Mullvad exit IPs are surprisingly identifying

(tmctmt.com)

143 points | by RGBCube 2 hours ago

13 comments

  • solenoid0937 38 minutes ago
    > As an example, imagine that you are a moderator on a forum and you suspect that a new face is actually a sockpuppet of a user you banned the day prior. You check the IP logs, and despite using different Mullvad servers, both accounts resolve to the overlapping float ranges 0.4334 - 0.4428 and 0.4358 - 0.4423. This gives you a >99% chance that they are the same person.

    This sounds like how I'd design a VPN if I were an intelligence agency.

  • faangguyindia 1 minute ago
    I maintain a list of

    "23034 IPs to blocklist.txt"

    blocked IPs they contain all VPN providers. Often VPN providers seed Geofeeds with wrong data, this is why i use traceroute and ping network to locate their real location.

  • lorenzohess 56 minutes ago
    The purpose of a VPN does not include anonymizing users with respect to the sites they visit,so it shouldn't be too surprising that Mullvad doesn't enforce unique exit IPs. Users who want anonymity should use networks like Tor.
  • fooker 23 minutes ago
    It seems surprising that people would expect a VPN to be comparable to Tor.

    It does seem ridiculous once you spell it out like that, and then you have to realize that it’s plausible to de-anonymize even Tor users by controlling exit nodes.

    • curtisf 2 minutes ago
      Most of the big consumer VPNs include "privacy" with an implication of anonymity in their marketing, so it shouldn't really be surprising
  • VoidWhisperer 57 minutes ago
    > Surprisingly, the exit IP you are given is not randomized each time you connect to the server, but deterministically picked based on your WireGuard key, which rotates every 1 to 30 days (unless you use a third-party client, in which case it never rotates).

    I'm a little confused on this... what is stopping third parties from doing key rotations like the main app clients if it is detailed in the repo how to do it?

    • nvme0n1p1 38 minutes ago
      Third party clients include e.g. the WireGuard driver in the Linux kernel. It's definitely not the network driver's job to mitigate an attack against one specific commercial service.
    • DANmode 15 minutes ago
      > what is stopping third parties from doing key rotations

      Knowing to do so, primarily.

  • linkregister 1 hour ago
    Given that Mullvad is basically a bulletproof VPN host[1], it would be great if site operators could rely on this property to enact bans. Given that the solution is simple (add a pseudorandom seed), Mullvad will likely push out a fix within a couple days.

    1. It's the preferred VPN of TeamPCP.

    • fastily 17 minutes ago
      Source? Been googling for this but I don’t see any relevant info
  • Riany 38 minutes ago
    surprising that the mapping may be stable enough to become a user-level signal. and rotating away from deterministic assignment seems like a cheap way to avoid creating an extra fingerprint
  • paulpauper 12 minutes ago
    This is why VPNs have always been crap. The pool of IPs are backlisted/tainted, so you will run into various roadblocks and cpatchas, in addition to slow speed. If you are serious about privacy and don't want blocks and blacklists, buy high speed private proxies. Don't use a pooled service.
    • BLKNSLVR 1 minute ago
      A VPN by any other name.
  • gruez 1 hour ago
    >Surprisingly, the exit IP you are given is not randomized each time you connect to the server, but deterministically picked based on your WireGuard key

    What's the point of this? This seems more complicated to implement than mapping exit ips at the server level, so surely they must be doing this for a good reason?

    • TheDong 43 minutes ago
      It's a lot easier to implement because it's more stateless, and it's a better user experience.

      If you get a new exit IP each time you connect, you need something like a NAT table to look up "key 0xabc exits ip 1.2.3.4", and that grows to be the size of the number of users you have active, so fairly large.

      With a static mapping derived from the key, you don't need a table like that.

      It's also better UX since it means reconnecting your VPN software (say you switch wifi hotspots) doesn't give you a different IP address, so things like SSH sessions can resume, which wouldn't be possible if it were a different public IP each time.

    • arciini 1 hour ago
      I'd guess that this is to ensure one abusive user doesn't get every other user blocked from a large service (say, Google) for botting over the VPN and constantly rotating IPs.

      It's a practical measure, but definitely has a privacy cost though.

      • stevekemp 1 hour ago
        It's possible that contributes, but to be honest most VPN users are split "privacy seeking" and "abusive". Though I grant you paid users are probably slightly more circumspect than users of Tor, etc.

        It seems more likely this is just about load-balancing use against their available nodes.

    • tempest_ 1 hour ago
      I imagine there are a bunch of things on the internet that break if you start trying to connect to them from varying IP addresses. Things like the various CAPTCHA schemes and rate limiting etc, IP reputation etc.
      • lmm 1 hour ago
        > I imagine there are a bunch of things on the internet that break if you start trying to connect to them from varying IP addresses. Things like the various CAPTCHA schemes and rate limiting etc, IP reputation etc.

        Given how much of the world is stuck behind CGNAT now, I would expect any major sites to handle it.

    • Riany 36 minutes ago
      My guess is deterministic assignment makes load distribution and debugging easier. But for a privacy product, that convenience probably needs to be reconsidered
  • JoheyDev888 1 hour ago
    [flagged]
    • malfist 31 minutes ago
      Let's see, short summary of the article, saying nothing new or important. It's not x it's y. Comment history is exactly this type of comment everywhere.

      This is an AI comment from an AI account.

    • GalaxyNova 1 hour ago
      Doesn't matter much as long as it is a pseudonymous identity
      • stingraycharles 58 minutes ago
        It’s also not that difficult to fix, so I expect a fix to roll out soon enough.
  • wg0 1 hour ago
    VPNs are snake oil. Exit IPs are a public information.
    • BLKNSLVR 18 minutes ago
      Interesting handle to make that comment. I'm assuming you mean commercial VPN providers, and not wireguard (or other such VPN implementations).
    • Cider9986 1 hour ago
      VPNs are not snake oil. They transfer the trust of your internet activity from a place of low-trust, your ISP, to a place of high-trust, ideally a trustworthy VPN like Mullvad, IVPN, or Proton. Among other benefits. If you don't like your ISP creating a profile of you and selling it to target ads to you, you should use a VPN.

      >Should I use a VPN?

      Yes, almost certainly. A VPN has many advantages, including:

      1. Hiding your traffic from only your Internet Service Provider.

      2. Hiding your downloads (such as torrents) from your ISP and anti-piracy organizations.

      3. Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.

      4. Allowing you to bypass geo-restrictions on certain content.

      (https://www.privacyguides.org/en/basics/vpn-overview/)

      • BLKNSLVR 19 minutes ago
        Making your traffic cross jurisdictional boundaries also adds a level of difficulty for tracking usage.

        Local law enforcement can tap a local ISP for their records, but it would take a scale more effort to then tap a non-local service provider for their records. Each additional level of difficulty adds a cost, and at some point those costs aren't worth the potential results.

        (assuming that the VPN provider doesn't just roll over due to an email inquiry, or isn't a front for very cooperative law enforcement).

        • adgjlsfhk1 6 minutes ago
          the counterpoint is that making your traffic cross out of the US gives the NSA (by their ass backwards reading) permission to spy on you
      • wg0 35 minutes ago
        How is private company (VPN) is more trustworthy than an other private company (ISP) and how do you expect them to protect your identity in face of determined state actors that are afer you?

        What power is in $2.99/month that it offers so much security?

        Why is that at least 40% of sponsorship to YouTube Creators seem to be from VPN industry?

        What is that they know and we don't know?

        • nine_k 6 minutes ago
          Specifically Mullvad operate completely stateless nodes, which was confirmed several times when law enforcement tried to access their logs. There are no logs. Mullvad are selling their location, with very good connectivity and with laws that strongly protect privacy. They are €5/mo, almost $6/mo, and likely acquire bandwidth very cheaply due to scale and likely peering agreements.
        • pretzel5297 8 minutes ago
          You fundamentally misunderstand what privacy means if you're replying to someone stating using a VPN will help you avoid getting spied on by your ISP for commercial purposes with state actor based worries.
        • eipi10_hn 11 minutes ago
          Mullvad vs my ISP.

          One at least has open source software clients, and publishes audits from other 3rd-party audit organizations.

          The other open source... nothing. Their client apps have dozens of trackers inside. And it's a dream to see any of the ISPs in my county publish any 3rd-party audits. Their other products (going with the service) have trackers and personalized targeting ads inside.

          Yeah, in my 1 million alternate universes should I trust my ISP more.

      • bilalq 1 hour ago
        Unfortunately, the largest and most well-marketed VPNs are, in fact, less trustworthy than your average ISP.
        • SXX 46 minutes ago
          This depends on your treat model. If what you worry about is massive collection of Linux ISOs that you download and distribute over P2P then probably shady VPN ISP is what you need.
        • asdfsa32 57 minutes ago
          Exactly. Most ISP are subject to local laws at least; where a lot of these ISP are overseas in shady jurisdictions.
      • jesterson 1 hour ago
        > place of low-trust, your ISP, to a place of high-trust, ideally a trustworthy VPN like Mullvad

        This is highly subjective statement.

        Almost all commercial VPN services farm and sell your data. Just by that, my ISP is definitely high trust point while any commercial VPN is a low trust.

        • applfanboysbgon 1 hour ago
          Your ISP farms and sells your data too.

          Most VPNs are untrustworthy, but unlike ISPs, you can choose from any VPN provider in the world, not just the two or three that are local to you. And there are VPN providers in the world that have been proven not to retain data by audits + actual court cases where the court determined that the VPN provider did not have the data authorities were seeking. Do your research and choose a court-proven VPN, it's that simple.

          • KingOfCoders 33 minutes ago
            Deutsche Telekom in Germany/EU farms and sells my data? Any sources?
            • applfanboysbgon 23 minutes ago
              You probably won't find direct proof any more than you will find direct proof of any random VPN selling your data, it's just a given that commercial entities are liable to sell financially valuable data, and a list of all traffic, every website you visit and every service you use, tied to a specific identity is certainly financially valuable. Being in the EU doesn't change this; in fact the EU explicitly required that ISPs retain your identifying data with the Data Retention Directive, and though this was struck down after 8 years in court, many individual national governments immediately moved to impose similar requirements. I don't know if Germany was one of them but unless Germany has a specific privacy directive that goes beyond EU law I would see zero reason to place any trust in an ISP. In fact even if there was a law that's still not a reason to trust an ISP, because privacy laws are violated constantly; the most trustworthy source by far is a party acting opposite to the government, who has been investigated by the government and proven not to log the data that the government wants.
              • KingOfCoders 11 minutes ago
                "EU explicitly required that ISPs retain your identifying data with the Data Retention Directive"

                And then sells it?

        • sfdlkj3jk342a 1 hour ago
          I can easily pay for a VPN service with crypto anonymously. I can also use a VPN run by a company outside my country of residence and jurisdiction.

          Neither of those is possible with my ISP.

          • dakolli 49 minutes ago
            prepaid 5g sim cards and 5g modem.
            • SXX 40 minutes ago
              Yes and 5G provider knows your exact location while VPNs can be easily chained.
              • dakolli 17 minutes ago
                Sure, if you want to get crazy with it you put prepaid phone in another location, put it on your Tailscale VPN then proxy all traffic through the prepaid phone with something like: https://github.com/kost/revsocks

                Phone doesn't even need data if you have access to wifi wherever you stash it.

                VPN chaining easier though.

                • SXX 8 minutes ago
                  Whole idea of "put phone in location X" alone is much harder to implement than to buy 5, 10 or 100 VPN account or servers with crypto and setup how you like.

                  Like you need to physically be there, need ability to connect phone it to electricity and somehow maintain if it e.g reboots. And stay anonymous while doing so? I'd say that Hollywood kind of solution.

        • faangguyindia 36 minutes ago
          Most ISPs have invested big bucks in Deep Packet Inspection
          • sfdlkj3jk342a 19 minutes ago
            That just helps them classify the type of traffic. They're not breaking the encryption to see the actual content.
        • jojobas 55 minutes ago
          Now try saying that wearing some Russian or Chinese shoes.
        • eipi10_hn 18 minutes ago
          My ISP is in a communist country, they sell other products like TV boxes, cameras, clouds and have ads/trackers on all of their products too.

          Should I trust my ISP than Mullvad? LMFAO.

    • numpad0 26 minutes ago
      Mullvad is a tiny world-famous ISP in Sweden that has zero KYC and explicit zero-log policy, specifically designed that way to enable mild abuses, that also accept PayPal, credit cards, and today I learned, cash in an anonymous envelope for payments. That doesn't scream US three-letter organization at all.
      • BLKNSLVR 15 minutes ago
        I do all my illegal shit over Mullvad and I've only been raided once.

        (yes, I've been raided)

        (I started using Mullvad after - because of - that)

        (I don't do illegal shit, I just like some obfuscation of my trail because I enjoy fiddling with this stuff - which may have been why I ended up a raid target in the first place)

      • esseph 10 minutes ago
        > That doesn't scream US three-letter organization at all.

        They have their own tools + tor, they do not need mullvad.

    • Cider9986 1 hour ago
      I was just talking to a friend who believes that the feds poison privacy communities by spewing nonsense like this. I don't think wg0 is a fed, and my friend didn't have any proof for his claim. My feeling is that it is probably people acting like regular humans. They hear things, they have opinions and they don't provide proof or adhere to community norms. Eternal september or something. Regardless of if it's federal agents disrupting the discussion or human nature, the response should be the same—push back with proof, and demand proof and avoiding logical fallacies.

      >Also. This is how they ruined any meaningful talks about privacy

      There is so much noise

      "Use braive. Don't use braive. Use vpn. Don't use vpn"

      Then the debate spreads to all other aspects password managers, emails and etc

      • kalium-xyz 34 minutes ago
        If people using some tool made my job harder id be vocally against it during off hours. But lets be real any powerful group interested in tracking people would just be working with or running vpn companies. Or perhaps providing free vpn. Either way I think its all moot as for tracking you have to question who you do and do not want to be tracked by and for other purposes vpn works just fine
    • dewey 1 hour ago
      > VPNs are snake oil

      The most generous way of reading that would be the fact that every YouTube pushing for a VPN as an essential tool just to use the internet outside of your house without getting hacked is a big exaggeration or fear mongering but there's good reasons for using a VPN for a lot of reasons and it's not snake oil.

    • avazhi 1 hour ago
      > Exit IPs are a public information.

      Yes, obviously.

      > VPNs are snake oil

      Huh?

  • gchamonlive 32 minutes ago
    It's a game of cat and mouse. The service keeps banning IP ranges, the user keeps reconnecting to different servers and regions. The server can't know exactly who's who, just that a bunch of users are using mullvad, while the user just need to find one server on one IP range that works.

    Seems like a good deal to me. I don't care if they know I use mullvad, I care they don't know I'm me, and that's not something mullvad will easily disclose.

    • dns_snek 10 minutes ago
      > I don't care if they know I use mullvad, I care they don't know I'm me

      That's exactly what the article is about, a side channel information leak that de-anonymises users, did you read it?