this post was submitted on 20 Sep 2023
569 points (100.0% liked)

Privacy

789 readers
17 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
569
Mullvad Annouce Removal Of All Disk Infrastructure - Now RAM Only (mullvad.net)
submitted 1 year ago by leraje@lemmy.blahaj.zone to c/privacy@lemmy.ml
66 comments fedilink hide all child comments
 

Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!

top 50 comments
sorted by: hot top controversial new old
[–] eatham@aussie.zone 103 points 1 year ago

Full article:

We have successfully completed our migration to RAM-only VPN infrastructure

20 September 2023 NEWS SYSTEM TRANSPARENCY

Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!

In early 2022 we announced the beginning of our migration to using diskless infrastructure with our bootloader known as “stboot”. Completing the transition to diskless infrastructure

Our VPN infrastructure has since been audited with this configuration twice (2023, 2022), and all future audits of our VPN servers will focus solely on RAM-only deployments.

All of our VPN servers continue to use our custom and extensively slimmed down Linux kernel, where we follow the mainline branch of kernel development. This has allowed us to pull in the latest version so that we can stay up to date with new features and performance improvements, as well as tune and completely remove unnecessary bloat in the kernel.

The result is that the operating system that we boot, prior to being deployed weighs in at just over 200MB. When servers are rebooted or provisioned for the first time, we can be safe in the knowledge that we get a freshly built kernel, no traces of any log files, and a fully patched OS.

[–] minishoemaze 91 points 1 year ago (3 children)

Why is their logo a Mole when Mullvad is The Goat

[–] LoafyLemon@kbin.social 86 points 1 year ago

In case someone actually ponders this, Mullvad means mole in Swedish.

[–] Onii-Chan@kbin.social 80 points 1 year ago (2 children)

It's a good day to be a Mullvad user. Switched over from Surfshark a while ago, and I love it.

[–] DoucheBagMcSwag@lemmy.dbzer0.com 12 points 1 year ago* (last edited 1 year ago) (2 children)

no port forwarding. No business from me

load more comments (2 replies)
[–] TrustingZebra@lemmy.one 8 points 1 year ago (4 children)

Is it noticeably faster than Surfshark for you?

[–] candle_lighter@lemmy.ml 32 points 1 year ago (1 children)

I haven't noticed a difference but this company is significantly more trust worthy IMO

[–] TrustingZebra@lemmy.one 11 points 1 year ago (2 children)

Funny thing is I started using Surfshark just before they started all the YouTube sponsorships. Them doing so many sponsorships actually made me trust them less somehow, if that makes sense.

Mullvad "appears" to be more trustworthy but maybe they are just better at marketing that image. They still cost twice as much as Surfshark.

[–] candle_lighter@lemmy.ml 18 points 1 year ago

The best piece of marketing Mullvad ever got was when the Swedish police raided them and Mullvad literally had zero data to turn over to them.

[–] LucidNightmare@lemm.ee 4 points 1 year ago

Usually when a company throws buckoos of money into advertisements, that’s where the money that could’ve been spent on a better product went. I’ve found products that were advertised so heavily, almost always have dog shit quality.

[–] PeachMan@lemmy.one 28 points 1 year ago (2 children)

You don't use Mullvad for their performance, you use them for their insanely paranoid security and privacy practices.

And for the record, I was never impressed with Surfshark speeds. I dropped them when they bundled a virus scanner into their VPN client, that's sketchy as hell. I don't want my VPN provider scanning my files.

[–] TrustingZebra@lemmy.one 5 points 1 year ago (1 children)

Yes I agree Surfshark has done some weird things. I find it weird that it's actually the same company now as NordVPN, but they don't make it clear.

Regarding performance, Surfshark is decent speed but still slower than not using a VPN. The more annoying thing is that I get a lot more captchas when using Surfshark. I think these issues are common for all VPNs, though I haven't tried Mullvad yet (I will when my Surfshark subscription ends).

[–] PeachMan@lemmy.one 5 points 1 year ago

Yeah a lot of these little VPN companies are getting bought up by larger companies with unknown investors, it's kinda worrying. There's one company that owns ExpressVPN, PIA, and CyberGhost now: https://www.kape.com/our-brands/

Kape Technologies (previously named CrossRider) has a pretty sketchy history of making adware: https://www.forbes.com/sites/thomasbrewster/2015/06/09/from-israel-unit-8200-to-ad-men/?sh=7c46d70e26e2

[–] lud@lemm.ee 5 points 1 year ago

Mullvad has excellent performance though. I got nearly gigabit, I, unfortunately, had to switch when they removed port forwarding.

[–] Onii-Chan@kbin.social 12 points 1 year ago

I never had any real issues with speed using Surfshark, the reason I made the switch was largely about trust. As another user said, as soon as I saw Surfshark start their YouTube advertising spree, and start to bloat their client with unnecessary features, I started looking for alternatives.

I'm iffy about any VPN company that uses YouTuber marketing as it is, and while my threat model isn't overly paranoid, I believe the VPN company someone chooses to use should have paranoid business practices. After I saw the news on Mullvad's raid, the authorities subsequently finding nothing, and the fact that a user's account is merely a string of numbers, I decided it was the VPN for me.

[–] lemmyingly@lemm.ee 5 points 1 year ago (1 children)

Mullvad compared to PIA, Google annoys me less with recaptures. I know it doesn't answer your question but thought I'd throw my 2 cents in since PIA was quite a popular choice with their YouTube sponsor slots and cheap prices

load more comments (1 replies)
[–] Hubi@feddit.de 56 points 1 year ago

Wow, that is very impressive. I've been a subscriber for a few years and I couldn't be happier with their service.

[–] DeathWearsANecktie@lemm.ee 44 points 1 year ago

Mullvad is good, definitely my go-to VPN these days.

[–] mnmalst@lemmy.zip 34 points 1 year ago (6 children)

I find the "Mullvad VPN scratch cards" interesting. If a store near you has them you could buy one and be totally anonymous. What I find a bit odd is that you can buy them on amazon as well but sold directly by mullvad. Doesn't that defeat the purpose? The idea of the card is a decoupling of your real identity from the vpn user but when you buy the card in their store doesn't it negate that?

I am probably just missing something here. Does anyone have more insight?

[–] leraje@lemmy.blahaj.zone 57 points 1 year ago (4 children)

The code on the card is covered so Amazon might know you use Mullvad but they have no way of knowing what your account is.

Mullvad know your acct but they have no way of knowing how it is you paid other than maybe it being a scratchcard which they don't track anyway.

[–] mnmalst@lemmy.zip 3 points 1 year ago (2 children)

I am not talking about amazon knowing it. Amazon offers shops for businesses, where a business directly sells goods to their customers using amazon as a transaction platform. Those shops send the goods directly to their customers (Sometimes it comes from an amazon warehouse as well tho). If the first case is true, mullvad would send me the card directly, so they would know I bought it, which makes the card obsolete in my view.

But maybe they don't send it themself and the cards are all just sitting in a big warehouse. Either way, to me it's not 100% a given that they couldn't at least in theory know who bought it.

I am just playing devils advocate here btw, I am not really concerned about it.

[–] imgonnatrythis@lemm.ee 13 points 1 year ago

You are buying access to a VPN not a nuclear warhead for the black market. The link between buying a VPN card and the code used in that card to link to said vpn activity which is also pretty well protected on Mullvad is not easily discoverable. Seems like a pretty reasonable privacy gap to me.

[–] leraje@lemmy.blahaj.zone 12 points 1 year ago* (last edited 1 year ago)

If you're a Mullvad customer then they already know your IP and from that they could identify you pretty easily. But that's true of all VPN providers, but they claim they don't log and I seem to recall them saying they don't keep a record of scratch off card numbers (why would they?). Either way you have to trust them and based on the fact they're totally open I do.

load more comments (3 replies)
[–] Nioxic@lemmy.dbzer0.com 17 points 1 year ago

Well amazon can tell youve bought a card

But not which code you recieved, on the physical card..

[–] mojo@lemm.ee 8 points 1 year ago

Better yet, they employ a guy you can find in an alley who has a bunch of redemption cards in his trench coat. He takes cash or crack.

[–] Simran@lemm.ee 3 points 1 year ago

Well the biggest selling point of VPNs is easier piracy not privacy. Most VPN customers just want to protect themselves from anyone watching their downloading habits. Yeah technically there would be a trail but no one is going to follow it to catch someone downloading inception.

load more comments (2 replies)
[–] mojo@lemm.ee 31 points 1 year ago

Mullvad is such a good company. I just bought another month yesterday, but guess I'll go and add another year to that!

[–] csolisr@communities.azkware.net 26 points 1 year ago (3 children)

From what I read in the article, there is still one part of the boot sequence that does require some sort of storage: the part where the bootloader fetches the network boot image and verifies it against the checksum signature. But I think that can be performed by booting from a pendrive and then removing it. The problem will come if law enforcement gets a hold of said pendrive...

[–] Deconceptualist@lemm.ee 52 points 1 year ago

Why would that be a problem? A boot image should only contain the commands to get the main system started after POST. It shouldn't contain any kind of logs, traffic data, or user data. In fact it should be read-only.

[–] mub@lemmy.ml 11 points 1 year ago

Boot Drive could be immutable and not contain any form of log?

[–] ultratiem@lemmy.ca 8 points 1 year ago (3 children)

Destroy the drive. That’s what Apple does and how they get around the whole “we need a backdoor” problem. When no one can access the server, no more problems.

load more comments (3 replies)
[–] Carter@feddit.uk 25 points 1 year ago (3 children)

Of only they'd kept port forwarding.

[–] leraje@lemmy.blahaj.zone 61 points 1 year ago (1 children)

Didn't really have a choice:

...Regrettably individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers. This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.

Blog post

Big issue there is hosting providers cancelling them. Can't operate a business without that.

[–] csolisr@communities.azkware.net 4 points 1 year ago (2 children)

Short of getting their own servers of course. This update seems to be a step forward in that direction

[–] Kangie@lemmy.srcfiles.zip 9 points 1 year ago

Even if you own your own servers you still need somewhere to host them; ISPs / colocation providers are going to have the same issues with abuse.

load more comments (1 replies)
[–] imgonnatrythis@lemm.ee 13 points 1 year ago

Agreed. Seems like they were in a super tough spot with that and kind of had to drop it. All the sudden they seem to be doing some new cool stuff to try to keep their edge which I really appreciate / respect. That being said, I've dumped them and switched to a service that still port forwards as it gives me better torrenting throughput. Sorry Mullvad.

load more comments (1 replies)
[–] fmstrat@lemmy.nowsci.com 8 points 1 year ago (3 children)

Have they ever been audited like PIA?

[–] floofloof@lemmy.ca 39 points 1 year ago

The article is five very short paragraphs. The third one is:

Our VPN infrastructure has since been audited with this configuration twice (2023, 2022), and all future audits of our VPN servers will focus solely on RAM-only deployments.

[–] leraje@lemmy.blahaj.zone 18 points 1 year ago (1 children)

Few times, yeah. Last time was August this year

load more comments (1 replies)
load more comments (1 replies)
[–] azurefirefly@lemmy.basedcount.com 7 points 1 year ago (2 children)

Interesting, will this affect performance at all?

[–] leraje@lemmy.blahaj.zone 15 points 1 year ago (1 children)

I think (disclaimer: not an expert at all) that RAM is much faster to access than a hard drive so if anything it should improve.

load more comments (1 replies)
[–] Kissaki@feddit.de 11 points 1 year ago

It's unlikely to have any noticeable impact. This is more about verifiably and categorically not having any traces of logging or cached state.

Both caching and logging should be independent of the direct usage performance anyway. And service startup happens only once - not during its usage.

load more comments
view more: next ›