The ownership and future of Mullvad VPN
mullvad.net
mullvad.net
they don't use accounts or collect email addresses.
they accept cash in the mail
no matter what you think about crypto they were probably one of if not the first companies in the world to start accepting bitcoin in 2010 and have always self hosted their infrastructure, not offloading it to bitpay or whatever other company that just funnels right into chain analysis companies. back then bitcoin was on the super fringe and the only people interested and involved in it where people that were ideologically aligned with it's vision.
They started funding wireguard before it was cool and before anyone else gave a shit about wireguard.
They are the backbone for mozilla's vpn.
You can never REALLY be sure, but from what I can tell mullvad is the most honest and sincere vpn company in the space and I wouldn't even consider going anywhere else.
I remember spending north of 25 bitcoins on a month of Mullvad back in those days. I don't remember the exact price, but I do remember mining a single 50 bitcoin block was not enough to purchase 2 months. That is at least $1.2m a month for VPN service if we use today's prices. If they actually held on to any of the bitcoin from those days, I am guessing the company and the owners have no real financial motivation to sell.
Same boat with hosting services. 100% relatable.
This makes no sense. We don't know what the future of Bitcoin's market cap is going to do. That's why it is speculation.
Personally, I don't see the point of holding any cryptocurrency I own.
I'm not sure why FOMO has to do with any of this. Your logic also just doesn't make sense when talking about any investment. If the market value goes up and you continue to hold then you can sell it for more than you bought it for. No one is talking about regret here except you. All investing is speculative. That's the nature of investing.
Also, considering that early day cryptocurrency enthusiasts were also bullish on the technology that adjusts the chance that they'd keep some. I'm not sure why this is such a debate. The original comment just said "hey, they might have kept some of that crypto that people would pay them in. If they did, then they probably don't have to worry themselves with money." That's a speculative comment but also has a decent likelihood of being true.
Yes, I misunderstood the point.
The US government gets rid of Bitcoins ASAP, and I know of businesses who accept Bitcoin and who also sell it ASAP.
Ultimately your expected marginal value for speculative investments where you don't have significant expertise or scale or regulatory capture or magical powers has to be negative.
And for the record I generally don't have a positive opinion of cryptocurrencies and am specifically down on bitcoin. I am not projecting what the market cap will be in the future. I am simply commenting on its history.
What exactly is the difference between our scenarios?
The commenter you are replying to, had and sold, but you never had at all.
But my point stands: the idea that just because you had BTC at some point doesn’t really negate the fact that you had no prior knowledge. If you did, I bet you would have spent all your money and took out huge loans to buy more BTC at $2 or even $0.20. It’s a fallacy to think that just because you actually converted $ to BTC that somehow makes your lost opportunity cost more special than if you just held/spent $.
#1 "If privacy is of utmost concern, we recommend that you refrain from communicating any personal data to us since plain-text email is not a safe media for communication. If necessary, use PGP-encrypted email."
So, it sounds like emails are stored on a third-party server, encrypted or not? This is sort of unavoidable for email as I understand it.
i should have been more clear though (and i updated my original comment to reflect this)
They don’t have to store the mail on a third party server.
Email is by definition stored, at least until you retrieve it, so that’s unavoidable.
They could use some public key scheme where they encrypt incoming mail and only the user could decrypt it, but it definitely would be a lot of work. A read buffer’s worth of plaintext would exist briefly in their server’s RAM. I suspect this is more work than any but a tiny number of users would want to deal with.
1. Literally click a button on the homepage
2. Here are the automatically generated credentials for your new account, which you can load up by sending any amount of cryptocurrency (perfect for emptying out an old wallet)
I don't even bother renewing, that's how easy it is to make a fresh throwaway. Which they encourage!
"bitpay or whatever other company that just funnels right into chain analysis companies"
Is that risk with bitpay? Curious to learn more about chain analysis I thought they would analysis all transaction..
Not even Proton VPN is OK - sleuths have figured out that it's just a white-labeled version of NordVPN.
I am thankful that Mullvad is doubling down on their commitment to integrity, because there isn't an alternative.
Do you have links to this evidence/proof?
https://news.ycombinator.com/item?id=23571653
And since the link to [2] in what I linked above is broken, here is the archived version: https://archive.is/iZ2l2
I haven't heard this. Can you elaborate?
They just say "We don't know"? Aren't there consequences for letting people download illegal content via your servers?
It seems likely that they would say "At 2:43am CST, the IP address proxying <x.y.z.w> was <your actual IP>," at which point LEO would knock on your ISP's door. Right?
I think it's totally crazy (as in actually-insane) to trust your life to these services. You're right, you can't really be sure. And if you're in a situation where you need to protect your identity, you're already caught.
I wouldn’t trust my life to it, and I still think it would be crazy to. But if I ever need a VPN, I’ll go with mullvad.
I stopped using privateinternetaccess when their ownership stuff became really sketchy. I’d highly recommend Mullvad to anyone else looking for a good VPN provider.
Side note, Mozilla VPN uses Mullvad’s network under the hood.
They seem to be one that doesnt have an affiliate programme, so they go to the top of my trust ranking.
https://www.nytimes.com/wirecutter/reviews/best-vpn-service/
I've been on a subscription for ages now. Haven't really cared about that amount of anonymity so I'm just using a Paypal for payment though
Reminds me of the old "ZOMG! Your computer is broadcasting an IP address!! Send us money to save your live!!11!eleventy!1" ads.
Yeah I finally decided to leave PIA and at the time Mozilla started their offering. I figured I'd go through Mozilla to provide them some support while switching to a service I have some faith in.
EDIT: I’ve gotten around 90% of my non-VPN speed through Mullvad FWIW
Doesn't make much sense, but there's a lot of weird behaviour in the UK ISP business.
And as for what counts as "looks like VPN", I suspect they're just looking for GRE packets.
Mullvad tend to have a couple of options of ISPs across the servers in one location, and the couple of times I've come across peering I've always managed to find a combo that fully utilises my connection so far.
Yeah we don't want another Kape Technologies acquisition[0]. Kape already own Cyberghost, PrivateInternetAccess and Zenmate. If they bought Mullvad, I would immediately stop using Mullvad since Kape is Israeli and could possibly be tapped by Mossad (I keep an open mind about that however).
[0] https://www.cnet.com/tech/services-and-software/kape-technol...
https://www.expressvpn.com/blog/expressvpn-joining-kape/
It was a bummer to see the news.
Purely for schadenfreude, do we have any evidence the volume of leavers was meaningful?
I closed my account with PIA right after the sellout was announced. I received several emails with form letters about Kape actually being really dedicated to privacy and you can totally trust them buying PIA. Made me think that they took a noticeable hit.
For example GE makes engines for Boeing airplanes. They may have a cooperative agreement and mutual non-disclosure agreements that allow engineers and designers to share engine attachment and airframe details freely, but that doesn't mean GE employees have access to information on the radio headsets.
The fiber runs right out of the building.
You use a VPN to obscure your client IP from websites and app backends, not government mass surveillance.
I'm pretty convinced that the only way to do this is through enforceable legal restrictions, not through technology. This is because those with deep pockets (nation-states and multinational corporations) will always have the technological edge over any average user.
In addition, any operating business has to operate under the laws of the host country, see what happened with Lavabits and its refusal to hand over email encryption keys in 2013:
"The court ordered Levison to be fined $5,000 a day beginning 6 August until he handed over electronic copies of the keys. Two days later Levison handed over the keys hours after he shuttered Lavabit."
The only way to stop nation-states and multinationals from spying on everyone and everything is to make it illegal for them to do so, and to enforce those laws with meaningful punishments.
Part of a problem is that people with legislation-changing privileges are on the other side of the conflict.
If privacy-seeking people don't have a practical leverage for a negotiation, they can't sustain the legislation and enforcement tilted in their favour.
For example, the USSR was meant to be a very liberal and democratic state. At the very beginning, soldiers elected their officers! How long ago have you voted for your favorite manager to manage you at work? But given the "network effects" of the armed and aggressive party organization, the power was quickly centralized and pretty soon lowly individuals' needs and lives were worth nothing.
Now my point is simply that technology has not allowed repressed people in Saudi Arabia or China to defeat or evade state surveillance technology, has it? Now, I have no doubt the US government would love to have that kind of power - and the only thing stopping it from reaching out and taking that power is the legal system.
Of course, blatant violation of the legal system by the state is possible. So is violent armed resistance and civil war. But, I think a government that tried to toss the Bill of Rights would be a government with no legitimacy. See Declaration of Independence.
Many countries protect privacy; the EU is off to a good start on that. Yours can too if you make it happen.
For one example, Soviets forcibly disbanded the (democratically elected) Constituent Assembly after 13 hours of operation, because they didn't get the majority in it, and couldn't influence its decision - and this happened several years before the USSR was even formed.
For another example, the very first Soviet constitution (of 1918; again, before USSR was even a thing!) allocated voting power as follows:
"The All-Russian Congress of Soviets is composed of representatives of urban soviets (one delegate for 25,000 voters), and of representatives of the provincial (gubernia) congresses of soviets (one delegate for 125,000 inhabitants)."
That is, one urban vote counted for 5 rural votes. Most rural votes (and thus votes in general, back then) were those of peasants, who tended to vote for parties such as SR. Urban votes, on the other hand, were mostly factory workers, who tended to support Bolsheviks.
Furthermore, the same constitution outright banned several groups of people from voting:
"(a) Persons who employ hired labor in order to obtain form it an increase in profits; (b) Persons who have an income without doing any work, such as interest from capital, receipts from property, etc.; (c) Private merchants, trade and commercial brokers; (d) Monks and clergy of all denominations;"
As for liberal, one of the first Bolshevik decrees was the "decree on the press", which specifically stated that "bourgeois press" is not subject to freedom of speech. Or we could talk about how the Constitutional Democrat party was banned outright a few weeks later, and its members subject to arrest.
https://www.allabolag.se/5567839807/amagicom-ab
Surprisingly humble numbers. 2020 revenue was ~$2M.
No usernames, cash payments, published audits by reputable companies, handy FAQ/guide section, sleek application, split-tunelling, etc.
In the mess that is VPN products, it's refreshing to see Mullvad stick to its original goals.
"We will not sell MullvadVPN"
If that was the case you wouldn’t see titles like “you won’t believe what happens when you X” and instead you would see “nothing out of the ordinary happened when we X, save yourself 10 min”.
This title is clickbait in the sense that you see it and you have to wonder “oh crap are they selling out? Let’s click and find out”. If they said “Mullvad is not selling and we tell you why” there is no bait.
I wonder (hope for them) that they kept the bitcoin they've been getting by some people, including me, when bitcoin was around 1-2 euro each. If so, they must have 'fuck you money' now anyways.
This might suggest that they have a potential buyer who is aggressively trying to convince them to sell.
This could be Mozilla, considering their recent partnership. But more likely either a competitor that doesn't want to see them grow too much, or someone who really wants to get their hands on the data. Like a three letter agency shell company or hacker group.
https://alternativeto.net/news/2021/9/kape-technologies-buys...
They should switch to a cooperative co-owned by workers and customers then. It the easiest legal-entity way of ensuring that continuity. (Coops cannot "take outside investment" nor "go public"; Mullvad would be owned by stakeholders rather than shareholders)
You can organize a company as a cooperation. It is not a specific legal form of business, but a version of a normal limited company. It is used for non-profit businesses, for example a day care.
You can also form a business association - which is fairly common for non-profit organizations. Typically house owners that share a road, have a small pier for their boats etc.
Finally you can create a foundation. The foundation has no owners or members, but has a board. It is typically used to manage wealth, often for charity purposes (which I think matches the term used in the U.S.). The most famous foundation in Sweden is probably IKEA[0].
(INAL etc. And [0] yes, I know that the IKEA HQ is in Switzerland, with foundation operations in Holland IRRC. But it was founded in Sweden - and we get mixed up with Switzerland all the time anyway so... ;-)
1. my threat model is not my government. It seems that the TLAs have thoroughly pwned our privacy for a long time now. (please note that I am in no way advocating for this mass surveillance, but I don't see that I have much choice in the matter)
2. My threat model includes my ISP. I am forced to use a scummy ISP who would openly steal my data if I let them. Same with my mobile provider.
3. My threat model includes the data thieves who have obvious business models built around selling my stolen data to the highest bidder.
4. My threat model includes black hats and script kiddies.
5. Do I trust my VPN provider? Eh. A little. For now. The thing is, I trust them more than #s 2,3,4 above. What other choice do I have?
Their company is Swedish and therefore must respect Swedish and EU laws. It would be very easy to end up in a ProtonMail/VPN situation. I don't know if Sweden has laws that allow police/judge to order to log one's customer data, but I would be surprised if they don't or at least will have in the future, by their own legislation or EU's.
(I have a separate VPN for when I'm in a public place and it terminates at a machine I own. For movies, I don't care if my traffic is spied on)
The registration, books etc for limited companies (aktiebolag AB) are public information. As someone else pointed out, there are also third party information sources like allabolag:
Mullvad VPN is the first thing that I setup on every Internet connected device that I own.
IMHO better pick lesser-known, obscure service for higher safety. If you care of course.
Since then I have been a customer of Mullvad's and honestly, no affiliation, they're on another level entirely. Being able to pay in cash and have an account with zero information attached to it brings a peace of mind, even though it's totally unnecessary, at least in my humble use case. Being able to use wireguard directly with no weird app in between fits my needs perfectly as well, goodbye borderline-unsupported custom OpenVPN configurations. This is how an online "service" business should be run imo. My only fear is that they'll meet the same end as PIA at some point, or get themselves into trouble with data-hungry law enforcement.
EDIT: Oh, Kape purchased them. I assume that's it.
I know very little about Mullvad specifically, but my general presumption when an organization says this, it means the opposite.
Everyone has a price.
No. You really can't buy some people.
Either because they already have more money than they know how to use, or because they have, you know, principles.
"The ends don't justify the means" is also a principle. And it's a good one. 'Many a great evil has been done in the name of good' etc.
If someone won't kill their grandma for one billion dollars, they probably won't do it for 10 billion either.
> And it's a good one.
You're acting as if myself or the parent comment think everyone in business is evil. AFAIK you have no intimate knowledge about the founders and their motivations or what they believe to be "good", seemingly that they have some benevolent worldy principled intentions. At no point am I arguing that people don't have principles, just that those principles may manifest themselves in different ways (as the parent pointed out, the owners might sell and start a non profit privacy based solution, just like, ya know, Brian Acton did)
Please don't ascribe things to me that I did not say. Thanks a bunch.
We're here to evaluate whether the statement "Everyone has a price." (emphasis yours) is true or not and I have no interest in anything beyond that.
After all that's the part of your post I quoted.
In that sense, everyone has a price. It just doesn't necessarily go directly in their pockets.
As long as there is people willing to literally die for a cause, this won't change.
I don't know why Mullvad issued a notice to talk about ownership, but I presume it was because they've gotten alot of M&A interest or it's a marketing move to garner trust from their client-base (i.e. others are getting distrust for selling).
I know more examples of companies who publicly say they're not interested in selling that do than those that don't. In other words, why be public about it?[0] Clearly there is M&A interest for a company like this.
Do you know any for-profit orgs that say publicly they aren't selling and actually don't? Most I know simply aren't public about it.
[0] - Btw - one M&A trick to drive up a valuation is to say you're not for sale. So yes this heuristic is absolutely valid in that sense.
> I don't know why Mullvad issued a notice to talk about ownership
The reason is probably because ExpressVPN was just bought by Kape. https://news.ycombinator.com/item?id=28552731
> Upvoted because you have good points
I have a feeling people are downvoting me because they think people are bad/evil for wanting money. Weird.
Yeah, I agree it's weird.
Personally, I'd love to have enough money to not have to work the rest of my life, or worry about anything. Nothing evil with that.
You represent a branch of people this system grew which would rather make up some story than to believe that people actually won't sell something because it's important to them.
And yes, think about their families. My SO would throw me out if I's sell what I believe in and I'd deserve it. What an example to the kids would that make? I'd be despicable to them.
Where have we seen this before... ;)
Surely if requested by their government they will keep logs for any specific customer, just like it happen with protonmail.
Surely the support costs of dealing with all the constant abuse reports would outweigh the fee they are charging, not to mention the costs of running the infrastructure (if they're used for piracy they'd need quite a bit of bandwidth)?
Even if you are legally in the clear, it doesn't strike me as a business someone wants to get involved in unless there are alternative objectives they don't disclose.
I'm interested to know where you sourced that number? There are plenty of legitimate use cases for a VPN.
While I agree there is definitely users with subpar intentions, I highly doubt 99% of people subscribing to a VPN are doing it because they are 'scum'.
Employing /dev/null to handle abuse reports is usually pretty cheap.
[1] https://cccc.ncte.org/cccc/committees/ip/ipreports/swartzcas...
Artists need food, shelter, and comfort just like everyone else. Those things cost money. Even an artist who feels a need to create needs enough funding to survive and get materials. Great works of art require funding. This is particularly true for things like movies and video games - you can have some smaller indie passion projects, but the kind of funding for AAA games or blockbuster movies doesn't just appear out of thin air - it requires a return on investment. If piracy was widespread and universally acceptable, this content would not exist.
Again, AAA games aren't a couple of passionate friends. George on the engine team doesn't want to spend 2 days hunting down an obscure collision detection bug if they're not getting paid.
Nowadays, I pirate games I paid for, so I don't have to run invasive and performance-degrading DRM software that makes assumptions about current computers that might not hold in the future.
It's about convenience and archival, and the creator's compensation.
Philosophically, it's also about protesting about the nature of private property and how in many cases nowadays, a "purchase" is in fact more akin to a lease.
I don't think this is accurate. There are plenty of legitimate critiques against intellectual property, for example: https://plato.stanford.edu/entries/intellectual-property/#Ge...
So yes, I have an inherent legal and moral right to others' work as I pay for it.
You have an inherent (natural) right to freedom of speech, which includes propagation of information. Intellectual property rights are an artificial construct that is created by society, effectively limiting freedom of speech and granting limited monopolies on distribution of certain information, ostensibly to achieve certain social goals. Both the goals themselves, and to what extent the arrangement is conductive to achieving them, is very much debatable.
Does anyone use Mullvad on their mobile, has stability of the connection improved? (speed is not my first priority.)
EDIT: why downvotes (without leaving a comment…) ?
Anyone have a solution for always on mobile VPN using mullvad?
I don't use their app though, but the actual Wireguard config files.
I'm pretty sure the mobile WiFi handover is handled in your phone firmware and not by the VPN app, I would guess that's got to do with apple software but I could be wrong.