I'm sorry you feel that way, but I can relate. I initially had mixed feelings about it as well.
On the other hand the campaign we did in Stockholm last year worked out quite well. It managed to affect both domestic and EU legislative discussions at the time. Or at least our campaign contributed to moving the discussion in the right direction.
How much is that worth? I'm not sure, but the reason we started Mullvad in the first place was to conduct political action through entrepreneurship, specifically regarding mass surveillance and censorship.
If nothing else it seems to amuse a lot of people, including me and my colleagues. When I first heard of the idea of plastering privacy propaganda all over some major U.S. cities my initial reaction was more or less "lol, we can just do that?". As it turns out we can. :)
Thank you for sharing that! I am definitely part of the HN group think that tends to be irked by mass marketing- mainly because of baggage from the past of false advertising. However, I do agree that getting the non-IT geek's attention is what would actually move the needle for political action. I was amused (mostly surprised) to see a billboard while driving down the 110 in LA. More importantly, it led to a cool discussion with my non-tech wife who now appreciates your guys' brand more. :)
As frustrating as it is, even great products don't sell themselves. I find much, if not most marketing for subscription-based services pretty scummy, but it's not like it has to be, and I'd much rather see physical ads than how most stuff gets surreptitiously slipped into my surveillance-capitalism-sponsored life.
Since there's no existing compendium, maybe a social media contest for people submitting photos of anonymized objects (e.g. in a box), books (hardback with custom cover), humans (costume/mask/etc) with Mullvad ads / billboard in the background. Crowdsource field reporting and motivate discussion about metadata in online and offline privacy.
Okay, this comment was the comment that got me sold on Mullvad. I was looking for a VPN I liked anyway and if you also use your business entity to help drive legislation toward a more privacy focused end, I'm in.
For me, (one of) the moments was when there figured out how to do remote attestation of the server to check that what it was running was what you expected, so you could check its privacy yourself.
Rather a neat subversion of the common corporate use of remote attestation, to preserve user privacy and security rather than curtail it.
Thank you! You are of course referring to System Transparency. I feel obligated to point out that we have yet to fully implement that idea. I've been working on it, and the related projects Sigsum and Tillitis, for the past six years. There have been lots of detours, but we are making progress towards the vision outlined in the blog post I wrote in 2019: https://mullvad.net/en/blog/system-transparency-future
Two years ago we moved the OSS projects System Transparency and Sigsum to its own organization: Glasklar Teknik AB (glasklarteknik.se).
The OSS and OSHW project TKey was moved to Mullvad's other sister company Tillitis AB (tillitis.se)
Thank you for the service that you and the rest of the team provide. I've found it to be excellent, and you're one of only a very slim number of transparent VPN providers who seem to be in it for the right reasons.
How did you measure the effectiveness of physical ads to issues and other key metrics? I’m just curious what it takes to measure those as it’s always been mysterious to me. It seems like it needs to include a coupon code or something? Also interesting re: legislation. How so?
To my knowledge we don't measure it, at least not in the way I think you mean.
I can't speak for my marketing colleagues but I would assume they reason about it. It seems like a complex system to me, which means the approach kind of has to be (1) forming an understanding of the system and (2) deciding whether one is comfortable with the uncertainty.
One aspect that makes the cost/benefit assessment quite a bit easier is that we don't only care about how many new paying customers we get. It's also fun to do this kind of advertisement. How many interesting conversations about privacy have been had as a result of people seeing our billboards? That's worth something too.
thank you for offering up in this forum at least your own personal contributions to your organization's position on its advertising campaigns. not sure if any official statements on the matter have been made elsewhere, but you've assuaged at least my own slight concern about it with this one. truly. (and by 'truly' i mean i've been meaning to stuff some cash in an envelope addressed to you guys!)
I’m fanboying at this point, but I honestly believe Mullvad should be the poster child for a lot of things other companies should be doing. Transparency, accountability, data minimization, thorough documentation, publicly available audits, etc.
What is it about a company spreading awareness about their product that weirds you out in particular, I'm curious? Billboard advertisements are an awareness type of advertisement. I'd be much more concerned to learn about paid endorsements, which they document on their website that they specifically do not do. Endorsements are a much more sensitive form of advertising, where once money trades hands for an endorsement, it stops being a useful third party assessment and starts being an advertisement disguised as a third party assessment. Awareness advertisements just make good business sense, so I'm genuinely curious why those would shy anybody away.
I agree with you, but I also understand where GP is coming from. For the past 20 years, what people are mostly exposed to is internet ads, which are, to put it mildly, pushy. As a result, all ads now have to deal with considerable negative sentiment as a baseline simply by virtue of being ads.
I saw them on the side of a CTA bus for the first time the other day. I don’t think it is bad at all, but the initial reaction for me as an American used to typical bus advertising it was exactly as if seeing an ad for 4chan there. It just isn’t the expected modality for the product.
(Seeing the reply down thread from a Mullvad rep, this is not unexpected)
Mullvad itself is extremely clear that use of a VPN alone is not enough for the reasons you stated. Mullvad VPN (which is what they advertised) is a suite of products and services, some of which are:
- DNS services (ads, tracking)
- A privacy-optimized browser (cookies, fingerprinting)
- Network services like multihop routing (many benefits such as resistance to timing attacks)
All of these services are included with your subscription at no additional cost. I feel like the claim of preventing ad tracking is as legitimate as it could possibly be.
This can be instantly disproved by examining the cases where valid warrants were presented to them by LEAs and they were unable to provide any user data.
Also they actually make it easy to use their services without providing any data - you can use them by paying Monero over tor, and the only thing identifying you is a short unique "identifying number" - no emails, no names, not even an account.
I find their gimmick of "buy a physical gift card from Amazon, scratch to reveal one-time code" to be pretty genius. It's just a bulk pile of cards, Amazon records you bought one but doesn't know which one (and the actual code is under a scratch-to-reveal surface).
Even if a three-letter agency intercepted your package and swapped your gift card with a known code, I believe Mullvad is not recording the connection between specific gift code and the account number.
You can also exchange unscratched gift cards with friends and strangers.
1. We launched Mullvad 15 years ago. During those 15 years people's interest and awareness of online security and privacy has grown considerably, as has the consumer VPN market.
2. Our strategy is quite different from most of our competitors'. As a result we've grown slower than several of them, but we have nevertheless continued to grow year after year.
3. The costs of the campaign are perhaps lower than you assume.
tl;dr We've slowly grown over many years and are now making enough money to plaster privacy propaganda over your city. Hopefully it's an interesting change from the usual bus ads. Enjoy!
Not everyone telegraphs if they're in it for the money.
In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for your business if you do.
I also use mullvad because I don't really think this is the case, but bad actors are generally hard to conclusively identify by design. And VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.
Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with.
This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me.
Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't.
Thank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects:
On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
> VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.
Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?
You'd have to invent this one at least, as it currently doesn't exist. As the DNS server operator, you can view all my DNS queries. In a zero-trust environment where I don't trust you not to log all user queries and forwards them to the NSA, you'd need to use homomorphic encryption and create a DNS client and server than can do a lookup, without you, the DNS server operator, from finding out what the DNS lookup was of.
https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server.
Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product.
This is on the extreme end, but you asked for a fun challenge! :)
I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
Thank you for your hard work. You've spent way more time on the problem than I. Didn't realize it was rhetorical! Mostly I wanna see homophobic encryption happen in practice. :p
tbh I don't think they exist. And I'm, like, half okay with that - it's entirely justified paranoia, bad actors of all skill levels undeniably exist and they hide successfully for many years, but I do believe good actors exist. It's why I chose mullvad.
At best you have stuff like attestation... but we all know those have a long history of being flawed and are subject to loads of side channels that can't be attested against. Plus VPNs are such a honeypot in every conceivable way that TONS of state-actor-level efforts are entirely reasonable, and that could easily include cheating on basically all attestation systems imaginable. We're just kinda stuck trusting history and lack of public leaks / correlated actions / whistleblowers IMO.
Or, frankly, the Mozilla partnering counts for a lot to me. I won't use their setup because it doesn't have non-vpn-app options, but they're a group I mostly trust to have people's safety at heart.
Personally, stuff like Tor (where by construction you only need to touch a couple good actors to be reasonably secure, and anyone can contribute) is about the only mostly-actually-trustworthy kind of system. You can expect malicious actors to participate there, and still have a reasonable level of privacy, particularly if you check a few personally (which is feasible because anyone can contribute). Tor and similar have plenty of issues, but structurally they're much more sound by design than any centralized VPN can ever be. Now if only they were even a tiny fraction as usable...
I think legally they would have to change their ownership directive document in Switzerland to allow the board of directors to allow the two founders to sell more than 50% of their shares. So you might get a heads up!
A VPN is not enough for privacy. But in combination with a privacy-focused browser, you make sure to block third-party cookies and other tracking technologies used by the data collectors.
The paragraph above is clearly visible on our landing page. We don't want people using our service for things it's not designed for.
The paragraph below is also a direct quote from our website.
"When you visit a website, you can be identified and tracked through your IP address, third-party cookies, all kinds of tracking scripts, and through so called browser fingerprints. That’s why masking your IP address is not enough to stop the data collection. However, by using a trustworthy VPN in combination with a privacy-focused browser, you can put up a better resistance against the mass surveillance of today. That's why we partnered with the Tor Project to develop Mullvad Browser – a browser designed to minimize tracking and fingerprints."
Please show me evidence to back this up and I’ll happily walk back my statements.
The “mullvad” browser is not their VPN product. And if you think DNS denylisting prevents “ad networks from spying on you”, I have some unfortunate news for you. It works to prevent the rendering of a subset of ads (especially in the browser), but isn’t worth a damn for actual behavioral analysis.
I would guess it started with something like this: they serve DNS to prevent DNS leaks when using the VPN. They realize they can use this to block domains, just like a pihole or Cloudflare DNS. They integrate that into their VPN offering.
It's pretty logical once you think about it, but it was a surprise to me too.
It blocks almost all analytics, social pixels which likely covers 90% of the market. Between DNS blocking and uBlock, whatever behavior analysis they can do beyond that doesn't seem to work because the ads I see are entirely irrelevant
Not everyone's in it for the money. Assuming they're not operating at a loss, even less so.