Mullvad exit IPs are surprisingly identifying
599 points
• 4 days ago
• Article
Link
Mullvad VPN 在每台服务器上使用多个出口 IP，并根据用户的 WireGuard 密钥以确定性方式分配这些 IP；密钥会在 1 到 30 天内轮换一次。虽然这种设计有助于将用户分散到不同 IP 以避免被封锁，但也带来了指纹识别的风险。对 9 台服务器的测试表明，出口 IP 并非随机分配，而是遵循可预测的模式。每台服务器的 IP 池按比例划分，用户在不同服务器上获得的 IP 会始终位于各自池中的同一百分位；例如，有的用户在每台服务器上总是落在大约第 81 百分位。
这种现象源自 Mullvad 在 Rust 中使用基于种子的随机数生成器（RNG）。对于同一种子，RNG 会产生一致的浮点值，再按服务器 IP 池的大小进行缩放。因此即便理论上存在数万亿种 IP 组合，实际上用户只落入观测到的 284 种组合之一。池大小相同的服务器（如 Chile 和 South Africa）会共享相同的 IP 索引，进一步证实了 RNG 的确定性行为。这可能是 Rust 中 random_range 的比例缩放方式导致的意外后果，许多开发者（包括 Mullvad 的）可能未曾预料到这一点。
组合数量受限使得关联攻击成为可能。研究者开发了一个工具来估算一组 IP 对应的浮点区间，结果显示约 0.34% 的用户会共享相同组合。按约 100,000 名活跃 Mullvad 用户估算，约有 340 人可能在不同服务器间被关联。例如，当论坛上两个账户的 IP 日志显示重叠的浮点区间时，很大概率它们属于同一人。该漏洞在数据泄露或法务索取的 IP 日志中同样可被利用，从而可能去匿名化 VPN 背后的用户。
缓解建议：尽量不要在同一 WireGuard 密钥周期内频繁切换服务器，最好每个密钥只切换一次；若需强制轮换密钥，可退出 Mullvad 客户端重新登录。这样可以降低跨会话被关联的概率。此问题凸显了负载均衡与隐私之间的权衡：确定性分配虽有助于扩展和负载均衡，但也会为每个用户留下独特的指纹。
Mullvad VPN uses multiple exit IPs per server, assigning them deterministically based on a user's WireGuard key, which rotates every 1 to 30 days. While this design helps distribute users across IPs to avoid blocks, it introduces a fingerprinting risk. Testing 9 servers revealed that exit IPs are not randomly assigned but follow a predictable pattern. Each server's IP pool is divided proportionally, so a user's IP across different servers consistently lands in the same percentile of its pool. For example, one user might always get an IP around the 81st percentile of each server's range.
This behavior stems from Mullvad's use of a seed-based random number generator (RNG) in Rust. The RNG produces a consistent float value for a given seed, which is then scaled to the server's IP pool size. This means that even with trillions of possible IP combinations, users end up with one of only 284 observed combinations. Servers with identical pool sizes, like those in Chile and South Africa, share the same IP indexes, confirming the RNG's deterministic nature. This might be an unintended consequence of how Rust's `random_range` function works, as many developers, including Mullvad's, may not have anticipated this proportional scaling.
The limited number of combinations allows for correlation attacks. A tool was created to estimate the float range for a set of IPs, showing that about 0.34% of users share the same combination. With an estimated 100,000 active Mullvad users, this means around 340 people could be linked across different servers. For instance, if two accounts on a forum show overlapping float ranges in their IP logs, there's a high probability they belong to the same person. This vulnerability extends to data breaches or legal IP logs, potentially deanonymizing users behind the VPN.
To mitigate this, users should avoid switching servers more than once per WireGuard key and force rotate their key by logging out of the Mullvad app. These steps reduce the chance of being tracked across sessions. The issue highlights a trade-off between load balancing and privacy, where the deterministic IP assignment, while practical for scaling, creates a unique fingerprint for each user.
381 comments • Comments Link
• Mullvad 的一位联合创始人承认，部分被描述的 IP 关联行为是出于用户体验的考虑（例如在某台服务器上保持稳定的 IP）；其他行为并非有意，目前已有针对意外行为的补丁在测试中。他强调了隐私与用户体验之间的权衡，并请求研究人员在公布研究结果前通知厂商。
• Mullvad 默认的 WireGuard 密钥轮换间隔为 72 小时，这被视为缓解 IP 关联问题的一种措施。一些用户认为，更小的 IP 池反而能增加每个出口 IP 的用户数量，从而在结合 DAITA 和多跳等功能时加强隐私。
• 基于用户 WireGuard 密钥的确定性出口 IP 分配意味着，即便用户连接到不同的 Mullvad 服务器，也可能由于重叠的 IP 范围在这些服务器间被关联，形成跨服务器的伪静态标识，从而削弱匿名性。
• 有评论者怀疑考虑到这种关联漏洞，Mullvad 是否可能是情报机构的幌子。反驳者则指出，如果是蜜罐，机构会直接记录所有数据，而不会依赖这种微妙的统计关联；此外，Mullvad 的长期记录、第三方审计以及在法庭案件中证明的无日志政策，都支持其合法性。
• 讨论强调，VPN 主要保护用户免受 ISP 级别的监控和商业追踪，而不是用来对抗有能力的国家级对手或像浏览器指纹这类复杂的去匿名化技术。用户不应期望 VPN 达到 Tor 那样的匿名效果。
• Mullvad 的确定性 IP 分配被辩护为一种无状态且用户友好的设计，避免维护 NAT 表并允许 SSH 等服务保持稳定连接。然而，这种便利是以隐私为代价，可能需要重新评估。
• 博客中声称的 ">99% 的概率" 跨服务器识别用户受到了质疑，有人认为相关数学计算过于简化。但在用户数量很少的小型论坛中，这种关联仍可能构成强有力的证据。
• 一些用户指出，Mullvad 的出口 IP 广为人知，常被银行和由 Cloudflare 保护的网站等服务封锁，要求用户在访问时禁用 VPN——这是任何 VPN 供应商常见的权衡。
• 关于 VPN 与 ISP 的可信度辩论集中在司法管辖区、透明度和可验证的无日志政策上。 Mullvad 接受匿名支付、客户端开源，以及在法庭上得到证明的无日志政策，被认为比典型 ISP 更值得信赖，后者通常会将用户数据货币化。
• 建议那些需要避免 VPN 被列入黑名单的用户考虑使用住宅或移动代理，尽管这些服务可能更昂贵并且可能依赖可疑来源（例如被恶意软件感染的设备）。在更高安全需求下，也有人讨论使用 VPN 链和其他高级技术。
讨论显示了对该问题局限性的细致理解：大多数参与者承认 Mullvad 的 IP 关联问题确实是一个真实的隐私隐患，但并非恶意的证据。共识倾向于认为 Mullvad 是一家值得信赖的供应商，应修复跨服务器关联的缺陷，可能通过在 IP 分配中引入服务器特定的随机性来解决。关于 VPN 与 ISP 的比较、 VPN 对抗国家级对手的有效性以及将 VPN 作为万能隐私工具的宣传，引发了对商业隐私工具的普遍怀疑，同时也认可了它们在特定威胁模型下的实用价值。 • A Mullvad co-founder acknowledged that some of the described IP correlation behavior was intended (for user experience, like maintaining stable IPs on a given server) while other aspects were not, and that a patch for the unintended behavior is already being tested. He emphasized the trade-offs between privacy and UX, and requested that researchers notify vendors before publishing findings.
• Mullvad's default WireGuard key rotation interval is 72 hours, which serves as a mitigation for the IP correlation issue. Some users argue that a smaller IP space actually enhances privacy by increasing the number of users sharing each exit IP, especially when combined with features like DAITA and multi-hop.
• The deterministic assignment of exit IPs based on a user's WireGuard key means that even when connecting to different Mullvad servers, a user can be correlated across those servers via overlapping IP ranges, creating a pseudo-static identifier that undermines anonymity across services.
• Several commenters questioned whether Mullvad could be an intelligence agency front, given the correlation vulnerability. Others countered that if it were a honeypot, the agency would simply log everything rather than rely on such subtle statistical correlations, and that Mullvad's long track record, third-party audits, and proven no-log policy in court cases support its legitimacy.
• The discussion highlighted that VPNs primarily protect against ISP-level surveillance and commercial tracking, not against determined state actors or sophisticated deanonymization techniques like browser fingerprinting. Users should not expect VPNs to provide Tor-level anonymity.
• Mullvad's design choice to assign IPs deterministically was defended as a stateless, user-friendly approach that avoids maintaining NAT tables and allows stable connections for services like SSH. However, this convenience comes at a privacy cost that may need to be reconsidered.
• The blog post's claim of ">99% chance" of identifying a user across servers was questioned, with some arguing the math was oversimplified. However, for small forums with few VPN users, the correlation could still be strong evidence of sockpuppetry.
• Some users noted that Mullvad's exit IPs are widely known and often blocked by services like banks and Cloudflare-protected sites, requiring users to disable the VPN for access. This is a common trade-off with any VPN provider.
• The broader debate around VPN trustworthiness compared to ISPs centered on jurisdiction, transparency, and verifiable no-log policies. Mullvad's acceptance of anonymous payments, open-source clients, and court-proven lack of logs were cited as reasons to trust it more than typical ISPs, which often monetize user data.
• Residential and mobile proxies were suggested as alternatives for users needing to avoid VPN blacklists, though these services can be more expensive and may rely on questionable sources like malware-infected devices. VPN chaining and other advanced techniques were also discussed for higher-security use cases.
The discussion revealed a nuanced understanding of VPN limitations, with most participants acknowledging that Mullvad's IP correlation issue is a genuine privacy concern but not evidence of malicious intent. The consensus leaned toward Mullvad being a trustworthy provider that should fix the cross-server correlation flaw, likely by incorporating server-specific randomness into IP assignment. Debates about VPNs versus ISPs, the effectiveness of VPNs against state actors, and the marketing of VPNs as privacy panaceas reflected broader skepticism about commercial privacy tools while still valuing their utility for specific threat models.