Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad exit IPs are surprisingly identifying

tmctmt.com

Post reply on HN
Print view View original

351–360 of 408 posts

Re: Mullvad exit IPs are surprisingly identifying

#351

Post by dongcarl »

Cider9986 wrote: post #350
dongcarl wrote: post #339

Earlier quoted context omitted.

Carl here (Obscura CEO, one of Mullvad's partners) This was an interesting finding, though as kfreds mentioned it would have been better to notify the vendor before publishing. The main finding (IP-position-in-pool correlation between servers) seems to include genuinely unintended behaviour. Given our great experience with the Mullvad team, I'm sure this will be addressed soon. In general, if you want different "iden…

Apparently I already use Obscura despite never paying for it :) https://obscura.com/check/

Heh yeah we just check for a Mullvad exit IP, it's one way you know we're actually relaying to Mullvad!

Re: Mullvad exit IPs are surprisingly identifying

#352

Post by trelane »

mrpopo wrote: post #272
trelane wrote: post #271

Earlier quoted context omitted.

> Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset American culture is highly varied. For some this is true, for others this is wrong and highly insulting. Maybe try a narrower brush next time.

I think the "others" should open their eyes to the world around them, then.

> should open their eyes to the world around them

Amazingly brazen assumption right there.

Re: Mullvad exit IPs are surprisingly identifying

#353

Post by [deleted] »

jorvi wrote: post #80
lorenzohess wrote: post #23

The purpose of a VPN does not include anonymizing users with respect to the sites they visit,so it shouldn't be too surprising that Mullvad doesn't enforce unique exit IPs. Users who want anonymity should use networks like Tor.

That is exactly the point of public VPNs.. If I'm on a public VPN, I don't want anyone to know who is making the request, including the terminating IP. Think about it. By your logic, VPNs shouldn't be used for torrents because VPNs shouldn't anonymize you to the terminating IP. Whereas they work gangbusters for that. If you are talking about private VPNs.. Mullvad isn't one.

[deleted]

Re: Mullvad exit IPs are surprisingly identifying

#354

Post by jorvi »

charcircuit wrote: post #94
jorvi wrote: post #80

Earlier quoted context omitted.

That is exactly the point of public VPNs.. If I'm on a public VPN, I don't want anyone to know who is making the request, including the terminating IP. Think about it. By your logic, VPNs shouldn't be used for torrents because VPNs shouldn't anonymize you to the terminating IP. Whereas they work gangbusters for that. If you are talking about private VPNs.. Mullvad isn't one.

I think you are misreading his comment. He is saying that on a VPN it is standard behavior that if you visit site A and site B they will both see you connecting from the same IP and can infer you are potentially the same person.

Then he is using the wrong terminology.

Privacy = hide what I am doing

Anonimity = hide who I am

If site A and site B share some backchannel, then they can share what I was doing on their site, but aside from "this person is on Mullvad endpoint A1", they can't infer who I am[0]. To those sites, I am anonymous but not private.

On the other hand, to my ISP, I am private but not anonymous. They can see a tunnel originating from my home IP to Mullvad, so they know exactly who is connecting to Mullvad. But they don't know what I am doing inside that tunnel or where it leads beyond Mullvad.

That is the whole crux of a public VPN. The ISP doesn't know who to tell who I am, and the sites (and other terminating IPs) don't know who to tell what I'm doing, because the VPN breaks the chain in both directions.

So, if you torrent a movie illegally, the movie studio can only send an angry letter to Mullvad about someone on endpoint A1 torrenting their movie at 22:34. If it were possible for them to tell your ISP that you downloaded something illegally (privacy, the what), your ISP would have to give your address to the movie studio for a settlement fine (anonimity, the who).

It is kind of hilarious I am at -3 when parent is still in the positive, when he is so utterly wrong. But that's modern HN for ya.

[0]Fingerprinting obviously can throw a spanner into that, but that has nothing to do with the VPN. And it can be mitigated.

Re: Mullvad exit IPs are surprisingly identifying

#355

Post by aschar »

999900000999 wrote: post #304
aschar wrote: post #281

Earlier quoted context omitted.

> When I tried that I kept getting untrusted key warnings. You can skip them of course, but it kind of undermines any type of trust here Yes, the expected procedure would be to trust those keys for that package instead of disabling integrity checks. This is an issue between you and your package manager and not something Mullvad or any other packager (except OpenSUSE maintainers) can fix for you. You complain about th…

It's a skill issue that they decide to not list open suse as a supported distro on their own help page ? It's a skill issue that the thread has a bunch of different solutions and none of them are definitive and endorsed by the company I'm paying $5 a month too ?

[dead]

Re: Mullvad exit IPs are surprisingly identifying

#356

Post by buellerbueller »

alt227 wrote: post #322
buellerbueller wrote: post #317

Earlier quoted context omitted.

On the other hand, the lack of common decency can endanger innocent 3rd parties.

If you create a 3rd party app to some closed source insecure back end, thats on you for trusting them or not doing your due diligence. Time and time again private companies have rug pulled things like api access for 3rd party apps (such as twitter/X). Building 3rd party clients for private systems should already be approached with heavy scepticism and always be prepared for the worst.

You are correct, but none of that absolves the person of their responsibilities to others with regard to common decency.

Notify, then publish

Re: Mullvad exit IPs are surprisingly identifying

#357

Post by lucb1e »

mike_hock wrote: post #219
DaSHacka wrote: post #213

Earlier quoted context omitted.

Do you have a source for this?

No, because I don't keep a list of every article I've read over the past decade or so, but there were multiple busts where a regular law enforcement agency (FBI and their international counterparts) were able to prove the identity of a user simply by timing attacks. The fact that Tor does not intend to tackle the timing problem is plainly stated on the Tor website.

I was also curious about a source for this but if you just mean the common knowledge that...

> Tor does not intend to tackle the timing problem [as] plainly stated on the Tor website.

then that's not how I read the above claim about Tor "having been deanonymized". Yes, yes, it strictly fits within the meaning of what you wrote, but it's like saying bread has been made free before because someone found a place where they could plant wheat seeds and chop trees to bake it without having to pay for using the ground and wood: there is a roundabout way of getting there but it's not true in the common case (you can't just do this for everyone at will)

Re: Mullvad exit IPs are surprisingly identifying

#358

Post by [deleted] »

999900000999 wrote: post #304
aschar wrote: post #281

Earlier quoted context omitted.

> When I tried that I kept getting untrusted key warnings. You can skip them of course, but it kind of undermines any type of trust here Yes, the expected procedure would be to trust those keys for that package instead of disabling integrity checks. This is an issue between you and your package manager and not something Mullvad or any other packager (except OpenSUSE maintainers) can fix for you. You complain about th…

It's a skill issue that they decide to not list open suse as a supported distro on their own help page ? It's a skill issue that the thread has a bunch of different solutions and none of them are definitive and endorsed by the company I'm paying $5 a month too ?

[deleted]

Re: Mullvad exit IPs are surprisingly identifying

#359

Post by lucb1e »

unselect5917 wrote: post #69
curtisf wrote: post #62

Earlier quoted context omitted.

Most of the big consumer VPNs include "privacy" with an implication of anonymity in their marketing, so it shouldn't really be surprising

It is privacy with respect to your ISP. A lot of ISPs are pretty shitty. Some will rat out their own customers to copyright mongrels and threaten to disconnect you - which is important when there's a local monopoly. Things you connect to or log in to are clearly going to be able to ID you at least with in the context of the login that you use regardless of what the VPN does. I'm logged into HN through Mullvad as it h…

> what I'm doing isn't my ISP's business even though I'm pretty happy with them.

But it is Mullvad's?

I think I'm from a spoiled part of the internet (as in, with an ISP that legit cares) so maybe I'm biased, but swapping one vendor out for another seems relatively no-op to me. Is it that there is a bigger pool of VPN providers than ISPs available at a given address (even when including (M)VNOs), and so it's easier to find one that sounds like they care as much as the ISP should have?

Re: Mullvad exit IPs are surprisingly identifying

#360

Post by rpdillon »

embedding-shape wrote: post #267
abanana wrote: post #265

Earlier quoted context omitted.

Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?

Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)

Many Americans have contributed substantially to open source and free software over the past decades. What are you trying to say?
Post reply on HN