Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mullvad Browser

mullvad.net

Post reply on HN
Print view View original

411–420 of 434 posts

Re: The Mullvad Browser

#411

Post by notpushkin »

cpeterso wrote: post #374
l8rlump wrote: post #372

Earlier quoted context omitted.

I recently discovered the useful Firefox about:config setting “resistfingerprinting”, which I believe came from this collaboration.

Yes, but beware that many websites are broken when “resistFingerprinting” is enabled. That’s why that mode is not enabled by default or an opt-in option in Firefox’s settings UI.

I've ran into a couple ones that have some canvas-based features that break when resistFingerprinting is on. They get some visible noise added on top (which does indeed thwart fingerprinting, but also makes it harder / weirder to use those features).

Re: The Mullvad Browser

#412

Post by AccountAccount1 »

AtNightWeCode wrote: post #310
AccountAccount1 wrote: post #275

Earlier quoted context omitted.

There's already some work to that direction with cloudflare workers... but I really differs on why people would look for that; in a bit more convoluted case, for example, it would be destined for browsing nested pages of instagram, facebook, reddit, and so on... so it's bit difficult to that, especially with things that require auth... much more a coordination problem that an engineering one

My example is simple. This is for tracking and fingerprinting. At the same time. This all may soon fall into the mobile tracking problem. Like in my country. By having a mobile turned off is in itself a tracking point.

Sorry, you are def right; could you expand a bit on how -what you mention- works? How come that by having a mobile turned off is in itself a tracking point?

ty

Re: The Mullvad Browser

#413

Post by AccountAccount1 »

anigbrowl wrote: post #312
AccountAccount1 wrote: post #273

Earlier quoted context omitted.

The browser fingerprint is so crazy... I don't understand how they don't regulate this shit.

The people you are looking to to regulate it are the same people who would exploit it. I also think this approach of expecting the general public to adopt a borked browser to give deniability to people using it strategically is extremely naive. Human psychology just doesn't work like that, you might as well ask schools of fish to swim differently to hinder shark learning. To be frank, this seems like it will just cre…

Can you say more about the API calls, what would that be exposing of the user? I think it's difficult since most new apps are using Electron, or V8 scaffolds... but really nice idea

Re: The Mullvad Browser

#414

Post by highhedgehog »

enlyth wrote: post #105
thejosh wrote: post #47

Earlier quoted context omitted.

I quite like Mullvad. I haven't needed to use them much (mostly when my ISP has wonky routing and I need something semi-urgent), but their service is pretty good, their website feels like it's designed for the more "techy users". Their billing is the least sketchiest of VPN providers, with no ticking clocks, no upsell and other nonsense. I also like they provide a Wireguard file and a way to filter it, so it's super…

I share a VPN subscription with my father, I use it for torrenting so my ISP can't snoop on me, and he uses it to bypass geo blocking to watch UK shows (things like BritBox, Netflix, BBC etc.) in another country. Unfortunately, there is no way to legally pay for most of these services and watch them from abroad. I tried to get us to use Mullvad, as it was perfect for me, but for him it was constant problems with the…

does it work to bypass geoblocking of Netflix? i cannot access the us catalog from Italy for instance

Re: The Mullvad Browser

#415

Post by sputter_token »

Sporktacular wrote: post #398
coppsilgold wrote: post #222

You can run the tor browser without tor. env TOR_SKIP_LAUNCH=1 TOR_TRANSPROXY=1 about:config extensions.torlauncher.start_tor = FALSE network.dns.disabled = FALSE

Right. I'm struggling to understand the need for this. Does this browser provide some seamless access to some free-tier Mulled service? If not then it seems like a marketing difference to the TOR browser, which can be used with a VPN and have the TOR bit switched off.

This page[0] lists the differences from the Tor browser[0]. It has the Tor specific features removed, different default extensions, enabled webRTC, and added Mullvad's DoH resolver.

[0] https://mullvad.net/en/browser/hard-facts

Re: The Mullvad Browser

#416

Post by sputter_token »

s777 wrote: post #304
ramraj07 wrote: post #74

Earlier quoted context omitted.

Isn’t this like the one legitimate use for Monero?

It is, although then the next problem is getting Monero in the US with their clutterfuck of cryptocurrency regulations, so you have to find an exchange that works with Monero and actually works in the US, then give them your identity and bank account information and hope they don't think you're suspicious and block you.

You could acquire a different crypto on a US exchange such as BCH and then use a DeX which doesn't require any personal information to swap into Monero. You could buy a Mullvad giftcard on Amazon but then Amazon would know that someone at your address has a Mullvad subscription.

Re: The Mullvad Browser

#417

Post by hotpathdev »

As I suspected, this browser, just like the Tor browser, does NOT protect you from basic browser leaks. There are gaping issues and after looking at the github issues, the maintainers are certain that their current strategy is effective. This makes me continue to question this project and Mullvad.

Re: The Mullvad Browser

#418

Post by sodality2 »

hotpathdev wrote: post #417

As I suspected, this browser, just like the Tor browser, does NOT protect you from basic browser leaks. There are gaping issues and after looking at the github issues, the maintainers are certain that their current strategy is effective. This makes me continue to question this project and Mullvad.

Would you mind providing any links for what you’re saying?

Re: The Mullvad Browser

#419

Post by hotpathdev »

sodality2 wrote: post #418
hotpathdev wrote: post #417

As I suspected, this browser, just like the Tor browser, does NOT protect you from basic browser leaks. There are gaping issues and after looking at the github issues, the maintainers are certain that their current strategy is effective. This makes me continue to question this project and Mullvad.

Would you mind providing any links for what you’re saying?

[1] WebGL finger print is device specific and persistent. [2] Font finger print is device specific and persistent. [3] TLS finger print is device specific and persistent. [4] DNS is routed into USA by default. Incidentally, there are frequent dropped requests using this browser [5].

These are just a few that I spotted. Let's proceed with the discussion as though the above issues were not present.

After looking at the issue tracker, this project wants each Mullvad Browser user to look the same, per OS [6]. Blending into a crowd on the surface seems like a good idea, assuming the crowd was large enough, but that "per OS" detail is a big gotcha.

I personally don't see why a source-modified browser shouldn't be able to achieve perfect uniformity. It's especially suspicious to me that the Tor project never achieved it, despite having had multiple years of developer effort dedicated to this goal, and backed by funding. IMO, browsers should never have been flooded with so many uncontrolled privacy breaking features in the first place.

Modification of the browser is discouraged for any reason, including enhancing privacy features [6]. Now read that again, and this time assume hostile intent.

I mentioned in a different comment that the alternative to uniform blending is randomness. Some of the fingerprints in the browser are already randomized. Plausible randomness is far superior to trying to build up a large enough crowd and simultaneously solving the uniformity issues. The entire javascript engine should be ripped apart and reassembled so that all privacy invading features can only function for client-side specific tasks but cannot speak with the networking and storage features.

[1] https://browserleaks.com/webgl [2] https://browserleaks.com/fonts [3] https://browserleaks.com/ssl [4] DNS Leak test: https://browserleaks.com/ip [5] https://github.com/mullvad/mullvad-browser/issues/23 [6] https://github.com/mullvad/mullvad-browser/issues/1

Re: The Mullvad Browser

#420

Post by l8rlump »

notpushkin wrote: post #411
cpeterso wrote: post #374

Earlier quoted context omitted.

Yes, but beware that many websites are broken when “resistFingerprinting” is enabled. That’s why that mode is not enabled by default or an opt-in option in Firefox’s settings UI.

I've ran into a couple ones that have some canvas-based features that break when resistFingerprinting is on. They get some visible noise added on top (which does indeed thwart fingerprinting, but also makes it harder / weirder to use those features).

I believe you can turn off the canvas-based meddling per-site. There's a small icon that appears on the left of the URL input box on affected sites that allows you to do this.
Post reply on HN