5 ms·

https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

roncesvalles 3y ago
Here's the thing. The most likely reason Mullvad got rid of fixed forwarded ports is that it could be used to de-anonymize their users. TFA seems to offer a solution for that problem with "Experience uncompromising privacy with AzireVPN's Blind Operator! Your port stays confidential as we don't store or log assigned ports in any database. Thanks to our secure Blind Operator backend, your assigned port remains private." Ultimately you have to take their word that it works as well as described.
- crazygringo 3y ago
  No, they got rid of it for security/liability/reputation reasons as port forwarding makes it attractive for botnets. Port forwarding doesn't assist in deanonymization. Ultimately you either trust your VPN or you don't.
  - roncesvalles 3y ago
    Mullvad had to keep a record of which port maps to which account ID and LE could subpoena that. Mullvad's whole shtick is that even if LE has 100% of the data they have, you won't be deanonymized.
    - eddythompson80 3y ago
      Which is why Mullvad used to not allow auto-billing if you had portforwarding. If you wanted to use portforwarding, which Mullvad had for years, you needed to pay in advance for how much you wanted to use it. They didn’t need to keep any of your information on file, including payment stuff. Just that a particular account is paid up until a certain date. Linking a port to an account ID is possible, but there is nothing that needs to be kept about the owner of an account id either. So even LE can’t really do much with that information.
  - dec0dedab0de 3y ago
    Port forwarding, or really just having any ports open at all, can definitely be used as part of fingerprinting.
    - crazygringo 3y ago
      Mullvad, like many VPN's, only gives (gave) you a single port. And you're free to change that port number as often as you like if you want to avoid being fingerprinted. But fingerprinting isn't deanonymization anyways. And this is stretching the idea of "fingerprinting" in the first place -- a single port number provides the same amount of information as an IP address. With a VPN you can rotate both as often or as little as you like.
      - madars 3y ago
        Small correction: Mullvad gave you 5 ports per account that you could assign (per VPN server city) to any of your 5 public keys in an arbitrary manner. E.g. 3 for one + 2 for another.
- 111111IIIIIII 3y ago
  > Ultimately you have to take their word that it works as well as described. Compared with what other options? Mullvad does not support port forwarding. You can try to defend it all you want, but if someone needs port forwarding and your alternative does not support port forwarding then you need to find another alternative or your point is moot.
  - roncesvalles 3y ago
    IMO Mullvad is the most technologically advanced VPN provider in the industry. Mullvad decided to get rid of port forwarding entirely (knowing full well the impact it would have on their revenue) instead of trying to implement the special measures that TFA spends two whole paragraphs describing.
    - AwaAwa 3y ago
      Could you point to some info on why Mullvad is the most technologically advanced VPN?
      - livueta 3y ago
        "Most" might be hard to prove, but they're at the forefront of using new-ish technologies like TPM/SGX to ensure their non-retention policies are workable in practice: https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695 This results in raids leaving empty-handed: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917 This is in contrast to the flocks of VPN providers whose retention-related claims were either complete horseshit or not well-implemented.
    - 111111IIIIIII 3y ago
      This doesn't answer the question at all.

roncesvalles 3y ago

Here's the thing. The most likely reason Mullvad got rid of fixed forwarded ports is that it could be used to de-anonymize their users. TFA seems to offer a solution for that problem with "Experience uncompromising privacy with AzireVPN's Blind Operator! Your port stays confidential as we don't store or log assigned ports in any database. Thanks to our secure Blind Operator backend, your assigned port remains private." Ultimately you have to take their word that it works as well as described.

crazygringo 3y ago
No, they got rid of it for security/liability/reputation reasons as port forwarding makes it attractive for botnets. Port forwarding doesn't assist in deanonymization. Ultimately you either trust your VPN or you don't.
- roncesvalles 3y ago
  Mullvad had to keep a record of which port maps to which account ID and LE could subpoena that. Mullvad's whole shtick is that even if LE has 100% of the data they have, you won't be deanonymized.
  - eddythompson80 3y ago
    Which is why Mullvad used to not allow auto-billing if you had portforwarding. If you wanted to use portforwarding, which Mullvad had for years, you needed to pay in advance for how much you wanted to use it. They didn’t need to keep any of your information on file, including payment stuff. Just that a particular account is paid up until a certain date. Linking a port to an account ID is possible, but there is nothing that needs to be kept about the owner of an account id either. So even LE can’t really do much with that information.
- dec0dedab0de 3y ago
  Port forwarding, or really just having any ports open at all, can definitely be used as part of fingerprinting.
  - crazygringo 3y ago
    Mullvad, like many VPN's, only gives (gave) you a single port. And you're free to change that port number as often as you like if you want to avoid being fingerprinted. But fingerprinting isn't deanonymization anyways. And this is stretching the idea of "fingerprinting" in the first place -- a single port number provides the same amount of information as an IP address. With a VPN you can rotate both as often or as little as you like.
    - madars 3y ago
      Small correction: Mullvad gave you 5 ports per account that you could assign (per VPN server city) to any of your 5 public keys in an arbitrary manner. E.g. 3 for one + 2 for another.
111111IIIIIII 3y ago
> Ultimately you have to take their word that it works as well as described. Compared with what other options? Mullvad does not support port forwarding. You can try to defend it all you want, but if someone needs port forwarding and your alternative does not support port forwarding then you need to find another alternative or your point is moot.
- roncesvalles 3y ago
  IMO Mullvad is the most technologically advanced VPN provider in the industry. Mullvad decided to get rid of port forwarding entirely (knowing full well the impact it would have on their revenue) instead of trying to implement the special measures that TFA spends two whole paragraphs describing.
  - AwaAwa 3y ago
    Could you point to some info on why Mullvad is the most technologically advanced VPN?
    - livueta 3y ago
      "Most" might be hard to prove, but they're at the forefront of using new-ish technologies like TPM/SGX to ensure their non-retention policies are workable in practice: https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695 This results in raids leaving empty-handed: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917 This is in contrast to the flocks of VPN providers whose retention-related claims were either complete horseshit or not well-implemented.
  - 111111IIIIIII 3y ago
    This doesn't answer the question at all.