Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard multihop available in the Mullvad app

mullvad.net

Post reply on HN
Print view View original

81–90 of 141 posts

Re: WireGuard multihop available in the Mullvad app

#81

Post by justsomehnguy »

topdancing wrote: post #61
justsomehnguy wrote: post #56

Earlier quoted context omitted.

You probably missed > It’s a WireGuard tunnel being sent inside another WireGuard tunnel Edit: replaced with a better diagram (and again, now based on example in [0]): ▼ ▼ ▼ ▼ YOU->NL1 tunnel SE4->NL1 tunnel PLAIN/TLS YOU ────────────────────► SE4 ───────────────────► NL1 ───────────────► CATPICS.COM On the wire: YOU->SE4 traffic SE4->NL1 traffic NL1->CATPICS.COM traffic ┌────────────────┐ ┌────────────────┐ ┌──────┐…

This isn't how it works. If you actually pull down one of their multihop configurations - you'll see: - the WireGuard public key for server 2 - the IP address for server 1 - a unique port for server2 on server 1 So all they're doing is a standard iptables redirect to the second host (which may or may not itself be under a WireGuard tunnel).

Well, I stand corrected, because I relied on their promo description. *shrug_emoji*

I replaced the diagram in the previous comment, take a look.

Re: WireGuard multihop available in the Mullvad app

#82

Post by seanw444 »

mirceal wrote: post #34
netfortius wrote: post #20

Earlier quoted context omitted.

How are Mullvad apps across multiple platforms? I've been with PIA for quite a while, and I got it to work they way I want it, on macOS, windows and android, and I liked even more some of their recent exit points marked "for streaming", as I watch sports online, and there is a significant improvement when using those, with some countries local free broadcasting, but performance in the rest , sometimes, is really atro…

used it on macos, ios, linux. the app is solid. wireguard rules.

I use the app frequently on Android and Arch Linux, and it works equally well on both.

Re: WireGuard multihop available in the Mullvad app

#83

Post by lighttower »

throwanem wrote: post #3

I use (and really like!) Mullvad, but have never tried the app, preferring to use my existing OpenVPN clients with the profiles Mullvad provides. This isn't because I have any reason to mistrust their app, but just because if I've already got a perfectly serviceable client on my device, why add another binary to do the same thing? But I would be interested to hear, from folks who have used the app, what you like and…

Split tunneling an app to NOT GO THROUGH the tunnel is easy

Setting split tunneling to ONLY TUNNEL A SPECIFIC APP is hard

Re: WireGuard multihop available in the Mullvad app

#84

Post by capableweb »

vinay_ys wrote: post #78
capableweb wrote: post #76

Earlier quoted context omitted.

If mullvad gets compromised, you can still remain anonymous if the payment method is anonymous as long as the traffic you've sent to mullvad been anonymous as well. Obviously, if you log into your normal Facebook account, it isn't, but there are plenty of other uses.

If mullvad is compromised, then all my traffic is also compromised and potentially my client machine is also compromised (since I'm running mullvad client). Alternately, to begin with, if my traffic wasn't sensitive or personally identifiable, then I don't actually need this multi-hop setup.

Yes, if mullvad + your machine is compromised, then indeed there is not much you can do. But first, not everyone uses mullvads client, but instead the provided configuration files for wireguard/openvpn. Secondly, not all traffic is indeed personally identifiable, especially if you're using something like mullvad with for anonymous traffic to begin with. Imagine you have another account than vinay_ys that you only use via mullvad (and potentially other accounts). Using something like cash (or bitcoin for that matter) as a payment method makes it less likely the real person you will be connected to this other account.

Security and privacy is not a true/false thing, it's a thing you do at layers. Making payments anonymously is obviously adding another layer. Maybe it's not worth it for you, but for some it is.

Re: WireGuard multihop available in the Mullvad app

#85

Post by postingposts »

DenseComet wrote: post #75
throwanem wrote: post #3

I use (and really like!) Mullvad, but have never tried the app, preferring to use my existing OpenVPN clients with the profiles Mullvad provides. This isn't because I have any reason to mistrust their app, but just because if I've already got a perfectly serviceable client on my device, why add another binary to do the same thing? But I would be interested to hear, from folks who have used the app, what you like and…

If you don't want to switch to the Mullvad app, it's still worthwhile to switch to their wireguard profiles. Connections seem more stable and wireguard is far easier to configure.

Hey I’m curious about the terminology you guys are using here. Is there a manual or a page which I can read to learn more about wireguard profiles and what mullvad has done for them perhaps?

Re: WireGuard multihop available in the Mullvad app

#86

Post by justsomehnguy »

trashburger wrote: post #43
cpressland wrote: post #39

This thread seems to be full of people that use a VPN, I personally don’t as I find DoH + HTTPS to be enough. Why do so many of you use VPNs?

1) To simply make it harder for my ISP to see which websites I visit. 2) SNI sniffing makes some websites unavailable to me, so DoH isn't enough.

3) Even without SNI sniffing and DoH some sites could be outright banned by IP so you can't reach them anyway.

Re: WireGuard multihop available in the Mullvad app

#87

Post by judge2020 »

INTPenis wrote: post #72
ignoramous wrote: post #41

This isn't Tor-like multi-hop (but is similar to other multi-hop VPN providers out there). A proper multi-hop would happen across two different vendors in control of two different networks, as it were. The iCloud Relay paper outlined a pretty private and secure design [0] (and the intention to standardize it via IETF would probably make it simpler to self-host such a solution [1][2]). Among the VPNs, orchid.com's dis…

Splitting hairs no? I mean you're comparing multi-hop with onion routing. I'm just speaking as a layman end user. When I see multi-hop it's self-explanatory, it's literally in the name. Onion routing is another type of multi-hop with the onion routing algorithm.

Since it's the same company with access to both the first and second server, it wouldn't be too hard to log network on both ends and sync it up.

With iCloud Private Relay, it'd be harder for a single actor to de-anonymize requests; you'd either need collusion between the companies or a government entity would need to ask both companies to log network traffic at once, and this would complicate the "exit node" server since it can't filter/only record traffic from the target customer's connection without company 1 setting up a single server dedicated to being the proxy for that customer.

Re: WireGuard multihop available in the Mullvad app

#89

Post by mft_ »

clsec wrote: post #67
mft_ wrote: post #2

Tangential, but I recently discovered Mullvad. For years, I've used whichever mainstream VPN provider had a good deal on come renewal time, and cycled through a few of the usual suspects. Recently, I was with Surfshark, and was really struggling to get download rates above a few hundred K/sec - and sometimes even worse. I didn't even suspect the VPN at first, but ultimately tried a different provider as a diagnostic…

That's strange. I've had the opposite experience. I was with Cyberghost and, after 3 yrs of good speeds, almost overnight it basically became so slow that it was unusable. I then tried out Surfshark and have been very happy with the speeds that I've gotten for the past year+.

I had been with Surfshark for nearly a year when everything slowed down. They could have been having temporary technical issues, of course, but it went on over a long enough period that my troubleshooting made it through multiple steps to trying a different VPN provider - so over a week, IIRC.

Re: WireGuard multihop available in the Mullvad app

#90

Post by mft_ »

netfortius wrote: post #20
mft_ wrote: post #2

Tangential, but I recently discovered Mullvad. For years, I've used whichever mainstream VPN provider had a good deal on come renewal time, and cycled through a few of the usual suspects. Recently, I was with Surfshark, and was really struggling to get download rates above a few hundred K/sec - and sometimes even worse. I didn't even suspect the VPN at first, but ultimately tried a different provider as a diagnostic…

How are Mullvad apps across multiple platforms? I've been with PIA for quite a while, and I got it to work they way I want it, on macOS, windows and android, and I liked even more some of their recent exit points marked "for streaming", as I watch sports online, and there is a significant improvement when using those, with some countries local free broadcasting, but performance in the rest , sometimes, is really atro…

I use it on Mac, Windows, and iOS - they just work well.
Post reply on HN