9 ms·
Security audit of account and payment services
- asynchronous 4y agoLove mullvad, if you seek a truly privacy loving VPN provider look no further. Smart company, smart payment system.
- teaearlgraycold 4y agoI love that they accept envelopes of cash as payment.
- ChickenNugger 4y agoAnd several cryptocurrencies. You actually get a discount for paying in crypto. Which is awesome because it allows people with oppressive governments to use it.
- seanw444 4y agoAs long as you're using it for the right things. Most of the people here already know this, but I'll say it anyway: VPNs don't make you more secure necessarily, they just reroute your traffic. If you don't trust the network you're on, use Mullvad. If you want to appear as though you're in a different location, use Mullvad. If you want to bypass your network's firewall, use Mullvad. If you don't want the service you're using to see your true IP, use Mullvad. But most people don't need a VPN running all the time. Or even most of the time.
- Etheryte 4y agoI disagree, I think it would be highly beneficial if everyone ran a VPN exactly for the reasons you describe — websites and services online have no business knowing who I am or where I am. We can hope of a better tomorrow where browser fingerprinting, geo-IP and other such things are a thing of the past. Every step we take in that direction is a step towards a better future. (For that matter, every device I own sits behind Mullvad.)
- seanw444 4y agoSure, but then Mullvad has all your information. And all it takes is a change of leadership for that to go badly. At the moment, Mullvad is a great service with good goals. But every company hits a threshold where they lose their bearing. And while yes, you don't provide your personal information directly to Mullvad, it wouldn't be very hard to deduce you from your traffic with some amount of effort.
- Etheryte 4y agoYou're missing the core difference which is that I get to choose. Many people live in areas where only one ISP offers a competitive service, they don't get to choose. If there's three ISPs in my area and they all sell my data, I don't get to choose. If all of your social circles use one social network to organize events and you want to be in the loop with them, you don't get to choose. Etc. In all of those cases, you don't have a say in who gets to munch on all of your data. When you use a VPN, you choose who you trust with your data, which also means you can change your mind later if need be. In the other scenario you cannot.
- medstrom 4y agoThere's always someone in a position to acquire all your information. If it's not a VPN, it's an ISP. And ISPs have much weaker incentives not to step on the needs of the few. Most ISPs get to stay in business no matter how many scandals embroil them.
- seanw444 4y agoVery true as well.
- yjftsjthsd-h 4y ago> Sure, but then Mullvad has all your information No more than any ISP, and (in the USA) they're pretty universally going to spy on you, so even if (ex.) Mullvad is a coin-toss it's a win.
- prophesi 4y ago
- ramzyo 4y agoI've recently been describing what a commercial VPN provides to non-technical friends and family as a type of "global virtual Internet cafe" subscription. It's not inherently (i.e. due to technical benefits of underlying technology) any more or less secure than connecting to your home or work wifi/network, and the Internet cafe knows who you are and what websites you're visiting, but your ISP/employer doesn't (since you're "at" the Internet cafe, not on your home/work network). Of course, your ISP/employer does know that you're visiting the Internet cafe, and in the case of work (and some ISPs) can stop you from doing so. If you visit a website from an Internet cafe, the website may still be able to figure out who you are, just like they can when you bounce between different networks normally. And of course, if you login to your account on a website or put your shipping address or something in when buying something, you're self identifying (unless you have throwaway accounts or forwarding addresses or whatever). And finally, if someone really wants to figure out who you are to a high degree of confidence, they will. I find this lands pretty well and is close enough to being technically correct without getting into the details that non-technical people would start glazing over if I got into.
- deleted 4y ago[deleted]
- GaryNumanVevo 4y agoReader's Note: "Privacy loving" typically means "want to watch Spiderman Movie on Canadian Netflix"
- _joel 4y agoGreat to see this openness (although tbf would have expected encrypted redis but no biggie)
- qwertox 4y agoDoes Assured AB have a good reputation?
- hammock 4y agoGood question. I don't have an answer. I can say Assured did previous audits in 2020 and 2021. You can also review audits from a different vendor, Cure53, that were done in 2018[1] and 2020.[2] [1]https://cure53.de/pentest-report_mullvad_v2.pdf https://cure53.de/pentest-report_mullvad_v2.pdf [2]https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/ https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
- throwaway1828 4y ago[flagged]
- malteof 4y agoThe world is controlled by the Illuminati. Prove me wrong.
- seized 4y agoI've been using Mullvad for several years now, ever since PIA took a downward turn with that acquisition. Mullvad has been fantastic.
- 2636381321 4y agoI think VPNs give only a potentially dangerous illusion of anonymity given the widespread NSA surveillance and organizations such as Team Cymru collecting flow records from ISP core routers worldwide. https://www.vice.com/en/article/jg84yy/data-brokers-netflow-data-team-cymru https://www.vice.com/en/article/jg84yy/data-brokers-netflow-...
- ramraj07 4y agoSure, but what if this vpn is just part of the security cascade? Like what if you go through Mullavd, another vpn, Tor, and then maybe a mesh network on top of all of this? Maybe then host another vpn through a prepaid SIM card to top?
- Zak 4y agoAs with most security, it always depends on what you're trying to defend against. A commercial VPN, even a very good one is probably not good protection if you're being directly targeted by the NSA. It's very good against your ISP selling your browsing habits to advertisers. There's a spectrum between the two and it's likely decent protection for most of that.
- x86x87 4y agoIt depends. If you are targeted by any 3 letter agency this will not help/save you. If you're worried about your shady ISP and/or other entities mining the heck out of your traffic and/or selling this data it helps.
- GTP 4y agoBut then you're shifting your trust from your ISP to the VPN provider. So it makes sense only if you have good reasons to not trust your ISP. Personally I only use a VPN when I'm connected to a public WiFi network.
- x86x87 4y agoif your VPN provider does not know who you are it's a better than your ISP.
- greyskull 4y agoI have a very general question. What do you folks use these VPNs for besides, say, privacy/security or circumventing content restrictions?
- johnklos 4y agoI use it (Mullvad, specifically) to download videos I want to watch that online services make too onerous to purchase easily.
- quux 4y agoMy primary use case for a VPN is hiding BitTorrent traffic from my ISP.
- total-temp 4y ago[dead]
- jrootabega 4y agoThis applies more to VPN as a tunneling technology rather than an anonymity provider. But I don't want to share my personal IP address with everyone I interact with online. I don't currently care if, say, Hacker News or Reddit knows it, or really any big web platform where I'm not that interesting to them. But everyone and everything else? It could invite attacks, DOS, expose geographical information, social engineering targets, etc. A VPN at least gives you a layer of protection, and ideally one that you can throw away if anyone targets you. Once someone knows your main IP address, it probably can't be changed quickly, may be difficult to change it at all, and may even be impossible in some cases. It's a piece of knowledge you can't take back, so sharing it by default is bad, IMO. So I guess that's just a security/privacy concern, but the key point is that you should be secure/private before you think you need it.
- barbariangrunge 4y agoIs this the company that Mozilla’s vpn goes through?
- Hates_ 4y agoYes, they are. They are also listed on their "Partner and Reseller" page: https://mullvad.net/en/help/partnerships-and-resellers/ https://mullvad.net/en/help/partnerships-and-resellers/
- Jaepa 4y agoMozilla partnered with ProtonVPN, which also makes ProtonMail.
- prophesi 4y agoIn 2018. I think they're no longer parterned, or at the very least Firefox no longer has that popup recommending ProtonVPN to users ever since the new partnership with Mullvad.
- mozillamaxx 4y agoYes! https://mullvad.net/en/blog/2019/12/3/mullvad-partnerships-page-has-been-updated-mozilla/ https://mullvad.net/en/blog/2019/12/3/mullvad-partnerships-p...
- mig39 4y agoI had some Euros left over from a trip last summer. I put them in an envelope, put my super secret generated code on a piece of paper, and dropped it in the mailbox. A week later, my Mullvad account was credited with the extra time. I've been a Mullvad customer for a couple of years now. I actually have a wireguard connection right on my pfsense router, so I can selectively send traffic to the VPN at a network level using firewall rules. It's awesome.
- newfonewhodis 4y ago> I had some Euros left over from a trip last summer. I put them in an envelope, put my super secret generated code on a piece of paper, and dropped it in the mailbox. Oh awesome. I have some EUR left over as well. You can't send cash from the US to Sweden via mail right?
- vladvasiliu 4y agoI don't know about Sweden and even less about the US, but in France, for example, it's illegal to send cash via mail. Not sure what would happen if they caught you.
- lloydatkinson 4y agoFor what reason? To remove the issue of tracking down money stolen in transit?
- brewdad 4y agoI have to imagine it’s one of those charges they can tack onto other criminal charges so that something sticks. Sending €20 won’t be a problem. Sending €20.000 will be. Where the line in between lies, I have no idea.
- pancrufty 4y agoIn my European country, you can only mail money via insured mail. Otherwise it’s prohibited. I assume it’s to avoid responsibility and money laundering. From what I see there are limits on the amount of cash you can mail in the US as well.
- hammock 4y agoMullvad is the only mainstream VPN that doesn't have seriously questionable credibility. Not even Proton VPN is OK - investigations uncovered it's just white-labeled NordVPN. I am grateful Mullvad actively proves their commitment to integrity, because there isn't an alternative
- johnklos 4y agoI've wondered about other providers. I never used SurfShark, but someone I know did, so I checked it out. I still haven't gotten any response from SurfShark about why they insist that users install a root SSL certificate and why their service can't be used without it. That alone should be incredibly scary. Installing a cert for negotiation between my computer and my provider's is one thing, but installing a cert that lets my provider spoof any SSL / TLS they want is something else entirely.
- croutonwagon 4y agoI agree with you entirely. Ideally their client would allow for you to accept or even better pre-load a cert they allow. But some OS's can be finicky about trusting certs that arent loaded into some central trust store that in principle allows you some ability to ensure everything trust IS trustworthy, but also de-facto means a cert trust can be abused. However thats as true for the google certs, or the Gov certs that are already pre-loaded and updated with OS updates etc as it would be for that service. And rarely are people actually looking at trust chains for the sites/services they use. That said, i would trust google or even the NSA/gov over some rando vpn provider, if for no other reason than its on literally every install and there are millions of preying eyes watching.
- jacooper 4y agoWhat? Who said its white labeled nordVPN?
- hammock 4y agoIt's a rabbithole, and you might not be personally satisfied with the standard of evidence. Regardless, every other VPN has some evidence of partnering with some combination of state actors, data brokers, ad networks, or unexplained unnecessary compromising requirements etc. Mullvad has no such substantiated allegations against it. There are many VPN services that begin by reselling white-label VPN solutions, such as provided by NordVPN,[1] because it's cheaper and easier than building your own globally distributed high-capacity, low-latency network. Many suspect Proton VPN did so[2]. [1]https://nordvpn.com/white-label/ https://nordvpn.com/white-label/ (old link, can't find an archived version of the page) [2]https://archive.is/iZ2l2 https://archive.is/iZ2l2
- dblitt 4y ago> we have increased the minimum password length to 48 characters. Isn't this complete overkill? I suppose this effectively mandates the use of a password manager, but I wonder where the 48 number came from.
- avereveard 4y agoUgh I use it on my android TV 48 character password would kill my use case
- lapinot 4y agoWell, standard policy for cryptographic keys is to have 256 bits of entropy, with the paranoid number being 512. So if they're using ascii-printable characters, uniform random 48-char passwords have ~315 bits of entropy. That doesn't seem too far off. Basically this means you don't have to trust your key derivation function as much.
- 4y ago
- bfors 4y agoFor those who use a VPN - why do you do it? Region-locked content, untrusted networks? They're pitched as a privacy thing, but privacy from who?
- vorticalbox 4y agoISPs (at least here in the UK) are required by law to log everything you do for a number of years. But does one need a reason to exercise their right to privacy?
- brewdad 4y agoNo said you needed to justify a reason but everyone has one. OP was simply curious as to what those reasons might be. No need to get defensive about it.
- vorticalbox 4y agoI am sorry if I came off as defensive not my intention. I was merely trying to point out that not everyone has a "reason" other than the fact they want to be private.
- agentdrtran 4y agoit can help reduce some kinda of tracking/fingerprinting although from what I've heard the utility of that is going down over time
- rejectfinite 4y agoPrivacy from the ISP logs, and thus court logs. Also region lock on legit services. Torrenting, even here in Sweden had media companies look up IPs in torrent swarms, go to court to get ISP logs = send lawyer letter.
- Hamuko 4y agoProtection from seedy Linux ISO honeypots.
- 01foo12bar35 4y ago[dead]
- IceHegel 4y agoThis is great to see. I hope they expand to offer VPSs and domains in the future. Those are two areas where I have serious privacy concerns and am seeking a zero trust solution.
- rejectfinite 4y agoIf I didn't have lifetime Windscribe I would use Mullvad for sure.
- iasoy 4y agoisn't the most secure vpn solution is to have 5$ VPS with OpenVPN on it ? (Serious question)
- hrunt 4y agoNo, probably not. Your $5 VPS is going to be dedicated to you. The VPS provider is going to provide no privacy guarantees to you and will easily be able to associate requests for your information with your VPS. They will have no issue providing it to whomever asks for it. In addition, your traffic will be the only thing coming from that VPS, so tying network information to you will be easier. The key thing to remember about VPNs is that you are re-positioning your trust. Instead of trusting your ISP with your traffic, you are trusting the VPN provider. A hosting provider is about as trustworthy with your traffic as an ISP, and offers the same amount of pseudo-anonymity. It's a lateral move at best.
- mekster 4y agoVPN means many things of which, you would be throwing away anonymity as you're completely stuck with a single IP forever which no one else will use.
- fsociety 4y agoSpeaking from experience, definitely not.
- thinking001001 4y agoIn regards to using a VPN for privacy: The important thing about a shared VPN service is that it makes it difficult to distinguish traffic, and by sharing multiple IPs across different countries it becomes even harder to track an individual's activities. This is somewhat of a copy of Tor, but with less security-risk, at the expense of some privacy. Whereas if you run your own VPN, for example, all activity from that IP address gradually becomes more associated with you.
- netfortius 4y agoIf you really care about how Mullvad does this, and when, it'd more useful to monitor their blog, or /r/mullvadvpn. The info seems to reach HN a week later...