Mullvad VPN has introduced a new, secure downloader application designed to ensure safe and reliable installation of its VPN software. This new feature, known as the Mullvad VPN loader, provides a streamlined way for users to download and verify the Mullvad VPN app, eliminating the risk of downloading a malicious copy.
Automated Authentication for Enhanced Security
Mullvad has always prioritized transparency and security, using PGP signatures to authenticate the software it releases. However, until now, users were responsible for verifying these signatures themselves. The new loader automates this process, ensuring the authenticity of the app without requiring manual verification. The loader itself also carries a PGP signature, allowing users to verify it in the same way they would any other Mullvad release.
For those who prefer to verify the software themselves, Mullvad provides a guide on how to check PGP signatures.
Faster Downloads with Content Delivery Networks (CDNs)
Previously, the Mullvad VPN app was only available for download from Mullvad’s servers in Sweden, with GitHub acting as a backup. Now, Mullvad has expanded its download options by using a global network of third-party content delivery networks (CDNs). A CDN is a server that stores and delivers website content to users, and in this case, it allows users to download the Mullvad VPN app faster by selecting a server closer to them.
Mullvad claims that this CDN-based system enables faster downloads than were previously possible. However, the company acknowledged that using a CDN does come with a small privacy trade-off.
Privacy Implications of Using a CDN
While the use of CDNs offers faster downloads, Mullvad’s tech lead confirmed that the CDN can detect the IP addresses of users requesting the installer. This means that the CDN can infer which operating system a user is running. Although the CDN cannot see VPN traffic or know if the user is using Mullvad VPN, it will have access to certain personal information, such as the user’s IP address.
Mullvad has been transparent about this privacy consideration, explaining that the company approved the use of the CDN as part of the project. For users concerned about this privacy aspect, Mullvad still offers an alternative: users can download the VPN app directly from Mullvad’s servers in Sweden by visiting the “Alternative Installation” section of the website. This method bypasses the CDN and avoids sharing any personal data, though users will lose the automatic verification provided by the loader.
Independent Audit of the New Feature
Given the security-sensitive nature of VPN software, Mullvad had the new downloader functionality independently audited by Assured, a cybersecurity firm. The audit reviewed the installer downloader application, the script generating installer releases, and the metadata associated with the installer. Assured concluded that the new downloading solution was “well thought out and implemented.”
A New Standard for Mullvad VPN Installations
Mullvad has confirmed that the VPN loader will become the primary method for users to download and install the Mullvad VPN app moving forward. Installation instructions are available for all devices, ensuring users can easily and securely get the latest version of the software.
