I was reading this review of Mullvad on Mullvad VPN Test 2024: Lack of Transparency & Trust which covers speed, privacy, features, support and price.
Under the privacy section they posted that their tests have proven Mullvad stores real IPs in their databases.
“One of the main criticisms we had in our test was that Mullvad VPN recommends itself as being for “anonymisation” and pretends that they don’t use log files. Unfortunately, this is not the reality. In our tests we were able to prove the use of central databases that are also supposed to prevent usage on unlimited devices at the same time. So Mullvad stores log data of the users, which includes the real IP address as well as the used VPN IP addresses and the start and end times. In addition, the amount of data that is transferred. In practice, this information is sufficient to be able to answer requests from authorities satisfactorily. Therefore, the reports that no log files are stored that could lead to the identity of the users are simply lies.”
I’m inclined to believe this is outright lies but could there be truth? I’ve championed Mullvad as the top tier providers for years
I’m no expert but it seems like the tester derived this only from the information, that mullvad allows up to five devices. He went on and assumed the technology to enforce this is based on logs, which would be concerning. But afaik mullvad uses wireguard of which they allow (only) five generated keys to be linked with the account to limit devices.
Please correct me if I’m wrong.
This site is shit and just promotes the VPN provider that pays them. /u/The_BNut is right.
This review was brought to you by Raid Shadow Legends, the top rated game in all games, ever!
That website is thinly veiled (is it even thinly veiled? Or just not at all) advertising. You’ll notice the top rated VPNs are the same ones that show up everywhere and are known more for their ads than their actual services, there are tons of “review” websites out there that are just folks using affiliate links and getting kickbacks from the companies for pushing customers towards them. Some aren’t even people, they’re basically just “ChatGPT, write me a nordVPN ad that sounds like an article reviewing different VPN services.”
As a fun exercise, maybe see what that prompt gets you and how similar it is to the review sites!
"In our tests we were able to prove the use of central databases that are also supposed to prevent usage on unlimited devices at the same time. "
Wow, they managed to skim the help page on Mullvad’s site lol. I personally trust Cure53’s infrastructure audit more than a for-profit vpn “review” site.
Bogus.
“One of the main criticisms we had in our test was that Mullvad VPN recommends itself as being for “anonymisation” and pretends that they don’t use log files. Unfortunately, this is not the reality. In our tests we were able to prove the use of central databases that are also supposed to prevent usage on unlimited devices at the same time”
Q&A section: “Does Mullvad store log files? We do not assume this, the service also uses rented servers.”
So what is it? Logs or not?
I’m an expert.
The bottom line is that the only way to know what Mullvad logs or doesn’t log is through a third party audit or actually hacking their systems.
As a systems engineer “managed to prove” is not language I’d associate with “evidence”.
This commentary would be true regarding any VPN provider.
How do you take this information? As with everything… a grain of salt.
What’s your threat model?
In my case I use Mullvad mainly for remote pen testing and making sure my ISP doesn’t see my activity (God help you if you open a port on your router). I’m not defending against the FBI, NSA, or the Chinese government.
Which is to say: I trust Mullvad’s exit IPs more than my ISP. And I can keep my cell phone pinned to one Mullvad IP which is in a major datacenter- this is an advantage.
Would I trust Mullvad if I were to do anything felonious? Nope. I wouldn’t trust anyone if I was doing things like that.
If your goal is to circumvent your ISP’s monitoring or add an added layer of encryption to whatever it is you are doing, assuming the VPN provider supports the protocol, that’s what you are going to get.
If you’re looking for protection to do devilish things there’s no commercial VPN in the world that will protect you.
Please… do not send me messages asking how to do those things. I’m not on that team.
Op just made this post then disappeared
Yeah, I eyeballed the text and it does not seem quite alright somehow. Could be they are not native English speakers (nor am I but still) but the text itself does not promote the highest trust in what they actually say.
Also their accusation “we managed to prove” without any indication about the method or the proof itself, is quite vague as an accusation.
You’re correct. The author of this article is not trustworthy, as he can’t even understand this 5-key mechanism that Mullvad uses, but believes he is an expert, and is over-confident enough to make strong and incorrect conclusions.
Indeed, the website is full of ads for their “best rated VPN service”, that says a lot about how honest their “reviews” must be
Based on the sad state of VPN marketing, you may be able to infer the ethical stance of the service by the seediness of the advertising.
Just a thought.
And here’s the truth:
If you want to hide your identity on the internet there’s only two real choices:
TOR or I2P… and you better know what you are doing. Tor is incredibly imperfect and flawed. Conversely, I2P shouldn’t really be attempted without significant computer skills AT THE COMMAND LINE… on a Java enabled UNIX-like operating system. And even then you need to have significant skill to lock down a *NIX box. Running these things on Windows already compromises you. Windows… Is. Not. Secure. Period.
Tor has been compromised a bunch of times on it’s own for drugs and porn things. It’s pretty good at hiding the identity of parties exchanging information. But that assumes the information sent is small enough to avoid a correlation attack… or a compromised exit node.
I2P on the other hand is a Cadillac if you want to send information point to point anonymously. I’m unaware of any time I2P was compromised. It doesn’t exit to clearnet. Hence it’s advantage. A correlation attack could be used against it if you know the hop count. But you’d never be able to prove the content of the information sent without breaking it’s encryption… Which I believe is now more or less “supposedly” Quantum resistant.
So for a journalist sending sensitive information either of these options work fine.
For criminals… they’ll get you anyway. Targets are targets.
So it would be nice if people stopped talking about VPN services being “more secure”.
At best they are “more trustworthy”.
At worst they are so many dollars a month wasted while providing false security.
While I agree with everything stated in this post, I’d like to emphasize that this:
In my case I use Mullvad mainly for remote pen testing and making sure my ISP doesn’t see my activity (God help you if you open a port on your router). I’m not defending against the FBI, NSA, or the Chinese government.
describes almost exactly my point of view when using any VPN. This is effectively electing when to open the curtains to various rooms in your home and when to close them. And it’s not just for my ISP, it’s for any ISP carrying any of a number of random wireless access points I might use while away from my home.
I take it on faith that if I made myself a high value target of law enforcement, I’d have to do more than using a simple VPN.
Thanks for summing that up so well for us!
Thank you for confirming. I sincerely think it’s malicious sloppiness as he was most likely content with any reason to rank his sponsor higher.
I don’t think this is unique to VPNs. It’s more a feature of capitalism. Every dollar a company spends on marketing is a dollar they are not spending on making the product they are marketing better. In a capitalist society, the only reason a company would make such a choice is if they believe they can make more profit with their marketing spend than spending that same money on their product. The question then becomes: how do they make back that delta? What value do they see in marketing that they don’t see in their product? The answer is often “the data of the folks using the service can be sold”
I love how I’m the only person you replied to who didn’t make a critique on your statements
These are good points. Though some industries seem tackier than others. IMO.
Except I didn’t make a statement, I asked a question. Brush up on your reading comprehension
Okay rephrase last word as post now what