I've joined several popular VPN services this year in my work on VPN Wire, and Mullvad's signup flow was by far the most enjoyable. Not only because there's no email required (a little disorienting, but very refreshing), but also because, unlike the experience on many of your competitors' sites, I didn't feel pressured to buy/commit every step of the way. User-friendly site design, in other words, is a positive signal.
I personally regard audits and pentests as strong positive signals. For example, PwC's audit of NordVPN's no logs policy was a positive for me. As someone in the industry, I'm curious if you feel the same.
Open source software and public APIs are very nice to see.
> What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart?
Other than audits, I don't have a good answer to this one. I would love to hear some technical solutions, and hope other people reply!
And as an aside, kudos on running a very speedy network :) https://vpnwire.co
Audits are good and definitely have a place. There’s much more that can be done. I agree open source is also an important one.
We’ve tried to identify strong signals of trustworthiness together with a few other services here: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns...
A technical solution Mullvad is working on is something we call System Transparency. You can read more about that here: https://mullvad.net/blog/2019/6/3/system-transparency-future...
What is the deal with Mullvad and Firefox? Are they completely using your services but with their name on it? Would you rather a client directly or through Firefox (bit cheaper now in $ )?
To quote https://fpn.firefox.com/vpn - “The VPN is built by Firefox and runs on a global network of servers powered by our partner Mullvad using the WireGuard® protocol.“
Regarding using us directly or through Mozilla, I think both are good options. If you pay directly to us we will put your money to good use. Same goes for Mozilla. And they are not mutually exclusive. You could also sign up directly with us AND set up a monthly donation to Mozilla for Firefox development :)
Reason for TunnelBear: independent audit. They had had an audit that went through their system and, at least how I understood it, confirmed what they had said they were doing.
Reason for PIA: they had a history of being questioned by authorities and providing nothing - because they had nothing.
The latter is why I continue to trust Apple more than Google, too.
Perhaps the users should pay for an audit as in "Check this one for us!"
Question is, how that could be organized. I guess the user community would have to unite for it andthe VPN provider would need to declare ahead of time, that they are fine with being audited by an independent party, paid by the customers.
Please tell me - What makes a VPN provider trustworthy, and how do you _know_?
Personally I believe a trustworthy provider is _characterized_ by consistent actions that show transparency, honesty, and conscientiousness. Nevertheless, such consistent action doesn’t actually prove trustworthiness.
A good VPN honeypot, or reseller of your network traffic, is publicly indistinguishable from a trustworthy one. So what can the users do? What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? What do we need to build?
We all recognize that VPN providers are in a great position of power over their users. How do we tilt the scales in the users’ favor? What are _strong_ signals of trustworthiness?
Disclosure: I co-founded Mullvad.