29 ms·
Mullvad Browser
- ChrisArchitect 3y ago[dupe] FYI: news from April Bunch of discussion then: https://news.ycombinator.com/item?id=35421034 https://news.ycombinator.com/item?id=35421034
- yewenjie 3y agoInteresting. IIRC, TOR browser is itself a Firefox fork?
- pentamassiv 3y agoYes, the current Tor Browser is based on Firefox 102.14.0esr. https://blog.torproject.org/new-release-tor-browser-1252/ https://blog.torproject.org/new-release-tor-browser-1252/
- namanyayg 3y agoMullvad has been doing some great work -- and the browser is open source too.
- akkartik 3y agoDo you have a link to the source? I'm not seeing it on the site.
- SushiHippie 3y agohttps://github.com/mullvad/mullvad-browser/releases/tag/12.5.2 https://github.com/mullvad/mullvad-browser/releases/tag/12.5...
- r721 3y agoPreviously: https://news.ycombinator.com/item?id=35421034 https://news.ycombinator.com/item?id=35421034
- hendersoon 3y agoSo it's just the TOR browser with TOR disabled? Thing is, you could do that anyway. It did take setting a couple environment variables, no GUI method, but easy enough to do. Unclear what value Mullvad's version provides. Feels like a promotional thing.
- deleted 3y ago[deleted]
- suslik 3y agoI suspect that this: > It did take setting a couple environment variables, no GUI method , which is unknown to almost anyone, would scare an absolute majority of non-technical folk away. Even if what mullvad does is relatively small in scope, it can still provide a lot of value to people.
- yencabulator 3y agoOf course it's a promotional thing, it's named after a company. Think of it this way: Mullvad is sponsoring Tor at >=$100,000/year, and in exchange the Tor Browser developers made a slight fork of their codebase that sets a couple of environment variables and changes the branding. Now the fact that it's just a couple of environment variables sounds like a good thing, right?
- colesantiago 3y agoWhy is it that the main use case for this would be for criminals to use this Tor & Mullvad based browser + VPN?
- judge2020 3y agoMost criminals want to be anonymous, but wanting to be anonymous doesn't make you a criminal.
- safetybox 3y agoWanting to buy drugs online doesn't make you a criminal. Wanting to be criminal also doesn't make you a criminal.
- atdrummond 3y agoBuying drugs online almost certainly funds criminal acts. Some of the most vicious gangs in Europe traffic “mild” drugs like Ecstasy, Ketamine and marijuana. Denying this is to be profoundly dishonest with one’s self.
- dark-star 3y agoyou forgot to include tobacco and alcohol in that list... /s
- GhostWhisperer 3y agoit's true: https://en.wikipedia.org/w/index.php?title=Philip_Morris_International&oldid=1170438099#Cigarette_smuggling_in_Africa https://en.wikipedia.org/w/index.php?title=Philip_Morris_Int...
- kodt 3y agoTechnically his comment says "wanting to" not actually doing it.
- predictabl3 3y agoSeems like a real missed opportunity to cross pollinate between Mullvad user and Tor users. Like, why not just leave Tor enabled?
- wintermutestwin 3y agoIt would be great if they would bake in some extensions that are "table stakes" for a modern usable browser like uBlock Origin, Multi Account Containers, Total Suspender, and a vertical tabs solution like Sidebury.
- dotcoma 3y agoUblock Origin is baked-in, as far as I know.
- drcongo 3y agouBlock is the only one of those I've even heard of.
- ian-g 3y agomulti account containers is a Firefox thing. you can silo websites away from each other. for example, your work uses outlook and slack. a work tab has those logins memorized, but it won't know about your Facebook login. you could have a banking tab just for logging in to places like that. I'm a fan
- trackflak 3y agoBrilliant also for your sock puppeting... I mean legit separation of interests
- drcongo 3y agoThanks, I've never used that but it does sound useful! I tend to use different browsers to context switch as Cmd+Tab is a nice way to switch between them - Safari for actual browsing, Firefox (and developer edition) for dev.
- pferde 3y agoI prefer to use separate docker containers for that, with some trivial shell wrappers to make creating new persistent "browser profiles" easy. But for non-techies, I guess the Firefox addon is the next best thing.
- matthewaveryusa 3y ago>the Mullvad Browser applies a "hide-in-the-crowd" approach to online privacy by creating a similar fingerprint for all of its users. The browser's 'out-of-the-box' configurations and settings will mask many parameters and features commonly used to extract information from a person's device that can make them identifiable, including fonts, rendered content, and several hardware APIs. What does masking specifically mean? Is it returning pre-canned responses to those queries that match non mullvad browser users. Because otherwise the absence of these APIs basically fingerprints the user to the Mullvad Browser which, realistically, will always be a small fraction of total browser sessions.
- em-bee 3y agoconsidering the difference between the words mask and hide, i would assume it's replacing them with canned values.
- reaperducer 3y agoHopefully the values rotate randomly through a common set of values, rather than just making everyone Windows 11/Chrome.
- smegsicle 3y agothe 'scanner darkly' method, i think xxxterm used to do that probably more annoying to fingerprint in general, but its own signal in another way
- em-bee 3y agowell, each individual browser should not rotate the values to often, every few weeks or months maybe, if at all, or when sessions are cleared. or they could differ per site. but across all browser instances a statistical distribution of values that is similar to the existing distribution would help to ensure that no particular value stands out. given that it is firefox this should also mean that only average firefox values should be used because the browser itself can be detected through checking feature differences which can't be masked as easily.
- mcpackieh 3y agoThis is bizarre. Why would Tor lend the credibility of their association to an inferior privacy product? My spidey senses are tingling, something is very wrong here.
- Scion9066 3y agoBecause not everyone wants to use the Tor network but may still be interested in a browser that comes configured for as much privacy as possible by default instead of having to configure various settings/extensions manually? Options for incrementally improving privacy are still good, even if it doesn't go as far as the normal Tor browser.
- mcpackieh 3y agoFor a superior privacy product to neuter itself for the benefit of supposed people who want inferior privacy is bizarre. Who are these people, who would want to use Tor Browser but wish it were less private? All this does is make the inferior privacy product seem better than it really is, by associating it with a superior one. This whole thing STINKS.
- linuxandrew 3y agoI can think of some good uses. Lots of websites block Tor, some websites (like your bank) may lock your account if you start logging in from random countries. Tor can also be a bit slow for some uses.
- mcpackieh 3y agoWhat's the point of using a private browser (anti-fingerprinting/etc) for logging into your bank? They already know who you are. I understand using a VPN with the exit node in your country to do banking, but that's to hide your location not your identity.
- pseudalopex 3y ago
- MrAlex94 3y agoYears ago, I had the idea to create a clear-net version of Tor, e.g. Tor Browser without the Tor network (was called Aegis Digital, I believe The Epoch Times interviewed me about it). Separate to Waterfox, the idea would be ramp up the privacy to the max. The problem is, when you did that, many websites would break in the most bizarre of ways. Even now, it still breaks a lot of the web. Couple that with a well known VPN and large swathes of the web are going to be difficult to access. I'm sure this may go down well with the privacy crowd, but for the general user it was and still is a hard pill to swallow. I wound down any attempts, figuring a balance of privacy and usability would be better and if I were to offer this, why not just point users to use Tor instead? I figure this is a good opportunity for Mullvad to capture its VPN users and shift them onto a platform they control. Not necessarily a good or bad thing, as I know VPN providers try to launch their own browsers and even some browser vendors launching their own VPN to capture the maximum value out of their users.
- wing-_-nuts 3y agoI use mullvad's vpn and I know very well what you're talking about. Social media websites will shadowban you without any TOS violating actions on your part. Certain financial sites will straight up refuse to work, and the worst of all are the sites that use only certain js libs hosted on cdns that straight up refuse to serve anyone on a vpn. That leaves you with a site that looks like it's responding, but is in fact broken. I feel like the very act of trying to opt out of the web's surveillance is enough to mark you as a second class citizen on the web. You either submit, and let your isp and google resell your most sensitive secrets, or you're effectively shunned. Regarding tor, it's a great idea tarnished by the fact that it's used for vile illegal activity. There's no way I would ever run a tor exit node. The risk of some 3 letter agency taking all my hardware for a few months while they figure out I'm not the guy they're looking for is too damned high.
- WeylandYutani 3y agoYes I wonder how many people actually use Mulvad as their daily driver. Hell I'm using completely unmodified Edge for banking and government agencies because even something as simple as ublock cosmetic filters manages to break them.
- mediumsmart 3y agoI'll vote for anything that makes the web I don't care about break right at the doorstep, so yes.
- gslepak 3y agoHow does this compare to Brave?
- Daunk 3y agoIt's not a scam.
- gslepak 3y agoHow is Brave a scam?
- arrowsmith 3y agoFor the millionth time: you can use Brave without any of the crypto nonsense. I'm typing this on Brave now and I still barely understand what a BAT is; I've never spent more than 10 seconds looking into it and the browser makes no attempt to force it on me.
- deleted 3y ago[deleted]
- gslepak 3y ago> without any of the crypto nonsense I'm curious, what do people mean by this? How is the bank's financial system any less "nonsense" than crypto? Second question: when the banks start using crypto in not too long (via CBDCs), how will that crypto be any less "nonsense" than crypto?
- OkayPhysicist 3y ago> How is the bank's financial system any less "nonsense" than crypto? When things go wrong in real money land, we have a whole legal framework with standing precedent and built up processes for resolving them. Nevermind the fact that I can just call up my local pizza place, give them a credit card number, and get a pizza. Over in the crypto-hellscape, ever since the fall of the big darknet markets, the only real use case for cryptocurrency is trying to convince other people that everybody's getting rich, so that you can sell them your cryptocurrency for real money. Or accepting a ransom for your malware attack. When the only three inhabited niches in your ecosystem are "speculator", "con artist", and "criminal", it's safe to write the entire thing off as "nonsense".
- theyknowitsxmas 3y agoI understand a mutual fingerprint is good, but how is this better than LibreWolf?
- MrAlex94 3y agoWell, this will provide signed binaries and a "native" (to the browser) update service that doesn’t rely on a third party to update it. Librewolf breaks trust (for lack of a better term) by not offering both of those options. You just have to assume the binary you download isn’t compromised (maybe you could argue checking the hash is enough) and that the third-party updating service won’t serve you a compromised update.
- MasterYoda 3y agoOT: I use Mullvad as VPN and have 2 different Firefox instances, Firefox (standard) and Firefox Dev. Does anyone know if it is possible to run all web surfing thru one of the browsers thru Mullvad VPN thru some extension or similar? In other words: What I want to do is to use one of the Firefox web browsers to connect to my normal ISP and the others traffic to go thru MULLVAD VPN. I know about "split tunnel", but it does not feel optimal, because every single app must be deselected no to use VPN, to just make one web browser use the VPN. And if you want to run another app thru VPN, you must remember to activate it, not only turn on the VPN tunnel. So is there any way an extension could connect Firefox to Mullvad VPN directly or configure some proxies in Firefox that connects to Mullvad VPN app or similar?
- venatiodecorus 3y agomullvad offers a socks proxy. i generally use the wireguard app, and only allow traffic to the socks proxy through the vpn, and configure firefox to use that socks proxy. if you use their app it depends on your operating system how their whitelisting works, but you can pick apps you don't want to have routed through their vpn (but by default with their app all system traffic will be routed through the vpn except what you explicitly deny).
- plsbenice34 3y agoOne of the reasons I use Qubes OS is that it makes functionality like this easy, with strong guarantees that there won't be a leak since it is achieved though VMs in the background. With any application you can configure it to use only a certain VPN, or have multiple separate instances of the same application connected to different ones
- Bu9818 3y agoThis is possible with Linux network namespaces too (but doesn't provide protection against kernel exploitation).
- _jsnk 3y agoI do something like this. I run wireguard in a container along with dante-server (a socks proxy daemon). I then configured a Firefox profile to connect to the socks daemon running in the container. This way I have a single browser profile that is routed through Mullvad while everything else works normally.
- wolverine876 3y agoRegarding hiding-in-the-crowd anonymity (the technical term escapes me atm): Which is the larger crowd, Mullvad VPN or the Tor network?
- earth-adventure 3y agoWith TOR, even the middle men don't know who you are (not considering some large entity controlling too much of 5he TOR network). With a VPN, the middle man sees all your (encrypted) traffic. Considering your question from a host/website point of view, connections trough TOR endpoints are blocked way more often than connections trough a VPN.
- yieldcrv 3y agoIs there a new directory of onion services thats more reliable? I used to use dark.fail but every site they listed has been continually down for the last 2 years due to some widespread DDOS attack on onions, and now dark.fail itself is basically always down too Is there a good Dread replacement while we are at it? Did everyone really move to i2p? because I rarely see anyone talking about that network
- deleted 3y ago[deleted]
- noobermin 3y agoI guess the worry is that this is the tor project turning into the equivalent of the mozilla project at their scale, specifically mozilla of the last 5 years. Somehow it never seems sustainable just running on donations. Literally the only lasting institution to do so is wikimedia, and that's it.
- alexalx666 3y agoboth vpn service and web browser are commodities, giving me a dedicated browser was a trigger for me to learn about them and buy their vpn service. I love that i can login with 1 number. So I think the future is bright for companies that can create differentiation like that
- godelski 3y agoI have two questions: - Can we HN users help push Firefox to incorporate better fingerprint circumvention? (more than current) This is, imo, one of the worst technologies that has been developed around the web. This seems like a thing all privacy focused browsers, which includes FF, should be working on together. This seems like a thing that wins by the network effect, but can be done without an authoritative browser. You just need mass numbers, and while FF isn't that large of a user share, it is large enough that probably most local networks have at least a few connections and every ISP has thousands. FWIW, using amiunique.org I am unique on FF, Safari, Mullvad, Chrome, and Edge on a M2 Air. Mullvad is 0.22% across the board btw, so looks like that's how many Mullvad/Tor users have tried it. Though I am a bit surprised by some of the results. Similarity is very low for: UTC-07 (3% of users are on the... west coast? This can't be right), screen sizes (I thought this was going to be a win because apple consistency, but all values are <0.1% -- except depth, which is best on Safari and identical on FF/Chrome/Edge. Do people not make their browsers the full screen size? (not clicking green expand)). - Will the browser end up having a Tor connect switch? I'd imagine this would make Tor more accessible and could make the entry via VPN method easier and safer for many users. Is that why they're working together? I guess I'm a bit confused at the collaboration here? But it does seem natural that they could work to set up easy interfaces like x -> Mullvad -> Tor, x -> Tor -> Mullvad, or even x -> Mullvar -> Tor -> Mullvad? Is this the natural extension?
- ape4 3y agoI'd like that. But I might change the timezone from UTC to mine.
- burnte 3y ago> Can we HN users help push Firefox to incorporate better fingerprint circumvention? Yes, it's OSS and they are very happy to receive third party patches.
- godelski 3y agoIsn't this something that's already been in conversation though? Just not popular? I'm pretty sure I've seen discussion and pull requests for this on HN. I know even the strict privacy setting, which affects fingerprints, does not make it anywhere close to a Tor fingerprint. I was more suggesting that maybe we can demonstrate the desire of this, to put positive pressure on making this, and other privacy measures, a higher priority of FF
- kozzz 3y agoFew days after the project was announced, Mullvad was banned in Russia.