Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obscura VPN – Privacy that's more than a promise

obscura.net

Post reply on HN
Print view View original

21–30 of 170 posts

Re: Obscura VPN – Privacy that's more than a promise

#21

Post by vidyesh »

dang wrote: post #17
yardstick wrote: post #7

Interesting concept. The blog has a lot more details[1]. One comment/question about the exit nodes. Can someone correct or validate my thoughts: It’s a WireGuard tunnel from the user to Mullvad, so while Obscura can’t see the user traffic, couldn’t the Mullvad exit node see the traffic, and using knowledge of the users WireGuard public key, associate all that users traffic with that key? So even if they can’t associa…

Thanks! that blog post had a thread here: Trust, 2-Party Relays, and QUIC - https://news.ycombinator.com/item?id=43016574 - Feb 2025 (33 comments)

That blog needs some inline padding for mobile view.

Re: Obscura VPN – Privacy that's more than a promise

#23

Post by LeoPanthera »

eesmith wrote: post #16
wmf wrote: post #13

Earlier quoted context omitted.

No, the second hop is Cloudflare.

So, two US companies subject to US laws, the FISA court, and government-ordered secret surveillance.

That wasn't the question, though.

The answer is yes - this is the same concept as Apple's Private Relay.

Re: Obscura VPN – Privacy that's more than a promise

#25

Post by 0xEF »

bdhcuidbebe wrote: post #18

Wanna know about something cool? Tor i offers real untraceable anonymity and is 100% free.

It was also developed by the United States Navy and has been criticized for not being as secure as it claims it is. This should come as no surprise since the US military and agencies have a history of demanding backdoors in software, which just means more attack vectors for outsiders to sniff out.

I make no claims that commercial VPNs are more secure, but at least they have some level of interest in keeping their promises if people are paying them, whereas a free service does not carry the same incentive.

Pick your poison, I guess.

Re: Obscura VPN – Privacy that's more than a promise

#26

Post by conradev »

yardstick wrote: post #7

Interesting concept. The blog has a lot more details[1]. One comment/question about the exit nodes. Can someone correct or validate my thoughts: It’s a WireGuard tunnel from the user to Mullvad, so while Obscura can’t see the user traffic, couldn’t the Mullvad exit node see the traffic, and using knowledge of the users WireGuard public key, associate all that users traffic with that key? So even if they can’t associa…

> somehow log & associate each decrypted IP packet against the users public key.

Mullvad only needs to associate each decrypted IP packet against an assertion that the packet was paid for. I assume each Obscura node would have a public key, but not associated with a user.

They notably offer this service for Tailscale (as an add-on) and I imagine that it works similarly (on the backend)

Re: Obscura VPN – Privacy that's more than a promise

#27

Post by conradev »

mmooss wrote: post #9
yardstick wrote: post #7

Interesting concept. The blog has a lot more details[1]. One comment/question about the exit nodes. Can someone correct or validate my thoughts: It’s a WireGuard tunnel from the user to Mullvad, so while Obscura can’t see the user traffic, couldn’t the Mullvad exit node see the traffic, and using knowledge of the users WireGuard public key, associate all that users traffic with that key? So even if they can’t associa…

Also, Obscura can collect metadata on when you use the service, how much data you send/receive, etc. Even if Mullvad doesn't do it, someone else might. Mullvad is, I expect, now a valuable target because it is the VPN service of choice for so many people concerned with security. Does Mullvad have the budget and expertise to protect itself against determined, highly-resourced attackers? Finally, is it possible for a t…

Timing attacks are notably not a part of Tor's threat model, i.e. they are a real concern: https://support.torproject.org/about/attacks-on-onion-routin...

Re: Obscura VPN – Privacy that's more than a promise

#28

Post by yardstick »

conradev wrote: post #26
yardstick wrote: post #7

Interesting concept. The blog has a lot more details[1]. One comment/question about the exit nodes. Can someone correct or validate my thoughts: It’s a WireGuard tunnel from the user to Mullvad, so while Obscura can’t see the user traffic, couldn’t the Mullvad exit node see the traffic, and using knowledge of the users WireGuard public key, associate all that users traffic with that key? So even if they can’t associa…

> somehow log & associate each decrypted IP packet against the users public key. Mullvad only needs to associate each decrypted IP packet against an assertion that the packet was paid for. I assume each Obscura node would have a public key, but not associated with a user. They notably offer this service for Tailscale (as an add-on) and I imagine that it works similarly (on the backend)

Yeah my thinking is even if they don’t have the users IP, knowing and seeing all the traffic associated with a specific public key would allow them to build a profile of the user.

Eg based on the specific sites visited, payload sizes potentially, domains looked up, etc you’d be able to characterise the person. Especially so if anything they did was not encrypted, or they have their own vanity domain (for emails or anything else).

> Mullvad only needs to associate each decrypted IP packet against an assertion that the packet was paid for.

The idea of Obscura is by using two middlemen (them + Mullvad) that neither party can figure out who the end user is. So I’m looking at Mullvad from the perspective of: if they were evil, what about this solution are safeguard protecting the end users privacy. And my conclusion is they’d still be able to break the users privacy in the same way as knowing the users IP, just without the IP.

Re: Obscura VPN – Privacy that's more than a promise

#30

Post by NitpickLawyer »

bdhcuidbebe wrote: post #18

Wanna know about something cool? Tor i offers real untraceable anonymity and is 100% free.

> real untraceable anonymity and is 100% free.

And 50% of the time it works every time...

A lot of things simply don't work if you're using tor. You get blocked, you get blacklisted, accounts get terminated, and so on.

Post reply on HN