4 ms·

Imagine using Mullvad VPN for entering Tor and realizing that your activity is transparent for Mullvad.

beardog 4y ago
What do you mean by transparent? If you mean that a VPN can see you are using Tor and when, sure, but I'm not aware of circumstances where that would matter.
duxup 4y ago
Isn’t that just how VPNs work / a typical risk with VPNs?
- danuker 4y ago
  Indeed. Different tools for different use cases.
- red-iron-pine 4y ago
  You gotta trust someone, somewhere. Mullvad at least only requires that you use a PIN number instead of an ID.
vorpalhex 4y ago
Given that they have literally switched their nodes to be diskless and released lots of their work to strongly disable logging in systems, that may be acceptable for most users. The risk model determines your behavior.
- Zetice 4y ago
  Yeah I’m not trying to hide from the law, I’m trying to get the airline to stop giving me weird price quotes and bbc to let me stream their shows.
  - seanw444 4y ago
    Well I am. I have a right to. If you want to have plausible deniability when you inevitably must do something legally wrong but morally right, then you must always be hiding.
    - Zetice 4y ago
      No? Also I do struggle to think of a situation, for me, that would require TOR access in order to do something morally right but illegal.
      - seanw444 4y ago
        The most obvious example: whistleblowing.
        Zetice 4y ago
        Fair enough, but I have no idea how that would require me to always use TOR, lest the insanely unlikely scenario arise that I need to expose some hidden information. Also wait, whistleblowing on the government? I’m not privy to anything like that.
        seanw444 4y ago
        Maybe not now. But you don't know what your life will look like in 10 years, or even 20. People end up in politics more than they ever imagined, out of necessity. It's the OpSec equivalent of holding something behind your back and saying "no, there's nothing there." Makes you look even more guilty. You look a lot less guilty if you hold non-suspicious things behind your back often. Then people are more likely to think you're odd, rather than guilty. Kind of a bad example, but you get the point in the abstract. Suddenly starting to join the Tor network often around the time some major information is leaked would be a strong correlator pointing to your guilt. I'm just using one example, but there are many scenarios where this matters.
- SV_BubbleTime 4y ago
  Given that they have SAID they are diskless, etc. I feel like there is no scenario where it should be allowed to forget that all the claims are always falsifiable. Not saying they are lying, just that no one ever truly knows. It's important to not be complacent with that.
  - dymk 4y ago
    It's true we can't know for 100% certain, but things like third party audits can give one sufficient confidence (depending on your risk tolerance, of course) https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf https://www.assured.se/publications/Assured_Mullvad_relay_se...
infogulch 4y ago
Almost any proxy configuration could be useful in a specific scenario. It's almost always a tradeoff. For example, you could trade off your ISP knowing that you connected to Tor for your ISP knowing that you connected to mullvad and mullvad knowing that you connected to Tor. Who do you trust with that metadata more?
bombcar 4y ago
It's a question if you'd rather your ISP see you using a VPN and Mullvad seeing you use Tor or your ISP knowing you're using Tor.
- yieldcrv 4y ago
  Tor bridges mask Tor use to your network and ISP
  - costco 4y ago
    Bridges including "private" ones are trivially enumerated: https://github.com/scriptzteam/Tor-Bridges-Collector https://github.com/scriptzteam/Tor-Bridges-Collector I would not rely on bridges if you ever need to deny that you used Tor at a certain point in time though they may be useful for bypassing some censorship systems. A VPN could hide Tor use from your ISP but that obviously comes with a different set of risks (the VPN provider will know you are using Tor).
    - bauruine 4y ago
      I run multiple private bridges and they aren't in this list.
SahAssar 4y ago
It's not transparent (or at least any more than any other means of accessing TOR). If you at all access the internet through somewhat normal means (without running your own ISP and connecting to an IXP physically) you are placing some level of trust in a service provider. What these sort of VPNs do is allowing you to move that point of trust to another party than the one that maintains your intrastructure (your normal ISP). You do not give them any more trust than your normal ISP, but since your normal ISP is usually more regulated it is a good idea to scrutinize the VPN provider more. I trust mullvad more than my normal ISP on privacy. mullvad is also one of the few VPN providers that has not sold its product as a end-all-be-all privacy solution while a lot of others have been spreading FUD (things like saying that your ISP can see in cleartext all your traffic even though 99% is over https, saying their products protect against hackers when there is no evidence for that, etc.).

What do you mean by transparent? If you mean that a VPN can see you are using Tor and when, sure, but I'm not aware of circumstances where that would matter.

duxup 4y ago

Isn’t that just how VPNs work / a typical risk with VPNs?

danuker 4y ago
Indeed. Different tools for different use cases.
red-iron-pine 4y ago
You gotta trust someone, somewhere. Mullvad at least only requires that you use a PIN number instead of an ID.

vorpalhex 4y ago

Given that they have literally switched their nodes to be diskless and released lots of their work to strongly disable logging in systems, that may be acceptable for most users. The risk model determines your behavior.

Zetice 4y ago
Yeah I’m not trying to hide from the law, I’m trying to get the airline to stop giving me weird price quotes and bbc to let me stream their shows.
- seanw444 4y ago
  Well I am. I have a right to. If you want to have plausible deniability when you inevitably must do something legally wrong but morally right, then you must always be hiding.
  - Zetice 4y ago
    No? Also I do struggle to think of a situation, for me, that would require TOR access in order to do something morally right but illegal.
    - seanw444 4y ago
      The most obvious example: whistleblowing.
      - Zetice 4y ago
        Fair enough, but I have no idea how that would require me to always use TOR, lest the insanely unlikely scenario arise that I need to expose some hidden information. Also wait, whistleblowing on the government? I’m not privy to anything like that.
        seanw444 4y ago
        Maybe not now. But you don't know what your life will look like in 10 years, or even 20. People end up in politics more than they ever imagined, out of necessity. It's the OpSec equivalent of holding something behind your back and saying "no, there's nothing there." Makes you look even more guilty. You look a lot less guilty if you hold non-suspicious things behind your back often. Then people are more likely to think you're odd, rather than guilty. Kind of a bad example, but you get the point in the abstract. Suddenly starting to join the Tor network often around the time some major information is leaked would be a strong correlator pointing to your guilt. I'm just using one example, but there are many scenarios where this matters.
SV_BubbleTime 4y ago
Given that they have SAID they are diskless, etc. I feel like there is no scenario where it should be allowed to forget that all the claims are always falsifiable. Not saying they are lying, just that no one ever truly knows. It's important to not be complacent with that.
- dymk 4y ago
  It's true we can't know for 100% certain, but things like third party audits can give one sufficient confidence (depending on your risk tolerance, of course) https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf https://www.assured.se/publications/Assured_Mullvad_relay_se...

infogulch 4y ago

Almost any proxy configuration could be useful in a specific scenario. It's almost always a tradeoff. For example, you could trade off your ISP knowing that you connected to Tor for your ISP knowing that you connected to mullvad and mullvad knowing that you connected to Tor. Who do you trust with that metadata more?

bombcar 4y ago

It's a question if you'd rather your ISP see you using a VPN and Mullvad seeing you use Tor or your ISP knowing you're using Tor.

yieldcrv 4y ago
Tor bridges mask Tor use to your network and ISP
- costco 4y ago
  Bridges including "private" ones are trivially enumerated: https://github.com/scriptzteam/Tor-Bridges-Collector https://github.com/scriptzteam/Tor-Bridges-Collector I would not rely on bridges if you ever need to deny that you used Tor at a certain point in time though they may be useful for bypassing some censorship systems. A VPN could hide Tor use from your ISP but that obviously comes with a different set of risks (the VPN provider will know you are using Tor).
  - bauruine 4y ago
    I run multiple private bridges and they aren't in this list.

SahAssar 4y ago

It's not transparent (or at least any more than any other means of accessing TOR). If you at all access the internet through somewhat normal means (without running your own ISP and connecting to an IXP physically) you are placing some level of trust in a service provider. What these sort of VPNs do is allowing you to move that point of trust to another party than the one that maintains your intrastructure (your normal ISP). You do not give them any more trust than your normal ISP, but since your normal ISP is usually more regulated it is a good idea to scrutinize the VPN provider more. I trust mullvad more than my normal ISP on privacy. mullvad is also one of the few VPN providers that has not sold its product as a end-all-be-all privacy solution while a lot of others have been spreading FUD (things like saying that your ISP can see in cleartext all your traffic even though 99% is over https, saying their products protect against hackers when there is no evidence for that, etc.).