7 ms·

I sincerely apologize for the inconvenience we have caused you. Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to con

by kfreds 3y ago

I sincerely apologize for the inconvenience we have caused you. Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to conduct our business in the general case. I expect those of our customers who relied on this feature to be disappointed by its removal as well as the manner in which it was done. Nevertheless it was the right thing to do. The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. This feature should have been removed a long time ago, with a longer grace period. It wasn't - a mistake on our part - and some of our users suffered for it, including you. For this I am sorry. Affected customers can get their money back for any prepaid service they can not use, of course. If you used port forwarding to (I) make a service reachable (II) from the open Internet there are plenty of good hosting providers which will happily take your business. If you used port forwarding to (III) stay anonymous while (I) making a service reachable we can highly recommend Tor's "onion service" feature. It was built with that use case in mind. If you used port forwarding to (III) stay anonymous while (I) making a service reachable (II) from the open Internet, there are no good options that we can recommend. Port forwarding needed to be removed on moral grounds. It needed to be removed because it was causing too much of a disturbance to our core mission of making mass surveillance and censorship ineffective. I hope my explanation has - if not allayed your disappointment - at least provided some clarity. Best regards, Fredrik Stromberg (cofounder of Mullvad VPN)

treesciencebot 3y ago
What sort of abuses you have encountered when dealing with port forwarding? Was it DMCA'd content hosting or were there other major issues with it? Also how does other VPNs that offer port forwarding (like Proton) function against those sort of abuses?
- alwyn 3y ago
  They give some examples of things bad actors used port forwarding for in the blog post[1] announcing the removal of the feature. [1]: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
  - azalemeth 3y ago
    Reading between the lines, I'd be very surprised if it wasn't highly undesirable content, i.e. child porn or fraud. This came about a month after a very publicised raid by the Swedish police -- after which they left with nothing [1]. [1] https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warrant-in-attempted-police-raid https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warra...
    - kfreds 3y ago
      FYI: Our decision to remove port forwarding was not a reaction to the surprise visit by Swedish police. I wish we had been more clear about this in our blog post.
    - vGPU 3y ago
      I am highly certain it involved both and more. For example, say someone wanted to run their botnet distribution server. Now, unless you’re a state actor working for North Korea or some such, that generally gets a rather angry knock on your door in a rather short period of time. Being able to hide your IP/traffic for $5/mo is going to save you a significant amount of trouble. I’m certain AWS and other hosting providers keep track of any activity that’s too strange, and the authorities will have your hosting provider give you the boot even if they can’t figure out who you are exactly. Developing a reputation for allowing, if not quite condoning such behavior will quite quickly get you shut down as a business. Even if they can’t “prove” anything, you’ll get hassled, harassed, and investigated to death because your existence goes from being a nuisance to being a problem. Some guy torrented a few movies on your VPN? Whatever. Some guy used your VPN to break into their local government’s servers? If they can’t find him, they’ll take it out on you.
- electroly 3y ago
  VPN port forwarding is, by and large, used for BitTorrent because you can't seed without it. VPNs are used for BitTorrent in general because it's well-known that IPs participating in BitTorrent are monitored and logged by anyone who wants to[0]. I bet it's at least 100 BitTorrent users for every 1 user using port forwarding for any other purpose. [0] https://iknowwhatyoudownload.com/ https://iknowwhatyoudownload.com/
  - Arcuru 3y ago
    You can still seed/download without port forwarding setup, however the other person you're connected to needs to have port forwarding. Basically either side of the P2P connection needs to be reachable from the open internet, but not both. So you can still seed, it just won't be as usable.
- kfreds 3y ago
  There were several major issues.
BoppreH 3y ago
Thanks for the reply. I'm sorry my negative comment got to first spot on what should have been a positive post. I understand why the decision was made, and I think I'd have done the same. I really hope you guys stick around, Mullvad has exactly the posture that we need from security services.
- kfreds 3y ago
  Thank you. There is no need to be sorry. I'm grateful for the opportunity to clarify things.
wing-_-nuts 3y ago
I had no idea this even happened. It would have been useful to show a notice within the app itself (like you do for patch notes?). Maybe you did, and I didn't see it, but I just got done paying for another 6mo on your service being none the wiser.
- kfreds 3y ago
  I'm not sure whether we did or not. Please don't hesitate to contact support for a refund of remaining time in case you've decided to switch providers.
madars 3y ago
Port forwarding doesn't seem to be a problem for long-established independent VPNs like AirVPN (based in Italy but very ingeniously without exit servers in Italy) or AzireVPN (Swedish; added port forwarding -- all mappings in memory, no static records -- just recently [1]). What makes Mullvad's situation different? Is it a question of margins for high traffic port forwarding users (Mullvad is branching out in browsers and search while these two are not) or something else? I used to be a long time user and a huge fan and proponent of Mullvad's but the communication here has been very much opaque. This is especially so as port forwarding removal was announced straight after a raid where police, after Mullvad's explanations, didn't take anything [2]. [1] https://blog.azirevpn.com/port-forwarding/ https://blog.azirevpn.com/port-forwarding/ [2] https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/ https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
- capableweb 3y ago
  It seems pretty evident why they had to turn it off: > The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. Probably the difference between Mullvad and AirVPN/AzireVPN is how popular the service is, which also usually dictates how popular it is for people to try to abuse it. Maybe 1% of each service's traffic is abuse, which for AirVPN/AzireVPN is not that much, but on Mullvads scale it becomes a whole nother beast.
- kfreds 3y ago
  I'm sorry we haven't been more clear in our communication. Our decision to remove port forwarding was not a question of margins - it was a moral and practical decision. Port forwarding is a feature with many legitimate use cases. This year it became clear that we had become popular for use cases we didn't want to support. Undesirable content and malicious services is a good summary. I'm not privy to more details than that as my main focus is research. Technology is often a double-edged sword, but thankfully it is often also a net benefit to its users and society in general. Privacy online is exactly that kind of technology. Enabling anyone to host any service anonymously on the open Internet is another matter. I hope AirVPN and AzireVPN somehow succeed with providing that feature while steering clear of its downsides. That would be awesome. Nitpick: Mullvad is older than both Air and Azire. :)
nerdchum 3y ago
This is a very articulately worded and elegant response.
93po 3y ago
It is wild how good of a company and team you’ve proven to be. The world would be a much better place if everyone operated this way

by kfreds 3y ago

treesciencebot 3y ago

What sort of abuses you have encountered when dealing with port forwarding? Was it DMCA'd content hosting or were there other major issues with it? Also how does other VPNs that offer port forwarding (like Proton) function against those sort of abuses?

alwyn 3y ago
They give some examples of things bad actors used port forwarding for in the blog post[1] announcing the removal of the feature. [1]: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
- azalemeth 3y ago
  Reading between the lines, I'd be very surprised if it wasn't highly undesirable content, i.e. child porn or fraud. This came about a month after a very publicised raid by the Swedish police -- after which they left with nothing [1]. [1] https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warrant-in-attempted-police-raid https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warra...
  - kfreds 3y ago
    FYI: Our decision to remove port forwarding was not a reaction to the surprise visit by Swedish police. I wish we had been more clear about this in our blog post.
  - vGPU 3y ago
    I am highly certain it involved both and more. For example, say someone wanted to run their botnet distribution server. Now, unless you’re a state actor working for North Korea or some such, that generally gets a rather angry knock on your door in a rather short period of time. Being able to hide your IP/traffic for $5/mo is going to save you a significant amount of trouble. I’m certain AWS and other hosting providers keep track of any activity that’s too strange, and the authorities will have your hosting provider give you the boot even if they can’t figure out who you are exactly. Developing a reputation for allowing, if not quite condoning such behavior will quite quickly get you shut down as a business. Even if they can’t “prove” anything, you’ll get hassled, harassed, and investigated to death because your existence goes from being a nuisance to being a problem. Some guy torrented a few movies on your VPN? Whatever. Some guy used your VPN to break into their local government’s servers? If they can’t find him, they’ll take it out on you.
electroly 3y ago
VPN port forwarding is, by and large, used for BitTorrent because you can't seed without it. VPNs are used for BitTorrent in general because it's well-known that IPs participating in BitTorrent are monitored and logged by anyone who wants to[0]. I bet it's at least 100 BitTorrent users for every 1 user using port forwarding for any other purpose. [0] https://iknowwhatyoudownload.com/ https://iknowwhatyoudownload.com/
- Arcuru 3y ago
  You can still seed/download without port forwarding setup, however the other person you're connected to needs to have port forwarding. Basically either side of the P2P connection needs to be reachable from the open internet, but not both. So you can still seed, it just won't be as usable.
kfreds 3y ago
There were several major issues.

BoppreH 3y ago

Thanks for the reply. I'm sorry my negative comment got to first spot on what should have been a positive post. I understand why the decision was made, and I think I'd have done the same. I really hope you guys stick around, Mullvad has exactly the posture that we need from security services.

kfreds 3y ago
Thank you. There is no need to be sorry. I'm grateful for the opportunity to clarify things.

wing-_-nuts 3y ago

I had no idea this even happened. It would have been useful to show a notice within the app itself (like you do for patch notes?). Maybe you did, and I didn't see it, but I just got done paying for another 6mo on your service being none the wiser.

kfreds 3y ago
I'm not sure whether we did or not. Please don't hesitate to contact support for a refund of remaining time in case you've decided to switch providers.

madars 3y ago

Port forwarding doesn't seem to be a problem for long-established independent VPNs like AirVPN (based in Italy but very ingeniously without exit servers in Italy) or AzireVPN (Swedish; added port forwarding -- all mappings in memory, no static records -- just recently [1]). What makes Mullvad's situation different? Is it a question of margins for high traffic port forwarding users (Mullvad is branching out in browsers and search while these two are not) or something else? I used to be a long time user and a huge fan and proponent of Mullvad's but the communication here has been very much opaque. This is especially so as port forwarding removal was announced straight after a raid where police, after Mullvad's explanations, didn't take anything [2]. [1] https://blog.azirevpn.com/port-forwarding/ https://blog.azirevpn.com/port-forwarding/ [2] https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/ https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...

capableweb 3y ago
It seems pretty evident why they had to turn it off: > The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. Probably the difference between Mullvad and AirVPN/AzireVPN is how popular the service is, which also usually dictates how popular it is for people to try to abuse it. Maybe 1% of each service's traffic is abuse, which for AirVPN/AzireVPN is not that much, but on Mullvads scale it becomes a whole nother beast.
kfreds 3y ago
I'm sorry we haven't been more clear in our communication. Our decision to remove port forwarding was not a question of margins - it was a moral and practical decision. Port forwarding is a feature with many legitimate use cases. This year it became clear that we had become popular for use cases we didn't want to support. Undesirable content and malicious services is a good summary. I'm not privy to more details than that as my main focus is research. Technology is often a double-edged sword, but thankfully it is often also a net benefit to its users and society in general. Privacy online is exactly that kind of technology. Enabling anyone to host any service anonymously on the open Internet is another matter. I hope AirVPN and AzireVPN somehow succeed with providing that feature while steering clear of its downsides. That would be awesome. Nitpick: Mullvad is older than both Air and Azire. :)

nerdchum 3y ago

This is a very articulately worded and elegant response.

93po 3y ago

It is wild how good of a company and team you’ve proven to be. The world would be a much better place if everyone operated this way