Hacker News Reader

Hacker News

Comment by mondego | Hacker News Reader

Parent Full thread

mondego

Title: AzireVPN added port-forwarding support

A potential option for Mullvad refugees?

View on HN

OVPN offers port forwarding. https://www.ovpn.com/en/blog/port-forwarding-with-ovpn

Well they also sold out to Pango https://www.ovpn.com/en/blog/next-chapter-for-ovpn

That tells me nothing, is it bad?

They also offer static public IPs as an add-on, making port forwarding unnecessary if you agree to give up the bit of privacy that comes from the shared IPs.

Why are there Mullvad refugees?

https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

Here's the thing. The most likely reason Mullvad got rid of fixed forwarded ports is that it could be used to de-anonymize their users.

TFA seems to offer a solution for that problem with "Experience uncompromising privacy with AzireVPN's Blind Operator! Your port stays confidential as we don't store or log assigned ports in any database. Thanks to our secure Blind Operator backend, your assigned port remains private."

Ultimately you have to take their word that it works as well as described.

No, they got rid of it for security/liability/reputation reasons as port forwarding makes it attractive for botnets.

Port forwarding doesn't assist in deanonymization. Ultimately you either trust your VPN or you don't.

Mullvad had to keep a record of which port maps to which account ID and LE could subpoena that. Mullvad's whole shtick is that even if LE has 100% of the data they have, you won't be deanonymized.

Which is why Mullvad used to not allow auto-billing if you had portforwarding. If you wanted to use portforwarding, which Mullvad had for years, you needed to pay in advance for how much you wanted to use it. They didn’t need to keep any of your information on file, including payment stuff. Just that a particular account is paid up until a certain date. Linking a port to an account ID is possible, but there is nothing that needs to be kept about the owner of an account id either. So even LE can’t really do much with that information.

Port forwarding, or really just having any ports open at all, can definitely be used as part of fingerprinting.

Mullvad, like many VPN's, only gives (gave) you a single port. And you're free to change that port number as often as you like if you want to avoid being fingerprinted.

But fingerprinting isn't deanonymization anyways. And this is stretching the idea of "fingerprinting" in the first place -- a single port number provides the same amount of information as an IP address. With a VPN you can rotate both as often or as little as you like.

Small correction: Mullvad gave you 5 ports per account that you could assign (per VPN server city) to any of your 5 public keys in an arbitrary manner. E.g. 3 for one + 2 for another.

> Ultimately you have to take their word that it works as well as described.

Compared with what other options?

Mullvad does not support port forwarding. You can try to defend it all you want, but if someone needs port forwarding and your alternative does not support port forwarding then you need to find another alternative or your point is moot.

IMO Mullvad is the most technologically advanced VPN provider in the industry. Mullvad decided to get rid of port forwarding entirely (knowing full well the impact it would have on their revenue) instead of trying to implement the special measures that TFA spends two whole paragraphs describing.

This doesn't answer the question at all.

Could you point to some info on why Mullvad is the most technologically advanced VPN?

"Most" might be hard to prove, but they're at the forefront of using new-ish technologies like TPM/SGX to ensure their non-retention policies are workable in practice: https://news.ycombinator.com/item?id=29903695

This results in raids leaving empty-handed: https://news.ycombinator.com/item?id=35638917

This is in contrast to the flocks of VPN providers whose retention-related claims were either complete horseshit or not well-implemented.

What happens to Mullvad?

Reply on news.ycombinator.com