Technology – Page 2 – A Geek With Guns

A Do It Yourself Future

I would assume that most people who read Nineteen Eighty-Four understand that the Party is supposed to be the bad guy. However, most politicians and a large number of corporations seem to believe the Party is the good guy and should be emulated as closely as Snes9x attempts to emulate the Super Nintendo Entertainment System.

It seems like every day we see news of new surveillance technologies either being mandated by politicians of voluntarily implemented by corporations. The two entities aren’t always intentionally working in tandem. Many of the surveillance technologies implemented by corporations are done for profit. Google and Facebook for example have business models dependent on surveillance. But sometimes they two entities are working in tandem. The Pegasus spyware is an example of a protect developed by a corporation for the obvious intent of selling to governments interested in surveilling individuals. Then there are the gray ares. Apple’s recent decision to install spyware on iOS devices to ostensibly detect child pornography is an example of something that was likely implemented at the behest of politicians but not mandated (yet).

Unfortunately, the situation is unlikely to get better before it gets worse. There’s too much money to be made by spying on customers and politicians’ power necessarily depends on surveilling citizens. Does this mean you will have to give up technology entirely? Will the Hutterites and Amish be the only free people left in a few years? Not necessarily. There is an option to utilize technology without subjecting yourself to constant surveillance. That option is to do it yourself.

This is really an extension of my self-hosting advocacy. For a long time I’ve preached and practiced self-hosting online services. It’s much harder for Google to surveil your e-mail if you host your own server (of course Google can still surveil your conversations with Gmail users). However, at the current rate of things the do it yourself strategy will have to be applied to technological products other than online services. For example, there is no longer a privacy respecting smartphone readily available to consumers. Your only option is to buy a device that both allows you to flash custom firmware and is supported by privacy respecting firmware.

The laptop and desktop market at least has a few privacy respecting options like System76 available, but beyond those boutique manufacturers you can’t trust the default operating system shipped with most computers. You need to install an operating system that you can trust such as a Linux distro or one of the open BSD flavors like OpenBSD and FreeBSD. There is also the issue of surveillance technology baked into the hardware. Just installing a trustworthy operating system isn’t enough if the hardware itself is spying on you too. In that case you’re going to have to build your own hardware to some extent. This will require many of the same skills as building a computer does today except instead of choosing parts for performance, you’ll need to choose parts for lack of baked in surveillance technology.

If you want an automobile that won’t spy on you, you’ll likely need to either maintain automobiles that were manufactured prior to surveillance mandates or learn how to disable installed surveillance technology. Mind you that either strategy could and most likely will be declared illegal. In that case you will need to spoof the surveillance technology in such a way that it isn’t tampered with in a detectable manner or can be quickly restored to a fully functional state if you need to take the vehicle in for an inspection or repair.

For those unwilling to unable to do the work themselves, they will be dependent on black market dealers who can. The upside is there is already a black market for surveillance avoidance and it will expand as surveillance becomes more pervasive. But the days of being able to buy a technological product and be reasonably sure that it isn’t spying on you are over (they’ve been over for a while, but the situation is continually becoming worse).

Apple Adds Big Brother to iOS

There are two dominate smartphone operating systems: Google’s Android and Apple’s iOS. Google’s business model depends on surveilling users. Apple has exploited this fact by making privacy a major selling point in its marketing material. When it comes to privacy, iOS is significantly better than Android… at least it was. Today it was revealed that Apple plans to add a feature to iOS that surveils users:

Child exploitation is a serious problem, and Apple isn’t the first tech company to bend its privacy-protective stance in an attempt to combat it. But that choice will come at a high price for overall user privacy. Apple can explain at length how its technical implementation will preserve privacy and security in its proposed backdoor, but at the end of the day, even a thoroughly documented, carefully thought-out, and narrowly-scoped backdoor is still a backdoor.

[…]

There are two main features that the company is planning to install in every Apple device. One is a scanning feature that will scan all photos as they get uploaded into iCloud Photos to see if they match a photo in the database of known child sexual abuse material (CSAM) maintained by the National Center for Missing & Exploited Children (NCMEC). The other feature scans all iMessage images sent or received by child accounts—that is, accounts designated as owned by a minor—for sexually explicit material, and if the child is young enough, notifies the parent when these images are sent or received. This feature can be turned on or off by parents.

When Apple releases these “client-side scanning” functionalities, users of iCloud Photos, child users of iMessage, and anyone who talks to a minor through iMessage will have to carefully consider their privacy and security priorities in light of the changes, and possibly be unable to safely use what until this development is one of the preeminent encrypted messengers.

I’ve been pleasantly surprised by the amount of outrage I’ve seen online about this feature. I expected most people to praise this feature out of fear of being labeled a defender of child pornography if they criticized it. But even comments on Apple fanboy sites seem to be predominantly against this nonsense.

This move once again demonstrates the dangers of proprietary platforms. If, for example, a Linux distro decided to include a feature like this, users would have a number of options. They could migrate to another distro. They could rip the feature out. They could create a fork of the distro that didn’t include the spyware. This is because Linux is an open system and users maintain complete control over it.

Unfortunately, there aren’t a lot of options when it comes to open smartphones. The options that do exist aren’t readily accessible to non-technical users. Android Open Source Projects, which are versions of Android without Google’s proprietary bits, like LineageOS and GrapheneOS don’t come preinstalled on devices. Users have to flash those distros to supported devices. Smartphones developed to run mainline Linux like the PinePhone and Librem 5 still lack stable software. Most people are stuck with spyware infested smartphone. Exacerbating this issue is the fact that smartphones, unlike traditional x86-based computers, are themselves closed platforms (which is not to say x86-based platforms are entirely open, but they are generally much more open that embedded ARM devices) so developing open source operating systems for them is much harder.

Social Media is Impossible

The toughest barrier for a new social media network to overcome is adoption. People will refrain from adopting the new service because not everybody is already on it. This is why keeps Facebook, Twitter, Instagram, and other social media networks remain in business. Since everybody is already using them, nobody wants to migrate no matter how terrible the services become. But this raises an important question, why do you want everybody to be on the same social media network?

A small number of people can become a tight knit community surprisingly fast. These tight knit communities form norms. If a new individual wants to join the group, they are expected to adopt these norms. Likewise, established members are expected to teach prospective members the norms. However, it’s easy for an influx to new members to overwhelm the established members. When that happens, the tight knit community often falls apart.

The Usenet term for this is Eternal September. Back in the day colleges often had their own Usenets. When freshmen arrived in September, they would log into the college Usenet for their first time. Because they didn’t know the norms of the group, they would often violate the Usenet norms. In time the established members would teach the freshmen the norms of the group and those freshmen would either adopt those norms or drop out of the Usenet. This changed in 1993 when AOL provided subscribers access to Usenets. Suddenly a never ending stream of new members were joining Usenet groups and it overwhelmed the established members. This changed the nature of Usenet entirely.

The same thing happened to Facebook when it went from a social media network exclusive to college students to one open to everybody. Suddenly everybody and (literally) their grandmother joined and the entire network changed.

When a group is overwhelmed by new members, the old norms are usually destroyed. What compounds this issue is that new norms are seldom established. I often bring up Dunbar’s number when talking about social media. Humans have a limited capacity for stable social relationships. When that number is exceeded, some social relationships become unstable. What happens when the number of unstable social relationships exceed the number of stable ones? Current mainstream social media networks.

Let’s once again look at Facebook. Facebook is suffering from a widespread breakdown of social cohesion. The site administrators are attempting to force new social norms by implementing an increasingly long list of unapproved behavior. Because Facebook is trying to appeal to the largest number of people, it is making the mistake of adopting what might be considered mainstream norms. However, mainstream norms don’t actually exist (it turns out that you can’t get hundreds of millions and especially billions of users to agree on anything). So rather than establishing new norms and creating stable social relationships, Facebook is angering more users and creating an even more unstable environment.

Facebook isn’t unique in this case. Twitter, Reddit, Instagram, and other large social media networks are suffering from the same problem.

I’ve increasingly become disillusioned with the idea of social media networks. Instead I’ve sought out small niche communities. I run several groups on Element and Signal and participate in several groups on both services run by other people. The groups are closed. In order to join you need to be invited. The invitation process ensures any prospective member has already been vetted. Vetting doesn’t guarantee a prospective member will fit in, but it greatly improves the odds. This is the opposite strategy used by mainstream social media networks, which try to interconnect everybody to everybody else. The difference between groups that follow one strategy or the other is stark. The groups in which I participate that are invite only, have remained stable for years. The social media networks in which I used to participate that were open to everybody, became so bad that I left.

So I return to my first question, why do you want everybody to be on the same social media network? Different people have different interests and personalities so it only makes sense that different groups exist.

Many people believed that the Internet would lead to a new era of peace because people all around the world would be able to talk out their differences. This hiccup in that theory is that people seem less inclined to invest time and energy seriously discussing their differences unless they already have a social relationship. This makes sense. Why invest the not insignificant time and energy discussing complex issues with people whom you have no preexisting relationship? That takes time away from your stable social relationships into which you’ve already invested greatly and are therefore more inclined to maintain.

In summary if you want a better online social experience, establish small groups. Social media as most people envision is impossible.

A Glimmer of Hope for a Decentralized Internet

If you don’t own your online services, you’re at the mercy of whoever does. This rule has always been true, but hasn’t been obvious until recently. Service providers have become increasingly tyrannical and arbitrary with the exercise of their control. More and more people are finding themselves banned from services like Facebook and YouTube. Compounding the issue is that the reasons given for the bans are often absurd and that’s assuming any any reasons is given at all.

This type of abusive relationship isn’t good for anybody, but is especially dangerous to individuals with money on the table. Imagine investing years of your life in building up a profitable business on a service like YouTube only to have Google take it away without providing so much as a reason. Some content creators on YouTube are beginning to acknowledge that risk and are taking actions to gain control over their fate:

Whether he’s showing off astronomically expensive computer gaming hardware or dumpster-diving for the cheapest PC builds possible, Linus Sebastian’s videos always strike a chord, and have made him one of the most popular tech personalities on YouTube.

But Google-owned YouTube gets most episodes of Linus Tech Tips a week late.

Now, they debut on his own site called Floatplane, which attracts a much smaller crowd.

A handful of content creators are mentioned in the article. Most of them are too nice or perhaps timid to state the real reasons they’re seeking alternatives to YouTube: YouTube has become a liability. Google; like Facebook, Amazon, Twitter, and other large online service providers; has been hard at work destroying all of the goodwill it built up over its lifetime. There’s no way to know whether a video you upload to YouTube today will be available tomorrow. There isn’t even a guarantee that your account will be around tomorrow. If you post something that irritates the wrong person, or more accurately the wrong machine learning algorithm, it will be removed and your account may be suspended for a few days if you’re lucky or deleted altogether if you’re unlucky. And when your content and account are removed, you have little recourse. There’s nobody you can call. The most you can do is send an e-mail and hope that either a person or machine learning algorithm sees it and have a bit of pity on you.

I’m ecstatic that this recent uptick in censorship is happening. In my opinion centralization of the Internet is dangerous. Large service providers like Google are proving my point. They are also forcing people to decentralize, which advances my goals. So less anybody think I’m ungrateful I want to close this post by giving a sincere thank you to companies like Google, Facebook, Twitter, and Amazon for being such complete bastards. Their actions are doing wonders for my cause of decentralizing the Internet.

Maybe Connecting Everything to the Internet Isn’t a Great Idea

I’ve made my feelings about the so-called Internet of things (IoT) abundantly clear over the years. While I won’t dismiss the advantages that come with making devices Internet accessible, I’m put off by industry’s general apathy towards security. This is especially true when critical infrastructure is connected to the Internet. Doing so can leads to stories like this:

Someone broke into the computer system of a water treatment plant in Florida and tried to poison drinking water for a Florida municipality’s roughly 15,000 residents, officials said on Monday.

The intrusion occurred on Friday evening, when an unknown person remotely accessed the computer interface used to adjust the chemicals that treat drinking water for Oldsmar, a small city that’s about 16 miles northwest of Tampa. The intruder changed the level of sodium hydroxide to 11,100 parts per million, a significant increase from the normal amount of 100 ppm, Pinellas County Sheriff Bob Gualtieri said in a Monday morning press conference.

The individuals involved with the water treatment plant have been surprisingly dismissive about this. They’ve pointed out that there was never any danger to the people of Oldsmar because treated water doesn’t hit the supply system for 24 to 36 hours and there procedures in place that would have caught the dangerous levels of sodium hydroxide in the water before it could be release. I believe both claims. I’m certain there are a number of water quality sensors involved in verifying that treated water is safe before it is released into the supply system. However, they’re not mentioning other dangers.

Poisoning isn’t the only danger of this kind of attack. What happens when treated water can’t be released into the supply system? If an attacker poisons some of the treated water, is there isolated surplus that can be released into the supply system instead? If not, this kind of attack is can work as a denial of service against the city’s water supply. What can be done with poisoned water? It can’t be released into the supply system and I doubt environmental regulations will allow it to be dumped into the ground. Even if it could be dumped into the ground, doing so would risk poisoning groundwater supplies. It’s possible that a percentage of the plant’s treatment capacity becomes unavailable for an extended period of time while the poisoned water is purified.

What’s even more concerning is that this attack wasn’t detected by an intrusion detection system. It was detected by dumb luck:

Then, around 1:30 that same day, the operator watched as someone remotely accessed the system again. The operator could see the mouse on his screen being moved to open various functions that controlled the treatment process. The unknown person then opened the function that controls the input of sodium hydroxide and increased it by 111-fold. The intrusion lasted from three to five minutes.

This indicates that the plant’s network security isn’t adequate for the task at hand. Had the operator not been at the console at the time, it’s quite possible that the attacker would have been able to poison the water. There is also a valid question about the user interface. Why does it apparently allow raising the levels of sodium hydroxide to a dangerous amount? If there are valid reasons for doing so (which there absolutely could be), why doesn’t doing so at least require some kind of supervisory approval?

It’s not uncommon for people involved in industries to cite the lack of budget necessary to address the issues I’ve raised. But if there isn’t a sufficient budget to address important security concerns when connecting critical infrastructure to the Internet, I will argue that it shouldn’t be done at all. The risks of introducing remote access to a system aren’t insignificant and the probability of an attack occurring are extremely high.

Whenever somebody discussing connecting a device to the Internet, I immediately ask what benefits doing so will provide. I then ask which of those benefits can be realized with a local automation system. For example, a Nest thermostat offers some convenient features, but many of those features can be realized with a local Home Assistant controller.

Google Suspends Element from Its Play Store

The developers of Element; a decentralized, federated, and secure messaging client; were just informed that their application has been suspended from the Google Play Store, which means Android users cannot currently install Element unless they do it through F-Droid or side loading. Why did Google suspend the app? At first Element’s developers weren’t given a reason but they were eventually informed the suspension was because of abusive content. Both the lack of transparency and citing abusive content have become staples of application store suspensions, which are two of many things that make centralized application stores like the Apple App Store and Google Play Store so frustrating for both users and developers.

The abusive content justification is bullshit because Element is no different than any other messaging application in that all content is user created. If Element is removed due to showing abusive content then by that very same justification Signal, Facebook Messenger, Instagram, and Google’s own Gmail should be removed. Furthermore, Element actually has a pretty complete set of moderation tools so Google can’t even argue that the lack of moderation is the culprit. But this doesn’t matter because there are no consequences for Google if it suspends an application for incorrect reasons. Agreements between developers and Google (and Apple for that matter) are one-sided. The only option for developers when their applications are suspended is to beg for clemency.

The suspension of Element is yet another example on the already extensive list that shows why centralized application stores and closed platforms are bad ideas. Without prior notice or (initially) any reason Google made it so Android users can no longer install Element unless they jump through some hoops (fortunately, unlike with iOS, Android generally gives you some options for installing applications that aren’t in the Play Store). Google might decide to be magnanimous and change its mind. Or it might not. In any case there’s very little that Element’s developers or Android users can do about it.

Fleeing Facebook

Another election is on the horizon, which can only mean Facebook is clamping down on wrongthink in the futile hope that doing so will appease Congress enough that it won’t say mean things about the company that might hurt its stock price. This week’s clamp down appears to be more severe than others. I have several friends who received temporary bans for making posts or comments that expressed apparently incorrect, albeit quite innocent, opinions. A lot of them also reported that some of their friends received permanent bans for posting similar content.

In the old days of the Internet when websites were dispersed you usually had friends from forums, game servers, and various instant messenger clients added on other services. Because of that, getting banned for any single account wasn’t usually a big deal. However, with the centralization that Facebook has brought, losing your Facebook account can mean losing access to a large number of your contacts.

If you are at risk of losing your Facebook account (and if you hold political views even slightly right of Karl Marx, you are), you need to start establishing your contacts on other services now. If you’re like me and have friends that predominantly lean more libertarian or anarchist, you’ve probably seen a number of services being recommended such as MeWe, Parler, and Gab. The problem with these services is that they, like Facebook, are centralized. That means one of two outcomes is likely. If they’re successful, they will likely decide to capitalize by going public. Once that happens, they will slowly devolve into what Facebook has become today because their stock holders will demand it in order to maximize share prices. If they’re not successful, they’ll likely disappear in the coming years, forcing you to reestablish all of your contacts on another service again.

I’m going to recommend two services that will allow you to nip this problem in the bud permanently. The first is a chat service called Element (which was formerly known as Riot). The second is a Twitter-esque service called Mastodon. The reason I’m recommending these two services is because they share features that are critical if you want to actually socialized freely.

The most important feature is that both services can be self-hosted. This means that in the worst case scenario, if no existing servers will accept you and your friends, you can setup your own server. If you’re running your own server, the only people you have to answer to are yourselves. However, you may want to socialize with people outside of your existing friend groups. That’s where another feature called federation comes in. Federation is a feature that allows services on one server to connect with services on another server. This allows the users on one Element or Mastodon instance to socialize with users on another instance. Federation means not having to put all of your eggs in one basket. If you and your friends sign up on different servers, no one admin can ban you all. Moreover, you can setup backup accounts that your friends can add so if you are banned on one server, your friends already have your alternate account added to their contact list.

The reason I’m recommending two services is because Element and Mastodon offer different features that are geared towards different use cases. Element offers a similar experience to Internet Rely Chat (IRC) and various instant messenger protocols (such as Facebook Messenger). It works well if you and your friends want to have private conversations (you can create public chat rooms as well, if you want anybody to be able to join in the conversation). It also offers end-to-end encrypted chat rooms. End-to-end encrypted rooms cannot be surveilled by outside parties meaning even the server administrators can’t spy on your conversation. It’s much harder for a server administrator to ban you and your friends if they’re entirely ignorant of your conversations.

Mastodon offers an experience similar to Twitter (although with more privacy oriented features). You can create public posts that can be viewed by anybody with a web browser and with which anybody with a Mastodon account can interact. This works great if you have a project that requires a public face. For example, you and your friends may work on an open source project about which you provide periodic public updates. Mastodon enables that. Users can also comment on posts, which allows your posts to act as a public forum. Since Mastodon can be self-hosted, you can also setup a private instance that isn’t federated. Thus you could create a private space for you and your friends.

It’s critical to establish your existing contacts on another service now so you don’t find yourself suddenly unable to communicate with them because you expressed the wrong opinion. Even if you don’t choose Element and/or Mastodon, pick a service that you and your friends can tolerate and at least sign up for accounts and add each other to your contact lists. That way if you disappear down Zuckerberg’s memory hole, you can still keep in contact with your friends.

Error Indicators of Limited Value

When I moved into this house, I decided to use UniFi gear for my entire network because I wanted to centrally manage it (I, like most people who work in the technology field, am lazy by nature). This house doesn’t have Ethernet running through the walls so I (again, being lazy) opted to rely on a mesh network for most of my networking needs. My mesh network consists of three UAP-AC-M access points.

Like most other people working in the technology field, I’ve been working from home since COVID-19 started making headlines. This means my in-person meetings have mostly been done via remote video conferences. My setup ran smoothly until a few weeks ago when I started experiencing a strange issue where I’d periodically lose my video conference feeds for 10 to 30 seconds. Since I first setup my mesh network my UniFi Controller has reported a large number (as in several hundred per 24-hour period) of DHCP Timeout errors along with a handful of WPA Authentication Timeout errors. It also reported long access point association times for my two mesh nodes (the other node is wired to my switch). Searching Ubiquiti’s online support forum returned a lot of results for individuals experiencing these errors without any resolution. In fact several comments made by Ubiquiti employees stated that the DHCP Timeout errors can be ignored so long as the network is performing well. I ended up ignoring the errors because at the time my network was performing well and nobody seemed to have a resolution to the errors.

I began looking into the problem again when the video conferencing problems I mentioned started to manifest. To make a long story short, I finally figured out my problem. UAP-AC-M access points use the 5Ghz spectrum for mesh communications so they all operate on the same 5Ghz channel, but it’s expected that they utilize different 2.4Ghz channels. My mesh nodes were setup to automatically select their 2.4Ghz and 5Ghz channels during boot up. I assumed this was safe because I boot them up in stages one after the other. That should have caused them to see each other when they booted up and select a different 2.4Ghz channel. According to my UniFi controller, all three 2.4Ghz channels (one, six, and 11 are the only channels that don’t overlap with other channels) were being utilized so I assumed the access points were operating as I expected. After trying to few different settings I decided to manually select the 2.4Ghz channels for my access points. I put one access point on channel one, one on channel six, and one on channel 11.

Since doing that I haven’t experienced any video conferencing problems. Moreover, my DHCP Timeout errors have dropped to almost nothing (I now experience between two and four per 24-hour period), the WPA Authentication Timeout errors have remained at one or two per 24-hour period, and I no longer see any errors about access points taking longer than expected to associate.

If you’re one of the many people experiencing a massive number of DHCP Timeout errors with UniFi access points and you haven’t already manually selected non-overlapping 2.4Ghz channels for your access points, give it a try. I will note that since I live in the country and there are no other visible Wi-Fi networks anywhere on my property, your experience may differ if you’re in an environment with a lot of competing Wi-Fi networks.

The Way It Should Always Have Been

I received my PinePhone last week. The model I ordered was the UBPorts Community Edition. My initial thoughts on the phone are that the build quality is actually very solid, but otherwise it behaves like a $150 phone. The performance isn’t great, but acceptable; the battery life, which is a known issue, is pretty terrible; and the software is in a pretty rough state (easily beta quality, maybe even late alpha quality). All of these were what was promised and what I expected so none of this should be considered criticism. I’m actually impressed by what the manufacturers and software creators managed to pull off so far.

However, after playing with UBPorts I wanted to try some other operating systems. This is where the PinePhone shines since it doesn’t lock you into any specific operating system. The next released of the Community Edition of the PinePhone will come with postmarketOS so I loaded postmarketOS onto an MicroSD card (you can also flash it to the internal eMMC chip) and booted it on the phone. postmarketOS has a utility that builds an image for you. That utility also allow you to customize a number of things including using full-disk encryption (which I haven’t played with yet since it’s experimental) and choosing your user interface. I chose Phosh for the user interface because I wanted to see what the Librem team has been working on. My experience with postmarketOS was similar to UBPorts. Performance was sluggish, but acceptable and the software is still in a rough state. However, postmarketOS makes it easy to install regular Linux desktop and command line applications so I installed and tried a few applications that I use regularly on the desktop. Unfortunately, most of the available graphical software doesn’t yet support screen scaling so applications are too big for the PinePhone’s screen. With that said, progress is being made in that direction and once more applications support screen scaling there should be a decent number of apps available.

Being able to boot up a different operating system on my phone is the way it should always have been. On my desktop and laptops computers I have always been able to choose what operating system to run, but my mobile devices have always been locked down. Some Android devices do allow you to unlock the boot loader and install a different Android image, but often doing so it’s officially supported by the manufacturer (so it’s often a pain in the ass). It’s nice to finally see a mobile phone that is designed for tinkerers and people who want to actually own their hardware.

Mullvad VPN

Periodically I’m asked to recommend a good Virtual Private Network (VPN) provider. I admit that I don’t spend a ton of time researching VPN providers because my primary use case for VPNs is to access my local network and secure my communications when traveling so most of the time I use my own VPN server. When I want to guard my network traffic against my Internet Service Provider (ISP), I use Tor. With that said, I do try to keep at least one known decent VPN provider in my back pocket to recommend to friends.

In the past I have usually recommended Private Internet Access because it’s ubiquitous, affordable, and its claim that it doesn’t keep logs has been proven in court. However, Private Internet Access is based in the United States, which means it can be subject to National Security Letters (NSL). Moreover, Private Internet Access was recently acquired by Kape Technologies. Kape Technologies has a troubling past and you can never guarantee that a company will maintain the same policies after it has been purchased so I’ve been looking at some alternative recommendations.

Of the handful with which I experimented, I ended up liking Mullvad VPN the most. In fact I ended up really liking it (for me finding a decent VPN provider is usually an exercise in finding the least terrible option).

Mullvad is headquartered in Sweden, which means it’s not subject to NSLs or other draconian United States laws (it’s subject to Swedish laws, but I’m outside of that jurisdiction). But even if it’s subjected to some kind of surveillance law, Mullvad goes to great length to enable you to be anonymous, which greatly hinders its ability to surveil you. To start with your account is just a pseudorandomly generated number. You don’t need to provide any identifiable information, not even an e-mail address. When you want to log in to pay your account, you simple enter your number. The nice thing about this is that the number is also easily disposed of. Since you can generate a new account by simply clicking on a link, you can throw away your account whenever you want. You can even generate accounts via its onion service (this link will only work if you’re using the Tor Browser).

Mullvad’s pricing is €5 (roughly $5.50 when I last paid) per month. Paying per month allows you to change accounts every month if you want. Payments can be made using more traditional services such as credit cards and PayPal, but you can also use more anonymous payment options such as Bitcoin and Bitcoin Cash (I would like to see the option of using Monero since it has anonymity built-in).

The thing that initially motivated me to test Mullvad was the fact that it uses WireGuard. WireGuard is our new VPN overlord. If you’re new to WireGuard or less technically inclined, you can download and use Mullvad’s app. If you’re familiar with WireGuard or willing to learn about it, you can use Mullvad’s configuration file generator to generate WireGuard configuration files for your system (this is how I used it). Mullvad also supports OpenVPN, but I didn’t test it because it’s 2020 and WireGuard is our new VPN overlord.

Like most decent VPN providers, Mullvad also has a page to check if your Mullvad connection is setup correctly. It performs the usual tasks of reporting if you’re connecting through a Mullvad server and if your Domain Name System (DNS) requests are leaking. It also attempts to check if your browser is leaking information through WebRTC. You can also test your torrent client in case you want to download Linux distros (because that’s the only thing anybody downloads via BitTorrent) more securely.

I didn’t come across anything egregious with Mullvad, but don’t take my recommendation too seriously (this is the caveat I give to everybody who asks me to recommend a VPN provider). My VPN use case isn’t centered around maintaining anonymity and I didn’t perform thorough testing in that regard. Instead I tested it based on my use case, which is mostly protecting my connection from local actors when traveling. As with anything, you should test the service yourself.