Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad exit IPs are surprisingly identifying

tmctmt.com

Post reply on HN
Print view View original

291–300 of 408 posts

Re: Mullvad exit IPs are surprisingly identifying

#291

Post by wren6991 »

kfreds wrote: post #200
wren6991 wrote: post #194

Earlier quoted context omitted.

To support ? Oof.

I'm not sure what you mean by "Oof". We don't have a dedicated security team because security and privacy are integral to all aspects of our service. It doesn't make sense to centralise it. As for our support team they are responsive and experienced. Several of them have worked with us for many years and do offensive security research in their free time. Unlike many organisations we don't see customer support as a co…

You're right, that was a knee-jerk reaction. Sorry, I take it back.

Re: Mullvad exit IPs are surprisingly identifying

#292

Post by nusl »

seethishat wrote: post #262

I'm a long-time Mullvad user. I will continue to buy and use Mullvad VPN services (with my credit card that has my name on it) so long as it is legal to do so in my country. VPNs are not 100% anonymous. They are not meant to be. Instead, they are meant to provide some level of privacy to law-abiding adults. Most people would be embarrassed if their co-workers and neighbors knew the intimate personal details of their…

VPNs aren't anonymous, no, despite people pretending they are. Nonetheless, the findings in this report do highlight some things that make user identification easier than you'd expect it to be.

I'd not throw the report out just due to what you argue here. These findings are valid nonetheless.

Re: Mullvad exit IPs are surprisingly identifying

#293

Post by riley_dog »

GardenLetter27 wrote: post #273
kfreds wrote: post #178

I work at Mullvad. (co-CEO, co-founder) Some aspects of the described behavior are as we intended and some are not. The cause is not exactly as described in the blog post. As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure. If any of you try to reproduce the blog post's findings you may get confusing results throughout the day. We will also re-evaluate wheth…

Any chance on port forwarding coming back?

I'd leave Proton and go back if they offered it again. I doubt it'll happen, but you never know, I guess.

Re: Mullvad exit IPs are surprisingly identifying

#294

Post by [deleted] »

seethishat wrote: post #262

I'm a long-time Mullvad user. I will continue to buy and use Mullvad VPN services (with my credit card that has my name on it) so long as it is legal to do so in my country. VPNs are not 100% anonymous. They are not meant to be. Instead, they are meant to provide some level of privacy to law-abiding adults. Most people would be embarrassed if their co-workers and neighbors knew the intimate personal details of their…

[deleted]

Re: Mullvad exit IPs are surprisingly identifying

#295

Post by alt227 »

SauntSolaire wrote: post #286
threatofrain wrote: post #276

Earlier quoted context omitted.

This ought not be considered anything close to common courtesy. This is work. Mullvad is engaged in the business of making money. They should show how serious they are with your money. Since when do you have professionals giving you examinations out of common courtesy? Out of courtesy can I get a free cancer screening?

If I doctor performed a cancer screening on me, for free and without me asking, then yes — as a matter of courtesy I would still expect that doctor to tell me if he found cancer, rather than reading about it on his blog later.

> If I doctor performed a cancer screening on me, for free and without me asking

But that would never happen, so the point is moot.

Re: Mullvad exit IPs are surprisingly identifying

#296

Post by alt227 »

abanana wrote: post #265
ignoramous wrote: post #186

Earlier quoted context omitted.

> Finally, for those of you who do security research: when you find a security or privacy issue, please consider notifying the maintainer/vendor before publishing your findings How to report a bug or vulnerability ... we (currently) have no bug bounty program ... send an email to support@mullvadvpn.net https://mullvad.net/en/help/how-report-bug-or-vulnerability / https://archive.vn/BeHhr

Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?

When their 'common decency' is directly benefiting a money making corporation with shareholders and directors then yes they should definitely get some money out of it.

Re: Mullvad exit IPs are surprisingly identifying

#297

Post by alt227 »

dust-jacket wrote: post #243
mvdtnz wrote: post #234

Earlier quoted context omitted.

Yes it does actually.

I don't feel like its hard to come up with examples where (I would say) its ethically wrong to disclose immediately. If you spotted a company's mistake that might endanger their user's lives or safety, would you put those users at risk simply because there was no obvious financial reward? If so, I guess we just have different opinions on the ethics involved here.

If you are talking about some open source project then I would fully agree.

But when it comes to money making corporations then personally I dont agree that revealing flaws in their product comes into ethics at all.

A companies paid product is flawed, their own paid engineers didnt figure that out, why should I do it for free becasue 'ethics'?

This is the entire reason bug bounty programs exist in the first place.

Re: Mullvad exit IPs are surprisingly identifying

#298

Post by embedding-shape »

rafram wrote: post #282
embedding-shape wrote: post #267

Earlier quoted context omitted.

Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)

I would hesitate to make generalizations like that about a country with a population 35x larger than yours. There’s no US monoculture.

Great, thanks for the tip. I'd hesitate assuming what country people live in :) Seems we all have something to learn from each other.

Re: Mullvad exit IPs are surprisingly identifying

#299

Post by embedding-shape »

WarmWash wrote: post #289
embedding-shape wrote: post #275

Earlier quoted context omitted.

It's OK for the country to have a pervasive culture yet not every resident or citizen of the country to be a part of that culture, or even actively work against it. If you're not one of them matching that description, it shouldn't be insulting, as it's not about you in the first place. Maybe not everything is aimed towards you, especially if you don't feel like the description actually matches you :)

Sweden, the entire country, has the population of New York City, and is about 3/4 the size of Texas.

Don't forget about Sri Lanka, whose population is around 21 million.

Re: Mullvad exit IPs are surprisingly identifying

#300

Post by streetfighter64 »

WarmWash wrote: post #288
threatofrain wrote: post #276

Earlier quoted context omitted.

This ought not be considered anything close to common courtesy. This is work. Mullvad is engaged in the business of making money. They should show how serious they are with your money. Since when do you have professionals giving you examinations out of common courtesy? Out of courtesy can I get a free cancer screening?

>Since when do you have professionals giving you examinations out of common courtesy? Maybe when they decide on their own volition, without any external pressure, to go and poke around your system? "Hey, I'm a mechanic, I was looking at your car parked out there and noticed something incredibly dangerous that needs immediate fixing. I'll tell you what it is for $1,000." Please...

Even better, the mechanic writes a blog post about the dangers of non-functioning brakes, but doesn't tell the car owner, because they didn't have a sign advertising their "car issue bounty program".

Seems to be a systemic issue with computer guys feeling entitled to financial compensation for strange reasons. See also, people licensing their software as "open source" and then being mad when people make money off it.

Post reply on HN