> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.
> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.
How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.
They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?
Proton becomes increasingly pricier every year. It provides lot of servers but they are not owned by proton, those are residential proxies. Many of the names listed are discussed in forums having questionable privacy.
But good thing with proton is, you are bound to find a server which can open a specific website. I routinely find myself getting blocked by reddit or internet archive, unlimited google captachs, YouTube needing sign in, but there is always a server which can unblock this. However, if you check the isp for it, it lists some residential proxy.
Their desktop client is bloated, takes a lot of time to load, their vpn connections randomly disconnect or slow down.
When I got frustrated with their pricing and their vpn client, I switched to mullvad.
Sign up was really simple. Since they only charge a constant price, their onboarding experience felt smooth.
Their desktop client is small enough, it starts quickly.
But issues with mullvad surfaces during use. Many websites are blocked. I haven’t found a server which can open reddit. YouTube always need sign in. Only few servers open internet archive. Some servers even get blocked by HN.
Speed is extremely slow than proton. Their were no disconnects or reconnects, but I just couldn’t open websites which I frequently visit.
In the end, I went back to proton, I needed to browse the internet without getting blocked. Rest of the cons I grudgingly manage.
This article is good enough as a cursory read to know which vpn to begin exploring, but provides no information of the authors own experience.
For eg, mullvad has resellers, if you purchase from their, you can compromise your privacy completely. I don’t know why mullvad has this arrangement, considering their promise.
Also mullvad website has a dns leak check, which will always show dns leaking if you are not connected to mullvad. But if you check literally any other dns leak website, even their competitors like nord or surfshark, it gives a “not leaking” response. This is scummy behaviour from mullvad.
Only if you connect with mullvad, their status shows green.
Similarly, In the article about proton, there is no mention about proton using affiliates or resellers. Neither any mention about proton controlled servers.
Comparison page which has disconnected information , is not useful.
Perhaps the author can do better by actually using VPN’s, navigating their website, policies, vpn clients, than depending on Claude to do the writing. Otherwise, there is little value in such articles.
Mullvad page lists amazon and some electronic retailers as their resellers. Amazon needs your email and phone. It also holds your address. This automatically identifies you, leaving a papertrail.
Almost every non-cash payment leaves a paper trail. How does this compromise my VPN privacy? How does this relate to their resellers?
Let's say you know that I bought a Mullvad voucher, from first-party or third-party store. What would be your next steps you would take to get to know me?
A good selection of resellers is important because it allows users to choose where to put their trust. For example:
If you buy from the Mullvad reseller proxystore.de in Germany, you can go there in person and pay with cash. It's a real place.
Without such resellers, the only other way to pay Mullvad with cash is to mail an envelope to them.
Do you believe that every VPN service paid without cash (or maybe Monero et al) is inherently compromised? That would follow from your argument, right?
Upto you how much you want to disclose. If I purchase directly from mullvad, only mullvad and my bank knows. If I purchase from amazon or other online retailers, now even amazon knows. God knows what they do with it.
Hmm, no. I think your worry requires a proper, explicit threat model.
It is also not "even Amazon" knowing about the sale. When you buy from a reseller using a non-cash payment method, you shift the link to your identity from Mullvad to the reseller. You are compartmentalizing the transaction to isolate the payment flow from the account registration. To stick with your example: If you buy from Amazon, you remove that payment information from Mullvad and add it to Amazon, a generic mass market online shop.
The reseller does not know if you will activate the voucher, and if you do, they don't know if you will activate it yourself or give it to someone else. Mullvad does not know the ID that might have been used to buy the voucher.
Having niche as well as mainstream resellers is also a good thing: Many users buy from Amazon all the time. For those people, being able to use Amazon means they do not have to add payment details to another store, which might result in an unusual payment compared to their usual purchasing behavior. For users not wanting to use Amazon, there is no harm in ignoring this specific reseller on Amazon.
I go by what I see. My purchase is only known to mullvad/proton and bank. Nobody else. If you are comfortable in announcing your intention to purchase a vpn to a third party which does not have the same privacy policy as mullvad, you do you.
No worries! I did not try to convince you of anything.
In your initial comment, you wrote:
> I don’t know why mullvad has this [reseller] arrangement, considering their promise.
We have now (briefly) talked about threat modeling, compartmentalization, linkability/observability, obfuscation, as well as having user choice regarding the shop.
So now you know why Mullvad has this reseller arrangements, considering their promise.
You disregard privacy policy of organizations you deal with. You have no audit reports of amazon or any other retailer to know what they do with your private and purchase information. Since you don’t have that, you are only hypothesising that 3rd party platforms will keep you safe.
Therefore, arrangement between mullvad and their resellers are questionable.
I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
I wonder how the deals page ( /deals/black-friday-vpn ) is ordered. It's not by price, name, offer scope or discount relative to the standard price. Is it by referral margin?
> I checked the ones it flagged as uncertain by hand
I think it is fine to use LLMs. But only checking results or sources in cases where AI flagged them would feel like a major methodological oversight.
Going through mullvad's audit report,
> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.
> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.
How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.
They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?
[flagged]
I have used proton and mullvad.
Proton becomes increasingly pricier every year. It provides lot of servers but they are not owned by proton, those are residential proxies. Many of the names listed are discussed in forums having questionable privacy.
But good thing with proton is, you are bound to find a server which can open a specific website. I routinely find myself getting blocked by reddit or internet archive, unlimited google captachs, YouTube needing sign in, but there is always a server which can unblock this. However, if you check the isp for it, it lists some residential proxy.
Their desktop client is bloated, takes a lot of time to load, their vpn connections randomly disconnect or slow down.
When I got frustrated with their pricing and their vpn client, I switched to mullvad.
Sign up was really simple. Since they only charge a constant price, their onboarding experience felt smooth.
Their desktop client is small enough, it starts quickly.
But issues with mullvad surfaces during use. Many websites are blocked. I haven’t found a server which can open reddit. YouTube always need sign in. Only few servers open internet archive. Some servers even get blocked by HN.
Speed is extremely slow than proton. Their were no disconnects or reconnects, but I just couldn’t open websites which I frequently visit.
In the end, I went back to proton, I needed to browse the internet without getting blocked. Rest of the cons I grudgingly manage.
This article is good enough as a cursory read to know which vpn to begin exploring, but provides no information of the authors own experience.
For eg, mullvad has resellers, if you purchase from their, you can compromise your privacy completely. I don’t know why mullvad has this arrangement, considering their promise.
Also mullvad website has a dns leak check, which will always show dns leaking if you are not connected to mullvad. But if you check literally any other dns leak website, even their competitors like nord or surfshark, it gives a “not leaking” response. This is scummy behaviour from mullvad.
Only if you connect with mullvad, their status shows green.
Similarly, In the article about proton, there is no mention about proton using affiliates or resellers. Neither any mention about proton controlled servers.
Comparison page which has disconnected information , is not useful.
Perhaps the author can do better by actually using VPN’s, navigating their website, policies, vpn clients, than depending on Claude to do the writing. Otherwise, there is little value in such articles.
> if you purchase from their [resellers], you can compromise your privacy completely
Genuine interest: Why? I bought one of their vouchers in the past. How did I compromise my privacy?
Mullvad page lists amazon and some electronic retailers as their resellers. Amazon needs your email and phone. It also holds your address. This automatically identifies you, leaving a papertrail.
Almost every non-cash payment leaves a paper trail. How does this compromise my VPN privacy? How does this relate to their resellers?
Let's say you know that I bought a Mullvad voucher, from first-party or third-party store. What would be your next steps you would take to get to know me?
A good selection of resellers is important because it allows users to choose where to put their trust. For example:
If you buy from the Mullvad reseller proxystore.de in Germany, you can go there in person and pay with cash. It's a real place.
Without such resellers, the only other way to pay Mullvad with cash is to mail an envelope to them.
Do you believe that every VPN service paid without cash (or maybe Monero et al) is inherently compromised? That would follow from your argument, right?
Upto you how much you want to disclose. If I purchase directly from mullvad, only mullvad and my bank knows. If I purchase from amazon or other online retailers, now even amazon knows. God knows what they do with it.
Hmm, no. I think your worry requires a proper, explicit threat model.
It is also not "even Amazon" knowing about the sale. When you buy from a reseller using a non-cash payment method, you shift the link to your identity from Mullvad to the reseller. You are compartmentalizing the transaction to isolate the payment flow from the account registration. To stick with your example: If you buy from Amazon, you remove that payment information from Mullvad and add it to Amazon, a generic mass market online shop.
The reseller does not know if you will activate the voucher, and if you do, they don't know if you will activate it yourself or give it to someone else. Mullvad does not know the ID that might have been used to buy the voucher.
Having niche as well as mainstream resellers is also a good thing: Many users buy from Amazon all the time. For those people, being able to use Amazon means they do not have to add payment details to another store, which might result in an unusual payment compared to their usual purchasing behavior. For users not wanting to use Amazon, there is no harm in ignoring this specific reseller on Amazon.
Having the ability to use resellers adds privacy.
I go by what I see. My purchase is only known to mullvad/proton and bank. Nobody else. If you are comfortable in announcing your intention to purchase a vpn to a third party which does not have the same privacy policy as mullvad, you do you.
No worries! I did not try to convince you of anything.
In your initial comment, you wrote:
> I don’t know why mullvad has this [reseller] arrangement, considering their promise.
We have now (briefly) talked about threat modeling, compartmentalization, linkability/observability, obfuscation, as well as having user choice regarding the shop.
So now you know why Mullvad has this reseller arrangements, considering their promise.
No, you have only convinced yourself.
You disregard privacy policy of organizations you deal with. You have no audit reports of amazon or any other retailer to know what they do with your private and purchase information. Since you don’t have that, you are only hypothesising that 3rd party platforms will keep you safe.
Therefore, arrangement between mullvad and their resellers are questionable.
Like I said, you do you.
I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
I wonder how the deals page ( /deals/black-friday-vpn ) is ordered. It's not by price, name, offer scope or discount relative to the standard price. Is it by referral margin?
> I checked the ones it flagged as uncertain by hand
I think it is fine to use LLMs. But only checking results or sources in cases where AI flagged them would feel like a major methodological oversight.
[flagged]