https://lists.zx2c4.com/pipermail/wireguard/2017-November/00...
  - 8fingerlouie 8y ago
    >Wireguard also does not do any of the logging claimed by that article by default It might not do the logging, but it still maintains state about which IP has connected using which key, and when the client last sent a handshake. I have no idea how persistent this information is, but i can see from my Ubnt router, running WireGuard, that clients that haven't connected in weeks are still present in the Wg command status. It's not an issue for me, but if you were trying to hide information, that information is a pretty bit smoking gun. It directly ties your IP to the VPN IP. Assuming the rest of the VPN network is using shared IP addresses, and still maintains no logging, it might not be enough to prove that you're the one behind whatever they are searching for. Then again, not all countries care that much about the "innocent until proven guilty" principle.
therein 8y ago
Mullvad is amazing. Definitely my first choice as well.
maxyme 8y ago
I used to use Mullvad but switched to AirVPN. Mullvad was extremely slow in the US (under 25mbps most times) where I have found AirVPN to be able to reach ~750mbps. They also publish the congestion on their servers which is very handy for reaching high speeds.
frio 8y ago
I keep mullvad + Wireguard in my back pocket for when there's no choice but VPNing. It's been a perfectly workable combo so far.
- sandGorgon 8y ago
  how do you use wireguard from your phone (i assume that's what you meant by pocket). I thought wireguard was all cli based for now and no good UI (I use Linux desktop and Android phones)
  - latch 8y ago
    There's an android app (1). Works fine. Running it 24/7. https://play.google.com/store/apps/details?id=com.wireguard.android&hl=en_SG https://play.google.com/store/apps/details?id=com.wireguard....
    - h9n 8y ago
      Not exactly what the GP asked, but there’s also Wireguard in the iOS[0] and Mac App Stores[1]. Wireguard from the Mac App Store works successfully with Little Snitch (per-app firewall) and comes with a menubar icon that shows connectivity and allows quick switching. With the commandline-based version of Wireguard (installed from homebrew or wherever), Little Snitch sees all traffic as originating from the wireguard-go process. This is because the App Store version makes use of MacOS’s new network extension API, and Apple has only made that available to apps distributed through the App Store. [0] https://itunes.apple.com/us/app/wireguard/id1441195209 https://itunes.apple.com/us/app/wireguard/id1441195209 [1] https://itunes.apple.com/us/app/wireguard/id1451685025 https://itunes.apple.com/us/app/wireguard/id1451685025
  - frio 8y ago
    Just an expression of speech :). On Linux and macOS, I use the native stuff, on iOS I use the app the Wireguard team produced. I believe they've produced an Android app too.
nirv 8y ago
You may be interested in reading the discussion on Wireguard mailing list with Mullvad representative[1], where he voiced some security issues with particular use case of using Wireguard as a VPN provider (tl/dr: no identity hiding forward secrecy and no dynamic IP address assignment out of the box). As for personal applications, in-kernel wireguard-dkms is my default VPN solution day and night. [1] https://lists.zx2c4.com/pipermail/wireguard/2019-January/003777.html https://lists.zx2c4.com/pipermail/wireguard/2019-January/003...

spindle 8y ago

P.S. Also, Mullvad's staff have been doing some work to try to improve wireguard.

rb666 8y ago

Read this on Wireguard: https://restoreprivacy.com/wireguard/ https://restoreprivacy.com/wireguard/ Be aware.

throwawaymath 8y ago
The claim that Wireguard has not had a security audit is false[1][2]. It's based on the extremely robust Noise protocol framework, it has a formally verified Tamarin security model and two of the most well-known cryptographers in the world have personally reviewed it with no significant findings. Wireguard also does not do any of the logging claimed by that article by default. I know this because I maintain Wireguard VPN instances on baremetal and public cloud. This strikes me as a misunderstanding of what Jason wrote on the mailing list about Blind Operator Mode[3]. I stopped reading that article after I saw these two (glaring) inaccuracies. Either someone has a vendetta against Wireguard or they seriously misunderstand the protocol's security and default behavior. ________________ 1. https://www.wireguard.com/formal-verification/ https://www.wireguard.com/formal-verification/ 2. https://eprint.iacr.org/2018/080.pdf https://eprint.iacr.org/2018/080.pdf 3. https://lists.zx2c4.com/pipermail/wireguard/2017-November/001969.html https://lists.zx2c4.com/pipermail/wireguard/2017-November/00...
- 8fingerlouie 8y ago
  >Wireguard also does not do any of the logging claimed by that article by default It might not do the logging, but it still maintains state about which IP has connected using which key, and when the client last sent a handshake. I have no idea how persistent this information is, but i can see from my Ubnt router, running WireGuard, that clients that haven't connected in weeks are still present in the Wg command status. It's not an issue for me, but if you were trying to hide information, that information is a pretty bit smoking gun. It directly ties your IP to the VPN IP. Assuming the rest of the VPN network is using shared IP addresses, and still maintains no logging, it might not be enough to prove that you're the one behind whatever they are searching for. Then again, not all countries care that much about the "innocent until proven guilty" principle.

therein 8y ago

Mullvad is amazing. Definitely my first choice as well.

maxyme 8y ago

I used to use Mullvad but switched to AirVPN. Mullvad was extremely slow in the US (under 25mbps most times) where I have found AirVPN to be able to reach ~750mbps. They also publish the congestion on their servers which is very handy for reaching high speeds.

frio 8y ago

I keep mullvad + Wireguard in my back pocket for when there's no choice but VPNing. It's been a perfectly workable combo so far.

sandGorgon 8y ago
how do you use wireguard from your phone (i assume that's what you meant by pocket). I thought wireguard was all cli based for now and no good UI (I use Linux desktop and Android phones)
- latch 8y ago
  There's an android app (1). Works fine. Running it 24/7. https://play.google.com/store/apps/details?id=com.wireguard.android&hl=en_SG https://play.google.com/store/apps/details?id=com.wireguard....
  - h9n 8y ago
    Not exactly what the GP asked, but there’s also Wireguard in the iOS[0] and Mac App Stores[1]. Wireguard from the Mac App Store works successfully with Little Snitch (per-app firewall) and comes with a menubar icon that shows connectivity and allows quick switching. With the commandline-based version of Wireguard (installed from homebrew or wherever), Little Snitch sees all traffic as originating from the wireguard-go process. This is because the App Store version makes use of MacOS’s new network extension API, and Apple has only made that available to apps distributed through the App Store. [0] https://itunes.apple.com/us/app/wireguard/id1441195209 https://itunes.apple.com/us/app/wireguard/id1441195209 [1] https://itunes.apple.com/us/app/wireguard/id1451685025 https://itunes.apple.com/us/app/wireguard/id1451685025
- frio 8y ago
  Just an expression of speech :). On Linux and macOS, I use the native stuff, on iOS I use the app the Wireguard team produced. I believe they've produced an Android app too.

nirv 8y ago

You may be interested in reading the discussion on Wireguard mailing list with Mullvad representative[1], where he voiced some security issues with particular use case of using Wireguard as a VPN provider (tl/dr: no identity hiding forward secrecy and no dynamic IP address assignment out of the box). As for personal applications, in-kernel wireguard-dkms is my default VPN solution day and night. [1] https://lists.zx2c4.com/pipermail/wireguard/2019-January/003777.html https://lists.zx2c4.com/pipermail/wireguard/2019-January/003...