The Mullvad Browser • Hacker News Board

Re: The Mullvad Browser

#51

Post by cyber_kinetist » Mon, Apr 03, 2023, 11:16 AM UTC

fiso64 wrote: post #40

hotpathdev wrote: post #15

Earlier quoted context omitted.

Simply download the Tor browser and evaluate its performance on one of the many browser fingerprint [1][2] and browser leak [3][4] web services. The last time I checked, it didn't pass every test. [1] https://www.amiunique.org/fp [2] https://coveryourtracks.eff.org/ [3] https://browserleaks.com/ [4] https://www.dnsleaktest.com/

Indeed, my fingerprint in https://www.amiunique.org/fp appears to be unique when using the Mullvad browser.

Maybe Mullvad uses some techniques to randomize the unique fingerprint over time in order to not get tracked? So you’re basically identifiable for only a certain period of time until the tracked identity becomes invalidated.

Re: The Mullvad Browser

#52

Post by archb » Mon, Apr 03, 2023, 11:17 AM UTC

As a DuckDuckGo fan as well, I'd have loved to see them/DuckDuckGo develop their browser on the top of Firefox with Mullvad as a partner with deep integrations.

Re: The Mullvad Browser

#53

Post by udev4096 » Mon, Apr 03, 2023, 11:17 AM UTC

hotpathdev wrote: post #15

Eisenstein wrote: post #8

Earlier quoted context omitted.

> The last time I tried the Tor browser, it did not sufficiently handle browser finger prints. Can you expound on this?

Simply download the Tor browser and evaluate its performance on one of the many browser fingerprint [1][2] and browser leak [3][4] web services. The last time I checked, it didn't pass every test. [1] https://www.amiunique.org/fp [2] https://coveryourtracks.eff.org/ [3] https://browserleaks.com/ [4] https://www.dnsleaktest.com/

Testing on a bunch of sites does nothing at all. Fingerprinting is a lot more than just that

Re: The Mullvad Browser

#54

Post by Eisenstein » Mon, Apr 03, 2023, 11:18 AM UTC

nextaccountic wrote: post #33

Eisenstein wrote: post #22

> Dns Over HTTPS (DoH) > Mullvad Browser is configured to use Mullvad DoH for all DNS requests, without fallback. In the settings, you can also configure it to use Mullvad Adblocking DoH. about:config DOH entries screenshot here: * https://imgur.com/a/evd9OzN Can anyone knowledgeable comment on the security implications of this?

If you trust Mullvad to see all your traffic (including every IP you connect to), it seems okay to trust them to see your DNS queries (that will return the very same IPs you will later connect to)

I don't though. I don't use Mullvad VPN.

Re: The Mullvad Browser

#55

Post by daveoc64 » Mon, Apr 03, 2023, 11:19 AM UTC

archb wrote: post #34

esskay wrote: post #17

Earlier quoted context omitted.

Stick out to who? Just set the useragent to a default firefox one (assuming its not already set) and you're golden.

I decided to test it out on a website[0] and it does seem that the useragent goes by the Firefox name: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 On my Firefox: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0 It's interesting to note that the Mullvad browser seems to be based off on Firefox 102.0, which came way back on June 28, 2022: https://www.mozilla.…

Firefox 102 is current Extended Support Release (ESR):

https://www.mozilla.org/en-US/firefox/102.9.0/releasenotes/

Re: The Mullvad Browser

#56

Post by udev4096 » Mon, Apr 03, 2023, 11:19 AM UTC

lofaszvanitt wrote: post #27

Why not sprinkle it with something like grsec? Now that would be a secure browser and would really upset a lot of shady people.

grsec isn't free anymore

Re: The Mullvad Browser

#57

Post by UncleSlacky » Mon, Apr 03, 2023, 11:21 AM UTC

ugurnot wrote: post #5

I hope there will be a mobile version too at some point.

I'm not sure if it's the same org behind it, but there is a Mull browser available on F-Droid:

https://f-droid.org/en/packages/us.spotco.fennec_dos/

Re: The Mullvad Browser

#58

Post by shp0ngle » Mon, Apr 03, 2023, 11:23 AM UTC

Isn't Tor using always out-of-date Firefox, for minimizing tracking on versions? Wouldn't this affect the security angle?

Re: The Mullvad Browser

#59

Post by [deleted] » Mon, Apr 03, 2023, 11:23 AM UTC

archb wrote: post #34

esskay wrote: post #17

Earlier quoted context omitted.

Stick out to who? Just set the useragent to a default firefox one (assuming its not already set) and you're golden.

I decided to test it out on a website[0] and it does seem that the useragent goes by the Firefox name: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 On my Firefox: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0 It's interesting to note that the Mullvad browser seems to be based off on Firefox 102.0, which came way back on June 28, 2022: https://www.mozilla.…

[deleted]

Re: The Mullvad Browser

#60

Post by detrites » Mon, Apr 03, 2023, 11:24 AM UTC

ta1243 wrote: post #31

detrites wrote: post #28

From the FAQ [0]: > Why is the time is wrong? > The timezone is spoofed, to combat fingerprinting. > What's this weird spacing around the websites? > It’s called letterboxing, a function to combat fingerprinting (using your browser window size to identify you together with other measures). > How do I stay logged into specific websites between sessions? > It’s not possible. It’s an action to combat tracking. Not sure…

Except most of the time I don't want to spoof my timezone, don't want weird spacing around websites, and do want to remain logged in to websites. > How do I stay logged into specific websites between sessions? > It’s not possible. It’s an action to combat tracking. Turns me off immediately

Well, some of us don't want to be tracked, don't want to be tracked and don't want to be tracked.

Given your stated preferences, are you actually looking for a privacy-focused browser?