Mullvad exit IPs are surprisingly identifying

Mullvad VPN's exit IP assignment system, designed to give users different public IPs, is surprisingly identifying because exit IPs are deterministically assigned based on a user's WireGuard key rather than randomized, resulting in only 284 unique IP combinations across all users despite theoretically billions being possible. The researcher discovered that Mullvad uses a seed-based random number generator with the user's public key as the seed, causing all assigned IPs to fall within the same percentile across different servers, allowing potential fingerprinting of individual users. Mullvad has since begun rolling out a mitigation feature that scrambles exit IP positions to address this vulnerability.