Review of Mullvad VPN
A new independent security audit of Mullvad’s VPN client app found several manageable issues—from unsafe signal handling to potential deanonymization via NAT and MTU quirks—which Mullvad has reportedly addressed, reinforcing its reputation among privacy‑focused users. Commenters contrast the value of app and infrastructure audits, emphasize the importance of explicit threat models, and debate how much privacy commercial VPNs really provide given constraints like captchas, removed features such as port forwarding and OpenVPN support, and varying payment/anonymity options.
Scope of the Audit
- Audit covers the Mullvad VPN app/client, not the whole VPN service or server infrastructure.
- Some note this makes the original title misleading, but still relevant since the app is the main entrypoint for users.
- Separate infrastructure audits (by other firms) were done earlier in the year.
Key Findings in the Report
- Issues found include: unsafe signal handling (too-small alt stack, non–async-safe functions), IP leaks via ARP, deanonymization via NAT/MTU behaviors, and a sideloading risk in the setup process.
- Commenters view these as “straightforward” and mostly low-to-moderate risk, with sideloading called the most concerning but not standalone-exploitable.
- Deanonymization vectors are said to apply broadly to VPNs, not just Mullvad.
Deep Dive: Signal Handling
- Large subthread debates how hard it is to write correct POSIX signal handlers.
- Points raised:
- Signal handlers can interrupt code in critical sections; they must not wait on locks or shared resources.
- Very small set of async-signal-safe operations is allowed.
- Languages/runtimes (C, Rust, Haskell, etc.) struggle to provide safe abstractions; ideas like function “coloring”, monads, or dedicated signal threads are discussed.
- Consensus: safe signal handling is extremely tricky; Mullvad’s issues here are understandable but real.
Threat Models and Value of Audits
- Several comments praise this report for explicitly stating its threat model.
- Debate over whether customer-defined scope weakens audits; counterargument is that every audit must target a defined model and constraints of time/budget.
- Users are encouraged to compare their own threat model (e.g., unprivileged local attacker vs. admin/nation-state) to the one used in the audit.
Mullvad’s Reputation and Business Model
- Many express strong trust in Mullvad relative to other VPNs: no-logs policy, multiple public audits, RAM-only infrastructure, simple flat pricing, and anonymous payment options (cash, crypto, Monero).
- Others worry about the general VPN industry’s marketing and snake-oil tendencies, but often exempt Mullvad as “one of the better ones.”
Usage, Limitations, and Ecosystem Issues
- Practical complaints:
- Removal of port forwarding significantly hurts torrenting and private tracker seeding.
- Planned deprecation of OpenVPN pushes some to consider other providers.
- Mullvad endpoints often hit CAPTCHAs or blocks (especially on YouTube/Reddit), possibly because of known hosting ASNs and anti-tracking incentives.
- VPNs seen as most valuable for ISP privacy and censorship circumvention; some argue they are over-marketed for broad “anonymity.”