Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard multihop available in the Mullvad app

mullvad.net

Post reply on HN
Print view View original

121–130 of 141 posts

Re: WireGuard multihop available in the Mullvad app

#121

Post by satyamkapoor »

netfortius wrote: post #20
mft_ wrote: post #2

Tangential, but I recently discovered Mullvad. For years, I've used whichever mainstream VPN provider had a good deal on come renewal time, and cycled through a few of the usual suspects. Recently, I was with Surfshark, and was really struggling to get download rates above a few hundred K/sec - and sometimes even worse. I didn't even suspect the VPN at first, but ultimately tried a different provider as a diagnostic…

How are Mullvad apps across multiple platforms? I've been with PIA for quite a while, and I got it to work they way I want it, on macOS, windows and android, and I liked even more some of their recent exit points marked "for streaming", as I watch sports online, and there is a significant improvement when using those, with some countries local free broadcasting, but performance in the rest , sometimes, is really atro…

The ios app reviews of PIA says it's now owned by a company which used to make malwares. I'm really happy with PIA as compared to Mullvad. Works better for me but this review is making me feel unsafe :(

The PIA app is lovely. Mullvad's as well

Re: WireGuard multihop available in the Mullvad app

#122

Post by vinay_ys »

capableweb wrote: post #102
vinay_ys wrote: post #97

Earlier quoted context omitted.

With a Wireguard VPN to reach Internet, all traffic from this machine meant for Internet is going via the tunnel, including the OS generated background traffic, and application generated background traffic (like update servers, analytics beacons/telemetry, license verification servers etc). These can contain tracking identifiers that can be tied back to app purchases, and even laptop purchase itself. If you really ha…

Yes, indeed, if there is identifiable traffic coming from the OS, you're screwed. This is why I said "not all traffic is indeed personally identifiable". If you are doing things where you have to be anonymous, there are plenty of OSes you can run to not have all those things giving away your identity. If you think just adding a VPN on top of the OS you use for other things, you're screwed. I think you're missing the…

The point was exactly that – you are already screwed, irrespective of being able to pay anonymously. If you are the kind of actor who will (or needs to) take all the countermeasures needed to be truly anonymous at a whole machine traffic level, then you are likely not going to be using mullvad.

To a typical customer of mullvad who also reads hn I would say this – you aren't going to gain any additional privacy by using anonymous payments. Here's why: either you believe Sweden is a safe haven for user data privacy or not.

– If it is, then you have nothing to worry about even with payment method tied to you.

– If it is not, then a Swedish government agency can compel mullvad to reveal the customer details (like payment method details) based on the WireGuard UDP socketpair details. But then they can also very likely compel mullvad to give them a live dump of traffic within the tunnel.

For truly high-risk people (journalists/whistleblowers against powerful entities, not regular geeks who want to block ad tracking), I'm not sure if any vpn service like this is a net help or does it actually cause more harm.

Re: WireGuard multihop available in the Mullvad app

#123

Post by cycomanic »

throwanem wrote: post #3

I use (and really like!) Mullvad, but have never tried the app, preferring to use my existing OpenVPN clients with the profiles Mullvad provides. This isn't because I have any reason to mistrust their app, but just because if I've already got a perfectly serviceable client on my device, why add another binary to do the same thing? But I would be interested to hear, from folks who have used the app, what you like and…

My main application is to get passed region block to keep up with news/TV in other places I've lived previously. The app makes changing your exit node very straight forward and I've not encountered any bugs, so it does what it should.

Re: WireGuard multihop available in the Mullvad app

#124

Post by cycomanic »

netfortius wrote: post #20
mft_ wrote: post #2

Tangential, but I recently discovered Mullvad. For years, I've used whichever mainstream VPN provider had a good deal on come renewal time, and cycled through a few of the usual suspects. Recently, I was with Surfshark, and was really struggling to get download rates above a few hundred K/sec - and sometimes even worse. I didn't even suspect the VPN at first, but ultimately tried a different provider as a diagnostic…

How are Mullvad apps across multiple platforms? I've been with PIA for quite a while, and I got it to work they way I want it, on macOS, windows and android, and I liked even more some of their recent exit points marked "for streaming", as I watch sports online, and there is a significant improvement when using those, with some countries local free broadcasting, but performance in the rest , sometimes, is really atro…

I used mullvad for streaming sports in Australia being in Europe at the time, no problem streaming in full HD. My machine is running linux although I doubt that makes a difference.

Re: WireGuard multihop available in the Mullvad app

#125

Post by faern »

topdancing wrote: post #61
justsomehnguy wrote: post #56

Earlier quoted context omitted.

You probably missed > It’s a WireGuard tunnel being sent inside another WireGuard tunnel Edit: replaced with a better diagram (and again, now based on example in [0]): ▼ ▼ ▼ ▼ YOU->NL1 tunnel SE4->NL1 tunnel PLAIN/TLS YOU ────────────────────► SE4 ───────────────────► NL1 ───────────────► CATPICS.COM On the wire: YOU->SE4 traffic SE4->NL1 traffic NL1->CATPICS.COM traffic ┌────────────────┐ ┌────────────────┐ ┌──────┐…

This isn't how it works. If you actually pull down one of their multihop configurations - you'll see: - the WireGuard public key for server 2 - the IP address for server 1 - a unique port for server2 on server 1 So all they're doing is a standard iptables redirect to the second host (which may or may not itself be under a WireGuard tunnel).

Your description is correct for the configuration files, yes! But it's not correct for the app. There are multiple ways of doing multihop with Mullvad. The config files use a simple redirect where each server has a unique port it's reachable over on all other servers. That's what the config files are doing.

But the app actually has a wg tunnel inside another wg tunnel. If you (on Linux) run `wg` (as root) in a terminal when it's connected with multihop you will see that it has two peers set up for the `wg-mullvad` interface, one peer is routed through the other.

So the only thing that SE4 can see is encrypted WireGuard traffic headed for NL1.

Re: WireGuard multihop available in the Mullvad app

#126

Post by maxwelldone »

twojacobtwo wrote: post #105
CPAhem wrote: post #74

Earlier quoted context omitted.

The Mullvad app is huge ~100MB which is odd for what it needs to do.

That is one of the nitpicks that I missed, along with their downloads being excruciatingly slow when already connected to the service, for whatever reason (I may just be doing something wrong).

I've noticed that as well. The trick as I found (and even recommended by their support) is to download from their GitHub repo.

Re: WireGuard multihop available in the Mullvad app

#127

Post by faern »

justsomehnguy wrote: post #81
topdancing wrote: post #61

Earlier quoted context omitted.

This isn't how it works. If you actually pull down one of their multihop configurations - you'll see: - the WireGuard public key for server 2 - the IP address for server 1 - a unique port for server2 on server 1 So all they're doing is a standard iptables redirect to the second host (which may or may not itself be under a WireGuard tunnel).

Well, I stand corrected, because I relied on their promo description. *shrug_emoji* I replaced the diagram in the previous comment, take a look.

This can be very confusing indeed, since there are multiple ways of doing multihop. Please see my description in https://news.ycombinator.com/item?id=31012071.

The guide at https://mullvad.net/en/help/wireguard-and-mullvad-vpn/ only talks about how the config files does it. Which is completely different from how the app does it!

Re: WireGuard multihop available in the Mullvad app

#128

Post by INTPenis »

teawrecks wrote: post #96
INTPenis wrote: post #72

Earlier quoted context omitted.

Splitting hairs no? I mean you're comparing multi-hop with onion routing. I'm just speaking as a layman end user. When I see multi-hop it's self-explanatory, it's literally in the name. Onion routing is another type of multi-hop with the onion routing algorithm.

The point of multihop, tor or otherwise, is for each node in the route to not know what the other knows. The first node sees packets coming from you, but not where they're going. The second see's where they're going but doesn't know where they're from (and vice versa). If the two nodes exchange this info (ex. if same person runs both nodes) then there's no point. Nothing is gained, you just incur the overhead of the…

Where is this defined? Because the word multi-hop only implies more than one hop. Anything else needs to be defined as a specific algorithm, like onion routing for example. That's why I think this is semantics.

Re: WireGuard multihop available in the Mullvad app

#129

Post by database64128 »

wraptile wrote: post #112
daqhris wrote: post #104

I'm a happy Mullvad user. But I have one concern. Recently, Instagram "tagged" my account as either based in Russia or using Russian currency. I'm based in Western EU and set up the VPN to connect to the same country or neighboring ones. I'm trying to figure out if some endpoints belonging to Mullvad have been shadowbanned by Meta/Instagram. Is there someone else who uses Mullvad to surf on Meta products whose accoun…

I use Mullvad and I constantly run into things like ASN bans etc. For example, cloudflare often bans whole ASN making many websites not accessible through Mullvad. Seems like mullvad is being used by a lot of bad actors and they're not really doing anything about it. I like their software and monetization but their IPs are probably the lowest quality IPs in the VPN market.

> Seems like mullvad is being used by a lot of bad actors and they're not really doing anything about it.

If you set up your own VPN server on popular cloud platforms, you'll notice that almost all Cloud platforms face the same issue. Basically this is what you get when you use a data center IP for Internet browsing.

Re: WireGuard multihop available in the Mullvad app

#130

Post by brobinson »

dosshell wrote: post #44
gavinray wrote: post #28

Earlier quoted context omitted.

> "They never shutdown their computers and if it happened, they did a full format and reinstalled the os - because if security." I don't get it

I don't recall why, it was so long time ago. But my best guess is that they wanted to guarantee that they know what has been booted?

The sibling comment already mentioned evil maid attacks (not as much of an issue nowadays thanks to SecureBoot and TPMs), but there's also DMA attacks through physical ports: https://en.wikipedia.org/wiki/DMA_attack
Post reply on HN