HI version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
61% Positive
Analyzed from 2360 words in the discussion.
Trending Topics
#mullvad#browser#vpn#https#using#servers#com#don#more#providers
Discussion (94 Comments)Read Original on HackerNews
which is the blog post, rather than a list of exit servers
related to this post: https://news.ycombinator.com/item?id=48143880
https://datatracker.ietf.org/doc/rfc5737/
Mmm.
It's pretty easy to put three IPv4 /24s on a sticky note on your monitor. I think it's not unfair to say that if one can remember every fact related to one's job, then one has a job with a very, very small scope.
Also, this is another great reason to use IPv6. The v6 documentation prefix is '2001:db8::/32'... plenty of space for example subnets and easy to remember.
How does that matter? The point isn't that the reader should know that "oh, this is a reserved address". The point is that there should be no room for the address that's actually being used by someone to end up being used incorrectly just because it showed up in some random documentation.
Much like how you probably wouldn't be thrilled if your phone number was used as an example in some random documentation somewhere.
It partly because attitudes like that is why software is a mess. Too few people care about correct semantics, everyone is satisfied with whatever sticks. From lists for sets, to tag soup instead of markup, and so on - all the way to modern code slop.
</rant>
Running a browser without javascript that you still want graphics to display (so not a screenreader or text-based-browser), is part of the .1% they are willing to disappoint.
Do I think it is overkill? Sure. Do I still use jQuery at work even though the vast majority of its once handy features are now baked into JS in the browser by default? Of course.
* the useless-to-me "document history" bar graph at the top
* the automatic switch to Dark Mode(TM) that I don't care about
* functional pull down menus at the very tippy top of the page that are entirely unrelated to RFCs that I give zero shits about
The "without javascript" version of the page seems to me to be otherwise identical. Amusingly, the "Email authors", "IPR", & etc buttons switch to the pages they reference notably faster with Javascript disabled.
What broken things were you seeing that I haven't mentioned? Were you using Chrom(e|ium)? Safari?
Wow, is this how things were before bureaucratic behemoths took over the tech industry?
Effectively, stop spoofing random data, start spoofing still useful but not for finger printing data.
Not the same thing.
I use both Firefox and Mulllvad Browser side-by-side on a regular basis and in practice Mullvad Browser is far more aggressive in its privacy preserving measures to the extent that you do sometimes stumble across websites that are "broken" in Mullvad Browser but work fine in Firefox, for example the animated map features on the Ventusky website (which, IIRC, breaks because Mullvad is more aggressive at blocking JS graphics functions).
The browser also has a cool feature in the browser extension called Random mode. This gives you a different IP for each site, improving your privacy.
(TBF this is presumably why parent specified that proxying ought to happen on separate hardware.)
- Browser vulnerabilities are non-trivial.
- Mullvad browser's proxy feature only works if you're connected at the OS level, which helps mitigate browser level exploits.
Compared to any other off the shelf solution, Mullvad browser provides a good balance of usability & privacy.
Compared to something like you're describing, I agree it's worse.
Please talk in terms of specific threats instead of fearmongering. For people wanting to avoid surveillance capitalism, which is a very common threat, I think Mullvad Browser is a fantastic choice.
For journalists targetted by nation states, perhaps it would be better to use Brave or Chrome inside of Qubes.
Curious why Chrome/Brave is recommended? I don't think any modern browser is better for anti-fingerprinting like the Firefox-based ones, including TOR and Mullvad Browser? Don't install random extensions outside the defaults and you're doing a lot better than a Brave/Chrome install if you want a usable internet.
I'm happy that Mullvad actually explains the issue very clearly in https://mullvad.net/en/blog/exit-ip-fingerprinting-between-v...
1. I log into service X with account A1 via Mullvad from country C1.
2. I log into service X with account A2 via Mullvad from country C2.
If the service wanted they can calculate how likely it is that A1 and A2 are the same WireGuard key. If you only use one exit server this probability won't be very precise. But the more exits you use the more accurate it will be even if the sets of exits are distinct between the two accounts.
If the egress IPs were assigned randomly all that service X would know is that these were both Mullvad users but the IPs alone wouldn't allow them to correlate the two users further than that.
I have been confused by this mitigation because switching networks while using the same service is pretty much always a VPN. But maybe I'm not aware of another case where that would happen?
My clanker says no because socks proxies have all one IP per server but I don't know whether to trust it.
When I use a proxy it says like 99% of mullvad users,and when I use wireguard it's between 0.5 and 5%.
(https://tmctmt.github.io/mullvad-seed-estimator/)
Just like scrapers (and a lot of VPNs are quietly using their custom VPN clients to sell your own IP [and data] to scrapers) it's mostly a "don't ask don't tell" situation for IP sourcing. You use a multitude of IP providers and if a scandal happens you just say "We didn't know!" and move on to the next. Almost always grey-market, very rarely through legitimate providers.
Does anyone know if this is any issue for non-vpn users of datapacket.com?
https://www.datapacket.com/case-study/nordvpn
Probably not that much worse than other VPS providers with trashed IP reputations, eg. digital ocean, vultr, ovh. If you're blocking bots, the first thing to block is any datacenter ip ranges, not just known VPN servers.
https://mullvad.net/en/servers
They also have a document that lists some of their practices around the servers, such as not using shared servers:
https://mullvad.net/en/help/server-list
I noticed that the website of one of the two providers they use near me was over a decade out of date :/. DAITA is Mullvad's anti-traffic analysis framework, without it a single hop can likely be easily deanonymized by logging by a single party (it isn't clear if multihop uses fixed packet sizes between their servers).
> Will other users of tuxlerVPN be able to connect using my IP address?
"When you use our free residential VPN, you automatically agree to add your IP address into the community pool. This means that you are trading your own IP address in return for the ability to connect via the IP addresses of other users. You can opt out of this by purchasing our premium subscription; once you upgrade to the premium version, your IP address will be removed from our community pool."
https://medium.com/@xianghangmi/resident-evil-understanding-...
Technical paper: https://ieeexplore.ieee.org/document/8835239
This isn't a practice all VPN providers partake in. And from my own anecdotal experiences, Mullvad seem to be using services that are geo-located (I say this because I've tested latency between different endpoints in Mullvad). But it is something to be wary of with some of the less reputable providers.
From our side we noticed a VPN provider had a location we'd been trying to get, but had been unable to, so we started digging to find their provider. Long story short the server purportedly in some middle east country was actually 3ms away from our server in Berlin.
https://mullvad.net/en/help/connecting-to-mullvad-vpn-from-r...
They've worked quite a bit the past year or two on censorship breaking. But I guess there's always more to be done in a cat and mouse game
https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_g...
Dismissing Wyden's remarks as "american politics" is near equivalent to dismissing the entire notion of VPN security.
https://www.washingtonpost.com/politics/after-years-of-obscu...
its a letter signed by american politicians, addressed to an american agency, about american citizens.
no scare quotes are needed around american politics.
(mullvad is swedish)