Mullvad VPN security audit (DoH)

[netblue30]

The guys from Mullvad are bringing up a non-logging DNS over HTTPS service built on Unbound, and they contracted a company to do a security review - quite an interesting read:

https://www.assured.se/wp-content/uploads/2021/03/Assured_Mullvad_DoH_server_audit_report.pdf

[reinerh]

Thanks, was an interesting read. :)

[topimiettinen]

Firejail has disable-devel.inc to disable (some) compilation software. The tools useful for attackers (tcpdump, nc, nmap, wireshark, nessus, msfconsole...) could be also blocked with something like disable-scanners.inc. For example: tools available on Kali Linux .

Though it's always better to use whitelist/allowlist mode and only allow the very few needed programs rather than disable a few things left and right.