27 ms·

Mozilla VPN Completes Independent Security Audit by Cure53

407 points by st3fan 5y ago

mfollert 5y ago
"FVP-02-014 General: Cross-site WebSocket hijacking (High) The provided staging build contains the Mozilla VPN WebSocket Controller, which exposes a WebSocket endpoint on localhost. No additional authentication is required to interact with this port, thus allowing any website to connect and interact with the VPN client. At the beginning of the audit, Mozilla assured that this WebSocket server is only part of the staging build. However, later it was revealed that Mozilla would like to reuse this connection for communication with a browser extension in the future. Thus, Cure53 decided to report this issue." A classic one. Also interesting: "On Linux and macOS, a helper shell script is called by the privileged daemon which sets up WireGuard and network configurations. This script is extremely critical for security and should normally get most of the security attention. However, prior to the test, Mozilla has announced that it will be replaced soon and, as such, does not warrant substantial reviewing efforts. This - in Cure53’s opinion - is rather unfortunate in relation to its criticality. Cure53 therefore recommends that the upcoming changes get comprehensively reviewed in terms of security before they are shipped in production releases."
- corty 5y ago
  So in short, the audit is an advertising stunt and will say nothing at all about the security of the actual product.
  - munchbunny 5y ago
    That's an overly cynical way of looking at this. Security audits of your code are a matter of course best practice and are unrelated to "does the VPN live up to its marketing claims?" It's like publishing that you passed health and safety inspection for a factory that makes safes. I don't think anyone would reasonably confuse a company publishing that its factory passed inspection for a claim that its safes are hard to break into. They released the full report here and it's pretty clear on what they did and didn't audit: https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...
    - ivegotnoaccount 5y ago
      You don't expect it. But if they were to publicize the result of the inspection, promote it and after the said inspection, start manufacturing plutonium safes, you probably would not be happy as a buyer. (I know plutonium is not a good choice for the comparison as in the VPN case, we don't know if what will replace the script will be secure or not whereas plutonium is known to be unsafe, but the idea remains that changing something critical to safety after the audit is not nice to hear at all.)
      - munchbunny 5y ago
        I think what you're saying is you don't know whether future versions of the code are safe? That's fair, but also I don't know any companies in the industry that pay for a fine-toothed-comb audit like this one for every major/minor release because it's simply not practical. I don't think this report pretends or is intended to pretend that a one-time audit is representative of future code any more than a negative COVID test is representative of whether you have COVID two weeks later. But that's not an argument against disclosing that you came up negative on your last test a few days ago, because disclosure is still better than the opposite. The way Mozilla is handling this is a textbook implementation of typical pretty-good transparency/disclosure practices. A post discussing the big issues, and the full report available publicly. I think it's a cynical take specifically because it's the least charitable take on someone following best practices.
        ivegotnoaccount 5y ago
        If the code in question was standard code, this would not be such an issue. However, it is code that runs with all the privileges, and is therefore the one where security issues would hit the biggest. That is even more true as this code manipulates what is running on the computer, which is easy to get slightly wrong (For instance, for a long time, the LDD binary could be used to execute arbitrary code and it was therefore unsafe to run dracut with dependency resolution on unsafe binaries) I am not saying that I am against Mozilla's transparency, especially as they were clear on this issue and said by themselves they intended to change this code before release. I'm simply explaining why some may find it either a bad faith or strong security issue.
  - sneak 5y ago
    Yes, because a VPN is a service and you can only meaningfully audit software itself. Any service audit is meaningless one second later as the operator of the service can change it to serve their purposes. People all too frequently confuse software and services. They aren't the same. This is a software audit, and the thing that needs trust is the service.
    - commoner 5y ago
      Mozilla VPN uses the Mullvad VPN service for most of its backend, and Mullvad had Cure53 complete an audit of its infrastructure last December: https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/ https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
      - sneak 5y ago
        As I mentioned, this is irrelevant one second after it's published.
        dylan604 5y ago
        If they tie a hash of the software to the report, then you can verify the software is the same. Not sure how to handle updates later though. What level of udpates would require an entirely new audit?
        m4rtink 5y ago
        But how do you verify the backend code and infrastructure? Thats the most important question for a VPN.
        sneak 5y ago
        The audit commoner is referring to is of their backend infrastructure, not their published software.
- deleted 5y ago
  [deleted]
badguybeetle 5y ago
they do use mullvad to provide this service and mullvad's pricing model is flat monthly rate at ~$5 and yet mozilla charges almost double the amount per month at $9.99 and you need to get locked in to 12 month subscription to get the same price as mullvad charges. i don't get what is the reasoning behind this
- arbitrage 5y ago
  Mozilla can't afford to work for free. They need to get paid, too.
  - auslegung 5y ago
    If I understand the OP well, the question is, how can Mozilla justify charging twice what Mullvad charges, and lock you into a 12-month contract, for what is largely a repackaging of Mullvad.
    - vmoore 5y ago
      So just use Mullvad instead. For those who want to support Mozilla's efforts, this is a good way of doing it. Think of your extra $5 as a sort of donation to them for building such a wonderful browser and browser ecosystem (Lockwise, extensions, Pocket etc)
      - dweekly 5y ago
        A $5 donation is at least tax deductible and comes with less overhead for the foundation to process.
        gruez 5y ago
        But firefox is developed by mozilla corporation, and donations to mozilla foundation doesn't fund firefox development. It goes to various advocacy/activism causes.
vmoore 5y ago
I've toyed with some VPN browser extensions. Not naming names. I became a customer of a few VPNs over the years, to try some of these extensions out, and the extensions leak your real IP inadvertently. One such extension said it was 'connected' when I DuckDuckGo'd 'what is my ip' and it reported my real / naked IP. So my solution was to use a (hardware) VPN router which ensures all your traffic is tunneled through the VPN and you don't have to worry about edge cases like this leaking your real IP. Also: many users don't even turn off WebRTC which can expose you too. Many people it seems, don't know about the WebRTC VPN vuln that was disclosed many years ago. Edit: I reported these extension vulns and they got fixed, but I still don't trust them.
- pydry 5y ago
  you can still get dns leaks with hardware vpn i think.
  - dahfizz 5y ago
    If your route to the DNS server is through your VPN router, you are protected. DNS leaks are a subset of the problem where not all of your traffic goes through the VPN routes. If your only connection to the internet is through the VPN, the odds of that happening approaches 0%. If you're using some browser extension, the odds of that happening approaches 100%
- madars 5y ago
  Regarding WebRTC-type leaks probably the best answer on Linux is to have a separate network namespace with only wg0 inside of it and then run your browser in the network namespace. Then the browser does not get to "see" the real egress interface/its IP and thus can't leak it even if it wanted to. Or, if you want this to apply for everything, move physical interface in its own namespace so all apps from the default namespace only see the WireGuard interface. See https://www.wireguard.com/netns/ https://www.wireguard.com/netns/
  - thayne 5y ago
    I actually did something similar to this for slightly different use case. I needed to connect to two different VPNs simultaneously that had overlapping cidr ranges. So I created a network namespace for one of them, and used that for any connections that needed that VPN, and used the root network namespace for the other VPN. I did have to create two separate browser profiles though, since both firefox and chrome won't let you run multiple instances of the same profile simultaneously.
xanaxagoras 5y ago
Aren't they just reselling Mullvad? So is everything said here true for Mullvad generally? Edit: I use an always on VPN on my phone but I can only have one, and that's taken by my local wireguard so I can access the not-cloud services that I run remotely. I've figured out how to connect Mullvad at the same time on that server, such that all traffic on the server goes through Mullvad. I can't figure out how to chain them. I want to make a request to my local network wireguard (wg0) and have any traffic that isn't local be routed through to the mullvad connection (wg1) so I can both access my local network and use the internet over the VPN. Has anyone don this or could anyone point me in the right direction? This is on a linux machine...
- tyingq 5y ago
  The GUI client is different and produced by Mozilla, probably other pieces as well. https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client
  - deleted 5y ago
    [deleted]
- kristjank 5y ago
  Yup, it's still just mullvad.net with less privacy and a shadier corporate front. Chaining is doable using separate routing domains. Not for the faint of heart though.
  - orf 5y ago
    I trust Mozilla way more than I trust Mullvad. And I’m a Mullvad customer.
    - haswell 5y ago
      This raises an interesting question: Is there any benefit to getting the Mozilla offering over the Mullvad offering?
lol768 5y ago
Somewhat surprised at how far you can get down the sign-up flow using the (internet-facing, publicly accessible) staging URLs that the report mentions - i.e. https://www-dev.allizom.org/en-US/products/vpn/ https://www-dev.allizom.org/en-US/products/vpn/ and https://accounts.stage.mozaws.net/settings https://accounts.stage.mozaws.net/settings
tptacek 5y ago
Hey, finally I'm catching a report like this at a point in time where I'm not myself working as a software security assessment consultant, which frees me to get publicly back on my hobby horse about public assessment reports. I think third-party assessment reports like these are a real problem in our industry. There are firms that are worse about them and firms that are somewhat better but it's a near-universal problem. I don't at all object to technical vulnerability reports being shared. It's good to know when third-party auditors have spotted problems in products (and it's also good for prospective customers of consulting firms to know what kinds of vulnerabilities that firm is likely to spot, and how padded out some of these reports can be with low-quality findings). I also think it's worth remembering that the overwhelming majority of security assessment engagements are never reported out to the public; even when vendors do publish reports, more often than not it's after previous unpublished engagements have been run. But the way these reports get written creates a huge conflict of interest. They're not simply reports of (1) what was tested and (2) what was found. Too often, they're also product marketing documents, beginning and concluding with "overall assessments" of the target software that is almost invariably positive, even on projects that reduced the target to a smoking crater (to say the least, that didn't happen here, but when it does, it's always framed as "[vendor] has made great strides in improving their security in the wake of this important engagement"). There are firms that specialize in writing public audit reports, and firms that specialize in finding excellent vulnerabilities, and the Venn of those firms is practically two disjoint circles† --- at least in the sense that there's a sort of insider chatter about who the quietly bad-ass firms are, and who the "most credible for shutting down sales objections" firms are. Even when they're not intended to be tools of persuasion, public audit reports tend to function that way systemically. That's because vendors control the terms on which these audits are done, what's to be tested, when the testing will occur, how much time will be allotted and who's staffing. Vendors pay for public-facing reports, as an extra line item in the SOW, and in some circumstances get to review drafts. Meanwhile, the public that reads these reports is in no way qualified to weigh or contextualize the report. If you're reading an audit report from a commercial vendor, it is invariably presented as a "clean bill of health". But even if you somehow get principals at Azimuth to assess your system, there is no such thing as a clean-bill-of-health audit. Different teams of auditors will find different bugs (even different teams from the same vendor!). I think we need a new norm in the industry, and that it can only come from the auditing firms themselves. I think that, roughly, that norm should be that public-facing reports can be provided only in the same dry, technical form they're presented to development teams in ordinary, non-public projects: a methodology, a scope and rules of engagement, and a list of findings. No editorializing and no editorial review by vendors. Probably, though I'm less clear on the mechanics of how this would work, it should also stop being OK to charge different amounts for projects that do and don't have public reports. I know there are consultants that disagree with me about this; I look forward to reading their takes. † I'm not editing this out but on reflection this is pretty imprecise and it's probably easy to come up with a counterexample.
zoobab 5y ago
Boycott Firefox instead https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...
- q-rews 5y ago
  Care to give more context? Are you boycotting Firefox because of some triggering keywords in that article? Or what?
  - sfink 5y ago
    I don't know, but I'll paste the specific things that article is calling for: > Reveal who is paying for advertisements, how much they are paying and who is being targeted. > Commit to meaningful transparency of platform algorithms so we know how and what content is being amplified, to whom, and the associated impact. > Turn on by default the tools to amplify factual voices over disinformation. > Work with independent researchers to facilitate in-depth studies of the platforms’ impact on people and our societies, and what we can do to improve things. I'm at a bit of a loss to guess which of those might be triggering. But then, I agree with them. (Disclosure: I work for Mozilla too, so yeah, I'm biased. I'm a long way from the relevant policy discussions, though.) I've always had mixed feelings about that article. The whole "deplatforming" thing is kind of a red herring. The article seems to approve of deplatforming, which is something I'm generally not comfortable with, but it isn't actually about deplatforming at all. I suspect that's the part that triggers reactions, for reasons that I sympathize with even though I don't think they apply to the particular case in question.
    - deleted 5y ago
      [deleted]
    - hn8788 5y ago
      > Turn on by default the tools to amplify factual voices over disinformation. If we've learned anything over the past year, it's that tech companies have no business deciding what is factual. "We're going to decide what's true, then make sure people only hear what we want them to hear" is just deplatforming with extra steps.
opheliate 5y ago
Tangential: Can anyone with experience in this field provide an estimate for how much this kind of audit costs? Just considering the viability of open source projects fundraising to cover the cost of an audit.
- V99 5y ago
  It of course depends a lot on the scope of testing you want done (code audit, probing your running SaaS, some light breaking & entering [1]…) and how much time you want to give them to probe. And how well organized you are in providing them info/how much trouble it seems like you're going to be for them. And how well known the vendor doing the work is. And lots of other factors. Possibly somewhat discounted for OSS or high-profile projects, this is also an advertisement for Cure53 to some degree. But as a random guess for a random project, at least low 5-figures. [1]: https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te...
- InitialBP 5y ago
  Penetration tester here - My anecdotal experience: I've worked on a number of projects where bill rate is something like $250-$400/hr per engineer depending on complexity, access to source code, size of the project, etc. Usually equating to something like 10-12k for a single engineer on a project for a week. For bigger projects like this I would think it's totally reasonable to see anything from 4 engineering weeks -> 12 engineering weeks depending on different pieces and especially given this is a very high profile project. Based on that estimate of something between ~40k-120k. I know that's a huge range, but just wanted to share what I do know.
  - tpmx 5y ago
    For a Berlin-based team like the one Mozilla used, $250-$400/hr/engineer is kinda hard to believe. Probably closer to $150-$200/hr. The average software engineer in Berlin makes $71k/yr. The compensation levels are very different compared to SV.
    - 5y ago
deleted 5y ago
[deleted]
pgroves 5y ago
Ok but how do I know I should trust Cure53?
- Psychotherapist 5y ago
  cure53 has a pretty solid track record [1] and has some smart people working for them [2]. I get your concern, but considering this, I'd trust them. [1]: https://cure53.de/#publications https://cure53.de/#publications [2]: https://cure53.de/#team https://cure53.de/#team
  - no_time 5y ago
    Slight tangent but that's a cool looking website. Gives off a mid 00's private tracker vibe. Loads pretty fast too.
- genewitch 5y ago
  It's turtles all the way down.
- rsj_hn 5y ago
  Because they have an excellent reputation and do good work.
- lucb1e 5y ago
  Read the report and see if the findings are super basic or super advanced. If you can't tell, then this audit report is not of value to you, similar to how my mom has no use for open source software yet I would still say it's valuable to have open source software in the world.
cycomanic 5y ago
The issue with pretty much all of these security audits is that they typically are limited to code audits of desktop or server software. Much of the security of VPNs though depends on the configuration of the servers/endpoints. Does it keep logs (on purpose or accidentally), are logs/traces of connections wiped from the RAM as well when you disconnect ... So even if you VPN client is perfectly secure, if someone is listening on the server nothing matters. Importantly, it's probably not unlikely that they were even set up by a "subcontractor" so even if Mozilla does everything right, there is the chance that a subcontractor still made a mistake and logs are being saved for example. So a proper security audit would do lots of spotchecks on servers to see how well they are configured. A proper security
- bdibs 5y ago
  https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
  - cycomanic 5y ago
    Thanks I didn't see this before. In the infrastructure what exactly did they audit? It seems 4 servers? Is that correct? I'm not sure I understand how these companies set up their networks, but every exit point would correspond to a server wouldn't it? I should probably clarify that I didn't really mean that Mozilla (or mullvad) is unsecure, simply that reports like this don't really tell us a lot, because the infrastructure is quite significant and it might be changing continuously. On the other hand I don't think there's anything better.
jtdev 5y ago
Can anyone articulate what actual and tangible security and/or privacy benefit this or any other consumer VPN provides?
- floatingatoll 5y ago
  Do you have an existing opinion on that topic, or are you greenfield-unfamiliar with the reasons various people consider important?
  - jtdev 5y ago
    No strong opinion, but I’m a bit skeptical.
deleted 5y ago
[deleted]
aborsy 5y ago
Glad to see the positive report. On Mullvad VPN right now! Any privacy benefit if I go through Mozilla?
- kunagi7 5y ago
  Both Mullvad and Mozilla VPN are the same service (Mozilla leases it from Mullvad). Mullvad has a flat monthly fee (5€) and only stores a randomly generated 16 digit account number that you can stop filling up the day you want. You can pay with almost anything, crypto, credit card, even via post mail+. Mozilla's VPN requires you to create a Firefox account and provide them your email, your age and a password. Optionally you can enable 2FA authentication. So you trade off a bit more of your privacy in exchange of the same service you already have. It only makes sense if you want to support the Mozilla Corporation and Firefox's development (after all, money donated to the Foundation doesn't go to the Corporation). +Fixed
  - lucb1e 5y ago
    > even via post email Does Signal count as post-email message system? I heard they have a great payment system these days.
    - kunagi7 5y ago
      My bad, I really should be more careful with autocomplete. I just fixed my message. Mullvad's pricing page explains their available payment methods quite well: https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/
EVa5I7bHFq9mnYK 5y ago
What exactly this audit certifies? That the software has no bugs? But I don't think this is possible, even theoretically.
- cpeterso 5y ago
  The blog post links to Cure53's security audit report, which lists the issues found: https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...
- lucgommans 5y ago
  It certifies what it says on the tin: an independent audit was performed by Cure53. You are correct in believing that certifying complex software to be free of bugs to be practically impossible at the moment. But which product would you rather use: one where you have to trust the developers, or one where you have to trust the developers plus an independent team got 5 weeks of paid time to study it for any flaws? As someone working in this industry, I can also say it's significantly harder to find exploitable bugs after another audit team went over it already. A criminal would have the same problem and might chose another target instead.
Crazyontap 5y ago
My biggest problem with using a VPN is the overtly hostile treatment by Google and Cloudflare. Everytime I try to browse with a VPN (currently using Windscribe) I just see those nasty captchas everywhere. Google won't even let me do a simple search without letting me tag zebra crossings and school buses. Same with Cloudflare which also adds CAPTCHA before showing me a site which is basically most of the internet now. Really don't understand why they do this to VPN users. Anyway, Anybody know how to fix this?
- slivanes 5y ago
  Unfortunately criminal/fraudulent/unsocial activity also occurs almost elusively behind a VPN, you might not be doing such things, but websites can't tell if you're not one of those people.
  - gunapologist99 5y ago
    Unfortunately criminal/fraudulent/unsocial activity also occurs almost exclusively in certain neighborhoods. You might not be doing such things, but no one can tell if you're not one of those people.
    - jl6 5y ago
      This is one of the reasons why insurance premiums vary by zip code.
    - treesknees 5y ago
      I'm not sure what you're trying to add to the conversation. Companies and network providers implement regional and country blocking all the time. My company doesn't do business with anyone in China, so they block IP addresses associated with China. It's not insinuating racism or profiling of the people, but it's well-known that certain areas of the world have bad actors. If you're trying to somehow set an example of where it's OK in one context and not OK in another, that's really not a fair comparison.
    - supertrope 5y ago
k_bx 5y ago
What takes them so long to sell their VPN worldwide? Would love to become a user.
- LeoPanthera 5y ago
  Mozilla VPN is just Mullvad rebranded, and there's no geo restriction to joining Mullvad. https://mullvad.net/ https://mullvad.net/
  - k_bx 5y ago
    Does Mozilla make money from it at all? If yes, how much? (What’s the cut?)
Causality1 5y ago
Mozilla VPN advantage: a company far more reputable than almost any other VPN provider for doing all the things people say they want a VPN for. Mozilla VPN disadvantage: Mozilla is probably far less tolerant of all the things most people actually use a VPN for.
- KorematsuFred 5y ago
  Brilliant summary. I would need a VPN mostly to visit some sites while spoofing my location, testing my competitions ux in other countries etc. I can also see because of Mozilla's reputation employers offering these VPN free of cost to their employees.
- azalemeth 5y ago
  Mozilla isn't actually providing the VPN infrastructure and bandwidth -- Mullvad, a well-respected Swedish operator, is. I think they run their own ISP behind the scenes.
- threatofrain 5y ago
  But what's the advantage here? Once Mozilla blesses Mullvad, then... customers already know that Mullvad is good. It's understandable why Mullvad could have a partnership agreement with Mozilla, but it's not obvious why customers shouldn't just bypass Mozilla and go straight to Mullvad with cheaper prices.
  - CameronNemo 5y ago
    If you get the 12 month plan, they are the same nominal amount, but mullvad charges 5 euros and Mozilla charges 5 USD. So depending on the exchange rate, one will be cheaper. Right now and likely for the foreseeable future that is Mozilla.
    - deleted 5y ago
      [deleted]
    - piaste 5y ago
      On the other side, what sort of information do you need to provide to subscribe to Mozilla VPN? One of the killer features of Mullvad is that their accounts are as anonymous as you can get, up to and including paying with envelopes full of cash.
deleted 5y ago
[deleted]
Lio 5y ago
This looks interesting if only for an alternative income stream to support Mozilla.
lilsoso 5y ago
Shouldn't some non-trivial % of VPN companies popular on the market be run by intelligence agencies by various countries as a honey pot operation? Or is the idea that intelligence agencies have better means to monitor internet traffic?
- CyanBird 5y ago
  I mean, supposedly that's exactly what happens with tor, nsa and friends run many, many exit nodes and scrap info from there, to such a level that people are worried that it is possible (or plausible) that they can/could identify users through different fingerprints, maybe not for something that would hold in court, but enough that it could make you a person of interest for them to see if they can deploy some of their malware packages As for intelligence agencies, famously ProtonMail which works from Switzerland operates in a country with information sharing partnerships with the 5eyes, yet they are not all too concerned about it, nor interested on having their server-side software audited, so that to me raises eyebrows In the past we have had the cryptoag scandal and BCCI which was an entire huge international bank with branches all over the world which basically only existed to be a front to CIA money laundering.... I personally believe that these guys are now operating with Deutsche bank and Cryptocurrencies which is just what would make sense for them as Deutsche bank is a corruption ridden company and Crypto is can be obfuscated so much as to be basically nontraceable I have personally moved away from ProtonMail, I have 0 sources but they give me too much of a bad cryptoag vibe/honeypot, sad as it is, if you want secure email you must self host it which can be quite a pain in the arse, but these are the costs to have peace of mind As for their VPN I would not use it, I don't like that ProtonMail centralized so many "privacy things" into a single point of failure
- zinekeller 5y ago
  Actually, skip all of that: social engineering is still the best way, even NSA has stated that. Assuming that social engineering is hard (for example, the target are computers operating machinery), while Windows is... not bulletproof, most applications (especially in-house apps) tends to be nothing more than a wooden gate, and therefore it's more expedient to do that than monitoring encrypt communications (obviously, it's has some benefits but it also has a lot of chaff, so it's better to have a wiretap directly).
patrakov 5y ago
It bothers me that Cure53 is the only auditing agency for VPN providers that actually publishes their findings, finds more than nothing, and responds via email to queries regarding their past audits. Yes, there is another company, Altius IT, that audited PureVPN for their no-log policy. But they found nothing, and refused to answer my email inquiry with a simple question: "if PureVPN were have caught not storing any logs or connection data, but immediately sending them to a third party, would that have been reported as a finding?". The question was asked because on paper, this is not a violation of the published policy.
YeBanKo 5y ago
Once I learned that Mozilla was using Mullvad servers, my trust to Mullvad increased. Though, besides credibility I am not sure what other benefit Mozilla brings to the table by reselling it? Since they both use WireGuard protocol, client is mostly about UI, rather than functionality. What would be cool, if Mozilla partnered with multiple VPN providers and had a multi-hop VPN with at least 3 nodes and multi layered encryption, similar to TOR.

407 points by st3fan 5y ago

"FVP-02-014 General: Cross-site WebSocket hijacking (High) The provided staging build contains the Mozilla VPN WebSocket Controller, which exposes a WebSocket endpoint on localhost. No additional authentication is required to interact with this port, thus allowing any website to connect and interact with the VPN client. At the beginning of the audit, Mozilla assured that this WebSocket server is only part of the staging build. However, later it was revealed that Mozilla would like to reuse this connection for communication with a browser extension in the future. Thus, Cure53 decided to report this issue." A classic one. Also interesting: "On Linux and macOS, a helper shell script is called by the privileged daemon which sets up WireGuard and network configurations. This script is extremely critical for security and should normally get most of the security attention. However, prior to the test, Mozilla has announced that it will be replaced soon and, as such, does not warrant substantial reviewing efforts. This - in Cure53’s opinion - is rather unfortunate in relation to its criticality. Cure53 therefore recommends that the upcoming changes get comprehensively reviewed in terms of security before they are shipped in production releases."

corty 5y ago
So in short, the audit is an advertising stunt and will say nothing at all about the security of the actual product.
- munchbunny 5y ago
  That's an overly cynical way of looking at this. Security audits of your code are a matter of course best practice and are unrelated to "does the VPN live up to its marketing claims?" It's like publishing that you passed health and safety inspection for a factory that makes safes. I don't think anyone would reasonably confuse a company publishing that its factory passed inspection for a claim that its safes are hard to break into. They released the full report here and it's pretty clear on what they did and didn't audit: https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...
  - ivegotnoaccount 5y ago
    You don't expect it. But if they were to publicize the result of the inspection, promote it and after the said inspection, start manufacturing plutonium safes, you probably would not be happy as a buyer. (I know plutonium is not a good choice for the comparison as in the VPN case, we don't know if what will replace the script will be secure or not whereas plutonium is known to be unsafe, but the idea remains that changing something critical to safety after the audit is not nice to hear at all.)
    - munchbunny 5y ago
      I think what you're saying is you don't know whether future versions of the code are safe? That's fair, but also I don't know any companies in the industry that pay for a fine-toothed-comb audit like this one for every major/minor release because it's simply not practical. I don't think this report pretends or is intended to pretend that a one-time audit is representative of future code any more than a negative COVID test is representative of whether you have COVID two weeks later. But that's not an argument against disclosing that you came up negative on your last test a few days ago, because disclosure is still better than the opposite. The way Mozilla is handling this is a textbook implementation of typical pretty-good transparency/disclosure practices. A post discussing the big issues, and the full report available publicly. I think it's a cynical take specifically because it's the least charitable take on someone following best practices.
      - ivegotnoaccount 5y ago
        If the code in question was standard code, this would not be such an issue. However, it is code that runs with all the privileges, and is therefore the one where security issues would hit the biggest. That is even more true as this code manipulates what is running on the computer, which is easy to get slightly wrong (For instance, for a long time, the LDD binary could be used to execute arbitrary code and it was therefore unsafe to run dracut with dependency resolution on unsafe binaries) I am not saying that I am against Mozilla's transparency, especially as they were clear on this issue and said by themselves they intended to change this code before release. I'm simply explaining why some may find it either a bad faith or strong security issue.
- sneak 5y ago
  Yes, because a VPN is a service and you can only meaningfully audit software itself. Any service audit is meaningless one second later as the operator of the service can change it to serve their purposes. People all too frequently confuse software and services. They aren't the same. This is a software audit, and the thing that needs trust is the service.
  - commoner 5y ago
    Mozilla VPN uses the Mullvad VPN service for most of its backend, and Mullvad had Cure53 complete an audit of its infrastructure last December: https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/ https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
    - sneak 5y ago
      As I mentioned, this is irrelevant one second after it's published.
      - dylan604 5y ago
        If they tie a hash of the software to the report, then you can verify the software is the same. Not sure how to handle updates later though. What level of udpates would require an entirely new audit?
        m4rtink 5y ago
        But how do you verify the backend code and infrastructure? Thats the most important question for a VPN.
        sneak 5y ago
        The audit commoner is referring to is of their backend infrastructure, not their published software.
deleted 5y ago
[deleted]

badguybeetle 5y ago

they do use mullvad to provide this service and mullvad's pricing model is flat monthly rate at ~$5 and yet mozilla charges almost double the amount per month at $9.99 and you need to get locked in to 12 month subscription to get the same price as mullvad charges. i don't get what is the reasoning behind this

arbitrage 5y ago
Mozilla can't afford to work for free. They need to get paid, too.
- auslegung 5y ago
  If I understand the OP well, the question is, how can Mozilla justify charging twice what Mullvad charges, and lock you into a 12-month contract, for what is largely a repackaging of Mullvad.
  - vmoore 5y ago
    So just use Mullvad instead. For those who want to support Mozilla's efforts, this is a good way of doing it. Think of your extra $5 as a sort of donation to them for building such a wonderful browser and browser ecosystem (Lockwise, extensions, Pocket etc)
    - dweekly 5y ago
      A $5 donation is at least tax deductible and comes with less overhead for the foundation to process.
      - gruez 5y ago
        But firefox is developed by mozilla corporation, and donations to mozilla foundation doesn't fund firefox development. It goes to various advocacy/activism causes.

vmoore 5y ago

I've toyed with some VPN browser extensions. Not naming names. I became a customer of a few VPNs over the years, to try some of these extensions out, and the extensions leak your real IP inadvertently. One such extension said it was 'connected' when I DuckDuckGo'd 'what is my ip' and it reported my real / naked IP. So my solution was to use a (hardware) VPN router which ensures all your traffic is tunneled through the VPN and you don't have to worry about edge cases like this leaking your real IP. Also: many users don't even turn off WebRTC which can expose you too. Many people it seems, don't know about the WebRTC VPN vuln that was disclosed many years ago. Edit: I reported these extension vulns and they got fixed, but I still don't trust them.

pydry 5y ago
you can still get dns leaks with hardware vpn i think.
- dahfizz 5y ago
  If your route to the DNS server is through your VPN router, you are protected. DNS leaks are a subset of the problem where not all of your traffic goes through the VPN routes. If your only connection to the internet is through the VPN, the odds of that happening approaches 0%. If you're using some browser extension, the odds of that happening approaches 100%
madars 5y ago
Regarding WebRTC-type leaks probably the best answer on Linux is to have a separate network namespace with only wg0 inside of it and then run your browser in the network namespace. Then the browser does not get to "see" the real egress interface/its IP and thus can't leak it even if it wanted to. Or, if you want this to apply for everything, move physical interface in its own namespace so all apps from the default namespace only see the WireGuard interface. See https://www.wireguard.com/netns/ https://www.wireguard.com/netns/
- thayne 5y ago
  I actually did something similar to this for slightly different use case. I needed to connect to two different VPNs simultaneously that had overlapping cidr ranges. So I created a network namespace for one of them, and used that for any connections that needed that VPN, and used the root network namespace for the other VPN. I did have to create two separate browser profiles though, since both firefox and chrome won't let you run multiple instances of the same profile simultaneously.

xanaxagoras 5y ago

Aren't they just reselling Mullvad? So is everything said here true for Mullvad generally? Edit: I use an always on VPN on my phone but I can only have one, and that's taken by my local wireguard so I can access the not-cloud services that I run remotely. I've figured out how to connect Mullvad at the same time on that server, such that all traffic on the server goes through Mullvad. I can't figure out how to chain them. I want to make a request to my local network wireguard (wg0) and have any traffic that isn't local be routed through to the mullvad connection (wg1) so I can both access my local network and use the internet over the VPN. Has anyone don this or could anyone point me in the right direction? This is on a linux machine...

tyingq 5y ago
The GUI client is different and produced by Mozilla, probably other pieces as well. https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client
- deleted 5y ago
  [deleted]
kristjank 5y ago
Yup, it's still just mullvad.net with less privacy and a shadier corporate front. Chaining is doable using separate routing domains. Not for the faint of heart though.
- orf 5y ago
  I trust Mozilla way more than I trust Mullvad. And I’m a Mullvad customer.
  - haswell 5y ago
    This raises an interesting question: Is there any benefit to getting the Mozilla offering over the Mullvad offering?

lol768 5y ago

Somewhat surprised at how far you can get down the sign-up flow using the (internet-facing, publicly accessible) staging URLs that the report mentions - i.e. https://www-dev.allizom.org/en-US/products/vpn/ https://www-dev.allizom.org/en-US/products/vpn/ and https://accounts.stage.mozaws.net/settings https://accounts.stage.mozaws.net/settings

tptacek 5y ago

Hey, finally I'm catching a report like this at a point in time where I'm not myself working as a software security assessment consultant, which frees me to get publicly back on my hobby horse about public assessment reports. I think third-party assessment reports like these are a real problem in our industry. There are firms that are worse about them and firms that are somewhat better but it's a near-universal problem. I don't at all object to technical vulnerability reports being shared. It's good to know when third-party auditors have spotted problems in products (and it's also good for prospective customers of consulting firms to know what kinds of vulnerabilities that firm is likely to spot, and how padded out some of these reports can be with low-quality findings). I also think it's worth remembering that the overwhelming majority of security assessment engagements are never reported out to the public; even when vendors do publish reports, more often than not it's after previous unpublished engagements have been run. But the way these reports get written creates a huge conflict of interest. They're not simply reports of (1) what was tested and (2) what was found. Too often, they're also product marketing documents, beginning and concluding with "overall assessments" of the target software that is almost invariably positive, even on projects that reduced the target to a smoking crater (to say the least, that didn't happen here, but when it does, it's always framed as "[vendor] has made great strides in improving their security in the wake of this important engagement"). There are firms that specialize in writing public audit reports, and firms that specialize in finding excellent vulnerabilities, and the Venn of those firms is practically two disjoint circles† --- at least in the sense that there's a sort of insider chatter about who the quietly bad-ass firms are, and who the "most credible for shutting down sales objections" firms are. Even when they're not intended to be tools of persuasion, public audit reports tend to function that way systemically. That's because vendors control the terms on which these audits are done, what's to be tested, when the testing will occur, how much time will be allotted and who's staffing. Vendors pay for public-facing reports, as an extra line item in the SOW, and in some circumstances get to review drafts. Meanwhile, the public that reads these reports is in no way qualified to weigh or contextualize the report. If you're reading an audit report from a commercial vendor, it is invariably presented as a "clean bill of health". But even if you somehow get principals at Azimuth to assess your system, there is no such thing as a clean-bill-of-health audit. Different teams of auditors will find different bugs (even different teams from the same vendor!). I think we need a new norm in the industry, and that it can only come from the auditing firms themselves. I think that, roughly, that norm should be that public-facing reports can be provided only in the same dry, technical form they're presented to development teams in ordinary, non-public projects: a methodology, a scope and rules of engagement, and a list of findings. No editorializing and no editorial review by vendors. Probably, though I'm less clear on the mechanics of how this would work, it should also stop being OK to charge different amounts for projects that do and don't have public reports. I know there are consultants that disagree with me about this; I look forward to reading their takes. † I'm not editing this out but on reflection this is pretty imprecise and it's probably easy to come up with a counterexample.

zoobab 5y ago

Boycott Firefox instead https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...

q-rews 5y ago
Care to give more context? Are you boycotting Firefox because of some triggering keywords in that article? Or what?
- sfink 5y ago
  I don't know, but I'll paste the specific things that article is calling for: > Reveal who is paying for advertisements, how much they are paying and who is being targeted. > Commit to meaningful transparency of platform algorithms so we know how and what content is being amplified, to whom, and the associated impact. > Turn on by default the tools to amplify factual voices over disinformation. > Work with independent researchers to facilitate in-depth studies of the platforms’ impact on people and our societies, and what we can do to improve things. I'm at a bit of a loss to guess which of those might be triggering. But then, I agree with them. (Disclosure: I work for Mozilla too, so yeah, I'm biased. I'm a long way from the relevant policy discussions, though.) I've always had mixed feelings about that article. The whole "deplatforming" thing is kind of a red herring. The article seems to approve of deplatforming, which is something I'm generally not comfortable with, but it isn't actually about deplatforming at all. I suspect that's the part that triggers reactions, for reasons that I sympathize with even though I don't think they apply to the particular case in question.
  - deleted 5y ago
    [deleted]
  - hn8788 5y ago
    > Turn on by default the tools to amplify factual voices over disinformation. If we've learned anything over the past year, it's that tech companies have no business deciding what is factual. "We're going to decide what's true, then make sure people only hear what we want them to hear" is just deplatforming with extra steps.

opheliate 5y ago

Tangential: Can anyone with experience in this field provide an estimate for how much this kind of audit costs? Just considering the viability of open source projects fundraising to cover the cost of an audit.

V99 5y ago
It of course depends a lot on the scope of testing you want done (code audit, probing your running SaaS, some light breaking & entering [1]…) and how much time you want to give them to probe. And how well organized you are in providing them info/how much trouble it seems like you're going to be for them. And how well known the vendor doing the work is. And lots of other factors. Possibly somewhat discounted for OSS or high-profile projects, this is also an advertisement for Cure53 to some degree. But as a random guess for a random project, at least low 5-figures. [1]: https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te...
InitialBP 5y ago
Penetration tester here - My anecdotal experience: I've worked on a number of projects where bill rate is something like $250-$400/hr per engineer depending on complexity, access to source code, size of the project, etc. Usually equating to something like 10-12k for a single engineer on a project for a week. For bigger projects like this I would think it's totally reasonable to see anything from 4 engineering weeks -> 12 engineering weeks depending on different pieces and especially given this is a very high profile project. Based on that estimate of something between ~40k-120k. I know that's a huge range, but just wanted to share what I do know.
- tpmx 5y ago
  For a Berlin-based team like the one Mozilla used, $250-$400/hr/engineer is kinda hard to believe. Probably closer to $150-$200/hr. The average software engineer in Berlin makes $71k/yr. The compensation levels are very different compared to SV.
  - 5y ago

deleted 5y ago

[deleted]

pgroves 5y ago

Ok but how do I know I should trust Cure53?

Psychotherapist 5y ago
cure53 has a pretty solid track record [1] and has some smart people working for them [2]. I get your concern, but considering this, I'd trust them. [1]: https://cure53.de/#publications https://cure53.de/#publications [2]: https://cure53.de/#team https://cure53.de/#team
- no_time 5y ago
  Slight tangent but that's a cool looking website. Gives off a mid 00's private tracker vibe. Loads pretty fast too.
genewitch 5y ago
It's turtles all the way down.
rsj_hn 5y ago
Because they have an excellent reputation and do good work.
lucb1e 5y ago
Read the report and see if the findings are super basic or super advanced. If you can't tell, then this audit report is not of value to you, similar to how my mom has no use for open source software yet I would still say it's valuable to have open source software in the world.

cycomanic 5y ago

The issue with pretty much all of these security audits is that they typically are limited to code audits of desktop or server software. Much of the security of VPNs though depends on the configuration of the servers/endpoints. Does it keep logs (on purpose or accidentally), are logs/traces of connections wiped from the RAM as well when you disconnect ... So even if you VPN client is perfectly secure, if someone is listening on the server nothing matters. Importantly, it's probably not unlikely that they were even set up by a "subcontractor" so even if Mozilla does everything right, there is the chance that a subcontractor still made a mistake and logs are being saved for example. So a proper security audit would do lots of spotchecks on servers to see how well they are configured. A proper security

bdibs 5y ago
https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
- cycomanic 5y ago
  Thanks I didn't see this before. In the infrastructure what exactly did they audit? It seems 4 servers? Is that correct? I'm not sure I understand how these companies set up their networks, but every exit point would correspond to a server wouldn't it? I should probably clarify that I didn't really mean that Mozilla (or mullvad) is unsecure, simply that reports like this don't really tell us a lot, because the infrastructure is quite significant and it might be changing continuously. On the other hand I don't think there's anything better.

jtdev 5y ago

Can anyone articulate what actual and tangible security and/or privacy benefit this or any other consumer VPN provides?

floatingatoll 5y ago
Do you have an existing opinion on that topic, or are you greenfield-unfamiliar with the reasons various people consider important?
- jtdev 5y ago
  No strong opinion, but I’m a bit skeptical.

deleted 5y ago

[deleted]

aborsy 5y ago

Glad to see the positive report. On Mullvad VPN right now! Any privacy benefit if I go through Mozilla?

kunagi7 5y ago
Both Mullvad and Mozilla VPN are the same service (Mozilla leases it from Mullvad). Mullvad has a flat monthly fee (5€) and only stores a randomly generated 16 digit account number that you can stop filling up the day you want. You can pay with almost anything, crypto, credit card, even via post mail+. Mozilla's VPN requires you to create a Firefox account and provide them your email, your age and a password. Optionally you can enable 2FA authentication. So you trade off a bit more of your privacy in exchange of the same service you already have. It only makes sense if you want to support the Mozilla Corporation and Firefox's development (after all, money donated to the Foundation doesn't go to the Corporation). +Fixed
- lucb1e 5y ago
  > even via post email Does Signal count as post-email message system? I heard they have a great payment system these days.
  - kunagi7 5y ago
    My bad, I really should be more careful with autocomplete. I just fixed my message. Mullvad's pricing page explains their available payment methods quite well: https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/

EVa5I7bHFq9mnYK 5y ago

What exactly this audit certifies? That the software has no bugs? But I don't think this is possible, even theoretically.

cpeterso 5y ago
The blog post links to Cure53's security audit report, which lists the issues found: https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...
lucgommans 5y ago
It certifies what it says on the tin: an independent audit was performed by Cure53. You are correct in believing that certifying complex software to be free of bugs to be practically impossible at the moment. But which product would you rather use: one where you have to trust the developers, or one where you have to trust the developers plus an independent team got 5 weeks of paid time to study it for any flaws? As someone working in this industry, I can also say it's significantly harder to find exploitable bugs after another audit team went over it already. A criminal would have the same problem and might chose another target instead.

Crazyontap 5y ago

My biggest problem with using a VPN is the overtly hostile treatment by Google and Cloudflare. Everytime I try to browse with a VPN (currently using Windscribe) I just see those nasty captchas everywhere. Google won't even let me do a simple search without letting me tag zebra crossings and school buses. Same with Cloudflare which also adds CAPTCHA before showing me a site which is basically most of the internet now. Really don't understand why they do this to VPN users. Anyway, Anybody know how to fix this?

slivanes 5y ago
Unfortunately criminal/fraudulent/unsocial activity also occurs almost elusively behind a VPN, you might not be doing such things, but websites can't tell if you're not one of those people.
- gunapologist99 5y ago
  Unfortunately criminal/fraudulent/unsocial activity also occurs almost exclusively in certain neighborhoods. You might not be doing such things, but no one can tell if you're not one of those people.
  - jl6 5y ago
    This is one of the reasons why insurance premiums vary by zip code.
  - treesknees 5y ago
    I'm not sure what you're trying to add to the conversation. Companies and network providers implement regional and country blocking all the time. My company doesn't do business with anyone in China, so they block IP addresses associated with China. It's not insinuating racism or profiling of the people, but it's well-known that certain areas of the world have bad actors. If you're trying to somehow set an example of where it's OK in one context and not OK in another, that's really not a fair comparison.
  - supertrope 5y ago

k_bx 5y ago

What takes them so long to sell their VPN worldwide? Would love to become a user.

LeoPanthera 5y ago
Mozilla VPN is just Mullvad rebranded, and there's no geo restriction to joining Mullvad. https://mullvad.net/ https://mullvad.net/
- k_bx 5y ago
  Does Mozilla make money from it at all? If yes, how much? (What’s the cut?)

Causality1 5y ago

Mozilla VPN advantage: a company far more reputable than almost any other VPN provider for doing all the things people say they want a VPN for. Mozilla VPN disadvantage: Mozilla is probably far less tolerant of all the things most people actually use a VPN for.

KorematsuFred 5y ago
Brilliant summary. I would need a VPN mostly to visit some sites while spoofing my location, testing my competitions ux in other countries etc. I can also see because of Mozilla's reputation employers offering these VPN free of cost to their employees.
azalemeth 5y ago
Mozilla isn't actually providing the VPN infrastructure and bandwidth -- Mullvad, a well-respected Swedish operator, is. I think they run their own ISP behind the scenes.
threatofrain 5y ago
But what's the advantage here? Once Mozilla blesses Mullvad, then... customers already know that Mullvad is good. It's understandable why Mullvad could have a partnership agreement with Mozilla, but it's not obvious why customers shouldn't just bypass Mozilla and go straight to Mullvad with cheaper prices.
- CameronNemo 5y ago
  If you get the 12 month plan, they are the same nominal amount, but mullvad charges 5 euros and Mozilla charges 5 USD. So depending on the exchange rate, one will be cheaper. Right now and likely for the foreseeable future that is Mozilla.
  - deleted 5y ago
    [deleted]
  - piaste 5y ago
    On the other side, what sort of information do you need to provide to subscribe to Mozilla VPN? One of the killer features of Mullvad is that their accounts are as anonymous as you can get, up to and including paying with envelopes full of cash.

deleted 5y ago

[deleted]

Lio 5y ago

This looks interesting if only for an alternative income stream to support Mozilla.

lilsoso 5y ago

Shouldn't some non-trivial % of VPN companies popular on the market be run by intelligence agencies by various countries as a honey pot operation? Or is the idea that intelligence agencies have better means to monitor internet traffic?

CyanBird 5y ago
I mean, supposedly that's exactly what happens with tor, nsa and friends run many, many exit nodes and scrap info from there, to such a level that people are worried that it is possible (or plausible) that they can/could identify users through different fingerprints, maybe not for something that would hold in court, but enough that it could make you a person of interest for them to see if they can deploy some of their malware packages As for intelligence agencies, famously ProtonMail which works from Switzerland operates in a country with information sharing partnerships with the 5eyes, yet they are not all too concerned about it, nor interested on having their server-side software audited, so that to me raises eyebrows In the past we have had the cryptoag scandal and BCCI which was an entire huge international bank with branches all over the world which basically only existed to be a front to CIA money laundering.... I personally believe that these guys are now operating with Deutsche bank and Cryptocurrencies which is just what would make sense for them as Deutsche bank is a corruption ridden company and Crypto is can be obfuscated so much as to be basically nontraceable I have personally moved away from ProtonMail, I have 0 sources but they give me too much of a bad cryptoag vibe/honeypot, sad as it is, if you want secure email you must self host it which can be quite a pain in the arse, but these are the costs to have peace of mind As for their VPN I would not use it, I don't like that ProtonMail centralized so many "privacy things" into a single point of failure
zinekeller 5y ago
Actually, skip all of that: social engineering is still the best way, even NSA has stated that. Assuming that social engineering is hard (for example, the target are computers operating machinery), while Windows is... not bulletproof, most applications (especially in-house apps) tends to be nothing more than a wooden gate, and therefore it's more expedient to do that than monitoring encrypt communications (obviously, it's has some benefits but it also has a lot of chaff, so it's better to have a wiretap directly).

patrakov 5y ago

It bothers me that Cure53 is the only auditing agency for VPN providers that actually publishes their findings, finds more than nothing, and responds via email to queries regarding their past audits. Yes, there is another company, Altius IT, that audited PureVPN for their no-log policy. But they found nothing, and refused to answer my email inquiry with a simple question: "if PureVPN were have caught not storing any logs or connection data, but immediately sending them to a third party, would that have been reported as a finding?". The question was asked because on paper, this is not a violation of the published policy.

YeBanKo 5y ago

Once I learned that Mozilla was using Mullvad servers, my trust to Mullvad increased. Though, besides credibility I am not sure what other benefit Mozilla brings to the table by reselling it? Since they both use WireGuard protocol, client is mostly about UI, rather than functionality. What would be cool, if Mozilla partnered with multiple VPN providers and had a multi-hop VPN with at least 3 nodes and multi layered encryption, similar to TOR.