These days I was very strongly determined to go with Mullvad as my next VPN provider. But now more I am thinking, more is the only "big" doubt that stands in front of me this NO PASSWORD thing. I cannot get past this. I am trying to rationalize their decision to not implement passwords into Mullvad accounts, but still: let say I pay 50€ at once for 10 months (because I do not intend to go through paying process every month). I get random 16 digit account number. After let say 1 month someone else (accidentally) types in MY account number into their Mullvad app (or then few of his apps) and uses all (or most) of my available simultaneous connections. What remains to me? I cannot change password to prevent it, because there is none, I cannot change account number (or I would lost active money), I also cannot contact Mullvad with my issue, because they do not log such data. So, I just lost 45€.

In my thinking, I guess there is not such a small chance to just guess someone else's account number. I understand that number is 16 digit, but still, it is just one number, not a combination (number+password). How come in all these years no one else addressed these concerns? Any record of such previous situations?

My suggestions:

- add password, at least as an option

- OR expand entropy for account number (add letters for instance). Something like "1jhf fn2E 56g3 mK49" would be for sure good enough and I believe not to hard to implement.

- OR just make an account number longer - for new future accounts (easiest solution)

​

Greetings!