Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obscura VPN – Privacy that's more than a promise

obscura.net

Post reply on HN
Print view View original

81–90 of 170 posts

Re: Obscura VPN – Privacy that's more than a promise

#81

Post by dongcarl »

Reubend wrote: post #70

I'm not clear on the technical details here. > Obscura’s servers relay your connection to exit servers but can never decrypt your traffic. Doesn't that rely on us trusting that the server runs the code they claim it does? Or is there a way to prove that their server can't get the decryption key (i.e. by proving that it's not possible for them to switch the final hop, or add undisclosed hops in between)?

(Carl from Obscura here)

Here's what [one of our FAQ entries](https://obscura.net/#faq-trust) say:

> Additionally, our app displays your current exit hop’s WireGuard public key on its “Location” page. You can check this key against what Mullvad publishes [here](https://mullvad.net/servers) to ensure that you’re connected via a genuine Mullvad exit hop!

Let me know if that's unclear!

Re: Obscura VPN – Privacy that's more than a promise

#82

Post by staticelf »

arccy wrote: post #76
switch007 wrote: post #57

Earlier quoted context omitted.

You can mail them cash too

careful not to mail them from close to home, or have any handwriting, or leave any fingerprints

Doesn't matter if you use Windows / Mac because it will ping their services before you jump on the VPN and it will know the before IP and the IP after. :)

Re: Obscura VPN – Privacy that's more than a promise

#83

Post by remram »

NitpickLawyer wrote: post #30
bdhcuidbebe wrote: post #18

Wanna know about something cool? Tor i offers real untraceable anonymity and is 100% free.

> real untraceable anonymity and is 100% free. And 50% of the time it works every time... A lot of things simply don't work if you're using tor. You get blocked, you get blacklisted, accounts get terminated, and so on.

Run Mullvad over Tor instead of Mullvad over this Obscura thing ;-)

Re: Obscura VPN – Privacy that's more than a promise

#84

Post by Cyph0n »

hypeatei wrote: post #50
Nyr wrote: post #43

Earlier quoted context omitted.

Governments do not even need any of the providers to comply, they can access global NetFlow data. This is conveniently not discussed by any commercial VPN provider.

Okay, but this is a given if you don't run your own ISP. Your ISP can also see that you connect to Tor. Your data is still encrypted.

It ultimately depends on your threat model. But assuming a state actor has access to NetFlow data, an attack could work like this:

* State actor determines that an IP belonging to a VPN company had a session on example.com around t1-t2

* You -> VPN server at t1

* VPN server -> example.com at t1+latency

* More traces from both sides until around t2 as you browse the site

By correlating multiple samples, and accounting for latency between you and the VPN server and delay introduced by the VPN itself, they would be able to get decent confidence that it was you.

Re: Obscura VPN – Privacy that's more than a promise

#85

Post by remram »

rafram wrote: post #62
kkfx wrote: post #46

The sole meaningful VPN is the one you host yourself to connect personal stuff around the world in a sole network. For privacy I2P etc performances are not enough for normal use, the rest is mere noise. That's IMVHO the substance, not counting the fact that even a secure channel is meaningless if you run proprietary crapware at their end.

You ever tried browsing the web on a data center IP? It doesn’t work very well.

They specifically say "connect personal stuff" not "browse the web"

Re: Obscura VPN – Privacy that's more than a promise

#86

Post by VladVladikoff »

dongcarl wrote: post #75
v3xro wrote: post #52

Just to note here - with Mullvad you can pay via gift card that you can find at various retailers (to get a one-time code that you can use to create an account). Of course they can see your IP address but there is no payment/contact information on the system.

(Carl from Obscura here) Totally! Mullvad is _the_ pioneer in this space, and we look up to them. This is why they were our top pick for being an exit hop provider!

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will you simply allow bad actors to abuse the internet via your service? Or do you have some plans to address this issue?

Re: Obscura VPN – Privacy that's more than a promise

#87

Post by Imustaskforhelp »

dongcarl wrote: post #59

Carl from Obscura here Happy to answer any questions y’all might have!

Multiple questions here :

1)How can I trust that you are sending the data to mullvad only , is there some way of proving this instead of trusting you ?

2) What if all the VPN companies merge together to create such network with 2-3 hops yet still having maximum privacy.

3)Off-topic? But couldn't this theoretically be done if lets say the mullvad vpn connects via https to something like piping server but instead of a single write -> multiple reciever , we fork it a little bit for multiple write -> single receiver & this can work itself on curl and its encrypted. I can in my rough mind draw exactly what obscura is trying to do but with piping server which is so much easier to self host & even host it on multiple cloud providers. Though a big thing is that the nodes would have to be a little configured for this specific purpose (maybe this is where obscura can come in?)

Supposing that this can be done , then what threat model difference would have it as compared to current obscura. https://github.com/nwtgck/piping-server

Re: Obscura VPN – Privacy that's more than a promise

#88

Post by thrwaway1985882 »

ortichic wrote: post #55
Nyr wrote: post #43

Earlier quoted context omitted.

Governments do not even need any of the providers to comply, they can access global NetFlow data. This is conveniently not discussed by any commercial VPN provider.

How would such an attack work?

The threat actor most use to talk about this is a global passive adversary: a threat actor who can see all relevant traffic on the Internet but who can't decrypt or adjust the traffic.

This adversary would have the ability to ingest massive amounts of data and metadata[0] it acquires from tier 1 ISPs all over the country[1] and the world[2]. They'll not see raw HTTP traffic because most everything of interest is encrypted, but can store and capture (time, srcip, srcport, dstip, dstport, bytes).

From there, it's a statistical attack: user A sent 700 kilobytes to a VPN service at time t; at t+epsilon the VPN connected to bad site B and sent 700 kilobytes+epsilon packets. Capture enough packet flows that span the user, the VPN, and the bad site and you can build statistical confidence that user A is interacting with bad site B, even with the presence of a VPN.

This could go other directions too. If bad site B is a Tor hidden site whose admin gets captured by the FBI and turns over access, they'll be unmasking in reverse – I got packets from Tor relay A, which relay sent packets at time-epsilon to it, (...), to the source.

There's very little you can do to fight this kind of adversary. Adding hops and layers (VPN + VPN, Tor, Tor + VPN, etc.) can only make it harder. It's certainly an expensive attack both in terms of time consumption, storage, and it requires massive amounts of data, but if your threat model includes a global passive adversary, game over.

[0] https://en.wikipedia.org/wiki/XKeyscore

[1] https://en.wikipedia.org/wiki/Room_641A

[2] https://en.wikipedia.org/wiki/FVEY

Re: Obscura VPN – Privacy that's more than a promise

#89

Post by ziddoap »

VladVladikoff wrote: post #86
dongcarl wrote: post #75

Earlier quoted context omitted.

(Carl from Obscura here) Totally! Mullvad is _the_ pioneer in this space, and we look up to them. This is why they were our top pick for being an exit hop provider!

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will y…

If the abuse is serious enough, pursue legal avenues. Otherwise, these types of companies shouldn't be unmasking users based on a random persons assertion that someone is bad. That would be an abuse vector itself.

Re: Obscura VPN – Privacy that's more than a promise

#90

Post by dongcarl »

VladVladikoff wrote: post #86
dongcarl wrote: post #75

Earlier quoted context omitted.

(Carl from Obscura here) Totally! Mullvad is _the_ pioneer in this space, and we look up to them. This is why they were our top pick for being an exit hop provider!

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will y…

I can understand that concern, and I think in the future some version of [Privacy Pass](https://privacypass.github.io/) will allow for site operators to differentiate between normal vs. abusive users without relying on IP reputation (which is more unreliable anyway since CGNAT is a thing).
Post reply on HN