Hacker News

That blog post is a perfect example of when RFC5737 should be used.

https://datatracker.ietf.org/doc/rfc5737/

The post you preferred was submitted before. And had not much new information. The rollout was the news. The link was correct.

The page already contains link to both of these resources

No it doesn't affect people using the proxies. You can even see it in the demo, which I really don't understand how it knows that you are using wireguard vs a proxy.

When I use a proxy it says like 99% of mullvad users,and when I use wireguard it's between 0.5 and 5%.

(https://tmctmt.github.io/mullvad-seed-estimator/)

When you have tens of thousands, or hundreds of thousands of employees, your organisational culture and policies inevitably change to limit the impact -- good or bad -- of one individual or a small team.

This is just how things work when there’s much less overhead. Which is typically the case for smaller companies.

The Mullbad Browser? https://mullvad.net/en/browser

This is already what LibreWolf does for most of its fingerprinting protection, including resolution, which you call out. It already works, LibreWolf is the only browser besides Tor I’ve found that actually defeated fingerprinters in some of my testing. Is there something that’s currently randomized that you think should be binned or homogenous?

Original source: https://news.ycombinator.com/item?id=48143880

You can probably also use it on regular Firefox.

It's not going to be an issue for most things which have been properly thought out as they will have proper isolation between servers which should have separate identities. Reusing the same VPN for all servers and relying on an eventual expiry before the IP changes is fundamentally not a great approach to rely on for isolation.

Which you absolutely shouldn't use, because just like Tor Browser before, a vulnerability in the browser can be immediately escalated into decloaking your real IP. Ideally the proxying doesn't even happen on the same machine.

It's very common for people to switch networks many times a day anyway so it's not obviously a VPN user - even when switching countries to some extent.

What makes it a waste of time? A reputable VPN provider that offers a pretty reliable service and has every indication of having a competent security team is worth something in itself; not everyone using Mulled wants to set up / debug potentially complicated systems either.

They do have Shadowsocks

https://mullvad.net/en/help/connecting-to-mullvad-vpn-from-r...

They've worked quite a bit the past year or two on censorship breaking. But I guess there's always more to be done in a cat and mouse game

No, not usually. Few ISPs are willing to risk blacklisting.

Just like scrapers (and a lot of VPNs are quietly using their custom VPN clients to sell your own IP [and data] to scrapers) it's mostly a "don't ask don't tell" situation for IP sourcing. You use a multitude of IP providers and if a scandal happens you just say "We didn't know!" and move on to the next. Almost always grey-market, very rarely through legitimate providers.

Mullvad in particular has a page that lists the ISPs they use (in a few cases their own servers at a datacenter), although they don't list the datacenters (sometimes you can get this info from the ISPs).

https://mullvad.net/en/servers

They also have a document that lists some of their practices around the servers, such as not using shared servers:

https://mullvad.net/en/help/server-list

I noticed that the website of one of the two providers they use near me was over a decade out of date :/. DAITA is Mullvad's anti-traffic analysis framework, without it a single hop can likely be easily deanonymized by logging by a single party (it isn't clear if multihop uses fixed packet sizes between their servers).

Some VPN providers don't even have exit nodes in the country they're claiming. Instead they'll have their IPs registered to the respective countries in GeoIP databases.

This isn't a practice all VPN providers partake in. And from my own anecdotal experiences, Mullvad seem to be using services that are geo-located (I say this because I've tested latency between different endpoints in Mullvad). But it is something to be wary of with some of the less reputable providers.

Not retail ISPs, but many extensions and free VPNs route VPN traffic through the connections of those who use them.

it is a direct response to this disclosure: https://tmctmt.com/posts/mullvad-exit-ips-as-a-fingerprintin... and nothing to do with american politics