Viewing profile — dongcarl

Appreciate the shoutout! :-)

Thanks for the shoutout!

Heh yeah we just check for a Mullvad exit IP, it's one way you know we're actually relaying to Mullvad!

Carl here (Obscura CEO, one of Mullvad's partners) This was an interesting finding, though as kfreds mentioned it would have been better to notify the vendor before publishing. The…

> should Chat Control not pass Unfortunately in the world we live in no single jurisdiction is good enough anymore, laws can always change and Chat Control can be re-proposed over …

We've had many reports that it works. In fact, one of our users told us he took an hour video call over Obscura in China and things worked smoothly! Unfortunately, because we don't…

You could probably implement a pluggable transport for it?

Ah that's excellent! Do you have a link to the thesis?

Yes, you can with Obscura. That limitation of Private Relay is just an arbitrary limitation made by Apple.

We should really be moving towards a world of Multi-Party Relays rather than Single-Party VPN operators: https://www.privacyguides.org/articles/2024/11/17/where-are-... With Multi-…

Actually, they don’t need to do a reverse lookup at all. They can just look at the TLS SNI field and the hostname is there in plaintext. It’s _more_ trouble to do the reverse looku…

If you can't see your VPN's source code, you can almost safely assume that they're broken in some way.

It's trusting A OR B, rather than A AND B

Yup, when you're not using a VPN, even with encrypted DNS and HTTPS, you're still sending hostnames (e.g. wikileaks.org) over plaintext in TLS SNI for every HTTPS connection. I bel…

I'm surprised no one has mentioned iCloud Relay-style Multi-Party Relays yet: https://www.privacyguides.org/articles/2024/11/17/where-are-... It greatly improves on the existing VP…

We're working on it! Android is next :-)

We should link it in more places, apologies! Here it is: https://github.com/Sovereign-Engineering/obscuravpn-client

Very possible, though many of our users are saying that in network environments where WireGuard is blocked they were able to use Obscura.

Give Obscura a try, we get around internet restrictions by using QUIC as transport, which looks like HTTP/3 and doesn't suffer from TCP-over-TCP meltdown: https://obscura.net/ Tech…

I actually spent a few months prototyping SGX/SEV VPNs before settling on a Multi-Party Relay scheme for obscura.net Things may have changed since mid-2023 but here were my takeawa…

At Obscura we just tunnel WireGuard over QUIC's unreliable datagram mechanism to make it look like HTTP/3 (for DPI): https://github.com/Sovereign-Engineering/obscuravpn-client/b...…

I think he's just talking about using Mullvad's [DNS servers]( https://mullvad.net/en/help/dns-over-https-and-dns-over-tls ), which work in most cases.