[HN Gopher] The M247/DataPacket Problem with Mullvad VPN
___________________________________________________________________
The M247/DataPacket Problem with Mullvad VPN
Author : shelfchair
Score : 70 points
Date : 2022-10-20 13:01 UTC (10 hours ago)
(HTM) web link (worldofmatthew.com)
(TXT) w3m dump (worldofmatthew.com)
| mig39 wrote:
| > Mullvad VPN is not upfront with their customers about these
| risks.
|
| I think it's pretty clear which servers are owned and which are
| rented.
|
| https://mullvad.net/en/blog/2019/10/25/server-list-updated-p...
| GekkePrutser wrote:
| It is indeed. You can also see exactly which operator it is
| rented from. I think it's pretty well done.
| worldofmatthew wrote:
| Transparency of servers is not the same as making your users
| aware of a providers risks.
| nickphx wrote:
| It's naive to believe one can be physically connected to a
| network and remain undiscovered.
| barathr wrote:
| This isn't Mullvad's fault -- it's a challenge with the VPNs-as-
| a-privacy-service architecture generally, something we wrote
| about here: https://invisv.com/articles/relay.html
|
| VPNs are great when the network you're on is less trustworthy
| than any other network you have no visibility into, such as in
| places where the network is heavily censored or otherwise
| restricted. They're also widely used for evading country-level
| streaming restrictions. But VPNs aren't really the right
| architecture for privacy more generally.
| vmoore wrote:
| I always thought VPN companies like Mullvad, iVPN, ProtonVPN, etc
| rent out servers in the Point-of-Presence itself and rent servers
| that happen to be based in that area, rather than centralize
| everything on two providers.
|
| I guess this is the price we pay for having such VPN services
| relatively cheap ($5.00/mo). If they rented servers of specific
| server providers in an area, that gets expensive, fast.
| yamrzou wrote:
| > However, Mullvad is by default a single-hop service (Double-hop
| optionally available).
|
| This can be addressed by using tunnels to create multiple hops.
|
| See for example: Tunneling tunnels within tunnels (inside of
| tunnels) -- https://cryptostorm DOT is/blog/multitun (I broke the
| url because otherwise HN is incorrectly marking the comment as
| [dead])
|
| It would be great if Mullvad adds multi-hop support (>2) based on
| something like that.
|
| Another possibility is to create a VPN on top of a Mixnet like
| Nym: https://nymtech.net/.
| burnaway wrote:
| interesting idea on Nym, I'd like to discuss this further for a
| potential project, if you are interested you can find me email
| in my bio
| favourable wrote:
| Multi hop makes traffic analysis harder, but I wouldn't use the
| VPN provider's multi-hop feature, instead I do my own. So the
| first hop would be Mullvad, then the second hop would be
| ProtonVPN. There is a small performance penalty for doing this,
| but it's tolerable.
| GekkePrutser wrote:
| > M247 is extremely popular with VPN providers. A pro-privacy VPN
| provider should know to avoid upstream's known for hosting large
| amounts of VPN traffic. Passing user traffic though M247 is like
| painting a target on their back to be more heavily spied by
| security services, such as GCHQ and NSA.
|
| Of course the exact same goes for servers hosted by mullvad
| themselves.
|
| A VPN provider of their scale just doesn't fly under the radar.
|
| Considering the threat model for most users this is fine. It's
| good enough for avoiding copyright lawsuits after torrenting. If
| you're on the radar of state actors, Tor and i2p are a better bet
| (but I'm sure their exit nodes are heavily monitored too!)
| julienmarie wrote:
| I know it's not really related to the topic ( which I find pretty
| weak, of course VPNs are bad for privacy... ).
|
| I've been using Datapacket for a year for my e-commerce company.
| Amazing performance, stability and service. Best dedicated
| hosting I've experienced in a long time.
| _xander wrote:
| Can someone with more networking expertise than me explain
| whether this sort of risk applies only to rented DC servers? Or
| is it an ISP risk that can also impact Mullvad's owned
| servers[1]?
|
| [1] Mullvad owns 159 servers in 9 countries
| (https://mullvad.net/en/servers/), so not quite sure why you
| wouldn't just choose to use one of those instead if concerned
| about this
| [deleted]
| RealStickman_ wrote:
| I don't have more networking experience either. Anyways, I'd
| think a provider could also plug a logging box in front of any
| owned server. The more important point might be the high
| percentage of servers hosted by M247, making it a more
| attractive target.
| throwaway247 wrote:
| I work with a fintech company where we have had to completely
| block M247 IPs due to continuous attempted fraud. We generally
| allow access through VPNs otherwise. We are very receptive to
| customer feedback, but there have been no customer complaints
| despite having M247 blocked for months.
|
| There was an Ask HN from 2 years ago that was also suspicious of
| M247 [0] -- verging on paranoia -- which provides only weak
| evidence, but it does not encourage us to unblock M247 anytime
| soon.
|
| [0]: https://news.ycombinator.com/item?id=22086904
| mittermayr wrote:
| What I like about it, however, traffic-inspection and pattern
| analysis aside, is that Mullvad allows to sign up by mail (money
| by postal letter) or Bitcoin as far as I remember. I appreciate
| this it's-okay-to-be-anonymous approach as it'll probably be the
| part that gets them the most heat (if not now, then eventually,
| for sure).
|
| I did however notice that a lot of the geo-located services have
| stopped working on Mullvad endpoints, as those VPNs (like many)
| have been blacklisted widely now.
| GekkePrutser wrote:
| Yes and they just started with prepaid cards sold on Amazon
| zahma wrote:
| If the objective of using a VPN is to dodge GCHQ or NSA, then
| that person is likely not properly accounting for the capability
| of those organizations. I imagine those two have the ability to
| tap just about any traffic irrespective of the parent
| organization's infrastructure. Would Mullvad be wise to consider
| this in their expansion efforts? Sure, but I have to assume that
| the vast majority of their market is not in the habit of getting
| on the NSA's target list. I use Mullvad because they have sound
| business practices, good performance, and don't conduct the same
| invasive privacy practices that I'm trying to stymie across the
| web.
| bithavoc wrote:
| I've been using DataPacket.com for months, it's probably the most
| reliable providers outside the big clouds. They carefully watch
| their upstreams and support is top notch.
| dangerface wrote:
| > All it takes is a few black-boxes and the privacy of Mullvad
| uses (connected to a M247 location) is worse-off than not
| bothering with a VPN.
|
| In my country they log everything if they did setup black boxes
| to analyse timing in an attempt to de-anonymise then they could
| potentially log everything which is what they definitely do
| without a VPN, how am I worse off?
|
| Matthew is not upfront with their readers about these risks.
| bombcar wrote:
| It's all about understanding your risks and mitigating them.
|
| Someone in Iran could probably couldn't care less if the
| British are monitoring them, and perhaps vice versa.
|
| Those who are really worried about something will fight against
| that worry, or use Tor, no matter how painful it may be.
| bcook wrote:
| Why is the article focusing on Mullvad in particular? All the
| complaints seem to be problems that any/all VPN providers suffer
| from.
| StayTrue wrote:
| The author believes Mullvad is sincere about security. I don't
| believe that's true for other VPN providers.
| bombcar wrote:
| The article says: "The problem of aiming to be a privacy
| focused service means a high level of scrutiny is required. We
| are not talking about meme providers like NordVPN here; we are
| talking about a company who needs to do better."
|
| So he's claiming that Mullvad gets things right that other
| providers get wrong, but they're still missing a critical step.
|
| At the end: "All in all, Mullvad VPN appears to have put
| expanding the number of locations over user privacy. That
| points to a bigger problem in the VPN industry. That is a lack
| of a perfect provider. Mullvad VPN has multiple hops available
| but AzireVPN chooses their upstream carefully, runs everything
| from RAM and uses a custom made TPM-Level Rootkit that blocks
| common network monitoring features in Linux but does not offer
| real Multi-hop (Only though Socks5 proxy)."
|
| So every problem has a solution, but no VPN is offering all of
| them. But I suspect that's because VPNs are mainly for
| downloading movies and shitposting on the internet.
| dathinab wrote:
| >VPNs are mainly for downloading movies and shitposting on
| the internet.
|
| or not giving your ISP a list of which websites you visited
| when in a situation where you could only get internet by
| agreeing to allow the ISP to analyze your traffic and sell
| the result
|
| or to avoid regional legal restrictions which are not on the
| level of "if you are found out you have major problems" like
| non GDPR compliant US sites blocking EU users and you are
| from the US on holiday in the EU (most such sites are very
| US-local specific)
|
| or to avoid doggy price differences depending on from where
| you buy something
| [deleted]
| dathinab wrote:
| no idea
|
| I mean if you worry about attacks like described there you
| probably shouldn't use VPN anyway and probably "just" using Tor
| isn't good enough either.
| cr3ative wrote:
| The whole article is theoretical in nature (and light in
| substance). This is probably just who the author wanted to sign
| up for, then they discovered the common caveat of all VPN
| providers.
| worldofmatthew wrote:
| The Privacy community speak higher of Mullvad in relation to
| privacy. If they mislead, it could be harmful for their
| audience.
| [deleted]
___________________________________________________________________
(page generated 2022-10-20 23:02 UTC)