11 ms·

Honestly, nothing holds up to Mullvad [1]. They don't even take an email address while creating accounts, and you can pay easily with Bitcoin or even with cash

Honestly, nothing holds up to Mullvad [1]. They don't even take an email address while creating accounts, and you can pay easily with Bitcoin or even with cash mailed to them. I'm not affiliated, just a very happy customer. Mullvad is also who Mozilla trusts for the Mozilla VPN [2]. You can sign up with that if you'd like Mozilla to get a cut. [1]: https://mullvad.net/ https://mullvad.net/ [2]: https://vpn.mozilla.org/ https://vpn.mozilla.org/

soulofmischief 6y ago
Seconding Mullvad. Their service cannot be beat.
BelenusMordred 6y ago
Have massive respect for all the open source code Mullvad pumps out. https://github.com/mullvad https://github.com/mullvad Don't use their service but they do really come across as one of most trustworthy out there. Have a Protonvpn account for getting around a geoblock once in a blue moon, personally don't have much use for commercial vpns.
kevincox 6y ago
It is interesting to me that the Mozilla option is cheaper. (5 USD vs 5 EUR) Also it bugs me that there are 5 "Try" buttons on the Mozilla site before they even show you the price. To be fair it does show you the price on the credit card page after you log in but still feels a bit scummy to me. Mullvad puts it in your face above the fold.
vmception 6y ago
How do they take bitcoin? I’ve seen various invoicing systems that completely break in Tor+JS and in all noJS environments. If they shoehorned bitpay in, its probably not tapping into the utility of having bitcoin payment options. I like paying invoices with Monero over Tor, while the merchant receives bitcoin that a third party pushed to them. I’ve been doing that for at least half a decade. But if I can’t access their invoice they just lose a customer.
- wwwwwwwww 6y ago
  They show you a BTC address and you send BTC to that address. Whatever arrives at the address is credited to your account. No "invoicing system" involved.
  - vmception 6y ago
    Perfect!
  - StavrosK 6y ago
    How do things like Morphtoken and Xmr.to handle the $20 Bitcoin transfer fee?
    - boring_twenties 6y ago
      Current BTC fee seems to be just over $1, not $20. I don't think MorphToken would work because as far as I can tell, they have no way to set a fixed amount of the destination currency. Other providers like ChangeNOW do offer that but they have much higher minimums, something like .003 BTC, which is obviously not useful for a $5 payment.
      - StavrosK 6y ago
        > Current BTC fee seems to be just over $1, not $20. Really? My Ledger app says 112 sat/byte, which comes out to $8 for me, and I'm pretty sure they were higher a few weeks ago, when I checked. Am I way overpaying? > I don't think MorphToken would work because as far as I can tell, they have no way to set a fixed amount of the destination currency. That's too bad, XMR.to was really useful for this...
        boring_twenties 6y ago
        > Really? My Ledger app says 112 sat/byte, which comes out to $8 for me, and I'm pretty sure they were higher a few weeks ago, when I checked. Am I way overpaying? Hm, maybe? I think those clients usually just use the average fee paid in recent transactions, which will result in overpayment if everyone else is doing it too. The real question, "how low can I set the fee and still have my tx confirmed," is given an attempt at an answer by https://fees.watch https://fees.watch, which is what I checked -- it showed less than $2 for every speed at the time. To be honest I don't actually use Bitcoin, but I do use Ethereum regularly and I use this fees.watch site for that. My transactions almost always get confirmed exactly when expected, and it's almost always cheaper than whatever the wallet suggests.
shrimp_emoji 6y ago
Great Linux client, too!
- noisy_boy 6y ago
  Thanks this was the question in my mind. I use expressvpn which works fine but with the good feedback about mullvad here, want to check them out.
pbhjpbhj 6y ago
Mullvad is the service that Firefox use, I took that as an endorsement and tested them, it worked well (on Linux, which has a command line controller for a service that is installed) once you've got used to how it's set up. They seem to do anonymising thoroughly. IIRC you can even mail them cash. Edit: I should say, I used their support email, they responded pretty quickly for a cheap service, offered a beta client and that fixed the issue (I'd actually tried the beta by the time I got the email back, but still).
gopty 6y ago
Is mullvad able to drill through the Great Firewall of China? Few VPN can
- wwwwwwwww 6y ago
  Nowadays its probably best to set up your own VPN server for that. Back when I lived there, most VPNs got occationally blocked, then they would get new IPs and work fine again. But from what I heard, it got way worse since Winnie the Pooh took over.
  - dheera 6y ago
    Agree. I always use my own VPN for this. Most VPN services get blocked eventually and then play cat-and-mouse to get themselves back up, so the service is overall unreliable. The China firewall also does some "intelligent" blocking of common VPN protocols by fingerprinting their traffic patterns, handshakes, ports, and other things. If you set up own server, it helps to modify the protocol or wrap it in a proxy that obfuscates the VPN traffic as something innocent-looking. Basically, if you implement something like TCP/IP-over-cat-picture-jpeg-files-on-HTTP-port-80 you'll generally have a rock solid experience. (That's not exactly what I do, but it's along the same lines of thinking, you get the idea, be creative.) Unfortunately I'm not going to provide code to do this though because that makes it vulnerable to its traffic pattern being fingerprinted and blocked. Also, avoid AWS. Using slightly lesser-known IaaS providers helps.
    - rightbyte 6y ago
      Interesting thought. A little part of me want to make a TCP-over-HTML cat pictures wrapper. Maybe put the payload in every fifth cat pixel or something. Should work for bmp:s right.
    - mekster 6y ago
      So you'd be exchanging cat pictures million times a day? That'll stand out well.
  - myrandomcomment 6y ago
blindm 6y ago
And with Mullvad you can just make a one-time payment of EUR 5.00 if you need to use it for 30 days. No auto-renew crap / commitment to long subscriptions to deal with.
dheera 6y ago
I totally understand using a VPN service if you're trying to access the internet from another location, e.g. to get past the China firewall or get access to content from a different copyright jurisdiction. However, I don't fully understand the privacy argument. It would seem to be that instead of handing over your entire DNS query history and unencrypted HTTP history to your own corporate IT department or the Starbucks Wi-Fi router, you're now handing over all that data to Mullvad. Are people okay with that? I usually create my own VPNs. I realize that involves handing data over to AWS or whoever I use for my servers but I somehow feel slightly better about that than handing it over to some Mullvad dude. Google tries to impose its VPN on Android too and my first insinct is: do I really want all my traffic going through Google?
- hatsunearu 6y ago
  >However, I don't fully understand the privacy argument. Yes, it's crap, and any techbro worth their salary should know this. It's also incredibly annoying when VPN this and VPN that pops up on youtube.
  - VectorLock 6y ago
    I personally like the irony of VPN companies getting around adblockers by getting paid youtuber sponsorships.
    - rafram 6y ago
      SponsorBlock! https://sponsor.ajay.app/ https://sponsor.ajay.app/
- Cu3PO42 6y ago
  The VPN providers promise not to keep logs. They go to different lengths to prove this claim to you. If you do believe that, it's more private. If you don't, they still might have access to that data. Otherwise AWS or someone else will. However, even so it will be more difficult for third parties to track you since you will generally not be assigned a dedicated IP address. You are probably NATed with a bunch of other customers from all over the world. If you set up a VPN in a VPS you'll most likely have a permanent public IP. Personally, I believe that Mullvad is truthful about its privacy claims, but I'm not a customer.
LiberatedLlama 6y ago
Does Mullvad allow me to connect using wireguard without pasting my private key into their website? Their website says the private key never leaves my browser and is only used to generate the configuration file, but all I really want to do is give them a public key and I suppose let them know which server I'll be connecting to. I can put together the config file by hand myself, thanks, I shouldn't need to ever copy the private key into my clipboard, let alone paste it into a browser.
tedunangst 6y ago
So Mozilla VPN is wireguard, but won't let me use my own wireguard client?
- kbrosnan 6y ago
  The Mozilla VPN uses an auth key generated from the Firefox Account. There is at least one 3rd party app https://github.com/NilsIrl/MozWire/ https://github.com/NilsIrl/MozWire/ Though the official client support the major operating systems [Windows, MacOS, Linux, iOS, and Android] https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client
grishka 6y ago
You can't use any commercial VPN service and expect privacy. Those are only good for bypassing geographical restrictions. If you want privacy, buy a VDS and host your own VPN server. It'll cost about the same, and you can use it for other things at no additional cost.
- gazby 6y ago
  Perhaps it depends on the definition of privacy. Now your identity is tied to any and all traffic to/from that IP address for the duration of ownership.
  - colechristensen 6y ago
    The specific issue is the VPN provider harvesting data about your traffic and selling it.
    - gazby 6y ago
      I'm suggesting it's vastly greater effort to identify individuals in a VPN service than a VPS provider (shared vs dedicated tenancy). If you're talking about bulk collection, then your ISP is probably already doing that.
- freebuju 6y ago
  Except most providers worth their salt will require your credit card/paypal for a subscription. This adds another potential loophole for de-anonymization. At least with Mullvad you can pay in crypto or even mail them cash. Though it all depends on what you want to achieve I'd say a trusted VPN is much better than a VPS, esp one located in US or any of the five eyes countries.
- kelnos 6y ago
  Seems like it'd be easier to "unmask" someone's VPS account than figure out who someone is when they use a paid VPN service. If you're worried about a government, your personal info from a VPS provider is just one court order away. If you use a VPN service that actually is serious about not keeping PII or logs, you might fare better there (they might be coerced to log future traffic of yours, but at least your prior activity is still secret). If you're worried about ad tracking, a VPN just doesn't do you much good period: ad tracking is sophisticated enough to not care about your IP address. But all of this "VPN for privacy" stuff is predicated on trusting faceless third-parties to help keep you safe, so it's generally a losing proposition. Agree that the only "safe" thing to use a commercial VPN for is to bypass geographical restrictions.
rsync 6y ago
"Honestly, nothing holds up to ... (VPN provider)" If you're serious you send a machine, that you own, to a colo provider and you register for service with a corporate entity that you created for just that purpose. Your name exists nowhere and ... regulatory inquiries are directed to your corporate contact email. Or, if you feel like that's a heavy burden and you don't attach any value to the physical machine (some old 1U, right ?) then you can just sign up under an assumed corporate name with some colo provider that doesn't care that it is, or is not, an actual corporation and you can pay with your non-AMEX credit card[1] using whatever Mickey Mouse name you feel like. Trust me - it won't take long to find someone who will take your money.[2] [1] Only AMEX validates First Last ... [2] https://www.lowendtalk.com/ https://www.lowendtalk.com/
- Thorentis 6y ago
  This is far less anonymous than sending cash in the mail to Mullvad. There is a paper trail leading back to you when you register the corporate entity.
  - deleted 6y ago
    [deleted]
- michaelmrose 6y ago
  For practical purposes the only people who can penetrate a simple vpn service are potentially a government order to start recording your traffic that is legal based on jurisdiction or a dedicated hacker. It looks to me that NEITHER would be prevented by you using a colocated machine. It's not like your colocation provider is incapable of compromising you and probably would if ordered to do so in a jurisdiction where this act would be legal. A hacker presumably isn't concerned about whether they are attacking a machine on your desk or in Nebraska. Over a 5 year time frame your colocated machine would presumably run you between $6600 and $19000 and would have bought you zero additional privacy compared to paying $360 for a vpn in the same jurisdiction.
  - sbierwagen 6y ago
hda111 6y ago
Using Bitcoin doesn’t make one anonymous. I would always send cash to them.
- notRobot 6y ago
  Actually, it definitely can, if used right
symlinkk 6y ago
Who runs Mullvad? Am I supposed to just blindly trust these people with my entire internet activity?
- mekster 6y ago
  I'd assume Mozilla did the due diligence and it may count for something.
Wowfunhappy 6y ago
The thing is, it costs >$5 per month. I pay $2 for NordVPN. I'm not expecting privacy, I just want a way to occasionally geo-hop to other countries, for streaming video and to test if a problem is related to my IP/location or not. And occasionally to have some minimal level of protection in a coffee shop.
- prigadita 6y ago
  Ah great, we will all adapt to your use case and let nordvpn charge us for things they don't deliver unless we auto renew, since you are doing great!
  - Wowfunhappy 6y ago
    I actually have auto-renew turned off fwiw. But I didn’t mean to disparage people who use other services.

soulofmischief 6y ago

Seconding Mullvad. Their service cannot be beat.

BelenusMordred 6y ago

Have massive respect for all the open source code Mullvad pumps out. https://github.com/mullvad https://github.com/mullvad Don't use their service but they do really come across as one of most trustworthy out there. Have a Protonvpn account for getting around a geoblock once in a blue moon, personally don't have much use for commercial vpns.

kevincox 6y ago

It is interesting to me that the Mozilla option is cheaper. (5 USD vs 5 EUR) Also it bugs me that there are 5 "Try" buttons on the Mozilla site before they even show you the price. To be fair it does show you the price on the credit card page after you log in but still feels a bit scummy to me. Mullvad puts it in your face above the fold.

vmception 6y ago

How do they take bitcoin? I’ve seen various invoicing systems that completely break in Tor+JS and in all noJS environments. If they shoehorned bitpay in, its probably not tapping into the utility of having bitcoin payment options. I like paying invoices with Monero over Tor, while the merchant receives bitcoin that a third party pushed to them. I’ve been doing that for at least half a decade. But if I can’t access their invoice they just lose a customer.

wwwwwwwww 6y ago
They show you a BTC address and you send BTC to that address. Whatever arrives at the address is credited to your account. No "invoicing system" involved.
- vmception 6y ago
  Perfect!
- StavrosK 6y ago
  How do things like Morphtoken and Xmr.to handle the $20 Bitcoin transfer fee?
  - boring_twenties 6y ago
    Current BTC fee seems to be just over $1, not $20. I don't think MorphToken would work because as far as I can tell, they have no way to set a fixed amount of the destination currency. Other providers like ChangeNOW do offer that but they have much higher minimums, something like .003 BTC, which is obviously not useful for a $5 payment.
    - StavrosK 6y ago
      > Current BTC fee seems to be just over $1, not $20. Really? My Ledger app says 112 sat/byte, which comes out to $8 for me, and I'm pretty sure they were higher a few weeks ago, when I checked. Am I way overpaying? > I don't think MorphToken would work because as far as I can tell, they have no way to set a fixed amount of the destination currency. That's too bad, XMR.to was really useful for this...
      - boring_twenties 6y ago
        > Really? My Ledger app says 112 sat/byte, which comes out to $8 for me, and I'm pretty sure they were higher a few weeks ago, when I checked. Am I way overpaying? Hm, maybe? I think those clients usually just use the average fee paid in recent transactions, which will result in overpayment if everyone else is doing it too. The real question, "how low can I set the fee and still have my tx confirmed," is given an attempt at an answer by https://fees.watch https://fees.watch, which is what I checked -- it showed less than $2 for every speed at the time. To be honest I don't actually use Bitcoin, but I do use Ethereum regularly and I use this fees.watch site for that. My transactions almost always get confirmed exactly when expected, and it's almost always cheaper than whatever the wallet suggests.

shrimp_emoji 6y ago

Great Linux client, too!

noisy_boy 6y ago
Thanks this was the question in my mind. I use expressvpn which works fine but with the good feedback about mullvad here, want to check them out.

pbhjpbhj 6y ago

Mullvad is the service that Firefox use, I took that as an endorsement and tested them, it worked well (on Linux, which has a command line controller for a service that is installed) once you've got used to how it's set up. They seem to do anonymising thoroughly. IIRC you can even mail them cash. Edit: I should say, I used their support email, they responded pretty quickly for a cheap service, offered a beta client and that fixed the issue (I'd actually tried the beta by the time I got the email back, but still).

gopty 6y ago

Is mullvad able to drill through the Great Firewall of China? Few VPN can

wwwwwwwww 6y ago
Nowadays its probably best to set up your own VPN server for that. Back when I lived there, most VPNs got occationally blocked, then they would get new IPs and work fine again. But from what I heard, it got way worse since Winnie the Pooh took over.
- dheera 6y ago
  Agree. I always use my own VPN for this. Most VPN services get blocked eventually and then play cat-and-mouse to get themselves back up, so the service is overall unreliable. The China firewall also does some "intelligent" blocking of common VPN protocols by fingerprinting their traffic patterns, handshakes, ports, and other things. If you set up own server, it helps to modify the protocol or wrap it in a proxy that obfuscates the VPN traffic as something innocent-looking. Basically, if you implement something like TCP/IP-over-cat-picture-jpeg-files-on-HTTP-port-80 you'll generally have a rock solid experience. (That's not exactly what I do, but it's along the same lines of thinking, you get the idea, be creative.) Unfortunately I'm not going to provide code to do this though because that makes it vulnerable to its traffic pattern being fingerprinted and blocked. Also, avoid AWS. Using slightly lesser-known IaaS providers helps.
  - rightbyte 6y ago
    Interesting thought. A little part of me want to make a TCP-over-HTML cat pictures wrapper. Maybe put the payload in every fifth cat pixel or something. Should work for bmp:s right.
  - mekster 6y ago
    So you'd be exchanging cat pictures million times a day? That'll stand out well.
- myrandomcomment 6y ago

blindm 6y ago

And with Mullvad you can just make a one-time payment of EUR 5.00 if you need to use it for 30 days. No auto-renew crap / commitment to long subscriptions to deal with.

dheera 6y ago

I totally understand using a VPN service if you're trying to access the internet from another location, e.g. to get past the China firewall or get access to content from a different copyright jurisdiction. However, I don't fully understand the privacy argument. It would seem to be that instead of handing over your entire DNS query history and unencrypted HTTP history to your own corporate IT department or the Starbucks Wi-Fi router, you're now handing over all that data to Mullvad. Are people okay with that? I usually create my own VPNs. I realize that involves handing data over to AWS or whoever I use for my servers but I somehow feel slightly better about that than handing it over to some Mullvad dude. Google tries to impose its VPN on Android too and my first insinct is: do I really want all my traffic going through Google?

hatsunearu 6y ago
>However, I don't fully understand the privacy argument. Yes, it's crap, and any techbro worth their salary should know this. It's also incredibly annoying when VPN this and VPN that pops up on youtube.
- VectorLock 6y ago
  I personally like the irony of VPN companies getting around adblockers by getting paid youtuber sponsorships.
  - rafram 6y ago
    SponsorBlock! https://sponsor.ajay.app/ https://sponsor.ajay.app/
Cu3PO42 6y ago
The VPN providers promise not to keep logs. They go to different lengths to prove this claim to you. If you do believe that, it's more private. If you don't, they still might have access to that data. Otherwise AWS or someone else will. However, even so it will be more difficult for third parties to track you since you will generally not be assigned a dedicated IP address. You are probably NATed with a bunch of other customers from all over the world. If you set up a VPN in a VPS you'll most likely have a permanent public IP. Personally, I believe that Mullvad is truthful about its privacy claims, but I'm not a customer.

LiberatedLlama 6y ago

Does Mullvad allow me to connect using wireguard without pasting my private key into their website? Their website says the private key never leaves my browser and is only used to generate the configuration file, but all I really want to do is give them a public key and I suppose let them know which server I'll be connecting to. I can put together the config file by hand myself, thanks, I shouldn't need to ever copy the private key into my clipboard, let alone paste it into a browser.

tedunangst 6y ago

So Mozilla VPN is wireguard, but won't let me use my own wireguard client?

kbrosnan 6y ago
The Mozilla VPN uses an auth key generated from the Firefox Account. There is at least one 3rd party app https://github.com/NilsIrl/MozWire/ https://github.com/NilsIrl/MozWire/ Though the official client support the major operating systems [Windows, MacOS, Linux, iOS, and Android] https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client

grishka 6y ago

You can't use any commercial VPN service and expect privacy. Those are only good for bypassing geographical restrictions. If you want privacy, buy a VDS and host your own VPN server. It'll cost about the same, and you can use it for other things at no additional cost.

gazby 6y ago
Perhaps it depends on the definition of privacy. Now your identity is tied to any and all traffic to/from that IP address for the duration of ownership.
- colechristensen 6y ago
  The specific issue is the VPN provider harvesting data about your traffic and selling it.
  - gazby 6y ago
    I'm suggesting it's vastly greater effort to identify individuals in a VPN service than a VPS provider (shared vs dedicated tenancy). If you're talking about bulk collection, then your ISP is probably already doing that.
freebuju 6y ago
Except most providers worth their salt will require your credit card/paypal for a subscription. This adds another potential loophole for de-anonymization. At least with Mullvad you can pay in crypto or even mail them cash. Though it all depends on what you want to achieve I'd say a trusted VPN is much better than a VPS, esp one located in US or any of the five eyes countries.
kelnos 6y ago
Seems like it'd be easier to "unmask" someone's VPS account than figure out who someone is when they use a paid VPN service. If you're worried about a government, your personal info from a VPS provider is just one court order away. If you use a VPN service that actually is serious about not keeping PII or logs, you might fare better there (they might be coerced to log future traffic of yours, but at least your prior activity is still secret). If you're worried about ad tracking, a VPN just doesn't do you much good period: ad tracking is sophisticated enough to not care about your IP address. But all of this "VPN for privacy" stuff is predicated on trusting faceless third-parties to help keep you safe, so it's generally a losing proposition. Agree that the only "safe" thing to use a commercial VPN for is to bypass geographical restrictions.

rsync 6y ago

"Honestly, nothing holds up to ... (VPN provider)" If you're serious you send a machine, that you own, to a colo provider and you register for service with a corporate entity that you created for just that purpose. Your name exists nowhere and ... regulatory inquiries are directed to your corporate contact email. Or, if you feel like that's a heavy burden and you don't attach any value to the physical machine (some old 1U, right ?) then you can just sign up under an assumed corporate name with some colo provider that doesn't care that it is, or is not, an actual corporation and you can pay with your non-AMEX credit card[1] using whatever Mickey Mouse name you feel like. Trust me - it won't take long to find someone who will take your money.[2] [1] Only AMEX validates First Last ... [2] https://www.lowendtalk.com/ https://www.lowendtalk.com/

Thorentis 6y ago
This is far less anonymous than sending cash in the mail to Mullvad. There is a paper trail leading back to you when you register the corporate entity.
- deleted 6y ago
  [deleted]
michaelmrose 6y ago
For practical purposes the only people who can penetrate a simple vpn service are potentially a government order to start recording your traffic that is legal based on jurisdiction or a dedicated hacker. It looks to me that NEITHER would be prevented by you using a colocated machine. It's not like your colocation provider is incapable of compromising you and probably would if ordered to do so in a jurisdiction where this act would be legal. A hacker presumably isn't concerned about whether they are attacking a machine on your desk or in Nebraska. Over a 5 year time frame your colocated machine would presumably run you between $6600 and $19000 and would have bought you zero additional privacy compared to paying $360 for a vpn in the same jurisdiction.
- sbierwagen 6y ago

hda111 6y ago

Using Bitcoin doesn’t make one anonymous. I would always send cash to them.

notRobot 6y ago
Actually, it definitely can, if used right

symlinkk 6y ago

Who runs Mullvad? Am I supposed to just blindly trust these people with my entire internet activity?

mekster 6y ago
I'd assume Mozilla did the due diligence and it may count for something.

Wowfunhappy 6y ago

The thing is, it costs >$5 per month. I pay $2 for NordVPN. I'm not expecting privacy, I just want a way to occasionally geo-hop to other countries, for streaming video and to test if a problem is related to my IP/location or not. And occasionally to have some minimal level of protection in a coffee shop.

prigadita 6y ago
Ah great, we will all adapt to your use case and let nordvpn charge us for things they don't deliver unless we auto renew, since you are doing great!
- Wowfunhappy 6y ago
  I actually have auto-renew turned off fwiw. But I didn’t mean to disparage people who use other services.