It would be great to have the option to input any DoH address so custom resolvers from Control D, NextDNS, etc. could be used.
4 Likes
What would be also cool would be to offer (opt-in) to resolve .onion and .i2p addresses when connected to your VPN, so that you can visit these sites with any browser. I believe Cryptostorm is one VPN that does this.
(Best practice for anonymity/fingerprinting-resistance is Tor Browser, I know, don’t say it please)
Quad9 and Adguard
3 Likes
Thanks for the feedback, we’ll look into this.
2 Likes
Will there be support for ipv6?
1 Like
NymVPN already offers support for ipv6 and basic ipv6 leaks protection (https://support.nym.com/hc/en-us/articles/24630824940305-What-to-do-if-NymVPN-is-leaking-DNS-WebRTC-and-IPv6-addresses)
4 Likes
Looks very promising. Once there’s split-tunneling support for Android I’ll definitely give the service a try. Is ad/malware blocking via DNS on the roadmap?
Few suggestions for your website:
- On mobile the Grey top announcement banner has too much x-padding and makes the text wrap to unnecessary many lines, hard to read and looks unprofessional.
- The main menu header should be sticky and always accessible when scrolling the site on both mobile and desktop.
- Text size hierarchy could use some work: larger font size difference and bolding on titles and subheadings.
- “More than VPN”, ,“Anonymous by design” sections are bit exhaustive to scroll through, there’s little of visual interest and the icons don’t really provide much help to understand the concept. Maybe just the title would be enough on the home so if would occupy much less space with smaller icons? On desktop this section is fine.
- Comparison table is near unusable on mobile. You should have heading with checkbox list underneath or some way that doesn’t require horizontal scrolling with the features column not staying visible.
2 Likes
Skimming Nym’s whitepaper does remind one of the engineering awe of the original Session whitepaper. In contrast, Nym’s basis in genuine academic research is reassuring, and I do hope that Nym does not overcommit in quite the same way. The community interaction here is also quite refreshing.
Feedback
Nym’s presentation struck me as quite empty. Nym’s website contains generic marketing keywords and some arguably self-confident statements. In my opinion, Nym’s marketing undermines its credibility. Personally, I would not have given Nym a second look were it not for this thread.
I recognize your efforts to keep the comparison table up-to-date. However, comparison tables can be just as easily used to deceive readers. I hope you can then understand why such presentation devices can be off-putting.
I believe that using less absolute language would go a long way (see IVPN, whose marketing shows good humility). You may also highlight mechanisms instead of features/attributes where appropriate to earn trust (for example, “LIKE 2 VPNS (OR 5)” instead of “MORE ANONYMOUS”). Some mechanisms or attributes simply cannot be described without technical jargon, and for some, it is not obvious to the reader that they are needed. It is okay to omit these from the main page.
There is also something to be said about academic credentials. It wouldn’t hurt to mention the project is “BACKED BY RESEARCH”.
Summary
Where Session developed attractive applications but spread itself thin, Nym may be a stable project, albeit one flying under the radar [subjectively speaking].
While I do not have a firm grasp on the architecture yet, I am happy that the mixnet concept is being taken to its ideal form. Solid overall, but more time will be needed for the privacy community to recognize the value of and become familliar with NymVPN.
5 Likes
Removing forward secrecy was awe inspiring?
Session is based on an incentivized, sybil-resistant mixnet [that performs many other duties]. However, Session bit off more than it could chew and wound up cutting corners, PFS included. Your point, while valid, is not relevant to the mixnet design, and has been beaten to death elsewhere (see e.g. the featured topic on my profile). Please refrain from kneejerk reactions; I did not come here to advocate for Session.
Would be helpful if you had clarified. Sybil resistance based in staking for increasing cost of attack was not something pioneered by Session anyway. Nym paper does strike me as innovative, at least as far as VPNs go. Thanks for your helpful summary above.
2 Likes
Thanks! Give it a try today while it’s in free beta tests 
Paid versions start on March 13.
Yes, we’re thinking about letting users configure the DNS, which would also solve for ad/malware blocking.
Thanks, make sense. We’re continuously improving the website, stay tuned.
Thanks for sharing the specific points you find problematic. We’re in the process of upgrading the page, so it’s both more friendly for “mainstream” users and has the right level of tone/info for more advanced ones.
2 Likes
Reviving this topic to say: Nym have definitely cleaned up their marketing!
The main page now focuses on the important points, while still managing to sneak in “multi-layer encryption, noise generating mixnet and decentralized design” for users who understand how these features are a big step up. “Backed by research” has made an appearance, and the comparison table is also slightly more palatable now than before. Jargon has been meanwhile offloaded to the pricing page, as have the marketing bullet points, which are now trapped under the “Benefits” header.
I feel comfortable saying that Nym has taken this community’s advice to heart (or maybe just mine 
). But I can’t blame Nym for claiming to be “the world’s most private VPN”. 
P.S. The Pricing FAQ still has information about the free trial.
3 Likes
Still
strapi-www-nym-com-production.sos-ch-dk-2.exo.io - is blocked by Control D as Malware
snippet.maze.co - Hagezi’s DNS - Pro Plus
Brave Shields is also blocking https://matomo.nymtech.net/js/container_iT00PYD0.js
If I disable Brave Shields, I can see the picture file names on your page.
Maybe you should fix these issues first of the webpage design and talk to these guys?
same here, maybe it has been addressed as of:
but there are no responses so.
2 Likes
I don’t think that Brave Shields blocking your self-hosted Matomo analytics when set to aggressive is a mistake from Brave and instead expected behavior. So, I don’t see why Brave should do anything about it. An ad and tracker blocker is expected to block trackers and if it isn’t doing that, then it isn’t doing its job very well, even though your implementation isn’t very privacy invasive. Ublock Origin’s default easy mode also blocks this btw.
Then next step will be removing all the trackers and data collectors, like Proton and Mullvad from the website
Thanks for reporting. I’ve reached out to ControlD regarding strapi-www-nym-com-production.sos-ch-dk-2.exo.io. maze.co is a module used for user testing. Fine if blocked with aggressive privacy settings. It should have no impact on on-site experience.
That’d be ideal. Being new to the game, we want to understand a bit how the website is used. As already mentioned in the thread, it’s done via a self-hosted Matomo instance. Not sure about Mullvad, but Proton does seem to have on-site analytics too “2.1 Visiting proton.me or protonvpn.com website: We employ a local installation of self-developed analytics tools. Analytics are anonymized whenever possible and stored locally (and not on the cloud). IP addresses are not retained and stored for such analytics.” Seems it’s telemetry.proton.me.
ControlD acknowledged the issue and they said it’s fixed now. Keep us posted!
1 Like
As much as I am excited about Nym mixnet, and appreciate their efforts in building their product, I would like to add a grain of salt regarding NymVPN research.
I’m having suspicions of conflict of interest in their work:
- Comment on Mullvad DAITA:
they implemented the addition of cover traffic with the Maybenot framework. […] but in all cases, the cover traffic patterns were quite predictable and could be easily filtered out with simple traffic analysis. […] but back then, it was doing very little to hinder traffic analysis.
I would appreciate the source of your work to attest this. Back in May 2024, Tobias reported their work on initial DAITA servers: Evaluating using the first eight DAITA servers
Quote:
“Details on the actual defenses are another topic, but for now, it is enough to know that they are heavily randomized, and each WireGuard connection will likely behave quite differently.”
“DAITA reduces the success rate of both DF and RF attacks, with more prolonged traces (US servers) offering slightly less protection.”
and provided graphs showcasing its results.
Moreover mullvad defenses were based on MaybeNot Framework initial defenses state machines. mainly:
- Custom/pipelined FRONT
- RegulaTor
- Surakav
Maybenot provided a simulator validating their work. While they did acknowledge limitations regarding blocking actions and static delay, I have doubt that the prior algorithm can be “easily filtered out with simple traffic analysis”.
- Dandelion++ attack conclusion
Nym chief scientist participated back in 2022 to On the Anonymity of Peer-To-Peer Network Anonymity Schemes Used by Cryptocurrencies research paper. The paper stated that their work permitted to easily learn the privacy subgraph of Dandelion++. The paper has been criticized with the following points:
- The paper’s dandelion++ routing policy was flawed. Their implementation deviated from academic one, introducing a modification that made finding the subgraph easier.
- The “easy” to leverage attack is impractical in real word scenarios.
- Learning the subgraph of Dandelion++ isn’t equivalent to finding the origin IP address (which is the whole point of the scheme).
https:[//]moneroresearch.info/index.php?action=resource_RESOURCEVIEW_CORE&id=130 for an analysis from another researcher.
The paper concluded with:
Overall, our study highlights a pressing need for better network anonymity schemes in cryptocurrency networks, as the current solutions provide poor anonymity to users
Two cases of discrediting the work of others with no sources or flawed methodology is more than concerning. It is difficult not to interpret this, combined with your narrative during NymVPN launch event, as an attempt to create a credibility through FUD of competitors. Now, I am genuinely hyped about your work, and I’m hoping to be standing corrected upon your potential response. But I feel like this needs to be notated for posterity, as having a focus on discrediting others instead of focusing on your benefits is a very bad strategy.
To finish, I would like to add that IF you indeed found traffic analysis to be possible on initial versions of DAITA, and state it here publicly, this is at best irresponsible disclosure of past vulnerability.
2 Likes