Mozilla VPN Completes Independent Security Audit by Cure53

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by sneak on Wednesday September 01, 2021 @02:26PM (#28383762)

Yes, because a VPN is a service and you can only meaningfully audit software itself. Any service audit is meaningless one second later as the operator of the service can change it to serve their purposes.

People all too frequently confuse software and services. They aren't the same. This is a software audit, and the thing that needs trust is the service.

[ Parent | on HN ]

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by commoner on Wednesday September 01, 2021 @02:36PM (#28383897)

Mozilla VPN uses the Mullvad VPN service for most of its backend, and Mullvad had Cure53 complete an audit of its infrastructure last December:

https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...

[ Parent | on HN ]

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by sneak on Wednesday September 01, 2021 @03:01PM (#28384198)

As I mentioned, this is irrelevant one second after it's published.

[ Parent | on HN ]

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by dylan604 on Wednesday September 01, 2021 @03:48PM (#28384745)

If they tie a hash of the software to the report, then you can verify the software is the same.

Not sure how to handle updates later though. What level of udpates would require an entirely new audit?

[ Parent | on HN ]

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by m4rtink on Wednesday September 01, 2021 @04:14PM (#28385014)

But how do you verify the backend code and infrastructure?

Thats the most important question for a VPN.

[ Parent | on HN ]

Re:Mozilla VPN Completes Independent Security Audit by Cure53 by sneak on Wednesday September 01, 2021 @04:34PM (#28385216)

The audit commoner is referring to is of their backend infrastructure, not their published software.

[ Parent | on HN ]