4 ms·

Mullvad is the only mainstream VPN that doesn't have seriously questionable credibility. Not even Proton VPN is OK - investigations uncovered it's just white-la

Mullvad is the only mainstream VPN that doesn't have seriously questionable credibility. Not even Proton VPN is OK - investigations uncovered it's just white-labeled NordVPN. I am grateful Mullvad actively proves their commitment to integrity, because there isn't an alternative

johnklos 4y ago
I've wondered about other providers. I never used SurfShark, but someone I know did, so I checked it out. I still haven't gotten any response from SurfShark about why they insist that users install a root SSL certificate and why their service can't be used without it. That alone should be incredibly scary. Installing a cert for negotiation between my computer and my provider's is one thing, but installing a cert that lets my provider spoof any SSL / TLS they want is something else entirely.
- croutonwagon 4y ago
  I agree with you entirely. Ideally their client would allow for you to accept or even better pre-load a cert they allow. But some OS's can be finicky about trusting certs that arent loaded into some central trust store that in principle allows you some ability to ensure everything trust IS trustworthy, but also de-facto means a cert trust can be abused. However thats as true for the google certs, or the Gov certs that are already pre-loaded and updated with OS updates etc as it would be for that service. And rarely are people actually looking at trust chains for the sites/services they use. That said, i would trust google or even the NSA/gov over some rando vpn provider, if for no other reason than its on literally every install and there are millions of preying eyes watching.
jacooper 4y ago
What? Who said its white labeled nordVPN?
- hammock 4y ago
  It's a rabbithole, and you might not be personally satisfied with the standard of evidence. Regardless, every other VPN has some evidence of partnering with some combination of state actors, data brokers, ad networks, or unexplained unnecessary compromising requirements etc. Mullvad has no such substantiated allegations against it. There are many VPN services that begin by reselling white-label VPN solutions, such as provided by NordVPN,[1] because it's cheaper and easier than building your own globally distributed high-capacity, low-latency network. Many suspect Proton VPN did so[2]. [1]https://nordvpn.com/white-label/ https://nordvpn.com/white-label/ (old link, can't find an archived version of the page) [2]https://archive.is/iZ2l2 https://archive.is/iZ2l2
  - mardifoufs 4y ago
    Which oddly enough, circle back to a comment chain between a PIA and a Protonvpn employee, here on HN. It's far fetched but it seems like there is some corroborating evidence. https://archive.is/1vaZ8 https://archive.is/1vaZ8 Even though, to me, it seems like a LOT of trouble since tons of services have managed to roll out a VPN product without resorting to white labelling Nordvpn
    - jibcage 4y ago
      I’m going to reply in this thread, since I’m probably the employee you’re referring to. I would like to reiterate that this is completely untrue and borders on disinformation. ProtonVPN maintains its own VPN infrastructure, and we take our commitment to user privacy very seriously. It shouldn’t be surprising that the VPN space is a very competitive market, and certain people have a vested interest in defaming certain VPN providers, especially among a technical audience.
      - hammock 4y ago
        You want us to take your word for it?
        butterNaN 4y ago
giobox 4y ago
Serious question: how can we trust that any of these are "credible" as you put it? I'm reminded of the recent disclosure that a "private" Swiss software firm providing encryption software was owned by the CIA and had backdoors, and operated this way for nearly 50 years: > https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG > https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... Personally, I just don't see how you can possibly trust any assurance offered in the current world? You are implicitly handing your private traffic to a third party black box and hoping it is as "private" as they claim. For 99 percent of customers I'm sure this is fine, but I would not be surprised in the slightest if we find out in the future one of these was run by an intelligence agency. We've already seen them take advantage of fake/compromised encrypted messaging apps.
- morpheuskafka 4y ago
  For some threat models, that would almost be a good thing because if Mulled is a CryptoAG-style front, they aren't going to blow there cover on something trivial like a copyright lawsuit.
  - medstrom 4y ago
    And an intelligence agency is not as willing to share their data as an ISP would be, so you pretty much still win over the status quo. Indeed, several ISPs were found to be sharing with intelligence agencies anyway, so by putting your traffic directly through them, you at least remove the ISP from the picture and the 50 other companies they would've also shared with.
    - hammock 4y ago
      >several ISPs were found to be sharing with intelligence agencies In the US, I would suspect all of them. They ply you with multimillion dollar contracts. If you try to resist, they weaponize whatever they can against you. Consider the case of Qwest. After the CEO refused to work with the NSA, he was brought in on unrelated criminal charges: https://www.foxbusiness.com/features/former-qwest-ceo-joe-nacchio-tells-story-of-fight-against-nsa-sec https://www.foxbusiness.com/features/former-qwest-ceo-joe-na...
gavinhoward 4y ago
I agree. I just regret that I can't get Mullvad to work on my Gentoo machine. I've tried twice, and it just wouldn't work. I tried with their software built from scratch, and I tried their OpenVPN stuff. Once I can find a way to make it work, I would definitely use it.
- cassianoleal 4y ago
  Just generate an ovpn or a wireguard config and load on the native clients.
  - gavinhoward 4y ago
    I tried that.
    - testTED 4y ago
      Provide more information here or in a search box if you expect to achieve this rather ubiquitous functionality.
      - gavinhoward 4y ago
        I contacted Mullvad support twice. They couldn't our didn't want to help me.
zeendo 4y ago
Has there been something discrediting Private Internet Access? Or are they just not as transparent as Mullvad?
- michaelteter 4y ago
  Change of ownership a few years ago to a company with less stellar reputation. https://en.wikipedia.org/wiki/Private_Internet_Access https://en.wikipedia.org/wiki/Private_Internet_Access
- 3np 4y ago
  Yes, and it's been covered extensively. The Wikipedia page and past discussion here are OK starting points if you find it worthwhile going down that rabbit hole. I don't see why you'd want anything to do with them or their subsidiaries, unless your only research is googling "best VPN" and accepting the resulting misinformation at face value.

johnklos 4y ago

I've wondered about other providers. I never used SurfShark, but someone I know did, so I checked it out. I still haven't gotten any response from SurfShark about why they insist that users install a root SSL certificate and why their service can't be used without it. That alone should be incredibly scary. Installing a cert for negotiation between my computer and my provider's is one thing, but installing a cert that lets my provider spoof any SSL / TLS they want is something else entirely.

croutonwagon 4y ago
I agree with you entirely. Ideally their client would allow for you to accept or even better pre-load a cert they allow. But some OS's can be finicky about trusting certs that arent loaded into some central trust store that in principle allows you some ability to ensure everything trust IS trustworthy, but also de-facto means a cert trust can be abused. However thats as true for the google certs, or the Gov certs that are already pre-loaded and updated with OS updates etc as it would be for that service. And rarely are people actually looking at trust chains for the sites/services they use. That said, i would trust google or even the NSA/gov over some rando vpn provider, if for no other reason than its on literally every install and there are millions of preying eyes watching.

jacooper 4y ago

What? Who said its white labeled nordVPN?

hammock 4y ago
It's a rabbithole, and you might not be personally satisfied with the standard of evidence. Regardless, every other VPN has some evidence of partnering with some combination of state actors, data brokers, ad networks, or unexplained unnecessary compromising requirements etc. Mullvad has no such substantiated allegations against it. There are many VPN services that begin by reselling white-label VPN solutions, such as provided by NordVPN,[1] because it's cheaper and easier than building your own globally distributed high-capacity, low-latency network. Many suspect Proton VPN did so[2]. [1]https://nordvpn.com/white-label/ https://nordvpn.com/white-label/ (old link, can't find an archived version of the page) [2]https://archive.is/iZ2l2 https://archive.is/iZ2l2
- mardifoufs 4y ago
  Which oddly enough, circle back to a comment chain between a PIA and a Protonvpn employee, here on HN. It's far fetched but it seems like there is some corroborating evidence. https://archive.is/1vaZ8 https://archive.is/1vaZ8 Even though, to me, it seems like a LOT of trouble since tons of services have managed to roll out a VPN product without resorting to white labelling Nordvpn
  - jibcage 4y ago
    I’m going to reply in this thread, since I’m probably the employee you’re referring to. I would like to reiterate that this is completely untrue and borders on disinformation. ProtonVPN maintains its own VPN infrastructure, and we take our commitment to user privacy very seriously. It shouldn’t be surprising that the VPN space is a very competitive market, and certain people have a vested interest in defaming certain VPN providers, especially among a technical audience.
    - hammock 4y ago
      You want us to take your word for it?
      - butterNaN 4y ago

giobox 4y ago

Serious question: how can we trust that any of these are "credible" as you put it? I'm reminded of the recent disclosure that a "private" Swiss software firm providing encryption software was owned by the CIA and had backdoors, and operated this way for nearly 50 years: > https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG > https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... Personally, I just don't see how you can possibly trust any assurance offered in the current world? You are implicitly handing your private traffic to a third party black box and hoping it is as "private" as they claim. For 99 percent of customers I'm sure this is fine, but I would not be surprised in the slightest if we find out in the future one of these was run by an intelligence agency. We've already seen them take advantage of fake/compromised encrypted messaging apps.

morpheuskafka 4y ago
For some threat models, that would almost be a good thing because if Mulled is a CryptoAG-style front, they aren't going to blow there cover on something trivial like a copyright lawsuit.
- medstrom 4y ago
  And an intelligence agency is not as willing to share their data as an ISP would be, so you pretty much still win over the status quo. Indeed, several ISPs were found to be sharing with intelligence agencies anyway, so by putting your traffic directly through them, you at least remove the ISP from the picture and the 50 other companies they would've also shared with.
  - hammock 4y ago
    >several ISPs were found to be sharing with intelligence agencies In the US, I would suspect all of them. They ply you with multimillion dollar contracts. If you try to resist, they weaponize whatever they can against you. Consider the case of Qwest. After the CEO refused to work with the NSA, he was brought in on unrelated criminal charges: https://www.foxbusiness.com/features/former-qwest-ceo-joe-nacchio-tells-story-of-fight-against-nsa-sec https://www.foxbusiness.com/features/former-qwest-ceo-joe-na...

gavinhoward 4y ago

I agree. I just regret that I can't get Mullvad to work on my Gentoo machine. I've tried twice, and it just wouldn't work. I tried with their software built from scratch, and I tried their OpenVPN stuff. Once I can find a way to make it work, I would definitely use it.

cassianoleal 4y ago
Just generate an ovpn or a wireguard config and load on the native clients.
- gavinhoward 4y ago
  I tried that.
  - testTED 4y ago
    Provide more information here or in a search box if you expect to achieve this rather ubiquitous functionality.
    - gavinhoward 4y ago
      I contacted Mullvad support twice. They couldn't our didn't want to help me.

zeendo 4y ago

Has there been something discrediting Private Internet Access? Or are they just not as transparent as Mullvad?

michaelteter 4y ago
Change of ownership a few years ago to a company with less stellar reputation. https://en.wikipedia.org/wiki/Private_Internet_Access https://en.wikipedia.org/wiki/Private_Internet_Access
3np 4y ago
Yes, and it's been covered extensively. The Wikipedia page and past discussion here are OK starting points if you find it worthwhile going down that rabbit hole. I don't see why you'd want anything to do with them or their subsidiaries, unless your only research is googling "best VPN" and accepting the resulting misinformation at face value.