Mullvad VPN's deterministic exit IP assignment creates a potential fingerprinting vector

Summary

Mullvad VPN uses a deterministic method to assign exit IPs based on a user's WireGuard key, rather than randomizing them on each connection. While this approach helps manage IP distribution across their relatively small server fleet (578 servers) and prevents issues like IP blocks and rate limits, it creates a potential fingerprinting vector. Since the WireGuard key rotates every 1 to 30 days, the exit IP remains static during that period, which could allow websites and services to track users across sessions. The article explores the privacy and security implications of this design choice.