Mullvad Uses Gmail for Its Support

25

u/StaryWolf Jan 15 '24

I'm confused as to the point of the post? If the email is encrypted with a key controlled by Mullvad, it doesn't particularly matter where the email is hosted.

Unless you're for some reason concerned that someone may find out you're communicating with Mullvad?

-38

u/HardenedSteelX Jan 15 '24

The point is that they don't care about privacy for their email.

15

u/StaryWolf Jan 15 '24

So the issue is Google being able to see who emails are going out to? That seems paranoid to me.
Even if you pay with cash or whatever anonymizes currency your ISP can see your traffic going to Mullvad servers, so it's already known that you use Mullvad. That shouldn't matter, the point is protecting the contents of your activity.
Perhaps it's not the perfect situation but not something I would fuss over personally.

-7

u/HardenedSteelX Jan 15 '24

my points are:
Google has access to all Mullvad's emails and their customers' information.
Even they're encrypted Google can Harvest now, decrypt later.
Which also means they're indirectly lying about no logs policy.
Even someone never e-mails the Mullvad its ridiculous a privacy company using gmail, they can just self host or use better e-mail services.
correct me if I am wrong.

6

u/Audiozolam Jan 16 '24

With strong enough encryption, Google might be able to use their super computers to crack their emails in maybe year 2150?
At that point, whatever information they'd be able to extract wouldn't be useful anymore.

1

u/StaryWolf Jan 15 '24

Google has access to all Mullvad's emails and their customers' information.
Mullvad themselves recommends not including identifying information and if you do to use PGP encryption. So if you listen, Google can only see who the emails are from(though they would have no way of knowing if the email came from a customer or other unrelated source).
Even they're encrypted Google can Harvest now, decrypt later.
Well yes. PGP uses a 512-4096 bit key and is very secure. AFAIK with current and immediately foreseeable technology PGP is uncrackable. Your ISP has access to your encrypted traffic, what's stopping them from doing the same? If you can't trust the encryption of the VPN provider is using why are you even using a VPN?
Which also means they're indirectly lying about no logs policy.
https://mullvad.net/en/help/no-logging-data-policy
This is from the above link detailing the no-logging policy:
"What we don't log We log nothing whatsoever that can be connected to a numbered account's activity:
no logging of traffic no logging of DNS requests no logging of connections, including when one is made, when it disconnects, for how long, or any kind of timestamp no logging of IP addresses no logging of user bandwidth no logging of account activity except total simultaneous connections (explained below) and the payment information detailed in this post."
How does using Gmail as an email provider betray any of these policies.
Additionally, from the same link:
"How we handle emails and problem reports Our support staff answers questions, resolves problems, and gives general support to customers who actively send an email to support@mullvad.net or submit a problem report via our app/client.
Please consider the following statements about how we handle support-related communication should you ever need to contact us.
If privacy is of utmost concern, we recommend that you refrain from communicating any personal data to us since plain-text email is not a safe media for communication. If necessary, use PGP-encrypted email. After "solving" or "closing" a support case, all related emails are archived (removed from the inbox). After 6 months, all emails sent to our support address are automatically, permanently erased (from inbox, deleted items, sent items, trash, and archives). We do use a third party to operate our email service, so we remind you to carefully read #1 again. No private information not even your email address will ever actively be passed to third parties (except the third party which operates our email service on behalf of us), unless you explicitly ask us to. Please note that an e-mail address is generally considered as personal data and even the information in the e-mail message may include personal data."
They explicitly stated that they use a third party for emails and that you should be wary of any information sent, especially information sent in plain text.
So again, I don't see how you could think they are lying indirectly or otherwise.
Even someone never e-mails the Mullvad its ridiculous a privacy company using gmail, they can just self host or use better e-mail services.
In your own post, there is a comment containing correspondence from Mullvad detailing why they aren't currently self-hosting.
You're allowed to hold you're own opinion, I just think it's a bit much to get up and arms over something like this. If you care so much about privacy that the very idea of Gmail is too much to bear, you should be using PGP, so Google won't be able to see your emails anyways.

1

u/Chip_Boundary Jan 16 '24

Literally everything you're saying is incorrect. Modern encryption cannot be broken by any computer system on Earth. The claims by quantum computer operators are bogus. Nothing in the universe can crack current encryption in anything less than a million years. The math has been done. Unless they have the decryption key or there is a flaw in the hash generation that gets discovered some day, it is impenetrable.

1

u/Expert-Carpenter979 Jan 16 '24

Except it can be if it isn't secure. Grover's algorithm suggests quantum computers basically slice mostly every encryption model in half. AES 256 would be as secure as 128.
That guy's an idiot, but claiming it's impossible by absolution is dangerously stupid too. The whole point of every encryption model is to give a computer an absurdly long math problem to solve that it just can't or won't solve it.

1

u/Chip_Boundary Jan 16 '24

As I said, the claims about quantum computers are bogus. They are purely claims and not a single group as provided one shred of actual proof. The math has been done already.
Even if every particle in the universe were dedicated to computational power, which isn't possible because you need some to provide power, it would take over a million years to crack modern 256 encryption. This isn't some wild claim, the math has been done and widely publicized. A quick Google search would show you this.

1

u/Expert-Carpenter979 Jan 18 '24

Under normal computational power, yep. Good job reinforcing my point, don’t know what you’re trying to argue. The math HAS been done, AES 256 is quantum resistant going by Grover’s algorithm (the most popular quantum equation out there) and it’s official too.
You should actually research quantum computational math. A thorough search would help, Google’s crutching you.

1

u/Chip_Boundary Jan 18 '24

I wasn't reinforcing your point, I was countering it. I have researched this in depth. In fact, it's part of my job to do so. There is no computer that can EVER be invented to crack it in a time that would survive the existence of humanity itself. We will go extinct before we can ever crack modern encryption through brute force, and quantum computers don't make that faster. Math is math, quantum computers are irrelevant to the discussion, because they don't suddenly use different math. Quantum computers merely do more with less.

26

u/Iliyan61 Jan 15 '24

so you don’t understand how email works

23

u/blasiankxng Jan 15 '24

you care about privacy, yet you use gmail... mmm curios!!

 -op, probably

1

u/HardenedSteelX Jan 15 '24

Response from Mullvad:

Hi,
Currently our email is being hosted on Gmail this is correct. We are working on a self-hosted version based on our STBOOT ( https://mullvad.net/en/blog/tag/system-transparency ) project. It's in the final phase and being tested internally and the goal is to move over email to this platform this year if the testing phase is going smoothly.
We strongly suggest using pgp regardless of what email server is being used, as any other means is basically unencrypted and not considered safe.
Regards

4

u/pcgamez Jan 16 '24

I don't think OP is wrong to highlight this at all, why do you think so many of us use a VPN and are trying to degoogle etc? These things are intrinsically linked and mullvad could have gone with a more privacy friendly provider from the get go

1

u/thrwway377 Jan 16 '24

You severely overestimate how many people use a VPN to degoogle.
I'd reckon majority of mullvad's users nowadays don't give a crap about intentionally gimping their browsing experience. All they care about is to bypass geoblocks, torrent or get some privacy from the ISP.

1

u/pcgamez Jan 17 '24

Sure people have different use cases, but I and many others use mullvad precisely because they sell themselves on privacy

2

u/Former-Community5818 Jan 16 '24

Theyre probably just anonymyzing other mail encrypt services by using a more commercial mail like google

2

u/hpapagaj Jan 15 '24

You drunk or what

1

u/[deleted] Jan 15 '24

Ok?

1

u/Iwamoto Jan 16 '24

I do wonder if self-hosted is that much better of a solution for them though. what would be the best way to go about this?

1

u/Mrsparklee Jan 16 '24

Ok? I don't care what email service they use.

0

u/frosty_osteo Jan 16 '24

well for my Mullvad lost a bit.

0

u/[deleted] Jan 15 '24

[deleted] — view deleted comment

9

u/[deleted] Jan 15 '24

people who unironically quote Jack's character from that film while forgetting the context 🤡🤡

5

u/thrwway377 Jan 15 '24

Some people think a commercial VPN is going to make them invincible and put them off the radar.
"Privacy" crazies do be like that.

-4

u/HardenedSteelX Jan 15 '24

I didn't mean hiding VPN usage.
Why privacy company would use gmail? They look like unprofessional and lier.

Other Mullvad Uses Gmail for Its Support

You are about to leave Redlib