4 ms·

Hi! I'm one of Mullvad's founders. I can't speak for Mozilla, but we have our own desktop and mobile apps because it enables us to do more privacy-preserving t

by kfreds 6y ago

Hi! I'm one of Mullvad's founders. I can't speak for Mozilla, but we have our own desktop and mobile apps because it enables us to do more privacy-preserving things with a higher assurance. Consider for instance DNS leaks, Teredo leaks, IPv6 leaks, esoteric DHCP directives that can hack your routing tables, and so on. And these are just a few of the things we were early in mitigating correctly. Consider also the tight relationship between UX and security, and it is clear that we can't rely on "generic VPN clients" to always agree with our design and security preferences. That doesn't mean they are wrong and we are right of course. It's just that we have a very specific mission. One architecture decision we made for our app was to write its backend in Rust, and integrate tightly with the firewalls on Windows, macOS, and Linux. It facilitates stability and therefore reduces the risk of states where data leak outside of the tunnel. Check it out, it's open source. As all security-related things should be. https://github.com/mullvad/mullvadvpn-app https://github.com/mullvad/mullvadvpn-app

Spivak 6y ago
But it throws compatibility with devices that don't support your client out the window. Like I might want to have an entire VLAN on my home network route all traffic through the VPN which would happen through my router. But my router only supports common VPN protocols like IPSec, OpenVPN, and WireGuard. Sure, I could make it work with a separate Linux server running your app and some routing but that's far more work than most other VPN providers. I'm fine with warnings in your UI about connections with these protocols being "less secure" like how Zoom handles E2E with phones.
- purjolok 6y ago
  Mullvad also provides OpenVPN and Wireguard config files. https://mullvad.net/sv/help/tag/other-vpn-software/ https://mullvad.net/sv/help/tag/other-vpn-software/
  - Spivak 6y ago
    So then what's with all the claims that Mozilla VPN doesn't work with them? I held off trying Moz's VPN service because of people saying it didn't work and not finding any official support.
    - opheliate 6y ago
      While Mullvad provide those configuration files to customers who use their service directly, customers who are subscribed to Mozilla VPN don't have access to these configuration files, which is what makes it especially irritating to me.
      - wintermutestwin 6y ago
        I think the market segmentation is that more savvy users would bypass Mozilla and sub directly with Mullvad.
        Spivak 6y ago
        Which is fine except that I would go with Moz VPN specifically because I want to give them money. Mozilla seems to make it really hard to pay them for goods and services.
opheliate 6y ago
Hi, thanks for the response. I'm a big fan of Mullvad's approach to creating a VPN, and I'm hopeful that more companies will follow in your path. I've been using your service for a few months now, and I'm really satisfied with it. I should perhaps have been clearer when I referred to generic VPN clients, I was talking about the original WireGuard implementation by Jason Donenfeld, not just some random software, which I would hope you agree is a (sufficiently) secure implementation when used by technically proficient users? I do appreciate that there are reasons for having a specific client for your service, and it is absolutely necessary for those who are new to VPN apps, but I would hope you appreciate the reasons for providing implementation-agnostic WireGuard/OpenVPN config files, since your own service does so? Regardless, thanks again for the work you're doing in this sector, and best of luck for the future.
- kfreds 6y ago
  Thanks! Yes, I completely recognize that many users prefer to download a generic configuration file for WireGuard or OpenVPN. In our case we want to support that use case. At the same time encouraging use of our own app allows us to invent to a much greater extent. And mitigate risks. There are plenty of VPN clients, some by big enterprise-y networking companies, that at least historically have behaved in ways that leaks the user's traffic when interfaces change, on DHCP issues, tunnel disconnections. It's just easier to make our own app and be able to say what it does and doesn't. And that nothing will change tomorrow because of someone else's design decision. :)
tgragnato 6y ago
This is great for non-techies, but I want to control my own traffic, customize the behavior of my VPNs, ... Any deviation from the standard implementation, open source or not, is a hindrance.
- trillic 6y ago
  Mullvad allows you to use any Wireguard public key you want on your account, you can just use the standard client, generate your own keys, and do your own config. Not an employee I just like the service.
wintermutestwin 6y ago
I thought Mullvad recommends WireGuard and that your app uses OpenVPN? On Mac, WireGuard is certainly faster to connect and more stable than the Mullvad app.
- kfreds 6y ago
  Hi! No, our app uses WireGuard by default. https://mullvad.net/en/help/wireguard-macos-app/ https://mullvad.net/en/help/wireguard-macos-app/
input_sh 6y ago
I absolutely love your service and will definitely renew it considering my one-year license is close to expiry. Any reason why you don't use a PPA or something to auto-release updates? I've postponed an update quite a few times because the friction of going to your website, downloading it, and then upgrading the package is just a bit too much in certain situations. Other than that my only gripe with the app is that I can't close it from the app indicator, but have to re-open it, click on the settings, and then choose "quit app".
- kfreds 6y ago
  Hi! I'm glad to hear that! Regarding PPA etc I can't say for sure since I don't lead the app team and don't want to interrupt their work day. I'll relay your comment though. I hope that's OK.
  - IgorPartola 6y ago
    This is great to see. I highly recommend your team look into it. Setting up a PPA (or even just your own APT repo on S3) is extremely simple and is a robust way to push out updates. I would be happy to do a few hours of consulting for your team to help get this done.

by kfreds 6y ago

Spivak 6y ago

But it throws compatibility with devices that don't support your client out the window. Like I might want to have an entire VLAN on my home network route all traffic through the VPN which would happen through my router. But my router only supports common VPN protocols like IPSec, OpenVPN, and WireGuard. Sure, I could make it work with a separate Linux server running your app and some routing but that's far more work than most other VPN providers. I'm fine with warnings in your UI about connections with these protocols being "less secure" like how Zoom handles E2E with phones.

purjolok 6y ago
Mullvad also provides OpenVPN and Wireguard config files. https://mullvad.net/sv/help/tag/other-vpn-software/ https://mullvad.net/sv/help/tag/other-vpn-software/
- Spivak 6y ago
  So then what's with all the claims that Mozilla VPN doesn't work with them? I held off trying Moz's VPN service because of people saying it didn't work and not finding any official support.
  - opheliate 6y ago
    While Mullvad provide those configuration files to customers who use their service directly, customers who are subscribed to Mozilla VPN don't have access to these configuration files, which is what makes it especially irritating to me.
    - wintermutestwin 6y ago
      I think the market segmentation is that more savvy users would bypass Mozilla and sub directly with Mullvad.
      - Spivak 6y ago
        Which is fine except that I would go with Moz VPN specifically because I want to give them money. Mozilla seems to make it really hard to pay them for goods and services.

opheliate 6y ago

Hi, thanks for the response. I'm a big fan of Mullvad's approach to creating a VPN, and I'm hopeful that more companies will follow in your path. I've been using your service for a few months now, and I'm really satisfied with it. I should perhaps have been clearer when I referred to generic VPN clients, I was talking about the original WireGuard implementation by Jason Donenfeld, not just some random software, which I would hope you agree is a (sufficiently) secure implementation when used by technically proficient users? I do appreciate that there are reasons for having a specific client for your service, and it is absolutely necessary for those who are new to VPN apps, but I would hope you appreciate the reasons for providing implementation-agnostic WireGuard/OpenVPN config files, since your own service does so? Regardless, thanks again for the work you're doing in this sector, and best of luck for the future.

kfreds 6y ago
Thanks! Yes, I completely recognize that many users prefer to download a generic configuration file for WireGuard or OpenVPN. In our case we want to support that use case. At the same time encouraging use of our own app allows us to invent to a much greater extent. And mitigate risks. There are plenty of VPN clients, some by big enterprise-y networking companies, that at least historically have behaved in ways that leaks the user's traffic when interfaces change, on DHCP issues, tunnel disconnections. It's just easier to make our own app and be able to say what it does and doesn't. And that nothing will change tomorrow because of someone else's design decision. :)

tgragnato 6y ago

This is great for non-techies, but I want to control my own traffic, customize the behavior of my VPNs, ... Any deviation from the standard implementation, open source or not, is a hindrance.

trillic 6y ago
Mullvad allows you to use any Wireguard public key you want on your account, you can just use the standard client, generate your own keys, and do your own config. Not an employee I just like the service.

wintermutestwin 6y ago

I thought Mullvad recommends WireGuard and that your app uses OpenVPN? On Mac, WireGuard is certainly faster to connect and more stable than the Mullvad app.

kfreds 6y ago
Hi! No, our app uses WireGuard by default. https://mullvad.net/en/help/wireguard-macos-app/ https://mullvad.net/en/help/wireguard-macos-app/

input_sh 6y ago

I absolutely love your service and will definitely renew it considering my one-year license is close to expiry. Any reason why you don't use a PPA or something to auto-release updates? I've postponed an update quite a few times because the friction of going to your website, downloading it, and then upgrading the package is just a bit too much in certain situations. Other than that my only gripe with the app is that I can't close it from the app indicator, but have to re-open it, click on the settings, and then choose "quit app".

kfreds 6y ago
Hi! I'm glad to hear that! Regarding PPA etc I can't say for sure since I don't lead the app team and don't want to interrupt their work day. I'll relay your comment though. I hope that's OK.
- IgorPartola 6y ago
  This is great to see. I highly recommend your team look into it. Setting up a PPA (or even just your own APT repo on S3) is extremely simple and is a robust way to push out updates. I would be happy to do a few hours of consulting for your team to help get this done.