- With traditional Single-Party VPNs, even if you trust them fully and they're honest, they can still be compromised or hacked. With Obscura, even if we're hacked there's nothing to leak (other than WireGuard packets fully encrypted to Mullvad's servers).
- The change in trust is that instead of trusting a single company (Mullvad), you're trusting that not both Obscura AND Mullvad have been compromised, which is strictly less likely.
The "Obscura and Mullvad" argument actually makes sense. Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.
Another question: How does the Obscura client get the Mullvad exit server’s public key? Are they hardcoded at compile time, fetched from Mullvad's server, or fetched from Obscura's server?
The latter seems to be dangerous if there isn't some kind of signature verification done on the client side before using the key.
Good question! It's the latter right now (which is not ideal), but I think Mullvad is going to sign their server pubkeys pretty soon and we'll switch to that.
We do currently show it in the app and there's an easily clickable link so you can verify against Mullvad's website for the pubkey
Unless something has changed in Obscura's architecture, the interface with Mullvad is under Obscura's control, and thus it can compromise client's credentials. This is unlike iCloud Private Relay where the guarantees are cryptographic in nature and not merely based on promises.
After further research, I was under the wrong understanding. You are correct that Mullvad still receives your public IP even if routed through Tailscale.
Obviously seems to be an industry-wide problem, but I hope both you and Tailscale can consider alternative endpoints for those who don't want to rely on the Mullvad infrastructure.
Diversification of endpoint providers will help insolate your company from a collapse if Mullvad decides to sell out, and make you more attractive to former Mullvad customers turned off by their Co-Founder's investment of their privacy dollars into extreme right-wing politics.
As far as I know, they don't plan to part ways with the "great replacement theory" executive staff being paid enough to be the highest contributor to the Swedish far-right party Örebropartiet. You have to question whether their highest-paid staff's loyalty to far-right politics influences Mullvad decisions and future partnerships.
Cross the Örebropartiet, and you might be issuing refunds a year from now.
This doesn't prove it. However, Obscura makes it so that there's no *single party* that if hacked or otherwise compromised would hurt your internet privacy.
We don't actually, try visiting it with Mullvad turned on!
> Packet padding but no docs about this?
Yeah it's an experimental feature, we're not 100% happy about how we implemented it so we've left it experimental and are working on a v2.
reply