I don't use Mullvad, but I respect the shit out of them. This is a good, information dense explanation of the problem, their short term workaround and potential workarounds for others, as well as what will need to be fixed in Android. Good stuff.
However I'm worried that their goodwill and values will become more valuable to some private equity corp that buys them to asset strip and squeeze their customers.
Not everyone's in it for the money. Assuming they're not operating at a loss, even less so.
In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for your business if you do.
I also use mullvad because I don't really think this is the case, but bad actors are generally hard to conclusively identify by design. And VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.
This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me.
Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't.
https://github.com/mullvad/system-transparency
- https://www.sigsum.org (a transparency log with witness cosigning)
- https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?
https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server.
Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product.
This is on the extreme end, but you asked for a fun challenge! :)
I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
At best you have stuff like attestation... but we all know those have a long history of being flawed and are subject to loads of side channels that can't be attested against. Plus VPNs are such a honeypot in every conceivable way that TONS of state-actor-level efforts are entirely reasonable, and that could easily include cheating on basically all attestation systems imaginable. We're just kinda stuck trusting history and lack of public leaks / correlated actions / whistleblowers IMO.
Or, frankly, the Mozilla partnering counts for a lot to me. I won't use their setup because it doesn't have non-vpn-app options, but they're a group I mostly trust to have people's safety at heart.
Personally, stuff like Tor (where by construction you only need to touch a couple good actors to be reasonably secure, and anyone can contribute) is about the only mostly-actually-trustworthy kind of system. You can expect malicious actors to participate there, and still have a reasonable level of privacy, particularly if you check a few personally (which is feasible because anyone can contribute). Tor and similar have plenty of issues, but structurally they're much more sound by design than any centralized VPN can ever be. Now if only they were even a tiny fraction as usable...
https://mullvad.net/en/help/policy-reviews-advertising-and-a...
On the other hand the campaign we did in Stockholm last year worked out quite well. It managed to affect both domestic and EU legislative discussions at the time. Or at least our campaign contributed to moving the discussion in the right direction.
How much is that worth? I'm not sure, but the reason we started Mullvad in the first place was to conduct political action through entrepreneurship, specifically regarding mass surveillance and censorship.
If nothing else it seems to amuse a lot of people, including me and my colleagues. When I first heard of the idea of plastering privacy propaganda all over some major U.S. cities my initial reaction was more or less "lol, we can just do that?". As it turns out we can. :)
transparency is absolutely a corporate virtue.
I can't speak for my marketing colleagues but I would assume they reason about it. It seems like a complex system to me, which means the approach kind of has to be (1) forming an understanding of the system and (2) deciding whether one is comfortable with the uncertainty.
One aspect that makes the cost/benefit assessment quite a bit easier is that we don't only care about how many new paying customers we get. It's also fun to do this kind of advertisement. How many interesting conversations about privacy have been had as a result of people seeing our billboards? That's worth something too.
Rather a neat subversion of the common corporate use of remote attestation, to preserve user privacy and security rather than curtail it.
Two years ago we moved the OSS projects System Transparency and Sigsum to its own organization: Glasklar Teknik AB (glasklarteknik.se).
The OSS and OSHW project TKey was moved to Mullvad's other sister company Tillitis AB (tillitis.se)
The ads are great to see in NYC subway and giant billboard near NY Times HQ.
Is there an online page with all of the ads? Maybe a video tour of the ads "in the wild" in different cities?
(Seeing the reply down thread from a Mullvad rep, this is not unexpected)
> Imagine an ad that won’t track you after you see it
> Mullvad VPN
That’s not what a VPN does though. Tunneling my browsing does not stop sites from serving ads, setting cookies, fingerprinting browsers, etc.
Mullvad itself is extremely clear that use of a VPN alone is not enough for the reasons you stated. Mullvad VPN (which is what they advertised) is a suite of products and services, some of which are:
- DNS services (ads, tracking)
- A privacy-optimized browser (cookies, fingerprinting)
- Network services like multihop routing (many benefits such as resistance to timing attacks)
All of these services are included with your subscription at no additional cost. I feel like the claim of preventing ad tracking is as legitimate as it could possibly be.
They’ve made some claims that are downright lies, I chuckle at the idea anyone would trust them.
The NYC subway ads state that they save you from online web ad systems; blatantly false.
I’ll take a photo next time I see the ad to store away.
Which claims are you referring to?
> The NYC subway ads state that they save you from online web ad systems; blatantly false.
> The NYC subway ads state that they save you from online web ad systems; blatantly false.
While it's true they've not always offered this, it's on you when making such claims to ensure you're still factual.
Please show me evidence to back this up and I’ll happily walk back my statements.
The “mullvad” browser is not their VPN product. And if you think DNS denylisting prevents “ad networks from spying on you”, I have some unfortunate news for you. It works to prevent the rendering of a subset of ads (especially in the browser), but isn’t worth a damn for actual behavioral analysis.
"How to set up ad blocking in our app"
Dated May 27, 2021
I would guess it started with something like this: they serve DNS to prevent DNS leaks when using the VPN. They realize they can use this to block domains, just like a pihole or Cloudflare DNS. They integrate that into their VPN offering.
It's pretty logical once you think about it, but it was a surprise to me too.
The paragraph above is clearly visible on our landing page. We don't want people using our service for things it's not designed for.
The paragraph below is also a direct quote from our website.
"When you visit a website, you can be identified and tracked through your IP address, third-party cookies, all kinds of tracking scripts, and through so called browser fingerprints. That’s why masking your IP address is not enough to stop the data collection. However, by using a trustworthy VPN in combination with a privacy-focused browser, you can put up a better resistance against the mass surveillance of today. That's why we partnered with the Tor Project to develop Mullvad Browser – a browser designed to minimize tracking and fingerprints."
I don't know if it's easily configurable in the app, though.
I just discovered it by accident the other day.
It's super easy.
See "DNS content blockers" at https://mullvad.net/de/help/using-mullvad-vpn-on-android#vpn...
Some of the ads also felt deceptive making it seem like it will prevent all your online tracking, even though we know that’s not the case.
I'm sorry to hear that. For what it's worth our marketing colleagues make a big effort to minimize the risk of such interpretations. Sometimes a really snappy string of words can be interpreted multiple ways. There's also only so many words we can put on an ad before it gets messy. We do try hard to make the nuances clear on our website, which ultimately is where any new users will have to go in order to buy the service.
It certainly wasn’t the most egregious VPN ad I’ve ever seen, but it was disappointing to see Mullvad imply privacy properties for VPNs knowing that ordinary people don’t understand cookies, sessions, fingerprinting, or JavaScript.
In any case we make the most important nuances clear on our landing page, and in other places on our website.
That copy should’ve never made it past basic checks for legitimacy.
Or alternatively: feel free to describe to HN how Mulvad protects users against ad networks.
To claim that you stop online ad networks is a downright falsehood and you know it.
A VPN is not enough for privacy. But in combination with a privacy-focused browser, you make sure to block third-party cookies and other tracking technologies used by the data collectors.
That's why we partnered with the Tor Project to develop Mullvad Browser – a browser designed to minimize tracking and fingerprints.
Please also note that this information is clearly displayed on our landing page. We don't want people using our service for things it's not designed for.
The browser piece is doing almost all of the work against ad networks, isn’t it?
Which part of defense against ad networks does a VPN contribute to?
Where do they claim their VPN stops online ad networks?
https://mullvad.net/en/blog/aiding-to-break-habits-gambling-...
https://mullvad.net/en/blog/how-were-knocking-down-ads-and-t...
It's not going to prevent everything, but it'll definitely help.
>"Unfortunately port forwarding also allows avenues for abuse, which in some cases can result in a far worse experience for the majority of our users. Regrettably individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers. This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us."
>"The result is that it affects the majority of our users negatively, because they cannot use our service without having services being blocked."
https://mullvad.net/en/blog/removing-the-support-for-forward...
Mullvad and a few others have had to disable this feature because it turns out it’s super useful for hosting malware C&C servers, phishing pages, etc
There are other solutions for your use case, with or without a third-party VPN, that wouldn't require port forwarding. There are also other VPN services that do offer this functionality.
I wrote some info about it in this thread[0], including how you can do ad blocking at the DNS level (and cloudflare info for the same).
I got back a swift reply which solved the payment question, and a detailed iptables reply with pros and cons of different solutions.
In short: they are great.
im seeing it detect!!
I highly recommend reading some of our blog posts and community posts.
You can also checkout our IP data tags page: https://ipinfo.io/tags
If you are interested in what kind of other information we can discover from our internet measurements, check out our tags page: https://ipinfo.io/tags