Hadn't heard of Mullvad before reading this, figured I'd give it a try. That is hands down the BEST onboarding experience for an app (let alone a VPN) I've had in I don't know how long. Took me maybe 2 minutes to go from no account to a working VPN connection.
I love that everything is anonymous (down to the account credentials just being a randomly generated token).
I also like that they let you download the raw wireguard config files so that you can connect without having to use their client. You can just plop them onto your filesystem and use wg-quick to get going.
Since I'm also a ProtonMail user and I considered switching to them for VPN as well but their python client doesn't seem to work correctly on my Arch Linux install and it doesn't give me anything useful to debug it beyond "An unknown error has occured" so I couldn't be bothered to investigate beyond that.
Be aware, at least Nord clearly does something different with their client than with the OpenVPN files they provide ( https://news.ycombinator.com/item?id=21664692 ). When I dug into this, I found similar cases with other major VPN providers, but my notes are sufficiently out of date, they shouldn't be trusted anymore.
Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.
Been using protonmail on arch for years, you have to setup the configs a tad more manually and do some editing (I forget now); definitely doable and protonmail lets you download the configs (which work out of the box depending what you use).
I've read some articles online, but I still haven't managed to understand the hype around wireguard. It's lighter than OpenVPN, but has more obscure primitives? Doesn't seem like a great trade off...
Mullvad has been tremendous and the ease of use is terrific. I use a VPN relatively infrequently, sometimes going months without turning it on, so the one-time payments have been wonderful. The app is simple to use, and it's so, so easy to reactivate for a month when I need it.
I can't speak to their privacy as my VPN usecase is usually just "I need an IP in another region," but to the best of my understanding they are one of if not the best in the business.
You can also easily pay with better anonymity with the Strike app, https://strike.me, which abstracts bitcoin mainnet and lightning network payments behind USD, so you don't have to worry about actually holding bitcoin or managing tax implications. You just use bitcoin as a globally agnostic payment rail, masked with your local fiat, so the price volatility doesn't affect you.
Mullvad even gives you a 10% discount for bitcoin, bitcoin cash, and monero payments.
I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement for reduced transaction fees given the low value of transactions they deal with, as well as instant confirmation rather than 6 block (~1 hour) confirmations. You could even theoretically stream nanopayments for each minute of use with lightning, rather than pay for a whole month.
I signed up to Mullvad - my first VPN - literally about 12 hours ago, purely because of how simple, yet comprehensively-explained, their 'onboarding' process was.
I also particularly like the flat no-fuss EUR5 a month fee.
I can wholeheartedly recommend them after using their service the past few months.
They offer Linux configs with wireguard (a sore point with other VPN providers, who tend to either not support Linux at all or only offer openvpn), their Android App has worked flawless and it's just 5E/month.
I've been a mullvad user for the past couple of years. I only occasionally use them for privacy on open wifi networks or whatever, but the experience so far has generally been excellent. I initially used the official Wireguard iOS app to connect, but their iOS native app is freaking excellent. WAY more reliable and user friendly than the others I've used— ExpressVPN and some other. It's been quite some time since I used the other ones, however, and they may have equally good branded clients by now.
https://www.ivpn.net/ also generates a random userid and also accepts cash in the mail (only for large purchases unfortunately). I wasn't able to get mullvad's multihop to work on Android, but iVPN Pro does the trick. iVPN also has a nice server status page that helps you optimize for speed (low load server) or anonymity (high load server) as appropriate: https://www.ivpn.net/status/ They have a weird "anti-marketing" homepage which devotes almost equal space to explaining why you should not buy their product :-P
Perfect Privacy accepts a gift card (more convenient than mailed cash IMO) and has a nifty "neurorouting" feature which aims to be better than standard multihop (claims of speed, at least, I can attest to). They do ask for an email address, sadly, unlike iVPN/Mullvad. Also I just saw this and it looks a bit worrisome https://www.security.org/privacy-guide/perfect-privacy/
Both iVPN and PP let you block various trackers / MANGA corps at the network level.
I like Mullvad but it seems good to support a diversity of providers. Curious if anyone has any dirt on either of those two, or if they can make more recommendations.
I wish their scratch cards were available in Australia. Sounds easier than shipping money halfway across the word. I would just pay by card, threat level is not high enough to worry about that but their scratch card is a great idea. Must not be a popular enough option though, even a google search doesn't give you much information on them.
Of all their features, I love that they have an Android TV app so I can watch F1TV on my couch. They're worth more than the 5 euros I give them per month.
Aren't OTT streaming services notorious for blocking VPN IP ranges? How is Mullvad getting around those? Surely, they don't buy / lease / steal residential IP addresses [0]?
I tried the Android TV App to watch HBO max though (in a different country vs the subscription's host country) and the HBO app did not even load (not even the splash screen). I had no such problems with some other VPN providers (although to be frank some other VPN providers fail in a different way).
Interestingly I tried to watch HBO Max (from a different country) using Mullvad but it failed me. While some other VPN providers succeeded. So it seems it's kind of a hit and miss what works.
> convenience comes at a cost and we no longer think this is an acceptable trade-off.
In an age where dissertations about what color and position to use for buttons go pages long, that's a courageous position that follows a clear strategy. Kudos!
> For example, the port-forwarding feature won't work if you have a recurring subscription.
Yep, I had to cancel my subscription recently to get port forwarding working. I've been a customer for a few years now and trusted that they were doing this because it made sense from a privacy standpoint.
Presumably there are details linking together payments coming from Paypal and the account number. And obviously there is a link between account number and forwarded port. So following with that, you'd be able to make the connection between the account number and Paypal account, which is definitely not private nor even pretending to protect your privacy.
I normally don't use VPNs, so please correct me if I am wrong.
I think from a law enforcement/accountability standpoint, if an "actor" is accused of wrongdoing while using Mullvad's port forwarding service, Mullvad might have some evidence linking the "actor" to an actual identity, since they have the payment information. Depending on the laws of whatever territories, Mullvad may be compelled to leak that info to a judge. Without that information, then there's no information they can ever be forced to leak.
Are these benefits not eroding? Pressure on subscription models comes from both the public getting herd immunity against the underlying dark pattern and competitors chasing a diminishing supply of people to trick as world + dog has adopted the tactic.
In this particular case, with a privacy tailwind, it will be unsurprising if it ends up increasing their sales.
I think saying subscriptions are a dark pattern is going a bit far. In the case where you're offering an ongoing service that requires a cost to service, a subscription model is completely appropriate and in the best interest of both the subscriber and the issuer.
For sure there's some abuse of the model where you're selling something that should be a one-time item, but that's not the case here, and Mullvad is providing an ongoing service (and still billing by month / year / etc. for the service, just without automatic renewals).
I don't think so. Us privacy and control freaks abhor subscriptions, the mainstream just shrugs and pays what they're told to pay. I can even see them adopting rental models for a lot of stuff we purchase outright now (the "you will own nothing and you will be happy" great reset promoted by the world economic forum). I think this is pretty exploitative but I'm pretty sure I am in a minority. Obviously big business loves this because they have to do almost nothing and still get guaranteed income.
But to me their arguments sound too much like blackmail "With this model there is incentive for us to make longer-lasting products which is good for the environment". Well, sure but if you actually cared about the environment instead of money you'd be doing that right now. Why do we have to pay them more for less in order for them to do this?
To me this really sounds like a "pay us what we want or we'll mess up this environment of yours even more" extortion scheme.
The older generation is more against it but they tend to not trust tech very much anyway. They're not the ones buying a new phone every year, they use it for many years and even get it fixed when it breaks.
Disagree. If i have per-month subscription that does not have termination notice period, i could terminate it any time, next month effective.
If i have to pre-pay service, while i can still pay on per-month basis, that is usually such inconvenience that i would rather pay per-year or longer.
Considering privacy issues i assume that pre-paid account could not be cancelled and refunded earlier, i am implicitly forced to year-long contract with pay ahead.
absolutely not. people are wary of signing up for new subscriptions, because cancellation is not clearly protected in most jurisdictions, and people are aware that they can forget to cancel.
People dont forget to renew their world of warcraft membership because their game stops working if they do. if you use a VPN, you likely use it every day, and there will be no lost revenue.
Part of the advantage of the recurring subscription model is having predictable revenue every month due to it being recurring. And many businesses count on that "gym membership" effect, where people who don't use a service also don't take the time to cancel it for a while.
I've been using Mullvad ever since PIA was bought out. Never had an issue with them (other than when I forget to top up and my VPN connection dies :) ) with speed or reliability. I've always used the top up functionality rather than a subscription, but it's great to see how committed they are to reducing the attack surface for the users that need the most privacy.
Earlier this year I was changing some firewall configs and my torrent jail on my home server stopped working. I spent like an hour debugging, only to realize that my 1-year mulvad subscription had expired in the middle of messing with my firewall. Oops!
Mulvad is awesome and super fast. I reliably get in excess of 300mbps while torrenting.
Been using Mullvad for a year, give or take, and I'm very happy. Zero care to find another VPN provider. Simple, fast, and anonymous sign-up. The apps function perfectly. Never experienced a bug in the Android or Linux apps. And the Wireguard profiles work perfectly. Connections are fast and not throttled (IME). And the UI of the website and apps is minimal and to-the-point.
I hope Mullvad keeps on its current course. It's one of the most respectable companies right now, with a respectable product, and its one of the few I care to pay for on a consistent basis.
The only issue I have is on my phone. Whenever I leave my home wifi, it gets slow as hell and I have to do a reconnect to get to a new server. Usually the reconnect speeds things up a LOT.
My only concern with Mullvad is that, as their profile and reputation increase, they become a bigger target. That’s mostly a vote of confidence, though the concern is a real one.
But what is also great about Mullvad is that they're actively working to make their remote and local security better. They're involved in the stboot[1] project for example.
Perhaps a Swede can chime in, but I'd imagine Sweden has a lax regulatory approach, e.g. compare the fates of PRQ and Megaupload. It's, admittedly inexplicably, concerning that we've driven people to foreign companies (from American ones) due to government surveillance. It begs the question: under what conditions would a consumer be fine ceding privacy? Transparency? Remuneration?
Not really. See the trial against the founders of The Pirate Bay for example, and the controversies surrounding it. Also, the FRA surveillance. Also, according to the ISP Bahnhof, the police at least used to submit lots of data requests without a court order and for non-serious crimes.
AIUI, Bahnhof and other VPN providers stay in the clear by avoiding storage of data in the first place. They can be compelled to hand over any data they have, but not to log any additional data. (ISPs etc are forced to log more data IIRC.)
At least there's nothing like the Australian laws for forcing and gagging developers.
Why are VPNs what people flock to when they think they want privacy? Moreover they kinda break the internet so it's not a scalable solution. It's cool to see a good one selling a privacy message and doing it at level 11, but it seems kinda disingenuous to me to tell users that they're more private because they use a VPN. Private from your current ISP, sure, but not from Mullvad (they're your new ISP, you're just moving the problem of who to trust, not acquiring privacy) and especially not so much from the service level tracking and collection of data which is arguably the real problem short of being targeted by nation-states.
Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
Now, choosing where you want your traffic to geographically egress onto the public network does have marginal utility and it's a perfectly sane feature for VPN providers to market and consumers to pay for--VPNs aren't useless. It's just not privacy.
EDIT: add bit about how Mullvad is your new ISP to clarify the point
>Private from your current ISP, sure, but not from Mullvad
being private from your local ISP is what 99% of people care about because they use VPNs to send copyright infringement claims to /dev/null and watch netflix, not to smuggle nuclear secrets to Iran. It's privacy in a practical sense that's useful to people. If I go from an untrustworthy ISP to a trustworthy one I've gained privacy, there's no need to be overly academic about the term.
I'm not really trying to be pedantic for giggles.. perhaps I just think it's sad that 99% of ISPs are considered your privacy enemy and on top of that I don't consider VPNs a scalable solution to the problem at large so I'm more entertaining the "why is this the de facto solution" question in the "does it scale to society" solution space. It starts to look more like a social problem/solution than a technology problem/solution. That's more what this is about. If everyone used a VPN we'd really be in the same scenario we are today because to support that infrastructure you'd need exit nodes in every city and boom there goes your location advantage.
I don't disagree that centralized services are also bad for the internet, but that's not a rebuttal to my point (also, what is a VPN service if not a "centralized ISP with different egress options"). A VPN does not add a layer of privacy. That's a misunderstanding of the concept and unfortunately a popular one even among security folks and even more-so among security marketing folks. A VPN allows you to effectively choose a different ISP. You are not private from Mullvad. You just have their promise that they're better and more transparent than your alternatives and that they won't sell your DNS queries and connection logs to advertisers. It's not bad to align with an ISP that shares your values, but it's not privacy outright.
> And if you want you can even send them cash in an envelope. Or monero or whatever.
So why not only allow payments in privacy perfect currency if they're so concerned about privacy?
> [...] it seems kinda disingenuous to me to tell users that they're more private because they use a VPN. Private from your ISP, sure [...]
Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
Nothing will ever be perfect, and VPNs can easily be oversold in terms of their benefits (especially since https became the norm). But they have benefits in some common use-cases.
> Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
They accept cash and at least some other privacy preserving payment methods already.
> They accept cash and at least some other privacy preserving payment methods already.
So why even allow "traditional" KYC-ridden payments at all?
> Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
The nuance is that you're just moving the problem. You're not private from Mullvad. You're just trading one ISP for a different one. I could have phrased it better in my initial comment so as not to suggest a contradiction. Think of it this way, if Mullvad was your ISP, would you still tell someone to get a VPN? You have to trust someone not to snoop on your DNS queries and connections. All adding a VPN does is give you more freedom to choose who to trust, which is not bad in its own right. It's just not technically privacy manifest.
They break the practical solutions to content distribution and delivery that we've deployed. If everyone used a VPN, CDNs and caching would be rendered ineffective. Generally, VPN consumers use more bandwidth than necessary to acquire the same content which does impact the network.
I think that you're right in that by using Mullvad you're transferring the trust from your current ISP to them.
It's also important to mention that you can pay Mullvad with cash, sent in an envelope, so that your (real) identity is never known to them.
My ISP accepts cash payments in an envelope with an account number written on it. They probably require an address during signup so they can service the physical lines but just pointing out that paying is cash is not exclusive to Mullvad.
Browser and system configuration. Turn off tracking cookies, advertiser IDs, block tracking links/assets. I use a municipal ISP that doesn't sell my info. Stuff like that. But really I know that I'm not private from the services I access so I try to gravitate towards services that I trust with my personal information. My goal is not to make sure nothing ever lands in my advertising profile. It's to make sure that whatever my profile is looks so unlike my interests that it becomes a useless waste of money to build it.
Readit News
Hadn't heard of Mullvad before reading this, figured I'd give it a try. That is hands down the BEST onboarding experience for an app (let alone a VPN) I've had in I don't know how long. Took me maybe 2 minutes to go from no account to a working VPN connection.
I love that everything is anonymous (down to the account credentials just being a randomly generated token).
Since I'm also a ProtonMail user and I considered switching to them for VPN as well but their python client doesn't seem to work correctly on my Arch Linux install and it doesn't give me anything useful to debug it beyond "An unknown error has occured" so I couldn't be bothered to investigate beyond that.
Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.
I can't speak to their privacy as my VPN usecase is usually just "I need an IP in another region," but to the best of my understanding they are one of if not the best in the business.
Mullvad even gives you a 10% discount for bitcoin, bitcoin cash, and monero payments.
I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement for reduced transaction fees given the low value of transactions they deal with, as well as instant confirmation rather than 6 block (~1 hour) confirmations. You could even theoretically stream nanopayments for each minute of use with lightning, rather than pay for a whole month.
I was intrigued...
Then
"currently the Strike app is only available in the United States*, El Salvador, and Argentina"
I also particularly like the flat no-fuss EUR5 a month fee.
Just the only vpn with any integrity left remaining, no biggie.
They are a very good alternative among others.
Perfect Privacy accepts a gift card (more convenient than mailed cash IMO) and has a nifty "neurorouting" feature which aims to be better than standard multihop (claims of speed, at least, I can attest to). They do ask for an email address, sadly, unlike iVPN/Mullvad. Also I just saw this and it looks a bit worrisome https://www.security.org/privacy-guide/perfect-privacy/
Both iVPN and PP let you block various trackers / MANGA corps at the network level.
I like Mullvad but it seems good to support a diversity of providers. Curious if anyone has any dirt on either of those two, or if they can make more recommendations.
If I wanted to self-host a VPN, I would still need to pay for a cloud provider.
Is there an equivalent cash (snail mail) offering for hosting?
[0] https://news.ycombinator.com/item?id=9614993
This is a fantastic idea! Thanks mate!
How did you pay?
In an age where dissertations about what color and position to use for buttons go pages long, that's a courageous position that follows a clear strategy. Kudos!
https://mullvad.net/en/pricing/
Deleted Comment
For example, the port-forwarding feature won't work if you have a recurring subscription.
This just extends that kind of thinking to the service in general.
Been a Mullvad customer for a long time now, and it's always been awesome.
Yep, I had to cancel my subscription recently to get port forwarding working. I've been a customer for a few years now and trusted that they were doing this because it made sense from a privacy standpoint.
Is this something to do with state-level actors?
I think from a law enforcement/accountability standpoint, if an "actor" is accused of wrongdoing while using Mullvad's port forwarding service, Mullvad might have some evidence linking the "actor" to an actual identity, since they have the payment information. Depending on the laws of whatever territories, Mullvad may be compelled to leak that info to a judge. Without that information, then there's no information they can ever be forced to leak.
In this particular case, with a privacy tailwind, it will be unsurprising if it ends up increasing their sales.
For sure there's some abuse of the model where you're selling something that should be a one-time item, but that's not the case here, and Mullvad is providing an ongoing service (and still billing by month / year / etc. for the service, just without automatic renewals).
But to me their arguments sound too much like blackmail "With this model there is incentive for us to make longer-lasting products which is good for the environment". Well, sure but if you actually cared about the environment instead of money you'd be doing that right now. Why do we have to pay them more for less in order for them to do this?
To me this really sounds like a "pay us what we want or we'll mess up this environment of yours even more" extortion scheme.
The older generation is more against it but they tend to not trust tech very much anyway. They're not the ones buying a new phone every year, they use it for many years and even get it fixed when it breaks.
If i have to pre-pay service, while i can still pay on per-month basis, that is usually such inconvenience that i would rather pay per-year or longer.
Considering privacy issues i assume that pre-paid account could not be cancelled and refunded earlier, i am implicitly forced to year-long contract with pay ahead.
People dont forget to renew their world of warcraft membership because their game stops working if they do. if you use a VPN, you likely use it every day, and there will be no lost revenue.
Mulvad is awesome and super fast. I reliably get in excess of 300mbps while torrenting.
I hope Mullvad keeps on its current course. It's one of the most respectable companies right now, with a respectable product, and its one of the few I care to pay for on a consistent basis.
1. https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...
AIUI, Bahnhof and other VPN providers stay in the clear by avoiding storage of data in the first place. They can be compelled to hand over any data they have, but not to log any additional data. (ISPs etc are forced to log more data IIRC.)
At least there's nothing like the Australian laws for forcing and gagging developers.
Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
Now, choosing where you want your traffic to geographically egress onto the public network does have marginal utility and it's a perfectly sane feature for VPN providers to market and consumers to pay for--VPNs aren't useless. It's just not privacy.
EDIT: add bit about how Mullvad is your new ISP to clarify the point
being private from your local ISP is what 99% of people care about because they use VPNs to send copyright infringement claims to /dev/null and watch netflix, not to smuggle nuclear secrets to Iran. It's privacy in a practical sense that's useful to people. If I go from an untrustworthy ISP to a trustworthy one I've gained privacy, there's no need to be overly academic about the term.
And breaking the internet? I think centralisation by parties like Amazon, Google, CloudFlare does that a lot more.
And if you want you can even send them cash in an envelope. Or monero or whatever.
> And if you want you can even send them cash in an envelope. Or monero or whatever.
So why not only allow payments in privacy perfect currency if they're so concerned about privacy?
Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
Nothing will ever be perfect, and VPNs can easily be oversold in terms of their benefits (especially since https became the norm). But they have benefits in some common use-cases.
> Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
They accept cash and at least some other privacy preserving payment methods already.
So why even allow "traditional" KYC-ridden payments at all?
> Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
The nuance is that you're just moving the problem. You're not private from Mullvad. You're just trading one ISP for a different one. I could have phrased it better in my initial comment so as not to suggest a contradiction. Think of it this way, if Mullvad was your ISP, would you still tell someone to get a VPN? You have to trust someone not to snoop on your DNS queries and connections. All adding a VPN does is give you more freedom to choose who to trust, which is not bad in its own right. It's just not technically privacy manifest.