I also like that they let you download the raw wireguard config files so that you can connect without having to use their client. You can just plop them onto your filesystem and use wg-quick to get going.

Since I'm also a ProtonMail user and I considered switching to them for VPN as well but their python client doesn't seem to work correctly on my Arch Linux install and it doesn't give me anything useful to debug it beyond "An unknown error has occured" so I couldn't be bothered to investigate beyond that.

I think you can also get the raw wireguard config files for ProtonVPN: https://protonvpn.com/support/wireguard-configurations/

i just set it up to try it out (on macOS): created a free config on the proton dashboard, downloaded it, stuck it in the wireguard client, and it worked (without downloading their vpn client app). make sure your firewall isn't blocking the traffic though (something that caught me at first).

I did not know that! Thanks a lot. I'll definitely give it another try.

Be aware, at least Nord clearly does something different with their client than with the OpenVPN files they provide ( https://news.ycombinator.com/item?id=21664692 ). When I dug into this, I found similar cases with other major VPN providers, but my notes are sufficiently out of date, they shouldn't be trusted anymore.

Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.

What cloud do you use? A lot of websites will flag any AWS or data center IP as a bot.

So, I do have two VPN servers running, one on my home connection, and one on AWS, for just the reason you state.

That said, I got back from a week long trip a few weeks ago. I kept my AWS tunnel up the entire trip. For the set of websites I visit for personal and work reasons, it was never an issue. I'm sure I could find some website that doesn't work, but for me, it's just not a problem.

It's also super useful, since I can whitelist my AWS instance's IP on services that demand such things, and never have to worry about where I am as I move from network to network. I've also reserved the Elastic IP so I can stop/terminate my server when I want without needing to whitelist the IP again when I spin it back up

I use whatbox.ca as my global/universal VPN. So far I haven’t seen any issues. It works in places where most VPNs are banned or heavily throttled (like Saudi/Abu Dhabi/Qatar, my workplace, AT&T cellular data, etc)

Isn't whatbox.ca mainly aimed at hosting seedboxes? They are accordingly higher priced than a VPN. Whats the rationale for using them as a VPN ?

1) It’s the only VPN that worked in areas where they work hard to block most VPNs

2) it’s still not very expensive

3) it’s absurdly fast for a “VPN”! Like 400Mbit symmetric.

4) I also use it as a seedbox. Speaking of…does anyone have an invitation a private tracker to replace what.cd because I miss that. Or a no/low compression movie tracker.

Thankfully I never encountered that as an issue with e.g. Amazon Workspaces.

> ( https://news.ycombinator.com/item?id=21664692 )

Is there any proof of this? It seems like the original author was wrong and deleted the article.

I have no idea how right the author was about how Nord got ahold of the residential IPs. I was able to recreate the technical results, and noted at the time that the OpenVPN connection to the same Nord endpoint behaved differently (and, indeed, Disney+ blocked it).

Of course, that was a while ago .. long enough I assume my notes no longer reflect the current state of things. It'd be interesting to try and recreate it with the latest stuff, but all of my VPN providers accounts have lapsed by this point.

"The author deleted this Medium story."

Been using protonmail on arch for years, you have to setup the configs a tad more manually and do some editing (I forget now); definitely doable and protonmail lets you download the configs (which work out of the box depending what you use).

I've read some articles online, but I still haven't managed to understand the hype around wireguard. It's lighter than OpenVPN, but has more obscure primitives? Doesn't seem like a great trade off...

Wireguard is your plumbing layer. OpenVPN is an entire application stack. Wireguard is super simple because it's low level. If you wanted to compare something (as a user in terms of feature parity, etc.) to OpenVPN a more accurate comparison would probably be nebula or tailscale (private/mesh network management tools that are built atop wireguard). I'm a wireguard fan and it's true that its crypto is much simpler, smaller, and harder to fuck up than OpenVPN but that is really only something that matters to the security hats.

How is openvpn easy to fuck up? I just run sudo openvpn file, and that's it...

Also, I didn't really understand any of your explanation about layers. How is openvpn an application stack? Surely applications are the applications?

Wireguard is a water pipe, whereas OpenVPN is a water pipe connected to a water bottling factory connected to a bottled water shipping port.

> How is openvpn easy to fuck up? I just run sudo openvpn file, and that's it...

The configuration is what is easy to fuck up, not the command to run it

It is also much faster and allows p2p networks

What does "allow p2p networks" mean exactly?

It's not hub and spoke. Any existing network topology can be mirrored essentially 1:1 with wireguard. With hub and spoke VPNs the model constrains your deployment somewhat. Now I'm not saying key distribution with wireguard is easy, that's a different problem. But wireguard is literally like "let's take your existing network interface and give it modern fast impossible to fuck up encryption".

I have no idea what you just said.

Can you dumb it down maybe?

Traditionally you have a server and all clients connect to this server (Hub and spoke). Wireguard can connect clients like you would in your network. You can mesh clients if you like. The hard part is getting the keys to all peers in the network.

Mullvad has been tremendous and the ease of use is terrific. I use a VPN relatively infrequently, sometimes going months without turning it on, so the one-time payments have been wonderful. The app is simple to use, and it's so, so easy to reactivate for a month when I need it.

I can't speak to their privacy as my VPN usecase is usually just "I need an IP in another region," but to the best of my understanding they are one of if not the best in the business.

As an additional data point, I've been using Mullvad as a long-running VPN for a while now (hint: Linux ISOs) and it has been working like a charm.

You can also utilise port forwarding with mullvad (bound to specific key and location) to make distributing "Linux ISOs" faster.

You can also easily pay with better anonymity with the Strike app, https://strike.me, which abstracts bitcoin mainnet and lightning network payments behind USD, so you don't have to worry about actually holding bitcoin or managing tax implications. You just use bitcoin as a globally agnostic payment rail, masked with your local fiat, so the price volatility doesn't affect you.

Mullvad even gives you a 10% discount for bitcoin, bitcoin cash, and monero payments.

I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement for reduced transaction fees given the low value of transactions they deal with, as well as instant confirmation rather than 6 block (~1 hour) confirmations. You could even theoretically stream nanopayments for each minute of use with lightning, rather than pay for a whole month.

"Global payments for the internet"

I was intrigued...

Then

"currently the Strike app is only available in the United States*, El Salvador, and Argentina"

It's the "World" Series of Internet payments.

I also dismiss a project when it's still nascent. /s

Also, "Global payments for the internet" is really referring to bitcoin, not strike.

Strike isn't doing the magic here. It's just one of many possible APIs that can be built on top of bitcoin and the bitcoin lightning network. If you integrate with Strike with your company, anyone else on the planet with any other kind of bitcoin wallet can pay you.

Okay, however I have yet to see any crypto project that even comes close to solving borderless money transfers, although a lot of them claim to.

This is unfortunate as that market is ripe for disruption

You can literally just mail them cash if you want absolute anonymity.

Even with that though you'd still have to worry about them identifying you by your IP address. Are there any other VPN providers which support anonymous payments? It occurs to me that you could get some pretty decent anonymity by stringing two or three independent VPNs together, Tor-style, while avoiding many of the performance issues associated with Tor.

Careful! I used BTC and the processing time was absurdly long.

From my comment...

> I am a bit disappointed that they haven't yet integrated bitcoin lightning network. That would be a huge improvement ... as well as instant confirmation rather than 6 block (~1 hour) confirmations.

This is a known problem with blockchains and why naive projects like bitcoin cash that try to just pump up the layer one transaction volume for everyday merchant payments are doomed solutions.

The bitcoin lightning network payment experience is instant and magical, and constantly getting better.

What is "absurdly long" mean here? They say it can take up to 30 min, I didn't time it but I reupped for 1 year twice and it was right at or under 30min both times.

It depends on current network conditions.

If the bitcoin network is currently congested, your transaction can potentially take hours before it's included in a block. Mullvad would wait at least until this point.

I just paid using Bitcoin Cash (BCH), low fees and simple to integrate ;)

The UX of BCH beats BTC and ETH by very far.

Cool story.

Doesn't scale.

Layer up.

Bitcoin Cash does currently scale up to Paypal's daily number of transactions while keeping transaction fees below $0.01. [0]

Scalability tests are underway [1] to detect bottlenecks for increasing the block size further, which should take it closer to Visa's transaction capacity.

The scalability roadmap aims for eventually supporting 50 daily transactions for each human in the planet, again keeping fees low, which is key for Bitcoin to be used as cash. Check out [2] if you want to read about the technical feasibility of this (even with today's hardware, it will be even easier in the future).

I understand the skepticism about the ability to scale Bitcoin after the Bitcoin Core team has been pushing for years for keeping block sizes low, but please let's consider facts rationally and maintain a civil discussion.

[0] https://news.bitcoin.com/bitcoin-cash-stress-test-goes-beyon...

[1] https://bitcoincashresearch.org/t/assessing-the-scaling-perf...

[2] https://blog.vermorel.com/journal/2017/12/17/terabyte-blocks...

> Bitcoin Cash does currently scale up to Paypal's daily number of transactions while keeping transaction fees below $0.01.

On this here website there was a talk a couple months ago that led me to believe that paying $150 worth of bitcoin costs ... $150 if you want it done at credit card speed. Have things changed?

Without any other information I must suppose you are talking about Bitcoin (BTC), which has limited scalability and therefore high transaction fees when there is high demand. Bitcoin Cash BCH has low fees, below $0.01 as I mentioned.

You can see a graph of historic average transaction fees at https://bitinfocharts.com/comparison/transactionfees-btc-bch...

Credit cards take days to complete the transaction. Much like BTC, there are near-instant checks to make sure the desired transaction _will eventually and most likely_ be valid.

But that's not the user experience.

I signed up to Mullvad - my first VPN - literally about 12 hours ago, purely because of how simple, yet comprehensively-explained, their 'onboarding' process was.

I also particularly like the flat no-fuss EUR5 a month fee.

I can wholeheartedly recommend them after using their service the past few months. They offer Linux configs with wireguard (a sore point with other VPN providers, who tend to either not support Linux at all or only offer openvpn), their Android App has worked flawless and it's just 5E/month.

Yes and they even make double hopping easy. Many other VPNs don't like this, presumably because they have to eat 3 times the traffic.

> Hadn't heard of Mullvad before reading this

Just the only vpn with any integrity left remaining, no biggie.

Your blanket statement isn't true. OVPN for instance has gone to court to protect its data: https://www.ovpn.com/en/blog/ovpn-wins-court-order

They are a very good alternative among others.

Been a customer since they went to court for TPB and I read about their legal fee insurance and the lot. Too bad both are Swedish (I'm Swedish).

But yeah, I'd say Mullvad and OVPN has proven themselves over the years, met a mullvad employee in IRC discussing wireguard when it was still an earlybird, they're a good team.

Absolutely no way to know they are good and other is bad. The entire VPN industry is “trust us bro”. Which works until it doesn’t.

Would a 3rd party audit work?

https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...

That’s very good. But what do I know about “Cure53” other than they are saying “Yea, trust them bro”.

Is Cure53 incorruptible? Would there be any blip in the world if they were not and Mull was really an NSA op?

I’m not saying I don’t trust Mull over say, Nord. I am saying the nature of the whole thing is non-falsifiable with our existing technologies. We can only determine who was lying by looking back after an incident, and most are kept secret.

So far their track record seems good enough. I mean if you have NSA on your threat model you'll have to take this into account... But most don't.

cure53 has an impeccable reputation and delivered some of the best security analysis there is.

Most of them are also public and on github.

https://github.com/cure53/Publications

audits are only valid for that one instant in time when it was performed. anything could have changed after the fact.

You could say the same about all auditing. A restaurant could have changed its food hygiene standards since it was audited. But a company with a history of periodic and successful audits is certainly a good trust marker for me.

Restaurants routinely can't uphold their standards and often get wildly different results on every inspection. But yes I do say the same about all audits.

That is the entire tech industry. No audits, no repercussions for screw ups.

Why do the other popular VPNs not have any integrity left?

A lot of them have been gobbled up by Kape or otherwise proven to keep logs/data when they claim they don't https://restoreprivacy.com/kape-technologies-owns-expressvpn...

Oh man I thought Private Internet Access was still one of the independent VPNs. I feel duped. :/

PIA before the Kape acquisition was owned by parent company London Trust Media. The owner is Andrew Lee, who was best buddies with Mark Karpeles responsible for the MtGox collapse and defrauding all the users of the exchange. Unfortunately the Japanese government let him out of jail and Andrew Lee decided to make his old friend the CTO of the company. Andrew Lee is also the guy behind the shady "sale" of the nonprofit Freenode that caused everyone to jump ship to LiberaChat.

I feel like it's probably more trustworthy under Kape than a CEO and CTO surrounded by a long history of lies, fraud, and general scumbag behavior.

Wait, Andrew Lee, despoiler of Freenode, also associated with the MtGox guy?! The weirder bits of the internet are apparently extremely incestuous.

Birds of a feather and all that.

https://www.privateinternetaccess.com/blog/why-i-hired-mt-go...

That's the same rasengan you'll occasionally see on HN.

PIA continues to prove in court over and over again that they do not keep traffic logs. The extreme fear mongering over Kape has never been backed up by any evidence other than "they used to do bad things under their previous management." As I always say in these threads, all the people who shill Mullvad over everything probably just use them for web-browsing or adjacent activities, and not anything that requires a specialty product like p2p or bypassing national firewalls.

>all the people who shill Mullvad over everything probably just use them for web-browsing or adjacent activities, and not anything that requires a specialty product like p2p or bypassing national firewalls.

On the contrary. Mullvad gives you more flexibility than PIA in that regard and doesn't limit you to whatever features are built into the client like PIA does. You can build tunnels to whatever endpoint in whichever country you want. You can associate multiple ports to your tunnel or separate tunnels for inbound connections. It's very convenient if you want a P2P tunnel where you can get a wireguard interface on the client and then configure your P2P application to only use that tunnel so that there's no chance of leaks (Up to you if you want to also configure the P2P service to use DNS over the VPN or just the system resolver if you don't care) and you don't have to tunnel everything over the same VPN. You can have multiple interfaces going to different applications if you wanted. You have the flexibility to configure your client in whatever way you want without having to deal with proprietary endpoints to request a temporary forwarded port for the connection like what PIA makes you use.

I used to use PIA before the owner hired con artist Mark Karpeles as the CTO and jumped ship when that happened. Even though I only picked Mullvad because it was recommended on HN and wasn't PIA, I much prefer it from a technical standpoint. If I knew how much better it was originally I never would have went for the cheaper more popular option of PIA. People shilling Mullvad are probably doing so because it has many technical advantages over traditional VPNs used by more casual customers. Mullvad also supports bridge servers for shadowsocks. I've never had an opportunity to test it but I'd expect Mullvad to be more reliable in China than PIA.

PIA is cheap, and they don't seem to keep traffic logs. That's basically all they have going for them.

Where can I learn more about this p2p thing?

Anecdotally PIA performance seemed to drop around then, port forwarding was frequently broken and Wireguard wasn't making much progress (looks like maybe they've finally rolled it out now)

Maybe things were already bad before Kape but it was around the same time

They got bought sometime last year. I was a very happy customer until that announcement.

and then freenode had a hard fork! weird week.

That's two of us. I used NordVPN for years. Not any more.

Seems more like a reaction to inflation.

What about ovpn.com?

AirVPN seems to be quite good, and ethical.

I've been using AirVPN for many years now and is has always been reliable and fast for me. Recently they introduced Wireguard support.

Reliable and fast has nothing to do with integrity and anyone can build such a service.

How about ivpn or perfect privacy?

Perfect-Privacy still has integrity left.

Someone hacked into their Malmoe server a year ago or so, and found that they indeed run everything in RAM disks and aren't logging at all. Happened via the management interface. But please take this information with a grain of salt, as the write up for this exploitation has been vanished from the internet (or I am just unable to find it). *

However, there are still articles about how they've been raided multiple times [1][2][3] in the past, and the police never found any logs.

[1] https://lists.torproject.org/pipermail/tor-talk/2010-August/...

[2] https://torrentfreak.com/police-seize-two-perfect-privacy-vp...

[3] https://www.ip-insider.de/hausdurchsuchung-bei-erfurter-vpn-...

* Also, I believe that this kind of pwnage could've happened to every VPN provider. Always use VPN chains with multiple locations and always keep in mind that your VPN could have been compromised. Don't just rely on a single hoster which just shifts the liability from your ISP to another single point of failure. But this is probably still better than LE just having to call comcast. :)

Edit: ovpn.to is probably worth taking a look too. I remember that the admin grows cannabis in his basement (still illegal in Germany) and provides all users with access to warez via Usenet NNTP. Do with that info what you want.

> Someone hacked into their Malmoe server a year ago or so, and found that they indeed run everything in RAM disks and aren't logging at all

Hypothetically, without breaking into the network control plane, the hacker could have completely missed the existence of port mirror to a second read-only system that does logging for lawful intercepts.

Protonvpn?

That's just mullvad with a different name

I believe that would be Firefox/Mozilla VPN

Yeah you're right, I'm sorry. I got those mixed up.

I've been a mullvad user for the past couple of years. I only occasionally use them for privacy on open wifi networks or whatever, but the experience so far has generally been excellent. I initially used the official Wireguard iOS app to connect, but their iOS native app is freaking excellent. WAY more reliable and user friendly than the others I've used— ExpressVPN and some other. It's been quite some time since I used the other ones, however, and they may have equally good branded clients by now.

Mullvard is behind the mozilla vpn. They're crazy good about privacy. You can mail them cash with account info and they'll set you up.

https://www.ivpn.net/ also generates a random userid and also accepts cash in the mail (only for large purchases unfortunately). I wasn't able to get mullvad's multihop to work on Android, but iVPN Pro does the trick. iVPN also has a nice server status page that helps you optimize for speed (low load server) or anonymity (high load server) as appropriate: https://www.ivpn.net/status/ They have a weird "anti-marketing" homepage which devotes almost equal space to explaining why you should not buy their product :-P

Perfect Privacy accepts a gift card (more convenient than mailed cash IMO) and has a nifty "neurorouting" feature which aims to be better than standard multihop (claims of speed, at least, I can attest to). They do ask for an email address, sadly, unlike iVPN/Mullvad. Also I just saw this and it looks a bit worrisome https://www.security.org/privacy-guide/perfect-privacy/

Both iVPN and PP let you block various trackers / MANGA corps at the network level.

I like Mullvad but it seems good to support a diversity of providers. Curious if anyone has any dirt on either of those two, or if they can make more recommendations.

> You can mail them cash with account info and they'll set you up

If I wanted to self-host a VPN, I would still need to pay for a cloud provider.

Is there an equivalent cash (snail mail) offering for hosting?

>I would still need to pay for a cloud provider.

both google and oracle offer small, perpetually free VM instances.

...in exchange for knowing who you are. (If they couldn't de-dup you via some kind of identity verification, they wouldn't be able to offer a free promo, as some asshole could then just come and generate a million free accounts and lash them together to run a botnet/crypto-mining-farm/etc on.)

I believe the GP's question is "is there any public-web hosting platform that I can use entirely anonymously; where they allow me to sign up using a VPN; and where I don't ever have to pass them anything / sign in through anything / link anything that could be linked back to my identity?"

And I believe the answer to that question is "no."

(Well, okay, if you're fine with a static website, you could pin your data using FileCoin, and then set a domain up as a DNSLink pointer to [an IPFS gateway for] the relevant IPFS URN. That's how https://docs.ipfs.io works. But that's not quite what "web hosting" means to most people.)

The moment a service allows anonymous signup it inevitably gets abused the shit out of itself for spam, botnet C&C, DoS attacks and worse.

This is why I don't see how services like Mullvad can stay afloat forever.

You still have to pay for bandwidth. Free tier provides only 1Gb egress.

nearlyfreespeech.net

NFSN allows you to host websites but last I checked they won't just give you a server for you to run whatever you like.

Mullvad accepts cash as well. In what way are they behind?

As in they power Mozilla's VPN:

https://mullvad.net/en/blog/2019/12/3/mullvad-partnerships-p...

Misunderstanding. The Mozilla VPN is Mullvad (rebranded).

Ohhh, I see. I did not know that, thanks.

Mullvad is the service provider, Moz just resells their service

Behind in the "controlling or responsible for (an event or plan)" sense was meant, perhaps?

Crazy thing is, it was just as great already many years ago. And yet people fall for absolutely weird fake privacy vpn offers.

I wish their scratch cards were available in Australia. Sounds easier than shipping money halfway across the word. I would just pay by card, threat level is not high enough to worry about that but their scratch card is a great idea. Must not be a popular enough option though, even a google search doesn't give you much information on them.

Of all their features, I love that they have an Android TV app so I can watch F1TV on my couch. They're worth more than the 5 euros I give them per month.

Aren't OTT streaming services notorious for blocking VPN IP ranges? How is Mullvad getting around those? Surely, they don't buy / lease / steal residential IP addresses [0]?

[0] https://news.ycombinator.com/item?id=9614993

Probably Mullvad is still unknown to most. They're not the one doing the sponsorships on YouTube.

OH MY GOD. I've had to stop watching F1 in Australia because the only app that has licensing is like $27.50 a month and I don't love it that much.

This is a fantastic idea! Thanks mate!

Be aware: I share an account with someone in a country with F1TV.

If you register from abroad and use your credit card, they'll see you're from AU, block your account and you'll have to contact customer services for a refund.

Exclusivity deals are a cancer.

Best bet is to pay via App Store subscriptions instead of a credit card. It obscures the country so you are free to use a VPN without worrying about being banned.

I tried the Android TV App to watch HBO max though (in a different country vs the subscription's host country) and the HBO app did not even load (not even the splash screen). I had no such problems with some other VPN providers (although to be frank some other VPN providers fail in a different way).

Interestingly I tried to watch HBO Max (from a different country) using Mullvad but it failed me. While some other VPN providers succeeded. So it seems it's kind of a hit and miss what works.

> I love that everything is anonymous (down to the account credentials just being a randomly generated token).

How did you pay?