Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard multihop available in the Mullvad app

mullvad.net

Post reply on HN
Print view View original

61–70 of 141 posts

Re: WireGuard multihop available in the Mullvad app

#61

Post by topdancing »

justsomehnguy wrote: post #56
doubleorseven wrote: post #46

"The entry WireGuard server will be able to see your source IP and which exit server the traffic is headed for, but it can’t see any of the traffic." So server2 terminates the request twice? One for server1 and another time for the client who generated the request? I don't understand how it's possible for server1 to not be exposed to the data.

You probably missed > It’s a WireGuard tunnel being sent inside another WireGuard tunnel Edit: replaced with a better diagram (and again, now based on example in [0]): ▼ ▼ ▼ ▼ YOU->NL1 tunnel SE4->NL1 tunnel PLAIN/TLS YOU ────────────────────► SE4 ───────────────────► NL1 ───────────────► CATPICS.COM On the wire: YOU->SE4 traffic SE4->NL1 traffic NL1->CATPICS.COM traffic ┌────────────────┐ ┌────────────────┐ ┌──────┐…

This isn't how it works. If you actually pull down one of their multihop configurations - you'll see:

- the WireGuard public key for server 2

- the IP address for server 1

- a unique port for server2 on server 1

So all they're doing is a standard iptables redirect to the second host (which may or may not itself be under a WireGuard tunnel).

Re: WireGuard multihop available in the Mullvad app

#62

Post by matthews2 »

mikece wrote: post #11
johnwayne666 wrote: post #7

I’m wondering how this compares to Apple’s iCloud Private Relay. Mullvad is trying to increase their transparency and make sure users can trust them which is great. But would there be a way for them to make it so that users do not have to trust them? What if the second server was hosted by another entity?

"I'm wondering how this compares to Apple’s iCloud Private Relay." Simple answer: Apple doesn't get your info. Mullvad is one of the non-logging VPN providers so unless you're compromised in some other way (like logging into Google, Facebook, etc) then running a make on your is far more difficult than just serving a warrant to Apple.

> Mullvad is one of the non-logging VPN providers

How do you know that they're not logging? Or that their ISPs are not logging?

Re: WireGuard multihop available in the Mullvad app

#63

Post by goodpoint »

matheusmoreira wrote: post #53
oceanplexian wrote: post #19

Earlier quoted context omitted.

I would think you'd do the exact opposite. If you leave a computer running anyone (Well "anyone" being a skilled adversary) can simply pull out the RAM and grab encryption keys in clear text. Law enforcement does this so often, it's practically routine. The only "safe" system is one that has been long powered off and is using tried and true cryptography, ideally open-source FDE that's been fully audited.

> pull out the RAM and grab encryption keys in clear text How to defend against this?

there are methods to store keys in RAM in encrypted form and decrypt them only on the cache and CPU registers

Re: WireGuard multihop available in the Mullvad app

#65

Post by AlexandrB »

pydry wrote: post #38
gzer0 wrote: post #21

Tangentially related: Users can use Mullvad’s TOR address: http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7k... to generate their account ID and make their payment with Bitcoin seamlessly. I have never experienced such a smooth way to purchase from a provider, this was brilliant. +1 to Mullvad

The ease with which you can pay anonymously makes me feel that its more likely a genuine privacy provider rather than a CIA run honeypot like Crypto AG.

You can also mail them an envelope with your user ID # and some cash. It's pretty great.

Re: WireGuard multihop available in the Mullvad app

#67

Post by clsec »

mft_ wrote: post #2

Tangential, but I recently discovered Mullvad. For years, I've used whichever mainstream VPN provider had a good deal on come renewal time, and cycled through a few of the usual suspects. Recently, I was with Surfshark, and was really struggling to get download rates above a few hundred K/sec - and sometimes even worse. I didn't even suspect the VPN at first, but ultimately tried a different provider as a diagnostic…

That's strange. I've had the opposite experience. I was with Cyberghost and, after 3 yrs of good speeds, almost overnight it basically became so slow that it was unusable. I then tried out Surfshark and have been very happy with the speeds that I've gotten for the past year+.

Re: WireGuard multihop available in the Mullvad app

#68

Post by clsec »

matthews2 wrote: post #62
mikece wrote: post #11

Earlier quoted context omitted.

"I'm wondering how this compares to Apple’s iCloud Private Relay." Simple answer: Apple doesn't get your info. Mullvad is one of the non-logging VPN providers so unless you're compromised in some other way (like logging into Google, Facebook, etc) then running a make on your is far more difficult than just serving a warrant to Apple.

> Mullvad is one of the non-logging VPN providers How do you know that they're not logging? Or that their ISPs are not logging?

Here's the latest Mullvad security audit (June 2020).

https://cure53.de/pentest-report_mullvad_2020_v2.pdf

Re: WireGuard multihop available in the Mullvad app

#70

Post by vinay_ys »

gzer0 wrote: post #21

Tangentially related: Users can use Mullvad’s TOR address: http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7k... to generate their account ID and make their payment with Bitcoin seamlessly. I have never experienced such a smooth way to purchase from a provider, this was brilliant. +1 to Mullvad

How does it matter that your payment is anonymous when all your traffic is going through them?
Post reply on HN