Mullvad browser

L8437

https://mullvad.net/en/blog/2023/4/3/mullvad-vpn-and-the-tor-project-team-up-to-release-the-mullvad-browser/

What are people's thoughts

Chalko

Interesting but not a mobile option yet.

[deleted]

When I go to
https://mullvad.net/en/check
How seriously should I take the connectivity check? It is more than likely that my VPN is blacklisted somewhere and is DNS leak an issue? I mean you have to show the world exit node IP of your VPN server, no?

OpSecJunkrat

I'm confused.

What does this browser do differently than Librewolf? Based off of Tor Browser...without Tor? So it's essentially the Tor Browser without what makes the Tor Browser stand out? Supposed to use a VPN instead? Am I missing something? Who is this for?

One of the important features of the Tor Browser is that there's a collection of users who all use the same Browser to access the same resources. The "herd" mentality or homogeny is the reason the Tor Project recommends the Tor Browser. It's because if nothing else, you have a ton of users who have the same exact setup so extensive fingerprinting would be harder to achieve.

This browser currently has a less active userbase, based on the Tor Browser which is based on Firefox with its issues, packages two extensions out of the box, Mullvad's extension I'm not convinced should be included be default (IMO, uBlock Origin should be integrated within the browser like Brave's Adblock), so unless I'm missing something, what does this offer an end user that someone with a VPN and Brave (or Librewolf) cannot achieve?

Chalko

OpSecJunkrat

Maybe just brand recognition and marketing towards Mullvad VPN services, and with the backing of TOR, another recognizable name. (At least more than Librewolf)

Doesn’t have to make much sense.

I like Mullvad, but they are still for profit company.

kopolee11

OpSecJunkrat I'm not an expert, but I believe the Tor Browser's anti-fingerprinting features are superior to other options (including Brave). So having a browser that has that same anti-fingerprinting capabilities without the Tor network could have some use cases. (e.g. faster speed, wanting to avoid malicious exit nodes, etc)

However, as you mentioned, the drawback is worse security since it's based on Mozilla Firefox. So certainly not a foolproof solution.

OpSecJunkrat

Chalko

Brand name is fine. Being for profit is fine.

In my opinion, this browser is redundant.

OpSecJunkrat

kopolee11

But you're going to be on the clearnet. What threat model is asking for this specific browser? The removal of ads is through uBlock Origin to which Librewolf has.

I don't know if I haven't noticed it, but how bad is fingerprinting actually? I hear it all the time, but I've yet to see someone get pwned entirely via browser fingerprinting.

Chalko

kopolee11 So having a browser that has that same anti-fingerprinting capabilities without the Tor network could have some use cases. (e.g. faster speed, wanting to avoid malicious exit nodes, etc)

It’s less about anti-fingerprinting and more about everyone using the same TOR browser with the goal that everyone has the same or very similar fingerprint.

kopolee11

Chalko Seems like that's the same approach that the Mullvad Browser will be taking: "The same browser fingerprint for all Mullvad Browser users"

3njKu6Zc6

Exactly one month before they released this, they donated $100,000 to Tor.

It's sad to see Tor promote an inferior and commercial product, but hey, I guess money talks.

This solves zero problems and it's not something I would personally ever use or trust.

Why would anyone use this over Tor, if you need privacy? Why would anyone use this over any other browser + whatever commercial or home-brew VPN solution that you already use?

itehc

3njKu6Zc6 maybe that this could interest you ? https://github.com/mullvad/mullvad-browser/issues/1#issuecomment-1495998714

Relaks

I was also quite surprised seeing this announcement, in part because of all the writings I have read by people working with the Tor Project arguing against trusting a centralized VPN service with your traffic. Honestly, my immediate thought was that this must've been an April Fool's joke that I missed.

I'm sure it's a nice browser, but without the Tor components, rotating circuits per site and so on, I'm just a bit sceptical at this point in time. Will the pool of users grow large enough for the concept to work, is something I'm also wondering. It will be interesting to see if Mullvad will somehow be capturing usage statistics in the form that Tor metrics does now.

goslife

My question is why would tor or mullvad choose to use Firefox as base rather than chrome? Since it seems that chrome is stronger from a security standpoint. Plus since most people use chrome it seems like it would be easier to hide in the crowd. Anyone understand their logic?

kopolee11

goslife It’s basically just an artifact of history. The Tor Browser was first released in January 2008, and the Chromium Project started in September 2008. It would take a tremendous amount of work to transfer all their privacy work to a new web browser engine.

goslife

kopolee11 gotcha. But for mullvad I would have thought starting with something like vandalum since they are brand new but I guess its prob just marketing and easier to use TB recognition

[deleted]

Lot of negative feedback here not sure why... I like the browser. The anti-fingerprint works great out of the box. The browser will upgrade automatically compared to Librewolf which doesn't.

It is a convenient way, for less tech people to be more privacy aware on the web.

OpSecJunkrat

[deleted]

Don't get me wrong, it's certainly not a useless browser, but even reading this: https://github.com/mullvad/mullvad-browser/issues/1#issuecomment-1495998714, it felt like Mullvad could've used their time more wisely.

OpSecJunkrat

To add on to this, the reason the Tor Browser is effective against fingerprinting is because there's buckets of users using Tor Browser that look almost equivalent. Note on the word "almost", if you do nothing at all, you are unique. What TB and by extension what Mullvad does is have groups of users who look very very similar.

Overall, there is simply no better tool than using Tor Browser to fight advanced fingerprinting. Mullvad is based off of the Tor Browser, sure, but until it has an actual userbase, you're still probably going to be identifiable.

zzz

The problem I see with Tor in many countries is that it's very hard to avoid being victimized for it. Something unrelated happens in your area, and you get instant suspicion, a knock on your door, harassment, etc. Has not happened to me personally because I do not use Tor, but I have witnessed it.

I've heard suggestions to live in a Tor-only commune of dozens or hundreds for safety / anonymity in a crowd, but it's very impractical for most.

Seems like the mullvad browser is trying to advertise itself as the missing middle? Not as extreme as Tor, not as basic as vanilla Firefox?

I'm having trouble distinguishing Librewolf from Mullvad browsers myself, although I am not very knowledgeable.