StockholmMullvad’s exit-IP pool narrows to 284 identifiable combinations.
Each WireGuard key occupies the same percentile slot across all servers, creating a stable cross-site fingerprint regardless of server choice.
Any virtual private network with a small advertised exit-IP pool shares this property, independent of privacy claims.
Sources: Hacker News
WHAT A VPN ACTUALLY HIDES
A VPN substitutes its own IP address for yours and encrypts traffic between your device and its servers. It hides your IP from websites and your traffic content from your ISP. It does not hide that you are using a VPN, and it does not hide behavioral patterns that identify you across sites.
THE ANONYMITY SET PROBLEM
Anonymity is a function of crowd size. If a million people share an exit IP, you are 1-in-a-million. If 284 distinct exit-IP combinations exist across a service, the crowd is small enough that any additional signal — browser version, screen size, timezone — collapses it to one. The math of anonymity is the math of how many other people look exactly like you.
DEVICE FINGERPRINTING
Browsers leak hundreds of measurable properties: fonts installed, canvas rendering quirks, WebGL driver strings, audio context hashes, supported codecs. The EFF's Panopticlick project showed in 2010 that 84% of browsers were uniquely identifiable from these signals alone. A VPN changes your IP; it does not change any of this.
THE CROSS-SITE LINKING VECTOR
The specific failure here: if your WireGuard key always lands in the same percentile slot on every server, then site A and site B can correlate your visits even though you appear from different IPs. The percentile slot is the persistent identifier. This is the same class of vulnerability as cookie syncing — a stable handle that survives the thing meant to break it.
THE TOR CONTRAST
Tor solves this by routing each circuit through three random relays and rotating circuits every ten minutes. The anonymity set is every Tor user worldwide — roughly two million daily. VPNs trade Tor's latency and complexity for speed, but inherit a fundamentally smaller crowd. A privacy-marketed VPN with 284 distinguishable exit configurations offers an anonymity set roughly four orders of magnitude smaller than Tor's.
THE MARKETING PROBLEM
VPN providers compete on privacy claims — no-logs policies, jurisdiction shopping, audited infrastructure. None of that addresses the structural property exposed here: a small exit pool plus a stable per-user routing rule equals a fingerprint, regardless of how trustworthy the operator is. Privacy is a property of the protocol and the crowd, not of the provider's promises.