Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obscura VPN – Privacy that's more than a promise

obscura.net

Post reply on HN
Print view View original

91–100 of 170 posts

Re: Obscura VPN – Privacy that's more than a promise

#91

Post by shanusmagnus »

VladVladikoff wrote: post #86
dongcarl wrote: post #75

Earlier quoted context omitted.

(Carl from Obscura here) Totally! Mullvad is _the_ pioneer in this space, and we look up to them. This is why they were our top pick for being an exit hop provider!

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will y…

What would you suggest?

Re: Obscura VPN – Privacy that's more than a promise

#92

Post by VladVladikoff »

ziddoap wrote: post #89
VladVladikoff wrote: post #86

Earlier quoted context omitted.

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will y…

If the abuse is serious enough, pursue legal avenues. Otherwise, these types of companies shouldn't be unmasking users based on a random persons assertion that someone is bad. That would be an abuse vector itself.

I am not asking them to. I am asking them to do a better job of bad actor detection and banning. Their current stance seems to be “ignore all packets, log nothing”. In my opinion they should be doing some amount of AI based abuse detection. This should be possible without violating user privacy.

Re: Obscura VPN – Privacy that's more than a promise

#93

Post by dongcarl »

mmooss wrote: post #9
yardstick wrote: post #7

Interesting concept. The blog has a lot more details[1]. One comment/question about the exit nodes. Can someone correct or validate my thoughts: It’s a WireGuard tunnel from the user to Mullvad, so while Obscura can’t see the user traffic, couldn’t the Mullvad exit node see the traffic, and using knowledge of the users WireGuard public key, associate all that users traffic with that key? So even if they can’t associa…

Also, Obscura can collect metadata on when you use the service, how much data you send/receive, etc. Even if Mullvad doesn't do it, someone else might. Mullvad is, I expect, now a valuable target because it is the VPN service of choice for so many people concerned with security. Does Mullvad have the budget and expertise to protect itself against determined, highly-resourced attackers? Finally, is it possible for a t…

(Carl from Obscura here)

> Does Mullvad have the budget and expertise to protect itself against determined, highly-resourced attackers?

I think Mullvad is actively working on [System Transparency](https://www.system-transparency.org/), which will help a lot.

> Finally, is it possible for a third party, intercepting traffic between Obscura and Mullvad, to identify the public key used to encrypt it? I don't think so - the only way to validate a signature is with both keys; that's kind of the point. But maybe there is an attack I'm unaware of?

I had asked this question a long time ago on either a noiseprotocol or wireguard IRC channel, and the answer is no, a third party intercepting traffic between Obscura and Mullvad, WON'T be able to identify the public key used to encrypt it.

Re: Obscura VPN – Privacy that's more than a promise

#94

Post by dizhn »

layer8 wrote: post #74
v3xro wrote: post #52

Just to note here - with Mullvad you can pay via gift card that you can find at various retailers (to get a one-time code that you can use to create an account). Of course they can see your IP address but there is no payment/contact information on the system.

In theory, there could still be a possibility to track through the retailers who bought which one-time code (or have particular buyers be sent particular codes). But Mullvad also simply accepts cash by mail.

There's a new privacy focused entitlement proving thingy now. The first implementation is by cloudflare I believe but Kagi also just went live with it. The name escapes me at this mobile moment.

Re: Obscura VPN – Privacy that's more than a promise

#95

Post by [deleted] »

VladVladikoff wrote: post #92
ziddoap wrote: post #89

Earlier quoted context omitted.

If the abuse is serious enough, pursue legal avenues. Otherwise, these types of companies shouldn't be unmasking users based on a random persons assertion that someone is bad. That would be an abuse vector itself.

I am not asking them to. I am asking them to do a better job of bad actor detection and banning. Their current stance seems to be “ignore all packets, log nothing”. In my opinion they should be doing some amount of AI based abuse detection. This should be possible without violating user privacy.

[deleted]

Re: Obscura VPN – Privacy that's more than a promise

#96

Post by leishman »

remram wrote: post #80

This was already discussed last week: https://news.ycombinator.com/item?id=43016574 The security on the whole thing still relies on the idea that those two providers, who are partnering to offer this service and sharing the cost, would only try to attack you separately and not together. I don't buy it.

Would you agree it’s strictly better than a single provider?

Re: Obscura VPN – Privacy that's more than a promise

#97

Post by yjftsjthsd-h »

VladVladikoff wrote: post #86
dongcarl wrote: post #75

Earlier quoted context omitted.

(Carl from Obscura here) Totally! Mullvad is _the_ pioneer in this space, and we look up to them. This is why they were our top pick for being an exit hop provider!

Hey Carl, sorry to hijack the thread but I have a question for you. Being the operator a small website (5M views/month, 200k users), I am often plagued by targeted cyber attacks. Over the years many of these come from privacy enhanced networks (eg Tor, Mullvad, etc). I have approached Mullvad many times with abusive user reports which they seem to simply ignore. How do you plan to address this in your product? Will y…

> I have approached Mullvad many times with abusive user reports which they seem to simply ignore.

What would you like them to do? Considering that AIUI they outright don't log or monitor users at all, I can't think of anything they could do with your reports.

Re: Obscura VPN – Privacy that's more than a promise

#98

Post by dongcarl »

Imustaskforhelp wrote: post #87
dongcarl wrote: post #59

Carl from Obscura here Happy to answer any questions y’all might have!

Multiple questions here : 1)How can I trust that you are sending the data to mullvad only , is there some way of proving this instead of trusting you ? 2) What if all the VPN companies merge together to create such network with 2-3 hops yet still having maximum privacy. 3)Off-topic? But couldn't this theoretically be done if lets say the mullvad vpn connects via https to something like piping server but instead of a…

(Carl from Obscura here)

1) Here's what [one of our FAQ entries](https://obscura.net/#faq-trust) say:

> Additionally, our app displays your current exit hop’s WireGuard public key on its “Location” page. You can check this key against what Mullvad publishes [here](https://mullvad.net/servers) to ensure that you’re connected via a genuine Mullvad exit hop!

2) I really hope that the VPN industry comes together and become each others' 1st/exit hops!

3) Not totally sure what you mean, but we [use WireGuard-over-QUIC](https://obscura.net/blog/bootstrapping-trust/).

Re: Obscura VPN – Privacy that's more than a promise

#99

Post by ijustlovemath »

ignoramous wrote: post #66
ijustlovemath wrote: post #56

Earlier quoted context omitted.

Meaning they're achieving their privacy goals without any inherent trust in their systems (eg no databases of user info, etc)

> no databases of user info Depends on the payment method. Accounting is mandatory in Sweden. As a customer of [payment] services, these entities would allow us to request this information if we chose to do so. In short, your payment actions with these two methods are not anonymous and the GDPR and other relevant data protection regulations may apply if you are making a payment by credit card, PayPal, Swish or by ban…

Sure, but if privacy matters to you, you have the option of buying credit anonymously and applying it to an anonymized account number. And if your threat model includes nation states, you're definitely not buying anything with a credit card. I also think if you're after payment details, there's more lucrative targets, eg Stripe.
Post reply on HN