Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad exit IPs are surprisingly identifying

tmctmt.com

Post reply on HN
Print view View original

51–60 of 408 posts

Re: Mullvad exit IPs are surprisingly identifying

#51

Post by DANmode »

VoidWhisperer wrote: post #21

> Surprisingly, the exit IP you are given is not randomized each time you connect to the server, but deterministically picked based on your WireGuard key, which rotates every 1 to 30 days (unless you use a third-party client, in which case it never rotates). I'm a little confused on this... what is stopping third parties from doing key rotations like the main app clients if it is detailed in the repo how to do it?

> what is stopping third parties from doing key rotations

Knowing to do so, primarily.

Re: Mullvad exit IPs are surprisingly identifying

#52

Post by BLKNSLVR »

numpad0 wrote: post #41
wg0 wrote: post #3

VPNs are snake oil. Exit IPs are a public information.

Mullvad is a tiny world-famous ISP in Sweden that has zero KYC and explicit zero-log policy, specifically designed that way to enable mild abuses, that also accept PayPal, credit cards, and today I learned, cash in an anonymous envelope for payments. That doesn't scream US three-letter organization at all.

I do all my illegal shit over Mullvad and I've only been raided once.

(yes, I've been raided)

(I started using Mullvad after - because of - that)

(I don't do illegal shit, I just like some obfuscation of my trail because I enjoy fiddling with this stuff - which may have been why I ended up a raid target in the first place)

Re: Mullvad exit IPs are surprisingly identifying

#53

Post by paulpauper »

This is why VPNs have always been crap. The pool of IPs are backlisted/tainted, so you will run into various roadblocks and cpatchas, in addition to slow speed. If you are serious about privacy and don't want blocks and blacklists, buy high speed private proxies. Don't use a pooled service.

Re: Mullvad exit IPs are surprisingly identifying

#54

Post by eipi10_hn »

wg0 wrote: post #36
Cider9986 wrote: post #8

Earlier quoted context omitted.

VPNs are not snake oil. They transfer the trust of your internet activity from a place of low-trust, your ISP, to a place of high-trust, ideally a trustworthy VPN like Mullvad, IVPN, or Proton. Among other benefits. If you don't like your ISP creating a profile of you and selling it to target ads to you, you should use a VPN. >Should I use a VPN? Yes, almost certainly. A VPN has many advantages, including: 1. Hiding…

How is private company (VPN) is more trustworthy than an other private company (ISP) and how do you expect them to protect your identity in face of determined state actors that are afer you? What power is in $2.99/month that it offers so much security? Why is that at least 40% of sponsorship to YouTube Creators seem to be from VPN industry? What is that they know and we don't know?

Mullvad vs my ISP.

One at least has open source software clients, and publishes audits from other 3rd-party audit organizations.

The other open source... nothing. Their client apps have dozens of trackers inside. And it's a dream to see any of the ISPs in my county publish any 3rd-party audits. Their other products (going with the service) have trackers and personalized targeting ads inside.

Yeah, in my 1 million alternate universes should I trust my ISP more.

Re: Mullvad exit IPs are surprisingly identifying

#55

Post by KingOfCoders »

applfanboysbgon wrote: post #44
KingOfCoders wrote: post #38

Earlier quoted context omitted.

Deutsche Telekom in Germany/EU farms and sells my data? Any sources?

You probably won't find direct proof any more than you will find direct proof of any random VPN selling your data, it's just a given that commercial entities are liable to sell financially valuable data, and a list of all traffic, every website you visit and every service you use, tied to a specific identity is certainly financially valuable. Being in the EU doesn't change this; in fact the EU explicitly required tha…

"EU explicitly required that ISPs retain your identifying data with the Data Retention Directive"

And then sells it?

Re: Mullvad exit IPs are surprisingly identifying

#56

Post by esseph »

numpad0 wrote: post #41
wg0 wrote: post #3

VPNs are snake oil. Exit IPs are a public information.

Mullvad is a tiny world-famous ISP in Sweden that has zero KYC and explicit zero-log policy, specifically designed that way to enable mild abuses, that also accept PayPal, credit cards, and today I learned, cash in an anonymous envelope for payments. That doesn't scream US three-letter organization at all.

> That doesn't scream US three-letter organization at all.

They have their own tools + tor, they do not need mullvad.

Re: Mullvad exit IPs are surprisingly identifying

#57

Post by dns_snek »

gchamonlive wrote: post #39

It's a game of cat and mouse. The service keeps banning IP ranges, the user keeps reconnecting to different servers and regions. The server can't know exactly who's who, just that a bunch of users are using mullvad, while the user just need to find one server on one IP range that works. Seems like a good deal to me. I don't care if they know I use mullvad, I care they don't know I'm me, and that's not something mullv…

> I don't care if they know I use mullvad, I care they don't know I'm me

That's exactly what the article is about, a side channel information leak that de-anonymises users, did you read it?

Re: Mullvad exit IPs are surprisingly identifying

#58

Post by SXX »

dakolli wrote: post #49
SXX wrote: post #30

Earlier quoted context omitted.

Yes and 5G provider knows your exact location while VPNs can be easily chained.

Sure, if you want to get crazy with it you put prepaid phone in another location, put it on your Tailscale VPN then proxy all traffic through the prepaid phone with something like: https://github.com/kost/revsocks Phone doesn't even need data if you have access to wifi wherever you stash it. VPN chaining easier though.

Whole idea of "put phone in location X" alone is much harder to implement than to buy 5, 10 or 100 VPN account or servers with crypto and setup how you like.

Like you need to physically be there, need ability to connect phone it to electricity and somehow maintain if it e.g reboots. And stay anonymous while doing so? I'd say that Hollywood kind of solution.

Re: Mullvad exit IPs are surprisingly identifying

#59

Post by pretzel5297 »

wg0 wrote: post #36
Cider9986 wrote: post #8

Earlier quoted context omitted.

VPNs are not snake oil. They transfer the trust of your internet activity from a place of low-trust, your ISP, to a place of high-trust, ideally a trustworthy VPN like Mullvad, IVPN, or Proton. Among other benefits. If you don't like your ISP creating a profile of you and selling it to target ads to you, you should use a VPN. >Should I use a VPN? Yes, almost certainly. A VPN has many advantages, including: 1. Hiding…

How is private company (VPN) is more trustworthy than an other private company (ISP) and how do you expect them to protect your identity in face of determined state actors that are afer you? What power is in $2.99/month that it offers so much security? Why is that at least 40% of sponsorship to YouTube Creators seem to be from VPN industry? What is that they know and we don't know?

You fundamentally misunderstand what privacy means if you're replying to someone stating using a VPN will help you avoid getting spied on by your ISP for commercial purposes with state actor based worries.

Re: Mullvad exit IPs are surprisingly identifying

#60

Post by nine_k »

wg0 wrote: post #36
Cider9986 wrote: post #8

Earlier quoted context omitted.

VPNs are not snake oil. They transfer the trust of your internet activity from a place of low-trust, your ISP, to a place of high-trust, ideally a trustworthy VPN like Mullvad, IVPN, or Proton. Among other benefits. If you don't like your ISP creating a profile of you and selling it to target ads to you, you should use a VPN. >Should I use a VPN? Yes, almost certainly. A VPN has many advantages, including: 1. Hiding…

How is private company (VPN) is more trustworthy than an other private company (ISP) and how do you expect them to protect your identity in face of determined state actors that are afer you? What power is in $2.99/month that it offers so much security? Why is that at least 40% of sponsorship to YouTube Creators seem to be from VPN industry? What is that they know and we don't know?

Specifically Mullvad operate completely stateless nodes, which was confirmed several times when law enforcement tried to access their logs. There are no logs. Mullvad are selling their location, with very good connectivity and with laws that strongly protect privacy. They are €5/mo, almost $6/mo, and likely acquire bandwidth very cheaply due to scale and likely peering agreements.
Post reply on HN