Every single time I start researching VPN services I end up more confused and with more questions than before because basically every vouched service has the same amount of negative comments too. Like feels like the whole sector is a honeypot (lol) of shady stuff and also they figthing against each other (or not?). So I just wait until when turns out Mullvad is also one of the bad guys.
Every time the VPN service industry is discussed on HN there is a barrage of comments that use keywords like “honeypot”, “snake oil”, and “shady”. I’m not denying that the industry has problems, but in this thread I’d like to focus on how we can improve it.<p>Please tell me - What makes a VPN provider trustworthy, and how do you _know_?<p>Personally I believe a trustworthy provider is _characterized_ by consistent actions that show transparency, honesty, and conscientiousness. Nevertheless, such consistent action doesn’t actually prove trustworthiness.<p>A good VPN honeypot, or reseller of your network traffic, is publicly indistinguishable from a trustworthy one. So what can the users do? What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? What do we need to build?<p>We all recognize that VPN providers are in a great position of power over their users. How do we tilt the scales in the users’ favor? What are _strong_ signals of trustworthiness?<p>Disclosure: I co-founded Mullvad.
Come on Mozilla, hurry up! I want to give you money for goods and services (I also donate monthly [1]), but I'm not that interested in a VPN (I can and do also pay Mullvad).<p>Give me that real internet stuff - email, calendar, file sync, chat(?) - give me Firefox Premium. Bundle in the Lockwise password manager. I'd pay good money to see a company fill the void of paid, privacy first essential internet services and I think Mozilla is one of the foremost existing players to pull it off. They've started talking about Firefox Premium a while ago now [2] and it's obviously not easy to build all of this in a lean way, but I'll happily pitch in. If only to help make Firefox development less dependant on Google or Yahoo.<p>[1]: <a href="https://donate.mozilla.org/" rel="nofollow">https://donate.mozilla.org/</a><p>[2]: <a href="https://www.theverge.com/2019/6/10/18660344/firefox-subscription-paid-service-vpn-cloud-storage-release-date" rel="nofollow">https://www.theverge.com/2019/6/10/18660344/firefox-subscrip...</a>
I am surprised at how much money exists in the VPN industry. Whenever I watch even a mildly-popular YouTube video, it always has an advertisement for the latest VPN provider. As far as I can tell, there is only one reason there is this much money in the field -- to subscribe to US-based video streaming services from outside the US. But they never ever say that that's the reason, they always say things like "work from home securely" or "avoid being tracked". But, of course, your IT department already has a secure VPN for working from home, and that Facebook cookie works regardless of what your IP address is. In general, the sell of "you can't trust your network provider, so pay for an additional network provider that doesn't keep logs and only accepts payment in Bitcoins," doesn't seem particularly strong to me. Of course you can't trust the network layer. Nobody trusts the network layer. That is why we have TLS. (Anyone remember "wired equivalent privacy" when WiFi was a cool and new thing? Turns out wires don't offer much privacy.)<p>So why people are buying this service confuses me.<p>I am also confused at why people can run these services so cheaply. I looked into doing it myself (I had some ideas for actual value add), and the economics didn't seem that good. There is a lot of software between "ifup wg0" and "collect money from people that want a VPN". It seems expensive to write all that, unless a "yolo" strategy of starting up openvpn and setting up a couple NAT rules actually scales. (At the very least, you need to be able to distribute keys to pre-built clients, and if you want to make it smooth, you are looking at writing your own Windows/Mac/Android/iOS clients. Then you need all the business management software on top of that -- didn't get the Bitcoins so delete their private key, etc.) It seems like quite a bit of work that is quite expensive.<p>But these things exist left and right and have huge advertising budgets. So obviously I am misunderstanding something.
Every time someone mentions a VPN provider in my techie social circles, the "A VPN doesn't protect you" crowd piles in, usually with links to something like: <a href="https://gist.github.com/joepie91/5a9909939e6ce7d09e29" rel="nofollow">https://gist.github.com/joepie91/5a9909939e6ce7d09e29</a><p>I don't understand this argument, but would like to.<p>I run <a href="https://everytwoyears.org" rel="nofollow">https://everytwoyears.org</a>, a political non-profit focused on ending the warrantless metadata collection of U.S. citizens' communications. From everything I know about these programs, they are _explicitly_ not collecting content of communications. These programs only collect the metadata about a communication. As citizens, we don't get to have a clear definition of "metadata" (that is classified!) but we can assume anything that isn't the message itself is at risk of being considered metadata, especially if it was shared with a service provider in the normal course of conducting business (i.e. routing a request).<p>For HTTP requests, I assume the body of the request would require a warrant before it can be persisted on a government server. The HTTP headers, if unencrypted, _might_ be considered metadata but I would be surprised. The IPV4 headers are more than likely metadata. DNS queries are more than likely metadata.<p>If you are trying to avoid _active_ surveillance, where your government has a warrant, a VPN isn't going to help you. If you are trying to avoid _active_ surveillance where your adversary doesn't need/want a warrant to search you, a VPN isn't going to help you. But if you are trying to avoid having your internet activity ending up, de-anonymized, in a metadata database that your government does bulk analysis on, a VPN does seem like it would help. It seems like it would help a lot.
> At Mozilla, we are working hard to build products to help you control of your privacy and stay safe online.<p>> We know that we are on the right path to building a VPN that makes your online experience safer<p>Commercial VPNs are good for censorship circumvention or location spoofing. It is irresponsible to market VPNs as something which “protects” you online. In reality, they do <i>nothing</i> to improve security, and very little to improve privacy.<p>You do not need a VPN.<p><a href="https://gist.github.com/joepie91/5a9909939e6ce7d09e29" rel="nofollow">https://gist.github.com/joepie91/5a9909939e6ce7d09e29</a><p><a href="https://schub.io/blog/2019/04/08/very-precarious-narrative.html" rel="nofollow">https://schub.io/blog/2019/04/08/very-precarious-narrative.h...</a>
What an odd choice from Mozilla and Mullvad to segment this based on geography. Can you use it while traveling outside the US? Why not simply have a wait list? Mullvad already operates globally - what is the reason for the geofence? Is Mozilla not able to accept payment outside the US? (maybe not able to pay taxes?)
Forget the VPN--I already have a VPN provider and I have no interest in changing. Offer a paid e-mail service, on the other hand, and I'd sign on up Day 1.
When you connect to a VPN you advertise the fact that you are connected to a VPN to your local network, and hide your tunneled traffic. The tunneled traffic emerges elsewhere, with the extra encryption removed and proceeds as normal. Basically all a VPN provides is a mechanism to pretend that your butt is in a different seat. You hide your traffic from one network and expose it on another.<p>If you are on public wifi somewhere and are concerned about traffic that isn't otherwise encrypted (DNS comes to mind), or if your connection is in some way restricted (govt, shitty isp, etc), then a VPN can address these issues. But you have to keep in mind that your new network is similarly untrustworthy.<p>You might argue that by hiding behind your VPN provider, you are gaining anonymity. This might be true under the best circumstances, but this can _very_ easily break down. For example, the moment you load tracking_pixel.png then you are de-anonymized. That is saying nothing about the shady practices of the VPN providers themselves, or the governments that regulate them.<p>When people connect to a VPN, especially lay-people, there is this feeling that the VPN is providing security, and privacy. This is largely marketing BS designed to sell more subscriptions. When I connect to a VPN I might be able to obscure my activity from state actors, or avoid some coffee shops bogus DNS server. What I can't do with a VPN is avoid literally every other form of tracking. And of course if I connect to a VPN, then I should be ok with those same bad-actors knowing I am connecting to a VPN. And I should be OK with the VPN provider being able to monitor my unencrypted traffic. And I should be ok aggregating all of my encrypted traffic into one easy to watch place.<p>So what is a VPN providing the average consumer? If you want privacy install ad block software, https everywhere, enable DoH, don't log into social media sites, and clear your browser's cache frequently. If you want to avoid a state actor, then your best hope is probably something like Tor Browser.
> over 70% of early Beta-testers say that the VPN helps them feel empowered, safe, and independent<p>Well, <i>does</i> it make people empowered, safe and independent? Never mind what people <i>feel</i> - the users don't know the details of the implementation, so their belief could be mistaken.
Really smart from Mozilla; they leverage trust in their brand with a product for which trust is the most important feature. Making a VPN is a non-trivial technology project, but it's pretty straightforward how to do it well.
This is a hard pass from me.<p>Mozilla controls my browser. I have no interest in giving them control over any other part of my online life.<p>I like how Mozilla is run and hope other organizations emulate them to provide these other essential services.
Since they are using the infrastructure of Mullvad, what's the point of using Mozilla's software instead of using directly Mullvad's ?<p>Price related I'm paying 5€/month for Mullvad and Mozilla's VPN is at $4.99/month so when it will be available in Europe I expect it to be 4.99€.<p>If they where offering something more, I'll see the point, but here by them developping their own software to use someone else infrastructure seems to be a huge waste. If they wanted to put their Mozilla logo, they should have gone for a white-label product with Mullvad no ?
A little late in the game, but they're a brand I would hold in higher regard than 99% of the other providers out there. I believe that a lot of people misunderstand what exactly a VPN is and what scenarios it offers benefits of use in. I personally host my own VPN on a lowendspirit server [1] for when I'm on an untrusted WiFi network or I need to have an IP in the US (it comes in handy as a US citizen living abroad). I also use a VPN sometimes when I have a dev server (hosted on the server itself) that I'm developing/testing on since being on the same network as the server makes things easier, e.g. having a container with an API bound to the VPN network so that I can access it easily and without it being public facing.<p>Of course there's also the shady side of VPN use. If you're doing that it might be beneficial to use the VPN within a VM with strict firewall rules, i.e. only allow incoming/outgoing to/from the VPN. Doing so allows you to only send the traffic you want to over the VPN, thus reducing your exposure to any nefarious data collection that the provider might be doing.<p>[1] <a href="https://lowendspirit.com/" rel="nofollow">https://lowendspirit.com/</a>
I also want to subscribe to Mozilla. For viewing Mozilla as a foundation that does the right thing. Thankful for many of the Internet standards Mozilla helped develop.<p>Please help making Internet decentralized and private again.<p>* Support for paying content creators without advertising
* Decentralized CDN and compute
* fast privacy
Given the high ethical standard of Mozilla I’m not sure how popular this will be.<p>For example, a while back there were research showing nord was setting up users as proxies, there by making it impossible for Netflix to block these residential ips.<p>I don’t think Mozilla will do this.
How do we know this is safe from bad actors? If it's in the U.S. is it safe from discovery? For example Watchtower tried to use 'copyright Infringement' to force reddit to give a usernames IP and account information. <a href="https://m.youtube.com/playlist?list=PLkdgWccrJAy53-jeBxM3Pk_kcwz7Q9NR5" rel="nofollow">https://m.youtube.com/playlist?list=PLkdgWccrJAy53-jeBxM3Pk_...</a><p>VPN's are the only way of protecting what should be protected speech. You have to not keep logs or anything that allows a court to find the identity of a user.
What is the main benefit of using a VPN?<p>I download music, movie, tv, etc files via torrent using my Canadian IP address and I have never seen anything more than an email from my ISP saying essentially "so and so company thinks you downloaded their material, don't do that ok?".<p>Is the general public so afraid of getting the odd email that paying $5/$10 month to make them disappear is a good deal for them?<p>Why wouldn't people just use TOR for free? It was extremely fast the last I checked.
>guided by our Data Privacy Principles //<p>A cunning way of not starting any rules used for the VPN.<p>Then they can say "well we were <i>guided</i> by our policy when we secretly kept all your connection details and gave them to a marketing company".<p>How about being guided by your policies on openness and state precisely and fully how data is used/stored/shared.<p>Isn't privacy the/a principle feature of a VPN?<p>The irony of only being able to sign up from outside the USA of you use a VPN is not lost on me.
I'll live without a VPN as long as it is crazy expensive to find one fast enough to not throttle my connection (so 1gbps) with unlimited data and support for encryption at a level that is okayish secure yet still fast enough to not kill my server or router. I've tried a few that said they could deliver, but none of them could. I have no interest in paying my ISP for bandwidth and then strangle it with a VPN.
<snark>"This is why we built the Firefox Private Network VPN Network which you can use with your Personal PIN Identification Number! Please get some cash out at the Automatic ATM Machine and donate today!"<p>Naming things: one of the truly hard things in computer science... (But come on, you don't have to fail _that_ hard Mozilla, surely?)<p>:sigh:
I don't use a VPN as I'm pretty sure my traffic identifies me once it pops out the other end. But I do tunnel DNS with a server I trust so that my ISP only ends up seeing encrypted traffic (DNS over ssh, and HTTPS). I don't do DoH because there are only a few providers and so those are hotspots for espionage.
Who is the target market for this in the markets it actually operates (US)?<p>The only people I know that uses VPNs do so to download torrents and evade DMCA notices. And in that case it only really works if the VPN provider is itself located outside of US jurisdiction and collects little to no information about you the user.
I love Mozilla and Mullvad, but 5 simultaneous connections just isn't enough for me. I know they can't allow unlimited devices due to the potential for abuse, but is something like 20-30 connections so I can use it for all my devices/VMs isn't too much to ask for?
an alternative is also the <a href="https://librem.one/" rel="nofollow">https://librem.one/</a> services run by Purism. VPN, Email and more. All server and client code is at source.puri.sm and it's mostly only rebranded "standard tools".
After firefox introduced that megabar UI with no option to turn that off, I started considering switching back to chrome. It's very questionable if they still care about their users, and if that's the case, firefox has ZERO advantage over chrome.
Please take notes from Mullvad and give some basic transparency about the data centers and whether the servers are rented or owned and etc. Stuff like that goes a long way for people who are genuinely serious about privacy.
I currently run a wireguard vpn on digital ocean and it works really well.<p>What is the reason for developers to pay for this service when they can set one up in less than 5 minutes and automate the whole thing with user-init scripts.
I would love a VPN that would use a different IP address for each site I visit.<p>Just to prevent the backend IP address correlation between sites that trackers use.<p>Technically I know this is probably impossible without tons of virtual NICs
What good is a VPN if you have to reveal all of your personally identifiable information to the vendor?<p>You're better off using Mullvad directly--it looks like they don't require you to fork over personal information to use their service.<p>Shameless plug: SatoshiVPN (<a href="https://satoshivpn.com" rel="nofollow">https://satoshivpn.com</a>) gives you access to your own private and anonymous VPN server with Outline pre-installed, no questions asked. Payments in Bitcoin only.
It's disheartening that Mozilla is continuing to actively avoid partnering with the Tor project for problems like this, despite the fact that the Tor project has contributed to Firefox for many years (mostly related to fingerprint resistance). I get that Mozilla needs to make money, but the fact that they still haven't made "private browsing mode" actually private by making it use Tor is a real shame.
And there are countries that force users to get their VPNs registered.<p><a href="https://www.pta.gov.pk/en/media-center/single-media/public-notice---get-your-vpn-registered-080620" rel="nofollow">https://www.pta.gov.pk/en/media-center/single-media/public-n...</a>
They should fix their reliance [1] on Python 2 first. They had more than a decade to migrate, but still Python 2 EOL came as a surprise for them.<p>[1] <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1496527" rel="nofollow">https://bugzilla.mozilla.org/show_bug.cgi?id=1496527</a>
I stopped using Firefox when they discontinued RSS support saying “it’s too hard and old and lame! Oh but here’s Pocket (tm) which costs money and has nothing at all to do with cutting RSS support”<p>I wouldn’t expect much different here.
"For example, over 70% of early Beta-testers say that the VPN helps them feel empowered, safe, and independent while being online."<p>What have these "feelings" got to do with anything? This is a measure of successful marketing and has nothing to do with the product or its efficacy.<p>Personally I use Windscribe and I really like it (I've used PIA & Mullvad in the past). I use it for watching US Netflix and to make it <i>slightly</i> less easy to track me on the net (I know there are many other ways). I also like the idea of not having my IP or the gov't spy on me _as easily_.
As a security person, I am somewhat baffled by the popularity of VPNs. I have no idea why anyone would use them for general internet usage, and I suspect the majority of VPN service users are misinformed about what they think they are gaining.<p>Any VPN subscribers want to fill me in? The only thing I can think of is hiding the source of pirated media being shared via bittorrent.
I won't be switching to this. I've been paying €4.99 monthly for Blokada VPN on Android. It's pretty reliable and offers ad blocking as well. Also supports up to 5 devices.
It's a rebranding of Mullvad. I'm happy with Mullvad itself, and while I think Firefox is the most important browser I'm not very happy about Mozilla arguably destroying its brand and seemingly pivoting away from maintaining it. I'd directly pay for the development of FF, but not Mozilla's "btw, we now sell $completely_unrelated_product_without_even_an_ethical_business_model".<p>They seem to be relatively safe from forking though, because apparently the code base is too much of a mess. Yay.