We are removing the option to create new subscriptions
mullvad.net
mullvad.net
Hadn't heard of Mullvad before reading this, figured I'd give it a try. That is hands down the BEST onboarding experience for an app (let alone a VPN) I've had in I don't know how long. Took me maybe 2 minutes to go from no account to a working VPN connection.
I love that everything is anonymous (down to the account credentials just being a randomly generated token).
I also particularly like the flat no-fuss EUR5 a month fee.
https://mullvad.net/en/blog/2019/12/3/mullvad-partnerships-p...
Perfect Privacy accepts a gift card (more convenient than mailed cash IMO) and has a nifty "neurorouting" feature which aims to be better than standard multihop (claims of speed, at least, I can attest to). They do ask for an email address, sadly, unlike iVPN/Mullvad. Also I just saw this and it looks a bit worrisome https://www.security.org/privacy-guide/perfect-privacy/
Both iVPN and PP let you block various trackers / MANGA corps at the network level.
I like Mullvad but it seems good to support a diversity of providers. Curious if anyone has any dirt on either of those two, or if they can make more recommendations.
If I wanted to self-host a VPN, I would still need to pay for a cloud provider.
Is there an equivalent cash (snail mail) offering for hosting?
both google and oracle offer small, perpetually free VM instances.
I believe the GP's question is "is there any public-web hosting platform that I can use entirely anonymously; where they allow me to sign up using a VPN; and where I don't ever have to pass them anything / sign in through anything / link anything that could be linked back to my identity?"
And I believe the answer to that question is "no."
(Well, okay, if you're fine with a static website, you could pin your data using FileCoin, and then set a domain up as a DNSLink pointer to [an IPFS gateway for] the relevant IPFS URN. That's how https://docs.ipfs.io works. But that's not quite what "web hosting" means to most people.)
I can't speak to their privacy as my VPN usecase is usually just "I need an IP in another region," but to the best of my understanding they are one of if not the best in the business.
Since I'm also a ProtonMail user and I considered switching to them for VPN as well but their python client doesn't seem to work correctly on my Arch Linux install and it doesn't give me anything useful to debug it beyond "An unknown error has occured" so I couldn't be bothered to investigate beyond that.
Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.
That said, I got back from a week long trip a few weeks ago. I kept my AWS tunnel up the entire trip. For the set of websites I visit for personal and work reasons, it was never an issue. I'm sure I could find some website that doesn't work, but for me, it's just not a problem.
It's also super useful, since I can whitelist my AWS instance's IP on services that demand such things, and never have to worry about where I am as I move from network to network. I've also reserved the Elastic IP so I can stop/terminate my server when I want without needing to whitelist the IP again when I spin it back up
2) it’s still not very expensive
3) it’s absurdly fast for a “VPN”! Like 400Mbit symmetric.
4) I also use it as a seedbox. Speaking of…does anyone have an invitation a private tracker to replace what.cd because I miss that. Or a no/low compression movie tracker.
Is there any proof of this? It seems like the original author was wrong and deleted the article.
Of course, that was a while ago .. long enough I assume my notes no longer reflect the current state of things. It'd be interesting to try and recreate it with the latest stuff, but all of my VPN providers accounts have lapsed by this point.
Can you dumb it down maybe?
Also, I didn't really understand any of your explanation about layers. How is openvpn an application stack? Surely applications are the applications?
> How is openvpn easy to fuck up? I just run sudo openvpn file, and that's it...
The configuration is what is easy to fuck up, not the command to run it
Just the only vpn with any integrity left remaining, no biggie.
https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
Is Cure53 incorruptible? Would there be any blip in the world if they were not and Mull was really an NSA op?
I’m not saying I don’t trust Mull over say, Nord. I am saying the nature of the whole thing is non-falsifiable with our existing technologies. We can only determine who was lying by looking back after an incident, and most are kept secret.
Most of them are also public and on github.
On the contrary. Mullvad gives you more flexibility than PIA in that regard and doesn't limit you to whatever features are built into the client like PIA does. You can build tunnels to whatever endpoint in whichever country you want. You can associate multiple ports to your tunnel or separate tunnels for inbound connections. It's very convenient if you want a P2P tunnel where you can get a wireguard interface on the client and then configure your P2P application to only use that tunnel so that there's no chance of leaks (Up to you if you want to also configure the P2P service to use DNS over the VPN or just the system resolver if you don't care) and you don't have to tunnel everything over the same VPN. You can have multiple interfaces going to different applications if you wanted. You have the flexibility to configure your client in whatever way you want without having to deal with proprietary endpoints to request a temporary forwarded port for the connection like what PIA makes you use.
I used to use PIA before the owner hired con artist Mark Karpeles as the CTO and jumped ship when that happened. Even though I only picked Mullvad because it was recommended on HN and wasn't PIA, I much prefer it from a technical standpoint. If I knew how much better it was originally I never would have went for the cheaper more popular option of PIA. People shilling Mullvad are probably doing so because it has many technical advantages over traditional VPNs used by more casual customers. Mullvad also supports bridge servers for shadowsocks. I've never had an opportunity to test it but I'd expect Mullvad to be more reliable in China than PIA.
PIA is cheap, and they don't seem to keep traffic logs. That's basically all they have going for them.
Maybe things were already bad before Kape but it was around the same time
I feel like it's probably more trustworthy under Kape than a CEO and CTO surrounded by a long history of lies, fraud, and general scumbag behavior.
https://www.privateinternetaccess.com/blog/why-i-hired-mt-go...
That's the same rasengan you'll occasionally see on HN.
They are a very good alternative among others.
But yeah, I'd say Mullvad and OVPN has proven themselves over the years, met a mullvad employee in IRC discussing wireguard when it was still an earlybird, they're a good team.
Someone hacked into their Malmoe server a year ago or so, and found that they indeed run everything in RAM disks and aren't logging at all. Happened via the management interface. But please take this information with a grain of salt, as the write up for this exploitation has been vanished from the internet (or I am just unable to find it). *
However, there are still articles about how they've been raided multiple times [1][2][3] in the past, and the police never found any logs.
[1] https://lists.torproject.org/pipermail/tor-talk/2010-August/...
[2] https://torrentfreak.com/police-seize-two-perfect-privacy-vp...
[3] https://www.ip-insider.de/hausdurchsuchung-bei-erfurter-vpn-...
* Also, I believe that this kind of pwnage could've happened to every VPN provider. Always use VPN chains with multiple locations and always keep in mind that your VPN could have been compromised. Don't just rely on a single hoster which just shifts the liability from your ISP to another single point of failure. But this is probably still better than LE just having to call comcast. :)
Edit: ovpn.to is probably worth taking a look too. I remember that the admin grows cannabis in his basement (still illegal in Germany) and provides all users with access to warez via Usenet NNTP. Do with that info what you want.
Hypothetically, without breaking into the network control plane, the hacker could have completely missed the existence of port mirror to a second read-only system that does logging for lawful intercepts.
This is a fantastic idea! Thanks mate!
If you register from abroad and use your credit card, they'll see you're from AU, block your account and you'll have to contact customer services for a refund.
Exclusivity deals are a cancer.
Mullvad even gives you a 10% discount for bitcoin, bitcoin cash, and monero payments.
I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement for reduced transaction fees given the low value of transactions they deal with, as well as instant confirmation rather than 6 block (~1 hour) confirmations. You could even theoretically stream nanopayments for each minute of use with lightning, rather than pay for a whole month.
I was intrigued...
Then
"currently the Strike app is only available in the United States*, El Salvador, and Argentina"
Also, "Global payments for the internet" is really referring to bitcoin, not strike.
Strike isn't doing the magic here. It's just one of many possible APIs that can be built on top of bitcoin and the bitcoin lightning network. If you integrate with Strike with your company, anyone else on the planet with any other kind of bitcoin wallet can pay you.
This is unfortunate as that market is ripe for disruption
Doesn't scale.
Layer up.
Scalability tests are underway [1] to detect bottlenecks for increasing the block size further, which should take it closer to Visa's transaction capacity.
The scalability roadmap aims for eventually supporting 50 daily transactions for each human in the planet, again keeping fees low, which is key for Bitcoin to be used as cash. Check out [2] if you want to read about the technical feasibility of this (even with today's hardware, it will be even easier in the future).
I understand the skepticism about the ability to scale Bitcoin after the Bitcoin Core team has been pushing for years for keeping block sizes low, but please let's consider facts rationally and maintain a civil discussion.
[0] https://news.bitcoin.com/bitcoin-cash-stress-test-goes-beyon...
[1] https://bitcoincashresearch.org/t/assessing-the-scaling-perf...
[2] https://blog.vermorel.com/journal/2017/12/17/terabyte-blocks...
On this here website there was a talk a couple months ago that led me to believe that paying $150 worth of bitcoin costs ... $150 if you want it done at credit card speed. Have things changed?
You can see a graph of historic average transaction fees at https://bitinfocharts.com/comparison/transactionfees-btc-bch...
If the bitcoin network is currently congested, your transaction can potentially take hours before it's included in a block. Mullvad would wait at least until this point.
> I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement ... as well as instant confirmation rather than 6 block (~1 hour) confirmations.
This is a known problem with blockchains and why naive projects like bitcoin cash that try to just pump up the layer one transaction volume for everyday merchant payments are doomed solutions.
The bitcoin lightning network payment experience is instant and magical, and constantly getting better.
How did you pay?
In an age where dissertations about what color and position to use for buttons go pages long, that's a courageous position that follows a clear strategy. Kudos!
For example, the port-forwarding feature won't work if you have a recurring subscription.
This just extends that kind of thinking to the service in general.
Been a Mullvad customer for a long time now, and it's always been awesome.
Yep, I had to cancel my subscription recently to get port forwarding working. I've been a customer for a few years now and trusted that they were doing this because it made sense from a privacy standpoint.
Is this something to do with state-level actors?
They _can't_ do that with recurring subscriptions, since they need something that links to your CC or PayPal details to re-bill it next month/year. They've chosen to not do that any more, possibly as performative privacy, also possibly as having real privacy concerns for their clients, and also also possibly so they can tell law enforcement and courts to stop bothering them when needed. (realistically, it'll be some combination of those three things, and possibly others I've not thought of, that triggered them into this)
Like you show up and give me $5, tell me it’s for account XYZ, I go into my admin console and increment the remaining usage time, but don’t write that you were the one giving me $5
There’s a window of time where the link exists of course! But you can get rid of it.
(I Hope that they are not storing things like an account start date or too many payment records… it could easily be deanonymized through time stamp correlation and the banks/stripe/PayPal have the data)
I think from a law enforcement/accountability standpoint, if an "actor" is accused of wrongdoing while using Mullvad's port forwarding service, Mullvad might have some evidence linking the "actor" to an actual identity, since they have the payment information. Depending on the laws of whatever territories, Mullvad may be compelled to leak that info to a judge. Without that information, then there's no information they can ever be forced to leak.
https://help.audible.com/s/article/do-i-keep-my-credits-if-i...
Do I keep my credits if I cancel my Audible Premium Plus membership? No. If you end your Audible Premium Plus membership, your credits will be lost with your other membership benefits.
Dark patterns all over.
This and other privacy-related issues (see my comment history) is why I won’t consciously use Amazon again.
In this particular case, with a privacy tailwind, it will be unsurprising if it ends up increasing their sales.
For sure there's some abuse of the model where you're selling something that should be a one-time item, but that's not the case here, and Mullvad is providing an ongoing service (and still billing by month / year / etc. for the service, just without automatic renewals).
A fundamental part of healthy business relationships is value for value. E.g., you give me money, I give you a sandwich, you take the sandwich, eat it, and are happy with it. If you keep paying me for sandwiches but I don't give them to you, that's not healthy. Ditto if I put them on the counter but you stop taking them.
Personally, I think there should be a law that all service/software subscriptions auto-suspend after 30 days of non-use. Because right now there's a big incentive for businesses to get you to sign up for things they think you're not going to use, and to keep on charging you even though they know you're not using it.
All of them, from the local gym to Dropbox to Spotify. Subscription businesses can't make money if every consumer costs more to service than the revenue they generate. There's even an official accounting term for it, breakage.
> Produce nothing, but get paid every month
Failure to consume and get value from a subscription is your fault, not the business that fulfilled its obligation.
If a company can't exist without tricking people into paying for something they get no value out of, maybe it shouldn't exist.
You're getting all-you-can-eat from the business for a fixed price in exchange for predictable revenue as opposed to pay-as-you-go. That you think that's exploitative just tells me you don't understand the business model. You want to have your cake and eat it, too.
An all-you-can-eat restaurant where customers don't eat anything and you still keep charging them until they notice months or years later is indeed exploitative.
For something like an apartment, there's reasonable justification for long-term contracts and continuing to charge people without regard to use, in that it's an expensive good that has exactly one user at a time and where it can take a while to find a new tenant.
But that entirely vanishes with most internet-based subscriptions. If I stop watching Netflix, they stop experiencing marginal costs for me. If I get excited about a NYT subscription but then stop reading, it's the same deal. Nobody went out and bought another server just because I signed up. I could cancel at any time and they'd have to let me go. If they keep charging me when I'm not getting any value, then it's not a mutually beneficial relationship; they're just exploiting me. And indeed, maybe they were exploiting me from the get-go if their intent was to just get my money in without regard for whether I was going to get anything out of it.
People who take money without providing value are at best economic parasites, but quite a lot of them are just scammers, grifters, and frauds. Which is exactly why a law would be especially valuable here, so that their time and attention were devoted to some socially positive activity.
> keep charging them until they notice months or years later is indeed exploitative.
When is it the customer's fault for not cancelling? You're working very hard to avoid responsibility for the business contract you entered into.
> they stop experiencing marginal costs for me.
Which are a small part of the overall cost structure. So what?
> Nobody went out and bought another server just because I signed up
Absolutely they do. The business is managing its finances under the assumption of subscribers and LTV, and making investments accordingly based on those assumptions and forecasts.
> they're just exploiting me
For charging you for something you signed up for but were too lazy to manage properly?
> just get my money in without regard for whether I was going to get anything out of it
There you go passing the buck again. It's your responsibility to use the thing you signed up for.
> People who take money without providing value are at best economic parasites
You mean the money you're giving them as part of consensual business agreement?
And with that, I'm done. You are very dedicated to both exploitation and victim-blaming as justification. I'm not going to convince you otherwise, presumably because you made or make your living from that. “It's difficult to get a man to understand something when his salary depends on not understanding it," said Upton Sinclair, and I have better things to do with my time.
Does that also apply to your car/home/health insurance as well?
If you don't have an accident/get robbed/go to the doctor, are you being exploited by the insurance company?
Edit: BTW, I'm an old guy myself.
That said, those are prime opportunities for parasitism and exploitation, because it's hard to measure risk reduction until actual harm comes along. That's why those sectors need heavy regulation.
You said[0]:
"But that entirely vanishes with most internet-based subscriptions. If I stop watching Netflix, they stop experiencing marginal costs for me. If I get excited about a NYT subscription but then stop reading, it's the same deal. Nobody went out and bought another server just because I signed up. I could cancel at any time and they'd have to let me go. If they keep charging me when I'm not getting any value, then it's not a mutually beneficial relationship; they're just exploiting me. And indeed, maybe they were exploiting me from the get-go if their intent was to just get my money in without regard for whether I was going to get anything out of it."
A subscription with them provides access to the services they sell all the time as long as your subscription is current, in exactly the same way as as insurance provides risk mitigation.
You appear to be arguing that it's the subscription model that's the problem and not those who use it in an exploitative manner.
I'm not a fan of subscription models myself, which can be used in exploitative ways, but the fault isn't in the model, but in those who implement/administer it.
N.B.: I do have insurance, but not Netflix or NYT subscriptions.
[0] https://news.ycombinator.com/item?id=31818397
Edit: Fixed formatting, typo.
If you really can't tell those classes of product apart, I don't think I can help you.
Don't put words in my mouth. I never said anything even approaching that.
Netflix sells a service (a pretty useless one, in my view) -- video content -- for which they charge a monthly fee.
Insurance companies sell a service (more useful, in my view) -- covering (or at least reducing) the costs of bad stuff happening -- for which they charge a monthly fee.
One is (at least in my view) more useful than the other, but the business model is the same -- pay a monthly fee for some product/service.
As I said, it's not the model that's the problem, it's those who use it in an exploitative fashion.
Please do go ahead and set up another straw man you can knock down for your own satisfaction, but I won't participate further.
Have a great day!
I was inexact (business vs. payment model) in my previous comment. My apologies.
But my point still stands: Subscription payment models aren't inherently exploitative; rather they can be implemented/administered (or not) in an exploitative fashion.
Don't like Netflix/NYT and others' implementation of said payment model? I'm not surprised. I'm not very high on them either.
But just because you don't like the specific implementation, doesn't make them a different payment model. That payment model being: "pay a monthly fee, get whatever product/service you've paid (and continue to pay) for.
You appear to be claiming that because different companies sell different stuff, that the payment models are not the same.
Which is akin to arguing that since automobiles with ICEs[0] serve a different purpose than automobiles with electric engines. They don't.
And likewise, subscription payment models are subscription payment models, regardless of the product/service being offered.
>If you're not getting it, that's fine, you are free to carry on not getting it.
And you're free to continue making wildly inaccurate statements. Have fun and a good day!
[0] https://en.wikipedia.org/wiki/Internal_combustion_engine
Sure, but this doesn't describe all subscription businesses, plenty of companies have healthy margins even with active users.
No one is saying there aren't subscription businesses that abuse subscription pricing to get recurring revenue from what should be one-time revenue, leave customers locked into something they're not getting value out of, etc. but that's not a truism of subscriptions (even the traditionally shady ones like gyms!)
On some level yes. But recently banks here in Australia were busted for charging dead people.
https://www.afr.com/companies/financial-services/apra-punish...
Are you going to tell me the dead people are at fault for not taking advantage of services provided?
The point here is the relationship between (business) provider and consumer. It should be fair and balanced. No one is asking a business to provide services for nothing. But when the services aren't being used, the non-consumer shouldn't be charged either.
The only question remaining is - what is a fair way to go about this?
A reasonable time period of non-use before suspension of service seems ok. The business got money for nothing - but can't try to make that into a business plan.
Clearly businesses would rather have more "money for nothing" - so would everyone - but it isn't reasonable.
I also think there are systemic reasons to stop it. If you're running, say, a good streaming service, imagine a competitor coming along that makes a lot of use of dark patterns to get people to sign up and keep paying even though the value is much lower than your service. Now you have a choice: try to compete against a better-funded competitor or go for the same dirty money yourself?
As a society, we want companies to devote their capital and brainpower to making things better for customers that can freely choose the best products. And that's what most company founders want too, so that markets are competitive in fair ways and they can focus on the products that got them excited enough to start a company. So I think it's in the interests of everybody except the parasitically inclined to just rule out exploitative business models.
I also think pushing the risk of "the customer doesn't actually get anything out of it" onto the business is where the risk should be. Who better to understand and manage that risk than the people making the product and who have great masses of data on how it actually gets used?
The entire point of a subscription model is that a business can offer a steeply discounted price vs. pay-as-you-go in exchange for predictable, recurring revenue. That's the only way the model works.
In my opinion, that's the industry (at least here in .au) that are the poster-child worst example of dark patterns in manipulative subscription charging.
They are infamous here for doing fucked up things in an attempt to make it as difficult as possible to cancel your subscription. I had one friend who moved overseas, discovered his gym was still billing him monthly even though he'd emailed to cancel explaining they didn't have any locations in his new country of residence, and they tried to claim the only way to cancel his subscription was in-person at the location he signed up at. He had to lawyer up when he cancelled the credit card (and told them he'd done so), and they threatened to send his account to a collection agency. (On single lawyer letter got him a refund of all charges since the date of his original email saying he was cancelling, so they _knew_ they were legally in the wrong and wouldn't have a leg to stand on it of ever got to court.)
And it's all just such a waste for everybody. The first gym I joined was run by a very dedicated muscle-head who was at his gym a fair bit. You signed up for a fixed period, like a week or a month or a quarter. At the end of the period, you could renew if you wanted. And if you weren't coming to the gym often enough, he'd ask why you weren't coming. He believed in his product and wanted people to be successful at his gym.
But I'd guess part of the reason that doesn't dominate is that awful gym companies sucker people in, do everything they can to become credit card parasites, and then spend a lot of the extra money on marketing and on giving people good-looking deals that they know they won't use.
I also disagree that's the point of subscription models. If I'm on a month-to-month subscription, there's no legal guarantee the revenue is predictable more than 30 days out. That would be just as true if auto-suspend were required for non-use.
For most subscription businesses and SaaS companies, non-marginal costs are most of the costs. The pennies Netflix saves if you don't stream during the month are a pittance compared to other SG&A expenses like headcount and content production.
> I also disagree that's the point of subscription models.
What do you think the point is? Why would Jetbrain's move to a subscription model? Why does Spotify stream music and not sell tracks and albums? A subscription model is a fundamentally different business than one offering standard transactional sales.
But to me their arguments sound too much like blackmail "With this model there is incentive for us to make longer-lasting products which is good for the environment". Well, sure but if you actually cared about the environment instead of money you'd be doing that right now. Why do we have to pay them more for less in order for them to do this?
To me this really sounds like a "pay us what we want or we'll mess up this environment of yours even more" extortion scheme.
The older generation is more against it but they tend to not trust tech very much anyway. They're not the ones buying a new phone every year, they use it for many years and even get it fixed when it breaks.
Too easy and lazy to blame this on some grand conspiracy. Reality is much more complicated, and cuts to heart of human behavior.
I think part of this is the free market which only really works on "MORE". More turnover, more customers, more products YoY. If you make a loss or invest in something for the common good a company isn't just frowned upon, they are putting themselves at liability of due diligence lawsuits. Most of the societal and environmental problems we are seeing stem from this, in my opinion. We need to fix the system before it's too late, not pamper to it.
I don't think there is a dark "SPECTRE" style gathering going on at Davos, no. I'm not a conspiracy theorist. However I do see there is zero incentive to improving the status quo if it doesn't make some rich people much richer yet again. This is why I see the WEF as a 'bad' entity, for promoting such things which are clearly undesirable. It's a very one-sided image.
For me as a tinkerer and maker the idea of renting my stuff and not being allowed to improve or repair it, is absolutely unthinkable and something that must be fought tooth and nail.
But mullvad isn't targeting mainstream!
It's mainstream compatible, as-in not too hard to use, but that's it.
Also mainstream only cares about VPNs because they believe it does magically things, like somehow better protecting all your privacy even if you are logged into Facebook or somehow making account hijacking or banking scams less likely :/
That's why they will go anyway with VPN providers which do a lot of ad advertisement to make them subconscious feel like it's doing all this magical things (even if they never explicitly claim it). Like NordVPN (you probably know what I mean if you use e.g. twitch in the EU ;=) ).
So no point in competing for this users without doing things like a ad powered free plan, free testing month, and tons of dark-ish patterns.
Instead mullvad has I think a good idea about what works with their customers.
I think it still will cost them money (who hasn't forgotten to cancel and abo) but also might save them money (not having to handle anything in support related to subscriptions going wrong). And maybe with things like people pre-paying for a year, but stop using it after a few month it will also not cost them anything. Really hard to say. I mean it was also guaranteed to end up on HN, so free advertisement to exactly the right audience. That's worth some money, too.
I agree, this is precisely why they're doing this. Putting their customers' privacy over their investors' wallets. This is a big ballsy move IMO. They're buying a lot of goodwill here. And taking a risk.
> Also mainstream only cares about VPNs because they believe it does magically things, like somehow better protecting all your privacy even if you are logged into Facebook or somehow making account hijacking or banking scams less likely :/
Also totally agreed lol. I often get questions from friends about VPNs. Always have to explain that privacy really doesn't work if you willingly give up your data :)
And no I don't use Twitch so not sure what you mean there, sounds like an interesting story.
> So no point in competing for this users without doing things like a ad powered free plan, free testing month, and tons of dark-ish patterns. Instead mullvad has I think a good idea about what works with their customers.
Exactly. They're not doing a tunnelbear.
> I think it still will cost them money (who hasn't forgotten to cancel and abo) but also might save them money (not having to handle anything in support related to subscriptions going wrong). And maybe with things like people pre-paying for a year, but stop using it after a few month it will also not cost them anything. Really hard to say. I mean it was also guaranteed to end up on HN, so free advertisement to exactly the right audience. That's worth some money, too.
I agree it's ballsy, this makes me respect the gesture even more. It's not the 'done thing' in this day and age. But they're still doing it and for the right reason.
People dont forget to renew their world of warcraft membership because their game stops working if they do. if you use a VPN, you likely use it every day, and there will be no lost revenue.
If i have to pre-pay service, while i can still pay on per-month basis, that is usually such inconvenience that i would rather pay per-year or longer.
Considering privacy issues i assume that pre-paid account could not be cancelled and refunded earlier, i am implicitly forced to year-long contract with pay ahead.
Mulvad is awesome and super fast. I reliably get in excess of 300mbps while torrenting.
I hope Mullvad keeps on its current course. It's one of the most respectable companies right now, with a respectable product, and its one of the few I care to pay for on a consistent basis.
1. https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...
AIUI, Bahnhof and other VPN providers stay in the clear by avoiding storage of data in the first place. They can be compelled to hand over any data they have, but not to log any additional data. (ISPs etc are forced to log more data IIRC.)
At least there's nothing like the Australian laws for forcing and gagging developers.
This should or should not tell you enough...
The AABill introduced warrants that can be handed down without judicial oversight that compel the recipient (individual or institution) to grant (or, critically, develop the means to grant) read access to any system to the government; while simultaneously acting as a gag order preventing disclosure of the warrant's existence. Violating this gag order would incur jail time.
The IDBill introduced warrants that allow the government to "disrupt data by modifying, adding, copying or deleting data in order to frustrate the commission of serious offences online" and further allows them to impersonate the online profiles of a person deemed significant to a criminal investigation.
Both of these bills were rushed through parliament with minimal opportunity for public comment. Where public comment (from the legal, tech, and human rights arenas) was made, it was universally negative. We have just ousted the government that drove these bills, but the new government (supposedly considerably more left leaning) supported both these bills with minimal opposition and has made no public plans to repeal or amend this legislation.
A previous Prime Minister once said (not in regards to these particular laws): “The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.”
[1] Assistance and Access Bill (2018): https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
[2] Identify and Disrupt Bill (2021): https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
Actually I'm not so sure that's true. I'm pretty sure similar gag orders have been mentioned in episodes of P1's Gräns. Might want to double check that...
Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
Now, choosing where you want your traffic to geographically egress onto the public network does have marginal utility and it's a perfectly sane feature for VPN providers to market and consumers to pay for--VPNs aren't useless. It's just not privacy.
EDIT: add bit about how Mullvad is your new ISP to clarify the point
And breaking the internet? I think centralisation by parties like Amazon, Google, CloudFlare does that a lot more.
And if you want you can even send them cash in an envelope. Or monero or whatever.
> And if you want you can even send them cash in an envelope. Or monero or whatever.
So why not only allow payments in privacy perfect currency if they're so concerned about privacy?
Because perfect is the enemy of good. Mulvad would lose customers and that is not good for Mulvad, nor for the customer.
Beyond location, did you know there are services that can sometimes accurately provide a users place of work based on home IP? Their likely income level, and more. That becomes impossible with a VPN.
In short a VPN removes a key personal identifier that can be used to ID you online. Your IP address.
But the reality is that it does work for a variety of usecases. Try to torrent in Germany (of all places) and you'll get blackmail letters from random lawyers. Do this with a VPN and no problem.
For this scenario it's the tool for the job. If you're an insurgent trying to liberate Iran it's not.
For general surfing privacy it doesn't add much value at all because most of the identifying information is in the session itself, not the IP. This is where the layered approach comes in.
But I definitely see a value in these services.
And they do offer many anonymous payment options, but some are heavily frowned upon in some regions (eg anonymous crypto in India) and mailing bills is inconvenient and risky. And I guess for some people it's worth the tradeoff.
Otherwise sounds like we mostly agree.
Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
Nothing will ever be perfect, and VPNs can easily be oversold in terms of their benefits (especially since https became the norm). But they have benefits in some common use-cases.
> Also it seems all I need to do as an "attacker" is subpoena (or whatever the Swedish equivalent is) Mullvad while your payment record is on file and I get the info I want. If Mullvad really wanted to go hardcore why not only sell little top up cards cash-only at kiosks?
They accept cash and at least some other privacy preserving payment methods already.
So why even allow "traditional" KYC-ridden payments at all?
> Bit of a contradiction there. It adds friction to at least some attacks against your privacy. That's better privacy.
The nuance is that you're just moving the problem. You're not private from Mullvad. You're just trading one ISP for a different one. I could have phrased it better in my initial comment so as not to suggest a contradiction. Think of it this way, if Mullvad was your ISP, would you still tell someone to get a VPN? You have to trust someone not to snoop on your DNS queries and connections. All adding a VPN does is give you more freedom to choose who to trust, which is not bad in its own right. It's just not technically privacy manifest.
Another way of saying that is that you've gained a choice. Most people have essentially one option for an ISP, but _many_ for VPNs.
> So why even allow "traditional" KYC-ridden payments at all?
To allow user choice. Many probably don't really care about that aspect and just want to bypass region-locks.
Just turn off javascript and/or images.
I feel like if the bandwidth used by content distribution really mattered, we'd see a lot more effort being put into multicasting. Even a basic stateless "multiple destination IPs" version could save so much bandwidth.
being private from your local ISP is what 99% of people care about because they use VPNs to send copyright infringement claims to /dev/null and watch netflix, not to smuggle nuclear secrets to Iran. It's privacy in a practical sense that's useful to people. If I go from an untrustworthy ISP to a trustworthy one I've gained privacy, there's no need to be overly academic about the term.
I will admit that I know absolutely nothing of the Swedish legal system.
There are certain specific things that I would want always to auto renew (like domain names, hosting related stuff etc)
If I ever get round to building a subscription SaaS I might consider “off by default” auto-renewal and leave it to customers to turn it on if want it… though this does add a bit of complexity I guess.
[0]: https://blog.mozilla.org/en/products/firefox/firefox-rolls-o...
However, there are two cases where they are useful: - IP address hiding (something like iCloud Private Relay for iOS/Mac users does this at the browser level, VPN brings it to the entire system) - Legal protections - Location simulation
If you want to hide your IP address, this could be to stay more anonymous and less trackable, any system that relays your connection is fine.
If you want to break the law, you'll need something that has safeguards in place against that. Most VPNs do the most they can within the legal limits here.
If you want to simulate your location, you'll need a VPN with servers in those locations.
---
So really, it just depends on what "real privacy" means to you.
Free tiers provided by various "cloud" services work fine for this one (Oracle is the most generous among them).
Nah. As Europeans we're getting more and more censorship. Just think that most Russian news outlets have been blocked, youtube channels and so on. Plus until recently I couldn't read a good chunk of US news due to them refusing to adapt to GDPR.
But here they make privacy more important than pleasing the investors. Kudos. Glad I'm a customer.
And of course there are many countries completely outside of SEPA.
It absolutely is not. The only time I've seen a check was a gift from my grandfather in the 00s, and I don't think paying bills by mailing checks was ever a thing here.
Checks also often become very difficult and expensive to cash when going cross-border. E.g. most banks here (Finland) refuse to cash foreign checks altogether.
I've noticed this is not really a Mullvad specific issue, as the same thing happens when i apply their "killswitch" config (= pfctl firewall rules under the hood) while using other VPN services, like ProtonVPN.
Apple seems to be blocking some of the proxy ip's or some iCloud service process is misbehaving somehow.
This portable secure travel router supports MullVad (and Azire-VPN) out of the box:
https://www.amazon.com/GL-iNet-GL-MT1300-Wireless-Pocket-Siz...
Just input your Mullvad account number and it will upload all WireGuard configurations for all MullVad servers worldwide automatically.
Perfect to use to connect to any unsecure Wi-Fi and drive all traffic via VPN in hotels, airports, coffee shops, etc...
It can connect directly via ethernet cable or broadcast it's own WiFi SSID's to which you can connect.
You configure it to always connect to VPN of your choice using OpenVPN or WireGuard protocols.
Then you may connect to this device SSID and your traffic always be routed via VPN connection. This is way better, secure and more reliable than "VPN software" or "VPN apps" solutions.
Not sure if i answered your question?
I've been running a similar setup for a couple years now. It's been great.
or $90 on GL.iNet GL-AX1800 Wifi-6 router with MullVad support preconfigured.
Nothing to install, tweak or have hassles with.
Is there an easy way for regular consumers to set up recurring payments in a "push" configuration (i.e. from my bank to someone else's) rather than "pull" configuration (i.e. most subscriptions where the service charges a credit card on an interval)?
I split a T-Mobile multi-line plan with a few friends where I'm the payer, and I remember looking into this a while back to help them pay their share on time and without hassle, but coming up empty.
Feels like it would be useful for paying for something like Mullvad too, but I feel like there are benefits to that model that reaches beyond the individual use cases I mentioned.
It'd allow me to manage money going out of my account from 1 centralized location, making money flow more predictable and less chaotic than the status quo where a random amount of money is pulled out of my account from various credit cards every month, and I have to log into each account separately to figure out how much.
I wish more services supported this, but I understand it adds a lot of hassle for them as well.
I don't know what the rules are for sellers that are inside the EU, but if they are at all like the rules for sellers outside the EU selling to buyers in the EU they are required to collect two pieces of evidence that support their determination of which country's VAT to collect.
Where I work we use the country the person claims they are in from the country drop down on our cart and what country MaxMind says their IP address is from. This works most of the time. If those don't match we look up the first 6 digits of their credit card to see what bank issued it and see what country that bank is in, and if that matches either their selected country or the IP country we go with that. If the bank is in a third country, we look at their email address and if that is at a service that is mostly just serving one of the three countries we go with that.
How would a company that accepts cash and keeps very minimal customer information deal with this?
No - there’s no way to support all the anti fraud mechanisms of the major credit card networks without a thorough paper trail. Masked card services help prevent unwanted charges and inconvenience for the customer - they may give a fleeting layer of privacy between the consumer and the merchant but nothing more than that.
I am not for it. Just the way the lands lie right now.
https://www.cnet.com/tech/services-and-software/mullvad-revi...
If the Swedish courts find sufficient reason to do so, they will go in without warning and seize what they feel like.
VPNs don't mean shit. You're leaking data everywhere you go. Browser fingerprinting, WiFi/BT signals, cell tower signals, GPS. If you own a smart phone and a credit card you're already fucked.
Let's not confuse things for people by making them think if they plop a 5 Euro VPN between them and their yahoo! email account that this does anything at all to deter state level actors.
VPNs are good for a few things:
(1) Evading state-sponsored censorship (which uses technology minted in good old Silicon Valley) -- where the state doesn't really care unless you're really bothering them
(2) Marginally disrupting the pan-opticon that is surveillance capitalism by mixing the signals a bit, where your ISP can't sell you out to data brokers. But even then... DNS leaks, etc still happen and still fuck with the plan.
(3) Maybe not getting scooped up as badly in the state dragnet, and maybe not being accused of something you actually didn't have anything to do with.
But brother, if you think you're gonna be the next Ross Ulbrich with your Mullvad VPN, then you better be memorizing your recipe for toilet wine because you're gonna land in a fed pen.
A VPN headquarted offshore that will only respond to local subpoenas with local legal representation is pretty good protection against the second two.
Its almost the same in terms of privacy protections.
Now, I totally understand that letting people pause with super fine temporal resolution would crush their business model. I'm not asking for that. But I would like to buy say 30 months of service, flick a switch draining say one month of my credit (and having the service for a month), then pausing again.
I wish more companies had this attitude.
They seem to never actually associate the account number with any payments except at the moment the account gains time. This keeps them from having to respond to any legal demands with useful data.
I wonder if the iOS subscriptions are affected. Technically they could just not associate your payment with your account number. Then the app can submit the transaction ID and your account number that was stored locally to the service to extend your time.
Someone will know that Mr Smith has a mulvad VPN subscription. They just won't know his username on the service.
They also mentioned it's about less data, not about zero data. The moment you use a credit card, of course it's stored in a bunch of places. But this won't be stored with them.
See also: https://en.wikipedia.org/wiki/Tokenization_(data_security) and https://en.wikipedia.org/wiki/Crypto-shredding
This decision makes me like them even more.
Given the relative volatility I'd be surprised if they have any meaningful long term holding of cryptocurrency.
Why would you ever want to do that?
They could be safe against adversary that has access to Mullvad data, while still offering convenience of subscriptions. It is not safe against adversary that has access to banking data, but even independent payments are not safe against that adversary, if they are often enough.
But I think it's a bit overkill to completely remove the subscription option. They could have accomplished the same educating of end users with a simple recommendation or opt-out at sign up.
Still providing subscription for those users who find that most convenient.
Also, the Swedish government can't compel Mullvad to divulge information that it doesn't have.
Note: I'm not considering ProtonMail (Switzerland) as relatively cheap. I came to know about CTemplar (Iceland), but that shutdown a month ago.
Especially strong decision since this will certainly cost them a lot of revenue and I don't think the boost in reputation will counter that in the long run.
What'll happen. I suppose there is a "middle" group of users who want a VPN a bit but not super much, and long term now might leave
Anyway I like Mullvad's mindset
Hi Mullvad, I hope you'll post a follow-up a year later :-)
What if you, as part of the payment flow, included adding a calendar reminder X months later
I mean, maybe they won't be affected by this but they sort of suggest after a few weeks you could dispute the charge and they would have no idea it was you.
https://mullvad.net/en/help/no-logging-data-policy/#payments
Maybe that is fine, just a cost of doing business for them. But it is definitely atypical. Never heard of someone who would be completely unable to respond to disputes before.
One thought is that their offering is so uniform that they could provide the same information in response to every request, regardless of days passed since the transaction. They would only need to mark pre- and post- certain changes to terms and screens, which they could record without keeping identifying information.
They may also be using Stripe’s chargeback insurance, which relieves the need for the merchant to respond at all.
- ProtonVPN - Mullvad - IVPN
More details here on why: https://www.privacyguides.org/vpn
I personally picked Mullvad even though i use Proton Mail because they have a fully featured Linux app, unlike Proton's which is very very basic and they support IPv6.
Also, they do actually keep a link for 40 days, but it seems like some card card networks allow chargebacks past that.
So they hold your info and link for however long the chargeback period is (or the average one, probably 30-60 days is fine) and then lose it.
If you're more worried about privacy than convenience they offer other payment methods:
Which payment methods do you accept? We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24.
https://mullvad.net/en/pricing/
And you can pay for a decade in advance.
(What is Pretzel24 I wonder?)
"przelewy" means "wire transfers" in Polish: https://en.wiktionary.org/wiki/przelew Nothing to do with pretzels. :)
Perhaps a better model is the client stores the necessary data, and presents it when trying to connect?
All the ways I come up with (giving out keys) have the problem of how do you renew the key, and how do you cancel it, without knowing which is which.
e.g.
1. Connect to Mullvad over Tor, authenticate with real-world user ID
2. Use this to sign a blinded token
3. Use this to connect to Mullvad anonymously after some delay
The first run would be kind of dodgy, but after that you could get new session keys on a fixed schedule and switch them out at a random interval.
If they see that user A authenticates and 10 minutes later, key A comes online, that can be traced, but if you then wait a week, authorize key B, and then wait a few more days to start using it, you should be good.
In practice, this has way too many issues to work in practice. It still requires you to trust them not to e.g. log IPs and correlate it that way, so it's all just snake oil.
If Eve can determine the basis for which an account is identified, and there is a small number of subscriptions,[1] then the namespace may be exhaustively searched.
Mind that even if the resulting hash space is large, if the key space is small, the search is tractable. Just look for a resulting valid hash.
Even if a payment is required, if $0.01 is accepted, the cost for testing 1 million keys is $10,000. For a sufficiently high-value target, potentially reasonable. More so if you can create your own money.
________________________________
Notes:
1. For computers, any value < 10 billion is arguably small, and quite possibly somewhat larger than that. The present human population is < 10 billion. The Mulvad subscription list is all but certainly <<<10 billion, where '<<<' -> "very much smaller than".
I’ve funded some virgin addresses from Tornado Cash notes, running from my own local node
Thats sufficient and definitely less cumbersome than Monero.
" Which payment methods do you accept? We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24. "
also Cash
"Can I really pay with cash? You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD. "
With virgin addresses I can get bitcoin and monero (or anything incl cash) anonymously from the tornado cash notes via the bridges, or via exchanges and staying below KYC limits
But Tornado Cash notes decrypt only to EVMs where Tornado Cash is deployed. It would be more convenient for Ether and some ERC20 tokens to also be used directly, instead of bridges or exchanges.
Are you all beholden to a specific payment processor or implementation? People pay the most to use Ethereum for over half a decade now, which is best projection we have for activity and potential interest in merchants that aren't crypto native services.
Refreshing and definitely a good reason to switch.
Not sure why a savvy someone would use a subscription with a VPN, so not sure what the news is here.
Also, I find that using bullet points helps to visualize the sentences better, especially when used hierarchically.
Having to think about paying a bill every month is really a pain to me. I get the privacy ideals, but the tradeoffs are not ridiculous. I should be able to make a decision about how private I want to be, not have Mullvad decide for me so that they can feel better about themselves.
I will probably move over to Mozilla VPN now, since they will continue to rely on Mullvad for their infrastructure but allow me to pay them in a convenient way. I guess compromises are in order.
Others can correct me, but I believe each payment just adds a month of time to your balance. So a number of months can be added at once.
1) it doesn't cost mullvad very much to not autorenew subscriptions. People dont forget to renew their subscriptions to a service that breaks your connection to youtube when you forget to pay. It's closer to the world of warcraft model.
2) Customers are now rightfully wary of renewing subscriptions. Given horror stories of how difficult it is to cancel your subscription to a service, I suspect that you lose upwards of 50% of potential customers if you only offer subscription models.
3) No VPN has any incentive at all to "protect your privacy". It is perfectly legal for them to lie to you about not keeping logs and then turn them over to state actors, provided they are operating out of the right state. In fact, state actors would encourage such a thing. Perhaps some of these VPNs do something to protect your privacy, but it is not because they are incentivized to.
I'm not an expert and am ready to accept that I may be wrong. If you know any sources on the matter, it would be interesting to read.
I might be in a tiny minority of users (genuinely not sure) but I only enable my VPN when I want to get around IP geolocation (e.g. to stream something only available in another country) and otherwise turn it off when I'm done to minimize latency. I sometimes go a week or two without using it so I could easily not notice at least for days if my subscription didn't autorenew.
4) It is probably state funded and run by the CIA.