This entire project is developed in collab with Tor team and Mullvad team. The badge of “Tor” is something like a badge of trust. Tor is well reputed, regarded by privacy advocates and journalists around the globe. A true benchmark. Business model is not motivated by profits either. A not for profit entity relying on donations and grants.
Mullvad on the other hand is for profit company. Their VPN offering does not provide a free tier plan like Proton, which too is another for profit company. Mullvad strictly follows a price model without discounts and only have servers where they want to against where they are needed more. For example, many countries with censorship issues are not served by their servers. No comparing here but Proton again goes out of their comfort zone and provide servers in such oppressive regimes. Mullvad VPN has upsides too. And they get the audits regularly. Running in RAM and being transparent about lawful intervention. I am just here talking about the difference of practice. Here, Proton totally shocked the world when they logged IP of an activist and later changed their policy. Also, their recovery info data can be accessed and have no zero knowledge encryption. Just pointing out here that I am not taking anyone’s side.
Biggest red flag here is Mullvad’s lack of direct admission to using Google’s Gmail as support for VPN service. Their blog post too selectively removed these exact words. I am not saying that they can’t do that but what I am trying to point out here how this act alone is more like a deceiving move. They talk freely about them using Google but only when a customer asks about it and chances of that happening is less and they also confirmed most people not using PGP methods to contact them. Proton too uses Zendesk and so that too adversely impact user privacy but they are not hiding about it.
Now the Mullvad browser extension is good for people who uses it but serves no purpose for the rest. It does not add privacy or security if someone chooses to remove it. The WebRTC also is not disabled by default and this control is surprisingly linked with this extension! Should be independent instead. They also don’t support removing or customizing other extensions such as uBlock Origin or NoScript.
These are just few points I came across that I wanted to talk about.