this post was submitted on 20 Sep 2023
782 points (99.0% liked)
Technology
59204 readers
2972 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Great news! Mullvad is great even if their account security makes you do a double take
what do you mean?
I assume they mean there are no account credentials. When you "create" an account on their website, you'll be given a random account number, and no password.
Yeah this is what I meant. It feels so wrong but also makes complete sense.
I think I've gotten used to the "safety" of setting my own password and always typing it with my email or username.
But practically speaking they're very similar and Mullvad's is arguably safer
I think of it more as "no username, only password". Realistically, usernames are not expected to be secure or private, so this is effectively the same.
What's to stop somebody guessing your account number and gaining access? (Honest question)
There are lots of possible account numbers, much more than there are accounts. So there is a very small chance that you will guess an active paid account.
And if you do, there's not much you can get out of it. There's no personal information tied to the account.
I am surprised that they don’t provide UUIDv4’s, feels like what they provide is somewhat guessable
https://mullvad.net/en/blog/2017/6/20/mullvads-account-numbers-get-longer-and-safer/
As they outline here, there are ~9 quadrillion possible keys, needing around 5.5 million guesses to find an account. I think they hit a nice middleground between decent entropy and still having a number you can memorize (like a credit card).
people memorize their credit card numbers?
Nowadays, not so much. In the previous decades before password managers, card vaulting, apple pay and so on: yes, if you were typing it in or writing it on forms frequently, it wasn't uncommon to just memorize it.
My point though was that there is a limit to our ability to remember long and random alphanumeric strings, and I find credit card numbers to be that limit. UUIDs are longer and have a much bigger character set.
I never put my cc in any password manager, but I also mostly just use it for online payments where I don't mind taking out the actual card to type the number in
To be fair, would it matter if someone got access to your account key? There isn't really any data on your account is there (isn't that the point)? It'd just let you connect to the VPN
They can use your secondary connection for free. It depends if that bothers you or not. If you're already using both it could lead to disruption on your part I guess? Not 100% on that though