Hacker Newsnew | past | comments | ask | show | jobs | submit | dongcarl's commentslogin

> https://obscura.com/check/ does this page know the difference between a direct mullvad user and an obscura user, if so, how?

We don't actually, try visiting it with Mullvad turned on!

> Packet padding but no docs about this?

Yeah it's an experimental feature, we're not 100% happy about how we implemented it so we've left it experimental and are working on a v2.


(Carl from Obscura here)

Yeah it'd be a cool addition to combat internet surveillance but in practicality it may have a lot of problems:

1. Deteriorated performance if it's across unequal links (3G vs. Fibre WiFi)

2. Many countries have single exits to the global internet so they'd be able to assemble everything there

3. The most important plaintext data is probably in the TLS SNI which usually sits in a single packet for TLS in HTTP/3


> Deteriorated performance if it's across unequal links (3G vs. Fibre WiFi)

Hmm, maybe consider MPTCP-like design? It tackles exactly the problem you descrbed.

> Many countries have single exits to the global internet

Well it's f'ed anyway. But multipath makes content restoring much, much more complicated.


(Carl from Obscura here)

Basically:

Your device <-> Obscura Relay <-> Mullvad Exit <-> Internet

So the exit server knows the IP of the Obscura Relay, but never sees your device's IP, lmk if that's clear!


(Carl from Obscura here)

I love folks who are also reasoning through security models! A few things to note here:

- We believe that all software running on a user's computer should be open source, so you can audit and build your own client: https://github.com/Sovereign-Engineering/obscuravpn-client

- With traditional Single-Party VPNs, even if you trust them fully and they're honest, they can still be compromised or hacked. With Obscura, even if we're hacked there's nothing to leak (other than WireGuard packets fully encrypted to Mullvad's servers).

- The change in trust is that instead of trusting a single company (Mullvad), you're trusting that not both Obscura AND Mullvad have been compromised, which is strictly less likely.


The "Obscura and Mullvad" argument actually makes sense. Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.

Another question: How does the Obscura client get the Mullvad exit server’s public key? Are they hardcoded at compile time, fetched from Mullvad's server, or fetched from Obscura's server?

The latter seems to be dangerous if there isn't some kind of signature verification done on the client side before using the key.


> Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.

Its just very, very, very unfortunate that they chose the US for Obscura.

Of all the jurisdictions in the world you chose the one that has become exponentially untrustworthy in the eyes of non-US users ....


… as well as in the eyes of many of its own citizens.

Good question! It's the latter right now (which is not ideal), but I think Mullvad is going to sign their server pubkeys pretty soon and we'll switch to that.

We do currently show it in the app and there's an easily clickable link so you can verify against Mullvad's website for the pubkey


Generating all of your responses with AI makes me 100% sure you are not to be trusted

(Carl from Obscura here)

I totally agree for traditional Single-Party VPNs, which is why we are a Two-Party Relay. More here: https://obscura.com/blog/bootstrapping-trust/


(Carl from Obscura here)

Very true, but if even 1 of (Obscura, Mullvad) is honest, there's no de-anonymization.

For traditional Single-Party VPNs, you just need to compromise 1 party, with Two-Party Relays, you need to compromise both.


> Very true, but if even 1 of (Obscura, Mullvad) is honest

Just Obscura's compromise is enough, as pointed out previously: https://news.ycombinator.com/item?id=43016574

Unless something has changed in Obscura's architecture, the interface with Mullvad is under Obscura's control, and thus it can compromise client's credentials. This is unlike iCloud Private Relay where the guarantees are cryptographic in nature and not merely based on promises.


(Carl from Obscura here)

I could be wrong but in Tailscale if you use Mullvad as an exit node, the traffic flows directly from your device to Mullvad's servers.

Whereas with Obscura, your traffic flows to the Obscura relay, then the Mullvad exit.


Yes, but your tailnet IP is what is provided to Mullvad's servers. Not your public IP or personally identifiable information (according to Tailscale).

I'm under the impression that my personal device isn't the WireGuard endpoint for the Mullvad connection, Tailscale is.


I believe if your device connects directly to Mullvad they will have your real IP (to know where to send reply packets)

After further research, I was under the wrong understanding. You are correct that Mullvad still receives your public IP even if routed through Tailscale.

Obviously seems to be an industry-wide problem, but I hope both you and Tailscale can consider alternative endpoints for those who don't want to rely on the Mullvad infrastructure.

Diversification of endpoint providers will help insolate your company from a collapse if Mullvad decides to sell out, and make you more attractive to former Mullvad customers turned off by their Co-Founder's investment of their privacy dollars into extreme right-wing politics.

As far as I know, they don't plan to part ways with the "great replacement theory" executive staff being paid enough to be the highest contributor to the Swedish far-right party Örebropartiet. You have to question whether their highest-paid staff's loyalty to far-right politics influences Mullvad decisions and future partnerships.

Cross the Örebropartiet, and you might be issuing refunds a year from now.


(Carl from Obscura here)

Other than the obvious hassle? XP

If you connect to Mullvad over NordVPN:

- You're giving both Mullvad and Nord some payment information (with Obscura you only give that to us, Mullvad has no idea)

- You don't get our QUIC-based obfuscation (see more here: https://obscura.com/blog/bootstrapping-trust/)


(Carl from Obscura here)

This doesn't prove it. However, Obscura makes it so that there's no *single party* that if hacked or otherwise compromised would hurt your internet privacy.


(Carl from Obscura here)

Actually it's WireGuard over QUIC Unreliable Datagrams!

See: https://obscura.com/blog/bootstrapping-trust/


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: