# Mullvad Browser, as you (`extras/mullvad-browser-regular.sh`)

## SYNOPSIS

```
wrenctl install mullvad-browser-regular                     install it
wrenctl remove mullvad-browser-regular                      remove it (and Mullvad's repository, if Mullvad VPN isn't installed)
wrenctl manual mullvad-browser-regular                      print the manual steps below

mullvad-browser                                     start it (or Super+d); connect a VPN first
```

Mullvad Browser is made by the Tor Project and Mullvad: Tor Browser's
protections against tracking and fingerprinting, without Tor. It is meant for
use with a VPN, and forgets everything when closed. It comes from Mullvad's
own apt repository, whose signing key must be exactly the one pinned in
`pins.sh` (`MULLVAD_FPR`), and unattended-upgrades is told to install its
updates. It runs on X11, so XWayland is installed.

## LIMITS

- It doesn't hide your address: without a VPN, sites see it and your network sees where you go.
- It isn't Tor, and hiding your address doesn't hide who you are to a site you log in to.
- It runs as you, with no sandbox from Wren Linux: `wrenctl install mullvad-browser-sandbox` is the same browser as its own user.
- It keeps its own DNS over HTTPS, which secure DNS (`parts/secure-dns.sh`) can't stop.

## MANUAL INSTALL

```
# Mullvad's signing key. Check it is exactly the pinned one: this must
# print one "pub" key with the fingerprint @MULLVAD_FPR@
wget -O /tmp/mullvad-keyring.asc @MULLVAD_KEY_URL@
gpg --show-keys --with-fingerprint /tmp/mullvad-keyring.asc
sudo install -D -m 0644 /tmp/mullvad-keyring.asc /usr/share/keyrings/mullvad-keyring.asc
rm /tmp/mullvad-keyring.asc

# The repository, trusted with that key only
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$(dpkg --print-architecture)] https://repository.mullvad.net/deb/stable stable main" |
    sudo tee /etc/apt/sources.list.d/mullvad.list

# Let unattended-upgrades install its updates too (it takes only Debian's otherwise)
echo 'Unattended-Upgrade::Origins-Pattern:: "site=repository.mullvad.net";' |
    sudo tee /etc/apt/apt.conf.d/52wren-mullvad

# XWayland (it runs on X11) and the browser
sudo apt update
sudo apt install --no-install-recommends xwayland mullvad-browser
# If XWayland was new: log out and back in once, so sway starts it
```

To undo:

```
# Remove the browser
sudo apt purge mullvad-browser
# Only if Mullvad VPN isn't installed either: the repository, its key and the update rule
sudo rm /etc/apt/sources.list.d/mullvad.list /usr/share/keyrings/mullvad-keyring.asc
sudo rm /etc/apt/apt.conf.d/52wren-mullvad
sudo apt update
```