Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad exit IPs are surprisingly identifying

tmctmt.com

Post reply on HN
Print view View original

171–180 of 408 posts

Re: Mullvad exit IPs are surprisingly identifying

#171

Post by tschumacher »

Great find by the author and I have no trouble believing this is an oversight by Mullvad. Kind of shocking that something this simple slips by them but I could see myself missing it.

Putting aside the IP correlation across multiple servers, at first I wondered why even keep the user IP stable on one server. But I think it makes sense because as the author states other VPNs usually have only one IP per server so they are essentially simulating that. The advantages for the user are, if they find a server that works for accessing some service they can connect to that server again and it will work again because they get the same IP.

The IP correlation across multiple servers they should fix though with something like rand.seed(user_pub_key + server_id)

Re: Mullvad exit IPs are surprisingly identifying

#172

Post by nly »

lmm wrote: post #14
tempest_ wrote: post #5

Earlier quoted context omitted.

I imagine there are a bunch of things on the internet that break if you start trying to connect to them from varying IP addresses. Things like the various CAPTCHA schemes and rate limiting etc, IP reputation etc.

> I imagine there are a bunch of things on the internet that break if you start trying to connect to them from varying IP addresses. Things like the various CAPTCHA schemes and rate limiting etc, IP reputation etc. Given how much of the world is stuck behind CGNAT now, I would expect any major sites to handle it.

Ironically the CGNAT at my ISP is so broken at peak times the only way I can actually use the internet is via a VPN (presumably because I then only occupy one connection tracking slot on the NAT)

I'm also stuck in a 2 year ISP contract

Re: Mullvad exit IPs are surprisingly identifying

#173

Post by arcfour »

solenoid0937 wrote: post #32

> As an example, imagine that you are a moderator on a forum and you suspect that a new face is actually a sockpuppet of a user you banned the day prior. You check the IP logs, and despite using different Mullvad servers, both accounts resolve to the overlapping float ranges 0.4334 - 0.4428 and 0.4358 - 0.4423. This gives you a >99% chance that they are the same person. This sounds like how I'd design a VPN if I were…

Mullvad predates the Snowden leaks by several years and was not mentioned anywhere in them.

Sure, there are other intelligence agencies, but that's the one I'd be the most worried about. Since either they run it, or they would know of it and want to emulate the idea, or know of it and have access to it from the partner agency running it. Or they are not a threat to me.

There's also the issue of no publicly known cases where someone that used Mullvad being deanonymized through the VPN but instead being discovered through some other opsec failure. If an intelligence agency has this capability they have been sitting on it for almost 2 decades without making use of the data. Hard to believe.

Re: Mullvad exit IPs are surprisingly identifying

#174

Post by fragmede »

illiac786 wrote: post #135
hdgvhicv wrote: post #114

Earlier quoted context omitted.

The mass surveillance industry doesn’t rely on ips or even cookies to track you.

That seems like a huge bet. I don’t bet on this, I am careful about cookies and my source IPs. Do you have any facts? I know they really on _additional_ stuff, but do you have sources showing that they never use cookies or source IPs?

That's a different claim though. Obviously they'd use cookies and source IPs when they're available, because why not use all of the information available to you. That browser fingerprinting is good enough that neither of those sources are necessary is for you to decide on whom to believe.

On that topic, though, is the Mullvad Browser, who's entire intention is to defeat browser fingerprinting.

Re: Mullvad exit IPs are surprisingly identifying

#175

Post by antonvs »

fragmede wrote: post #156
charcircuit wrote: post #94

Earlier quoted context omitted.

I think you are misreading his comment. He is saying that on a VPN it is standard behavior that if you visit site A and site B they will both see you connecting from the same IP and can infer you are potentially the same person.

Site A and B have to collude in order to make that inference. Outside of Cloudflare, no one is colluding at that level.

That would only be true if there were no ad networks.

But today’s internet is essentially a giant ad network.

Re: Mullvad exit IPs are surprisingly identifying

#176

Post by illiac786 »

fragmede wrote: post #174
illiac786 wrote: post #135

Earlier quoted context omitted.

That seems like a huge bet. I don’t bet on this, I am careful about cookies and my source IPs. Do you have any facts? I know they really on _additional_ stuff, but do you have sources showing that they never use cookies or source IPs?

That's a different claim though. Obviously they'd use cookies and source IPs when they're available, because why not use all of the information available to you. That browser fingerprinting is good enough that neither of those sources are necessary is for you to decide on whom to believe. On that topic, though, is the Mullvad Browser, who's entire intention is to defeat browser fingerprinting.

I need to test it, that reminds me, thanks. So many browsers. Does it support multiaccount containers?

Re: Mullvad exit IPs are surprisingly identifying

#177

Post by lxgr »

tschumacher wrote: post #171

Great find by the author and I have no trouble believing this is an oversight by Mullvad. Kind of shocking that something this simple slips by them but I could see myself missing it. Putting aside the IP correlation across multiple servers, at first I wondered why even keep the user IP stable on one server. But I think it makes sense because as the author states other VPNs usually have only one IP per server so they…

> The advantages for the user are, if they find a server that works for accessing some service they can connect to that server again and it will work again because they get the same IP.

On the flip side, if they’re getting banned by a service because of a noisy neighbor on the same IP, they’d have no way to work around that, no?

Re: Mullvad exit IPs are surprisingly identifying

#178

Post by kfreds »

I work at Mullvad. (co-CEO, co-founder)

Some aspects of the described behavior are as we intended and some are not. The cause is not exactly as described in the blog post. As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure. If any of you try to reproduce the blog post's findings you may get confusing results throughout the day.

We will also re-evaluate whether the intended behaviors are acceptable or not. Some of this is a trade-off between multiple aspects of privacy, and multiple aspects of user experience.

Please note that this is my current understanding, which may change. I was only made aware of this an hour ago, and most of that time was spent talking with Ops, considering what to do immediately, and writing this post.

Finally, for those of you who do security research: when you find a security or privacy issue, please consider notifying the maintainer/vendor before publishing your findings, even if you intend to publish right away.

Re: Mullvad exit IPs are surprisingly identifying

#179

Post by my-next-account »

lukewarm707 wrote: post #151
linkregister wrote: post #148

Earlier quoted context omitted.

All the companies involved in PRISM made public statements saying they ceased participation. Google undertook a costly initiative to add encrypted connections over their datacenter circuits. The NSA leaks were a forcing function that led to a massive uptake of encryption. Up until that point it was common for websites to support only HTTP. The NSA leaks dominated news cycles for the entirety of 2013.

my llm api traffic terminates tcp at cloudflare in lovely plain text :/ it does give better peering. reduces latency a bit for me.

I had no idea that this was a thing. How can you figure out where SSL turns into plain text on its route to the destination?

Re: Mullvad exit IPs are surprisingly identifying

#180

Post by kfreds »

47282847 wrote: post #155

Missing from the story: did they reach out to Mullvad? Would have been interesting to see how their security team responded.

As far as I can tell they did not, and I've asked both our operations and support teams. I will update this post if I am mistaken.

Edit: In hindsight I regret making this comment. It was unnecessary, but removing it now would look weird.

Post reply on HN